struct _ETHREAD
{
struct _KTHREAD Tcb;
union _LARGE_INTEGER CreateTime;
union
{
union _LARGE_INTEGER ExitTime;
struct _LIST_ENTRY KeyedWaitChain;
};
VOID* ChargeOnlySession;
union
{
struct _LIST_ENTRY PostBlockList;
struct
{
VOID* ForwardLinkShadow;
VOID* StartAddress;
};
};
union
{
struct _TERMINATION_PORT* TerminationPort;
struct _ETHREAD* ReaperLink;
VOID* KeyedWaitValue;
};
ULONGLONG ActiveTimerListLock;
struct _LIST_ENTRY ActiveTimerListHead;
struct _CLIENT_ID Cid;
union
{
struct _KSEMAPHORE KeyedWaitSemaphore;
struct _KSEMAPHORE AlpcWaitSemaphore;
};
union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;
struct _LIST_ENTRY IrpList;
ULONGLONG TopLevelIrp;
struct _DEVICE_OBJECT* DeviceToVerify;
VOID* Win32StartAddress;
VOID* LegacyPowerObject;
struct _LIST_ENTRY ThreadListEntry;
struct _EX_RUNDOWN_REF RundownProtect;
struct _EX_PUSH_LOCK ThreadLock;
ULONG ReadClusterSize;
volatile LONG MmLockOrdering;
volatile LONG CmLockOrdering;
union
{
ULONG CrossThreadFlags;
struct
{
ULONG Terminated:
1;
ULONG ThreadInserted:
1;
ULONG HideFromDebugger:
1;
ULONG ActiveImpersonationInfo:
1;
ULONG HardErrorsAreDisabled:
1;
ULONG BreakOnTermination:
1;
ULONG SkipCreationMsg:
1;
ULONG SkipTerminationMsg:
1;
ULONG CopyTokenOnOpen:
1;
ULONG ThreadIoPriority:
3;
ULONG ThreadPagePriority:
3;
ULONG RundownFail:
1;
ULONG UmsForceQueueTermination:
1;
ULONG IndirectCpuSets:
1;
ULONG ReservedCrossThreadFlags:
14;
};
};
union
{
ULONG SameThreadPassiveFlags;
struct
{
ULONG ActiveExWorker:
1;
ULONG MemoryMaker:
1;
ULONG ClonedThread:
1;
ULONG KeyedEventInUse:
1;
ULONG SelfTerminate:
1;
ULONG RespectIoPriority:
1;
ULONG ReservedSameThreadPassiveFlags:
26;
};
};
union
{
ULONG SameThreadApcFlags;
struct
{
UCHAR OwnsProcessAddressSpaceExclusive:
1;
UCHAR OwnsProcessAddressSpaceShared:
1;
UCHAR HardFaultBehavior:
1;
volatile UCHAR StartAddressInvalid:
1;
UCHAR EtwCalloutActive:
1;
UCHAR SuppressSymbolLoad:
1;
UCHAR Prefetching:
1;
UCHAR OwnsVadExclusive:
1;
UCHAR SystemPagePriorityActive:
1;
UCHAR SystemPagePriority:
3;
};
};
UCHAR CacheManagerActive;
UCHAR DisablePageFaultClustering;
UCHAR ActiveFaultCount;
UCHAR LockOrderState;
ULONGLONG AlpcMessageId;
union
{
VOID* AlpcMessage;
ULONG AlpcReceiveAttributeSet;
};
LONG ExitStatus;
struct _LIST_ENTRY AlpcWaitListEntry;
ULONG CacheManagerCount;
ULONG IoBoostCount;
struct _LIST_ENTRY BoostList;
struct _LIST_ENTRY DeboostList;
ULONGLONG BoostListLock;
ULONGLONG IrpListLock;
VOID* ReservedForSynchTracking;
struct _SINGLE_LIST_ENTRY CmCallbackListHead;
struct _GUID* ActivityId;
struct _SINGLE_LIST_ENTRY SeLearningModeListHead;
VOID* VerifierContext;
ULONG KernelStackReference;
VOID* AdjustedClientToken;
VOID* WorkingOnBehalfClient;
struct _PS_PROPERTY_SET PropertySet;
VOID* PicoContext;
ULONG UserFsBase;
ULONGLONG UserGsBase;
struct _THREAD_ENERGY_VALUES* EnergyValues;
volatile ULONG CmCellReferences;
union
{
ULONGLONG SelectedCpuSets;
ULONGLONG* SelectedCpuSetsIndirect;
};
struct _ESILO* Silo;
};