_ETHREAD

Metadatacopy
struct _ETHREAD {
    struct _KTHREAD Tcb;/* 0x0  896 */
    /* ── cacheline 14 boundary (896 bytes) ── */
    union _LARGE_INTEGER CreateTime;/* 0x380  8 */
    union {
        union _LARGE_INTEGER ExitTime;/* 0x388  8 */
        struct _LIST_ENTRY KeyedWaitChain;/* 0x388  16 */
    };/* 0x388  16 */
    union {
        long ExitStatus;/* 0x398  4 */
        void* OfsChain;/* 0x398  8 */
    };/* 0x398  8 */
    union {
        struct _LIST_ENTRY PostBlockList;/* 0x3a0  16 */
        struct {
            void* ForwardLinkShadow;/* 0x3a0  8 */
            void* StartAddress;/* 0x3a8  8 */
        };/* 0x3a0  16 */
    };/* 0x3a0  16 */
    union {
        struct _TERMINATION_PORT* TerminationPort;/* 0x3b0  8 */
        struct _ETHREAD* ReaperLink;/* 0x3b0  8 */
        void* KeyedWaitValue;/* 0x3b0  8 */
        void* Win32StartParameter;/* 0x3b0  8 */
    };/* 0x3b0  8 */
    unsigned __int64 ActiveTimerListLock;/* 0x3b8  8 */
    /* ── cacheline 15 boundary (960 bytes) ── */
    struct _LIST_ENTRY ActiveTimerListHead;/* 0x3c0  16 */
    struct _CLIENT_ID Cid;/* 0x3d0  16 */
    union {
        struct _KSEMAPHORE KeyedWaitSemaphore;/* 0x3e0  32 */
        struct _KSEMAPHORE AlpcWaitSemaphore;/* 0x3e0  32 */
    };/* 0x3e0  32 */
    /* ── cacheline 16 boundary (1024 bytes) ── */
    union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;/* 0x400  8 */
    struct _LIST_ENTRY IrpList;/* 0x408  16 */
    unsigned __int64 TopLevelIrp;/* 0x418  8 */
    struct _DEVICE_OBJECT* DeviceToVerify;/* 0x420  8 */
    union _PSP_RATE_APC* RateControlApc;/* 0x428  8 */
    void* Win32StartAddress;/* 0x430  8 */
    void* SparePtr0;/* 0x438  8 */
    /* ── cacheline 17 boundary (1088 bytes) ── */
    struct _LIST_ENTRY ThreadListEntry;/* 0x440  16 */
    struct _EX_RUNDOWN_REF RundownProtect;/* 0x450  8 */
    struct _EX_PUSH_LOCK ThreadLock;/* 0x458  8 */
    unsigned long ReadClusterSize;/* 0x460  4 */
    volatile long MmLockOrdering;/* 0x464  4 */
    union {
        unsigned long CrossThreadFlags;/* 0x468  4 */
        struct {
            unsigned long Terminated : 1;/* 0x468:0  4 */
            unsigned long ThreadInserted : 1;/* 0x468:1  4 */
            unsigned long HideFromDebugger : 1;/* 0x468:2  4 */
            unsigned long ActiveImpersonationInfo : 1;/* 0x468:3  4 */
            unsigned long SystemThread : 1;/* 0x468:4  4 */
            unsigned long HardErrorsAreDisabled : 1;/* 0x468:5  4 */
            unsigned long BreakOnTermination : 1;/* 0x468:6  4 */
            unsigned long SkipCreationMsg : 1;/* 0x468:7  4 */
            unsigned long SkipTerminationMsg : 1;/* 0x468:8  4 */
            unsigned long CopyTokenOnOpen : 1;/* 0x468:9  4 */
            unsigned long ThreadIoPriority : 3;/* 0x468:10  4 */
            unsigned long ThreadPagePriority : 3;/* 0x468:13  4 */
            unsigned long RundownFail : 1;/* 0x468:16  4 */
        };/* 0x468  4 */
    };/* 0x468  4 */
    union {
        unsigned long SameThreadPassiveFlags;/* 0x46c  4 */
        struct {
            unsigned long ActiveExWorker : 1;/* 0x46c:0  4 */
            unsigned long ExWorkerCanWaitUser : 1;/* 0x46c:1  4 */
            unsigned long MemoryMaker : 1;/* 0x46c:2  4 */
            unsigned long ClonedThread : 1;/* 0x46c:3  4 */
            unsigned long KeyedEventInUse : 1;/* 0x46c:4  4 */
            unsigned long RateApcState : 2;/* 0x46c:5  4 */
            unsigned long SelfTerminate : 1;/* 0x46c:7  4 */
        };/* 0x46c  4 */
    };/* 0x46c  4 */
    union {
        unsigned long SameThreadApcFlags;/* 0x470  4 */
        struct {
            unsigned char Spare : 1;/* 0x470:0  1 */
            volatile unsigned char StartAddressInvalid : 1;/* 0x470:1  1 */
            unsigned char EtwPageFaultCalloutActive : 1;/* 0x470:2  1 */
            unsigned char OwnsProcessWorkingSetExclusive : 1;/* 0x470:3  1 */
            unsigned char OwnsProcessWorkingSetShared : 1;/* 0x470:4  1 */
            unsigned char OwnsSystemWorkingSetExclusive : 1;/* 0x470:5  1 */
            unsigned char OwnsSystemWorkingSetShared : 1;/* 0x470:6  1 */
            unsigned char OwnsSessionWorkingSetExclusive : 1;/* 0x470:7  1 */
            unsigned char OwnsSessionWorkingSetShared : 1;/* 0x471:0  1 */
            unsigned char OwnsProcessAddressSpaceExclusive : 1;/* 0x471:1  1 */
            unsigned char OwnsProcessAddressSpaceShared : 1;/* 0x471:2  1 */
            unsigned char SuppressSymbolLoad : 1;/* 0x471:3  1 */
            unsigned char Prefetching : 1;/* 0x471:4  1 */
            unsigned char OwnsDynamicMemoryShared : 1;/* 0x471:5  1 */
            unsigned char OwnsChangeControlAreaExclusive : 1;/* 0x471:6  1 */
            unsigned char OwnsChangeControlAreaShared : 1;/* 0x471:7  1 */
            unsigned char Spare1 : 8;/* 0x472:0  1 */
            unsigned char PriorityRegionActive;/* 0x473  1 */
        };/* 0x470  4 */
    };/* 0x470  4 */
    unsigned char CacheManagerActive;/* 0x474  1 */
    unsigned char DisablePageFaultClustering;/* 0x475  1 */
    unsigned char ActiveFaultCount;/* 0x476  1 */
    /* 1 byte padding */
    unsigned __int64 AlpcMessageId;/* 0x478  8 */
    /* ── cacheline 18 boundary (1152 bytes) ── */
    union {
        void* AlpcMessage;/* 0x480  8 */
        unsigned long AlpcReceiveAttributeSet;/* 0x480  4 */
    };/* 0x480  8 */
    struct _LIST_ENTRY AlpcWaitListEntry;/* 0x488  16 */
    unsigned long CacheManagerCount;/* 0x498  4 */
};