//0x258 bytes (sizeof)
struct _ETHREAD
{
struct _KTHREAD Tcb; //0x0
union
{
union _LARGE_INTEGER CreateTime; //0x1c0
struct
{
ULONG NestedFaultCount:2; //0x1c0
ULONG ApcNeeded:1; //0x1c0
};
};
union
{
union _LARGE_INTEGER ExitTime; //0x1c8
struct _LIST_ENTRY LpcReplyChain; //0x1c8
struct _LIST_ENTRY KeyedWaitChain; //0x1c8
};
union
{
LONG ExitStatus; //0x1d0
VOID* OfsChain; //0x1d0
};
struct _LIST_ENTRY PostBlockList; //0x1d4
union
{
struct _TERMINATION_PORT* TerminationPort; //0x1dc
struct _ETHREAD* ReaperLink; //0x1dc
VOID* KeyedWaitValue; //0x1dc
};
ULONG ActiveTimerListLock; //0x1e0
struct _LIST_ENTRY ActiveTimerListHead; //0x1e4
struct _CLIENT_ID Cid; //0x1ec
union
{
struct _KSEMAPHORE LpcReplySemaphore; //0x1f4
struct _KSEMAPHORE KeyedWaitSemaphore; //0x1f4
};
union
{
VOID* LpcReplyMessage; //0x208
VOID* LpcWaitingOnPort; //0x208
};
struct _PS_IMPERSONATION_INFORMATION* ImpersonationInfo; //0x20c
struct _LIST_ENTRY IrpList; //0x210
ULONG TopLevelIrp; //0x218
struct _DEVICE_OBJECT* DeviceToVerify; //0x21c
struct _EPROCESS* ThreadsProcess; //0x220
VOID* StartAddress; //0x224
union
{
VOID* Win32StartAddress; //0x228
ULONG LpcReceivedMessageId; //0x228
};
struct _LIST_ENTRY ThreadListEntry; //0x22c
struct _EX_RUNDOWN_REF RundownProtect; //0x234
struct _EX_PUSH_LOCK ThreadLock; //0x238
ULONG LpcReplyMessageId; //0x23c
ULONG ReadClusterSize; //0x240
ULONG GrantedAccess; //0x244
union
{
ULONG CrossThreadFlags; //0x248
struct
{
ULONG Terminated:1; //0x248
ULONG DeadThread:1; //0x248
ULONG HideFromDebugger:1; //0x248
ULONG ActiveImpersonationInfo:1; //0x248
ULONG SystemThread:1; //0x248
ULONG HardErrorsAreDisabled:1; //0x248
ULONG BreakOnTermination:1; //0x248
ULONG SkipCreationMsg:1; //0x248
ULONG SkipTerminationMsg:1; //0x248
};
};
union
{
ULONG SameThreadPassiveFlags; //0x24c
struct
{
ULONG ActiveExWorker:1; //0x24c
ULONG ExWorkerCanWaitUser:1; //0x24c
ULONG MemoryMaker:1; //0x24c
};
};
union
{
ULONG SameThreadApcFlags; //0x250
struct
{
UCHAR LpcReceivedMsgIdValid:1; //0x250
UCHAR LpcExitThreadCalled:1; //0x250
UCHAR AddressSpaceOwner:1; //0x250
};
};
UCHAR ForwardClusterOnly; //0x254
UCHAR DisablePageFaultClustering; //0x255
};