1

I was analyzing (with Procmon) a very simple program in two different VPS that Im renting. The program is a minimal C++ program:

int main() {
    return 0;
}

I compiled the previous code with g++ (tdm64-1) 5.1.0 in both machines. I just compiled the code as g++ Test.cpp -o Test.exe. After that I ran the Test.exe file in both servers and filter with Procmon. The first VPS shows the creation of a single thread (procmon csv), but the second one creates two threads instead (procmon csv). Im wondering why is this happening and how can I ensure that "single thread programs" creates only one thread in the second server. Maybe Im missing something here. Im going to describe the properties of every VPS:

First VPS
OS: Windows Server 2012 R2
Processor: Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40GHz 2.40 GHz, 2 cores, 2 logical processors
Installed memory (RAM): 6.0 GB
System type: 64-bit Operating System, x64-based processor

Second VPS
OS: Windows Server 2016
Processor: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz 2.20 GHz, 6 cores, 6 logical processors
Installed memory (RAM): 24.0 GB
System type: 64-bit Operating System, x64-based processor

In order to analyze a bit further I changed my code a little bit as follow:

int main() {
    while (true);
    return 0;
}

I ran the previous code and used Process Explorer to saw it behaviour and a second thread was created and removed 30 seconds after the program was running.

enter image description here

lcastillov
  • 2,163
  • 1
  • 11
  • 17
  • 1
    What's wrong with having the second thread? It appears that Windows is creating it. Perhaps you'd like to downgrade your new server to Windows Server 2012, then it will work the same as the old one. – John Zwinck Oct 14 '17 at 07:26
  • @JohnZwinck I know Windows is creating that thread (maybe because Windows Thread Pool) but I want to keep only the threads created by the program. Or at least manage when Windows can or not create that threads. – lcastillov Oct 14 '17 at 07:30
  • What's wrong with having the second thread? Is it causing a problem? – John Zwinck Oct 14 '17 at 07:43
  • @JohnZwinck I have a program (that I cannot modify) that sandbox executables and inspects for number of threads created among other things. The sandboxed program should executes in a single thread. I just want to tell Windows that dont add that second thread (if that's possible). I can always do a downgrade but I want to see whether the problem has a solution in Windows Server 2016. – lcastillov Oct 14 '17 at 07:50
  • @Icastillov It doesn't get much more generic than the code you show above. If OS decides to span threads so be it. There is probably underlying reason for that. There is very little you can do to prevent it. Why worry about it in the first place? – Ron Oct 14 '17 at 07:57
  • @Ron Well I can live with that, but I like my programs uses the resources I want. I think there must to be an option to disables that extra threads somehow. Lets forget about the benefits behind what Windows is doing here. – lcastillov Oct 14 '17 at 08:07
  • See https://stackoverflow.com/questions/34822072/why-does-windows-10-start-extra-threads-in-my-program – John Zwinck Oct 14 '17 at 08:45
  • @JohnZwinck I read that right after I updated my answer and searched for ntdll.dll and additional threads. Thank you very much. – lcastillov Oct 14 '17 at 09:02

0 Answers0