ExtendedTools: Fix invalid IssuingThreadId for some disk events on Windows 11
@@ -274,17 +274,30 @@ VOID NTAPI EtpEtwEventCallback(
DiskIo_TypeGroup1 *data = EventRecord->UserData;
if (PhWindowsVersion >= WINDOWS_8)
+ {
+ if (data->IssuingThreadId != ULONG_MAX)
{
diskEvent.ClientId.UniqueThread = UlongToHandle(data->IssuingThreadId);
diskEvent.ClientId.UniqueProcess = EtThreadIdToProcessId(diskEvent.ClientId.UniqueThread);
}
else
+ {
+ diskEvent.ClientId.UniqueThread = 0;
+ diskEvent.ClientId.UniqueProcess = SYSTEM_PROCESS_ID;
+ }
+ }
+ else
{
if (EventRecord->EventHeader.ProcessId != ULONG_MAX)
{
diskEvent.ClientId.UniqueProcess = UlongToHandle(EventRecord->EventHeader.ProcessId);
diskEvent.ClientId.UniqueThread = UlongToHandle(EventRecord->EventHeader.ThreadId);
}
+ else
+ {
+ diskEvent.ClientId.UniqueThread = 0;
+ diskEvent.ClientId.UniqueProcess = SYSTEM_PROCESS_ID;
+ }
}
diskEvent.IrpFlags = data->IrpFlags;
