struct _ETHREAD { struct _KTHREAD Tcb;/* 0x0 1184 */ /* ── cacheline 18 boundary (1152 bytes) ── */ union _LARGE_INTEGER CreateTime;/* 0x4a0 8 */ union { union _LARGE_INTEGER ExitTime;/* 0x4a8 8 */ struct _LIST_ENTRY KeyedWaitChain;/* 0x4a8 16 */ };/* 0x4a8 16 */ union { struct _LIST_ENTRY PostBlockList;/* 0x4b8 16 */ struct { void* ForwardLinkShadow;/* 0x4b8 8 */ void* StartAddress;/* 0x4c0 8 */ };/* 0x4b8 16 */ };/* 0x4b8 16 */ /* ── cacheline 19 boundary (1216 bytes) ── */ union { struct _TERMINATION_PORT* TerminationPort;/* 0x4c8 8 */ struct _ETHREAD* ReaperLink;/* 0x4c8 8 */ void* KeyedWaitValue;/* 0x4c8 8 */ };/* 0x4c8 8 */ unsigned __int64 ActiveTimerListLock;/* 0x4d0 8 */ struct _LIST_ENTRY ActiveTimerListHead;/* 0x4d8 16 */ struct _CLIENT_ID Cid;/* 0x4e8 16 */ union { struct _KSEMAPHORE KeyedWaitSemaphore;/* 0x4f8 32 */ struct _KSEMAPHORE AlpcWaitSemaphore;/* 0x4f8 32 */ };/* 0x4f8 32 */ /* ── cacheline 20 boundary (1280 bytes) ── */ union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;/* 0x518 8 */ struct _LIST_ENTRY IrpList;/* 0x520 16 */ unsigned __int64 TopLevelIrp;/* 0x530 8 */ struct _DEVICE_OBJECT* DeviceToVerify;/* 0x538 8 */ /* ── cacheline 21 boundary (1344 bytes) ── */ void* Win32StartAddress;/* 0x540 8 */ void* ChargeOnlySession;/* 0x548 8 */ void* LegacyPowerObject;/* 0x550 8 */ struct _LIST_ENTRY ThreadListEntry;/* 0x558 16 */ struct _EX_RUNDOWN_REF RundownProtect;/* 0x568 8 */ struct _EX_PUSH_LOCK ThreadLock;/* 0x570 8 */ unsigned long ReadClusterSize;/* 0x578 4 */ volatile unsigned long MmLockOrdering;/* 0x57c 4 */ /* ── cacheline 22 boundary (1408 bytes) ── */ union { unsigned long CrossThreadFlags;/* 0x580 4 */ struct { unsigned long Terminated : 1;/* 0x580:0 4 */ unsigned long ThreadInserted : 1;/* 0x580:1 4 */ unsigned long HideFromDebugger : 1;/* 0x580:2 4 */ unsigned long ActiveImpersonationInfo : 1;/* 0x580:3 4 */ unsigned long HardErrorsAreDisabled : 1;/* 0x580:4 4 */ unsigned long BreakOnTermination : 1;/* 0x580:5 4 */ unsigned long SkipCreationMsg : 1;/* 0x580:6 4 */ unsigned long SkipTerminationMsg : 1;/* 0x580:7 4 */ unsigned long CopyTokenOnOpen : 1;/* 0x580:8 4 */ unsigned long ThreadIoPriority : 3;/* 0x580:9 4 */ unsigned long ThreadPagePriority : 3;/* 0x580:12 4 */ unsigned long RundownFail : 1;/* 0x580:15 4 */ unsigned long UmsForceQueueTermination : 1;/* 0x580:16 4 */ unsigned long IndirectCpuSets : 1;/* 0x580:17 4 */ unsigned long DisableDynamicCodeOptOut : 1;/* 0x580:18 4 */ unsigned long ExplicitCaseSensitivity : 1;/* 0x580:19 4 */ unsigned long PicoNotifyExit : 1;/* 0x580:20 4 */ unsigned long DbgWerUserReportActive : 1;/* 0x580:21 4 */ unsigned long ForcedSelfTrimActive : 1;/* 0x580:22 4 */ unsigned long SamplingCoverage : 1;/* 0x580:23 4 */ unsigned long ImpersonationSchedulingGroup : 1;/* 0x580:24 4 */ unsigned long ReservedCrossThreadFlags : 7;/* 0x580:25 4 */ };/* 0x580 4 */ };/* 0x580 4 */ union { unsigned long SameThreadPassiveFlags;/* 0x584 4 */ struct { unsigned long ActiveExWorker : 1;/* 0x584:0 4 */ unsigned long MemoryMaker : 1;/* 0x584:1 4 */ unsigned long StoreLockThread : 2;/* 0x584:2 4 */ unsigned long ClonedThread : 1;/* 0x584:4 4 */ unsigned long KeyedEventInUse : 1;/* 0x584:5 4 */ unsigned long SelfTerminate : 1;/* 0x584:6 4 */ unsigned long RespectIoPriority : 1;/* 0x584:7 4 */ unsigned long ActivePageLists : 1;/* 0x584:8 4 */ unsigned long SecureContext : 1;/* 0x584:9 4 */ unsigned long ZeroPageThread : 1;/* 0x584:10 4 */ unsigned long WorkloadClass : 1;/* 0x584:11 4 */ unsigned long GenerateDumpOnBadHandleAccess : 1;/* 0x584:12 4 */ unsigned long BalanceSetManager : 1;/* 0x584:13 4 */ unsigned long ReservedSameThreadPassiveFlags : 18;/* 0x584:14 4 */ };/* 0x584 4 */ };/* 0x584 4 */ union { unsigned long SameThreadApcFlags;/* 0x588 4 */ struct { unsigned char OwnsProcessAddressSpaceExclusive : 1;/* 0x588:0 1 */ unsigned char OwnsProcessAddressSpaceShared : 1;/* 0x588:1 1 */ unsigned char HardFaultBehavior : 1;/* 0x588:2 1 */ volatile unsigned char StartAddressInvalid : 1;/* 0x588:3 1 */ unsigned char EtwCalloutActive : 1;/* 0x588:4 1 */ unsigned char SuppressSymbolLoad : 1;/* 0x588:5 1 */ unsigned char Prefetching : 1;/* 0x588:6 1 */ unsigned char OwnsVadExclusive : 1;/* 0x588:7 1 */ unsigned char SystemPagePriorityActive : 1;/* 0x589:0 1 */ unsigned char SystemPagePriority : 3;/* 0x589:1 1 */ unsigned char AllowUserWritesToExecutableMemory : 1;/* 0x589:4 1 */ unsigned char AllowKernelWritesToExecutableMemory : 1;/* 0x589:5 1 */ unsigned char OwnsVadShared : 1;/* 0x589:6 1 */ unsigned char PasidMsrValid : 1;/* 0x589:7 1 */ unsigned char SlabReplenishInProgress : 1;/* 0x58a:0 1 */ };/* 0x588 3 */ };/* 0x588 4 */ unsigned char CacheManagerActive;/* 0x58c 1 */ unsigned char DisablePageFaultClustering;/* 0x58d 1 */ unsigned char ActiveFaultCount;/* 0x58e 1 */ unsigned char LockOrderState;/* 0x58f 1 */ unsigned long SharedPsModuleLockAcquires;/* 0x590 4 */ unsigned long MmReserved;/* 0x594 4 */ unsigned __int64 AlpcMessageId;/* 0x598 8 */ union { void* AlpcMessage;/* 0x5a0 8 */ unsigned long AlpcReceiveAttributeSet;/* 0x5a0 4 */ };/* 0x5a0 8 */ struct _LIST_ENTRY AlpcWaitListEntry;/* 0x5a8 16 */ long ExitStatus;/* 0x5b8 4 */ unsigned long CacheManagerCount;/* 0x5bc 4 */ /* ── cacheline 23 boundary (1472 bytes) ── */ unsigned long IoBoostCount;/* 0x5c0 4 */ unsigned long IoQoSBoostCount;/* 0x5c4 4 */ unsigned long IoQoSThrottleCount;/* 0x5c8 4 */ unsigned long KernelStackReference;/* 0x5cc 4 */ struct _LIST_ENTRY BoostList;/* 0x5d0 16 */ struct _LIST_ENTRY DeboostList;/* 0x5e0 16 */ unsigned __int64 BoostListLock;/* 0x5f0 8 */ unsigned __int64 IrpListLock;/* 0x5f8 8 */ /* ── cacheline 24 boundary (1536 bytes) ── */ void* ReservedForSynchTracking;/* 0x600 8 */ struct _SINGLE_LIST_ENTRY CmCallbackListHead;/* 0x608 8 */ const struct _GUID* ActivityId;/* 0x610 8 */ struct _SINGLE_LIST_ENTRY SeLearningModeListHead;/* 0x618 8 */ void* VerifierContext;/* 0x620 8 */ void* AdjustedClientToken;/* 0x628 8 */ void* WorkOnBehalfThread;/* 0x630 8 */ struct _PS_PROPERTY_SET PropertySet;/* 0x638 24 */ /* ── cacheline 25 boundary (1600 bytes) ── */ void* PicoContext;/* 0x650 8 */ unsigned __int64 UserRoBase;/* 0x658 8 */ unsigned __int64 UserRwBase;/* 0x660 8 */ struct _THREAD_ENERGY_VALUES* EnergyValues;/* 0x668 8 */ union { unsigned __int64 SelectedCpuSets;/* 0x670 8 */ unsigned __int64* SelectedCpuSetsIndirect;/* 0x670 8 */ };/* 0x670 8 */ struct _EJOB* Silo;/* 0x678 8 */ /* ── cacheline 26 boundary (1664 bytes) ── */ struct _UNICODE_STRING* ThreadName;/* 0x680 8 */ void* SparePointer;/* 0x688 8 */ void* EtwSupport;/* 0x690 8 */ struct _LIST_ENTRY OwnerEntryListHead;/* 0x698 16 */ unsigned __int64 DisownedOwnerEntryListLock;/* 0x6a8 8 */ struct _LIST_ENTRY DisownedOwnerEntryListHead;/* 0x6b0 16 */ /* ── cacheline 27 boundary (1728 bytes) ── */ void* SchedulerSharedDataObject;/* 0x6c0 8 */ void* CmThreadInfo;/* 0x6c8 8 */ void* FlsData;/* 0x6d0 8 */ unsigned long LastExpectedRunTime;/* 0x6d8 4 */ unsigned long LastSoftParkElectionRunTime;/* 0x6dc 4 */ unsigned __int64 LastSoftParkElectionGeneration;/* 0x6e0 8 */ struct _GROUP_AFFINITY LastSoftParkElectionGroupAffinity;/* 0x6e8 16 */ unsigned __int64 UserIsolationDomain;/* 0x6f8 8 */ /* ── cacheline 28 boundary (1792 bytes) ── */ union { struct _KAPC UpdateTebApc;/* 0x700 88 */ struct { unsigned char UpdateTebApcFill1[3];/* 0x700 3 */ char Win32kPriorityFloor;/* 0x703 1 */ };/* 0x700 4 */ struct { unsigned char UpdateTebApcFill2[4];/* 0x700 4 */ unsigned char LastSoftParkElectionQos;/* 0x704 1 */ unsigned char LastSoftParkElectionWorkloadType;/* 0x705 1 */ unsigned char LastSoftParkElectionRunningType;/* 0x706 1 */ unsigned char MmSlabIdentity;/* 0x707 1 */ };/* 0x700 8 */ struct { unsigned char UpdateTebApcFill3[64];/* 0x700 64 */ union _RTL_THREAD_RNG_STATE RngState;/* 0x740 16 */ };/* 0x700 80 */ struct { unsigned char UpdateTebApcFill4[72];/* 0x700 72 */ void* UsedByRngState;/* 0x748 8 */ };/* 0x700 80 */ struct { unsigned char UpdateTebApcFill5[83];/* 0x700 83 */ unsigned char UpdateTebSpareByte2;/* 0x753 1 */ unsigned long UpdateTebSpareLong2;/* 0x754 4 */ };/* 0x700 88 */ };/* 0x700 88 */ /* ── cacheline 29 boundary (1856 bytes) ── */ unsigned __int64 Win32kThreadLock;/* 0x758 8 */ void* ThreadIndex;/* 0x760 8 */};size 1896 (0x768)147 members0 holespadding 030 cachelines
Used in (27)
_ALPC_DISPATCH_CONTEXT_CC_PARTITION_CM_DIRTY_VECTOR_LOG_ENTRY_EPROCESS_ETW_APC_POOL_ETW_GUID_ENTRY_HIVE_WRITE_WAIT_QUEUE_IOV_FORCED_PENDING_TRACE_IO_WORKITEM_IRP_KALPC_MESSAGE_MI_PARTITION_MODWRITES_MI_PARTITION_STORES_MI_SHUTDOWN_STATE_MI_SYSTEM_IMAGE_STATE_MI_SYSTEM_TRIM_STATE_MI_VAD_EVENT_BLOCK_MMINPAGE_SUPPORT_NONOPAQUE_OPLOCK_POP_IRP_WORKER_ENTRY_POP_SHUTDOWN_BUG_CHECK_RH_OP_CONTEXT_VF_KE_CRITICAL_REGION_TRACE_VF_POOL_TRACE_VI_FAULT_TRACE_WMI_LOGGER_CONTEXT_WORK_QUEUE_ENTRY