struct _ETHREAD
{
struct _KTHREAD Tcb;
union _LARGE_INTEGER CreateTime;
union
{
union _LARGE_INTEGER ExitTime;
struct _LIST_ENTRY KeyedWaitChain;
};
VOID* ChargeOnlySession;
union
{
struct _LIST_ENTRY PostBlockList;
struct
{
VOID* ForwardLinkShadow;
VOID* StartAddress;
};
};
union
{
struct _TERMINATION_PORT* TerminationPort;
struct _ETHREAD* ReaperLink;
VOID* KeyedWaitValue;
};
ULONG ActiveTimerListLock;
struct _LIST_ENTRY ActiveTimerListHead;
struct _CLIENT_ID Cid;
union
{
struct _KSEMAPHORE KeyedWaitSemaphore;
struct _KSEMAPHORE AlpcWaitSemaphore;
};
union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;
struct _LIST_ENTRY IrpList;
ULONG TopLevelIrp;
struct _DEVICE_OBJECT* DeviceToVerify;
VOID* Win32StartAddress;
VOID* LegacyPowerObject;
struct _LIST_ENTRY ThreadListEntry;
struct _EX_RUNDOWN_REF RundownProtect;
struct _EX_PUSH_LOCK ThreadLock;
ULONG ReadClusterSize;
volatile LONG MmLockOrdering;
union
{
ULONG CrossThreadFlags;
struct
{
ULONG Terminated:
1;
ULONG ThreadInserted:
1;
ULONG HideFromDebugger:
1;
ULONG ActiveImpersonationInfo:
1;
ULONG HardErrorsAreDisabled:
1;
ULONG BreakOnTermination:
1;
ULONG SkipCreationMsg:
1;
ULONG SkipTerminationMsg:
1;
ULONG CopyTokenOnOpen:
1;
ULONG ThreadIoPriority:
3;
ULONG ThreadPagePriority:
3;
ULONG RundownFail:
1;
ULONG UmsForceQueueTermination:
1;
ULONG IndirectCpuSets:
1;
ULONG DisableDynamicCodeOptOut:
1;
ULONG ExplicitCaseSensitivity:
1;
ULONG PicoNotifyExit:
1;
ULONG DbgWerUserReportActive:
1;
ULONG ForcedSelfTrimActive:
1;
ULONG ReservedCrossThreadFlags:
9;
};
};
union
{
ULONG SameThreadPassiveFlags;
struct
{
ULONG ActiveExWorker:
1;
ULONG MemoryMaker:
1;
ULONG StoreLockThread:
2;
ULONG ClonedThread:
1;
ULONG KeyedEventInUse:
1;
ULONG SelfTerminate:
1;
ULONG RespectIoPriority:
1;
ULONG ActivePageLists:
1;
ULONG SecureContext:
1;
ULONG ZeroPageThread:
1;
ULONG ReservedSameThreadPassiveFlags:
21;
};
};
union
{
ULONG SameThreadApcFlags;
struct
{
UCHAR OwnsProcessAddressSpaceExclusive:
1;
UCHAR OwnsProcessAddressSpaceShared:
1;
UCHAR HardFaultBehavior:
1;
volatile UCHAR StartAddressInvalid:
1;
UCHAR EtwCalloutActive:
1;
UCHAR SuppressSymbolLoad:
1;
UCHAR Prefetching:
1;
UCHAR OwnsVadExclusive:
1;
UCHAR SystemPagePriorityActive:
1;
UCHAR SystemPagePriority:
3;
UCHAR AllowWritesToExecutableMemory:
1;
};
};
UCHAR CacheManagerActive;
UCHAR DisablePageFaultClustering;
UCHAR ActiveFaultCount;
UCHAR LockOrderState;
ULONG AlpcMessageId;
union
{
VOID* AlpcMessage;
ULONG AlpcReceiveAttributeSet;
};
struct _LIST_ENTRY AlpcWaitListEntry;
LONG ExitStatus;
ULONG CacheManagerCount;
ULONG IoBoostCount;
ULONG IoQoSBoostCount;
ULONG IoQoSThrottleCount;
struct _LIST_ENTRY BoostList;
struct _LIST_ENTRY DeboostList;
ULONG BoostListLock;
ULONG IrpListLock;
VOID* ReservedForSynchTracking;
struct _SINGLE_LIST_ENTRY CmCallbackListHead;
struct _GUID* ActivityId;
struct _SINGLE_LIST_ENTRY SeLearningModeListHead;
VOID* VerifierContext;
ULONG KernelStackReference;
VOID* AdjustedClientToken;
VOID* WorkOnBehalfThread;
struct _PS_PROPERTY_SET PropertySet;
VOID* PicoContext;
ULONG UserFsBase;
ULONG UserGsBase;
struct _THREAD_ENERGY_VALUES* EnergyValues;
VOID* CmDbgInfo;
union
{
ULONG SelectedCpuSets;
ULONG* SelectedCpuSetsIndirect;
};
struct _EJOB* Silo;
struct _UNICODE_STRING* ThreadName;
ULONG LastExpectedRunTime;
struct _LIST_ENTRY OwnerEntryListHead;
ULONG DisownedOwnerEntryListLock;
struct _LIST_ENTRY DisownedOwnerEntryListHead;
};