struct _ETHREAD { struct _KTHREAD Tcb;/* 0x0 1216 */ /* ── cacheline 19 boundary (1216 bytes) ── */ union _LARGE_INTEGER CreateTime;/* 0x4c0 8 */ union { union _LARGE_INTEGER ExitTime;/* 0x4c8 8 */ struct _LIST_ENTRY KeyedWaitChain;/* 0x4c8 16 */ };/* 0x4c8 16 */ union { struct _LIST_ENTRY PostBlockList;/* 0x4d8 16 */ struct { void* ForwardLinkShadow;/* 0x4d8 8 */ void* StartAddress;/* 0x4e0 8 */ };/* 0x4d8 16 */ };/* 0x4d8 16 */ union { struct _TERMINATION_PORT* TerminationPort;/* 0x4e8 8 */ struct _ETHREAD* ReaperLink;/* 0x4e8 8 */ void* KeyedWaitValue;/* 0x4e8 8 */ };/* 0x4e8 8 */ unsigned __int64 ActiveTimerListLock;/* 0x4f0 8 */ struct _LIST_ENTRY ActiveTimerListHead;/* 0x4f8 16 */ /* ── cacheline 20 boundary (1280 bytes) ── */ struct _CLIENT_ID Cid;/* 0x508 16 */ union { struct _KSEMAPHORE KeyedWaitSemaphore;/* 0x518 32 */ struct _KSEMAPHORE AlpcWaitSemaphore;/* 0x518 32 */ };/* 0x518 32 */ union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;/* 0x538 8 */ /* ── cacheline 21 boundary (1344 bytes) ── */ struct _LIST_ENTRY IrpList;/* 0x540 16 */ unsigned __int64 TopLevelIrp;/* 0x550 8 */ struct _DEVICE_OBJECT* DeviceToVerify;/* 0x558 8 */ void* Win32StartAddress;/* 0x560 8 */ void* ChargeOnlySession;/* 0x568 8 */ void* LegacyPowerObject;/* 0x570 8 */ struct _LIST_ENTRY ThreadListEntry;/* 0x578 16 */ /* ── cacheline 22 boundary (1408 bytes) ── */ struct _EX_RUNDOWN_REF RundownProtect;/* 0x588 8 */ struct _EX_PUSH_LOCK ThreadLock;/* 0x590 8 */ unsigned long ReadClusterSize;/* 0x598 4 */ volatile unsigned long MmLockOrdering;/* 0x59c 4 */ union { unsigned long CrossThreadFlags;/* 0x5a0 4 */ struct { unsigned long Terminated : 1;/* 0x5a0:0 4 */ unsigned long ThreadInserted : 1;/* 0x5a0:1 4 */ unsigned long HideFromDebugger : 1;/* 0x5a0:2 4 */ unsigned long ActiveImpersonationInfo : 1;/* 0x5a0:3 4 */ unsigned long HardErrorsAreDisabled : 1;/* 0x5a0:4 4 */ unsigned long BreakOnTermination : 1;/* 0x5a0:5 4 */ unsigned long SkipCreationMsg : 1;/* 0x5a0:6 4 */ unsigned long SkipTerminationMsg : 1;/* 0x5a0:7 4 */ unsigned long CopyTokenOnOpen : 1;/* 0x5a0:8 4 */ unsigned long ThreadIoPriority : 3;/* 0x5a0:9 4 */ unsigned long ThreadPagePriority : 3;/* 0x5a0:12 4 */ unsigned long RundownFail : 1;/* 0x5a0:15 4 */ unsigned long UmsForceQueueTermination : 1;/* 0x5a0:16 4 */ unsigned long IndirectCpuSets : 1;/* 0x5a0:17 4 */ unsigned long DisableDynamicCodeOptOut : 1;/* 0x5a0:18 4 */ unsigned long ExplicitCaseSensitivity : 1;/* 0x5a0:19 4 */ unsigned long PicoNotifyExit : 1;/* 0x5a0:20 4 */ unsigned long DbgWerUserReportActive : 1;/* 0x5a0:21 4 */ unsigned long ForcedSelfTrimActive : 1;/* 0x5a0:22 4 */ unsigned long SamplingCoverage : 1;/* 0x5a0:23 4 */ unsigned long ImpersonationSchedulingGroup : 1;/* 0x5a0:24 4 */ unsigned long Prefetching : 1;/* 0x5a0:25 4 */ unsigned long ReservedCrossThreadFlags : 6;/* 0x5a0:26 4 */ };/* 0x5a0 4 */ };/* 0x5a0 4 */ union { unsigned long SameThreadPassiveFlags;/* 0x5a4 4 */ struct { unsigned long ActiveExWorker : 1;/* 0x5a4:0 4 */ unsigned long MemoryMaker : 1;/* 0x5a4:1 4 */ unsigned long StoreLockThread : 2;/* 0x5a4:2 4 */ unsigned long ClonedThread : 1;/* 0x5a4:4 4 */ unsigned long KeyedEventInUse : 1;/* 0x5a4:5 4 */ unsigned long SelfTerminate : 1;/* 0x5a4:6 4 */ unsigned long RespectIoPriority : 1;/* 0x5a4:7 4 */ unsigned long ActivePageLists : 1;/* 0x5a4:8 4 */ unsigned long SecureContext : 1;/* 0x5a4:9 4 */ unsigned long ZeroPageThread : 1;/* 0x5a4:10 4 */ unsigned long GenerateDumpOnBadHandleAccess : 1;/* 0x5a4:11 4 */ unsigned long PeriodicTrimmerThread : 1;/* 0x5a4:12 4 */ unsigned long ReservedSameThreadPassiveFlags : 19;/* 0x5a4:13 4 */ };/* 0x5a4 4 */ };/* 0x5a4 4 */ union { unsigned long SameThreadApcFlags;/* 0x5a8 4 */ struct { unsigned char OwnsProcessAddressSpaceExclusive : 1;/* 0x5a8:0 1 */ unsigned char OwnsProcessAddressSpaceShared : 1;/* 0x5a8:1 1 */ unsigned char HardFaultBehavior : 1;/* 0x5a8:2 1 */ volatile unsigned char StartAddressInvalid : 1;/* 0x5a8:3 1 */ unsigned char EtwCalloutActive : 1;/* 0x5a8:4 1 */ unsigned char SuppressSymbolLoad : 1;/* 0x5a8:5 1 */ unsigned char SpareBit : 1;/* 0x5a8:6 1 */ unsigned char OwnsVadExclusive : 1;/* 0x5a8:7 1 */ unsigned char SystemPagePriorityActive : 1;/* 0x5a9:0 1 */ unsigned char SystemPagePriority : 3;/* 0x5a9:1 1 */ unsigned char AllowUserWritesToExecutableMemory : 1;/* 0x5a9:4 1 */ unsigned char AllowKernelWritesToExecutableMemory : 1;/* 0x5a9:5 1 */ unsigned char OwnsVadShared : 1;/* 0x5a9:6 1 */ unsigned char PasidMsrValid : 1;/* 0x5a9:7 1 */ unsigned char SlabReplenishInProgress : 1;/* 0x5aa:0 1 */ unsigned char RefillingPtes : 1;/* 0x5aa:1 1 */ };/* 0x5a8 3 */ };/* 0x5a8 4 */ unsigned char CacheManagerActive;/* 0x5ac 1 */ unsigned char DisablePageFaultClustering;/* 0x5ad 1 */ unsigned char ActiveFaultCount;/* 0x5ae 1 */ unsigned char LockOrderState;/* 0x5af 1 */ unsigned long SharedPsModuleLockAcquires;/* 0x5b0 4 */ unsigned long MmReserved;/* 0x5b4 4 */ unsigned __int64 AlpcMessageId;/* 0x5b8 8 */ /* ── cacheline 23 boundary (1472 bytes) ── */ union { void* AlpcMessage;/* 0x5c0 8 */ unsigned long AlpcReceiveAttributeSet;/* 0x5c0 4 */ };/* 0x5c0 8 */ struct _LIST_ENTRY AlpcWaitListEntry;/* 0x5c8 16 */ long ExitStatus;/* 0x5d8 4 */ unsigned long CacheManagerCount;/* 0x5dc 4 */ unsigned long IoBoostCount;/* 0x5e0 4 */ unsigned long IoQoSBoostCount;/* 0x5e4 4 */ unsigned long IoQoSThrottleCount;/* 0x5e8 4 */ unsigned long KernelStackReference;/* 0x5ec 4 */ struct _LIST_ENTRY BoostList;/* 0x5f0 16 */ /* ── cacheline 24 boundary (1536 bytes) ── */ struct _LIST_ENTRY DeboostList;/* 0x600 16 */ unsigned __int64 BoostListLock;/* 0x610 8 */ unsigned __int64 IrpListLock;/* 0x618 8 */ void* ReservedForSynchTracking;/* 0x620 8 */ struct _SINGLE_LIST_ENTRY CmCallbackListHead;/* 0x628 8 */ const struct _GUID* ActivityId;/* 0x630 8 */ struct _SINGLE_LIST_ENTRY SeLearningModeListHead;/* 0x638 8 */ /* ── cacheline 25 boundary (1600 bytes) ── */ void* VerifierContext;/* 0x640 8 */ void* AdjustedClientToken;/* 0x648 8 */ void* WorkOnBehalfThread;/* 0x650 8 */ struct _PS_PROPERTY_SET PropertySet;/* 0x658 24 */ void* PicoContext;/* 0x670 8 */ unsigned __int64 UserFsBase;/* 0x678 8 */ /* ── cacheline 26 boundary (1664 bytes) ── */ unsigned __int64 UserGsBase;/* 0x680 8 */ struct _THREAD_ENERGY_VALUES* EnergyValues;/* 0x688 8 */ union { unsigned __int64 SelectedCpuSets;/* 0x690 8 */ unsigned __int64* SelectedCpuSetsIndirect;/* 0x690 8 */ };/* 0x690 8 */ struct _EJOB* Silo;/* 0x698 8 */ struct _UNICODE_STRING* ThreadName;/* 0x6a0 8 */ struct _CONTEXT* SetContextState;/* 0x6a8 8 */ void* SparePointer2;/* 0x6b0 8 */ struct _LIST_ENTRY OwnerEntryListHead;/* 0x6b8 16 */ /* ── cacheline 27 boundary (1728 bytes) ── */ unsigned __int64 DisownedOwnerEntryListLock;/* 0x6c8 8 */ struct _LIST_ENTRY DisownedOwnerEntryListHead;/* 0x6d0 16 */ void* SchedulerSharedDataObject;/* 0x6e0 8 */ void* CmThreadInfo;/* 0x6e8 8 */ void* FlsData;/* 0x6f0 8 */ unsigned long LastExpectedRunTime;/* 0x6f8 4 */ unsigned long LastSoftParkElectionRunTime;/* 0x6fc 4 */ /* ── cacheline 28 boundary (1792 bytes) ── */ unsigned __int64 LastSoftParkElectionGeneration;/* 0x700 8 */ struct _GROUP_AFFINITY LastSoftParkElectionGroupAffinity;/* 0x708 16 */ unsigned __int64 UserIsolationDomain;/* 0x718 8 */ union { struct _KAPC UpdateTebApc;/* 0x720 88 */ struct { unsigned char UpdateTebApcFill1[3];/* 0x720 3 */ signed char Win32kPriorityFloor;/* 0x723 1 */ };/* 0x720 4 */ struct { unsigned char UpdateTebApcFill2[4];/* 0x720 4 */ unsigned char LastSoftParkElectionQos;/* 0x724 1 */ unsigned char LastSoftParkElectionWorkloadType;/* 0x725 1 */ unsigned char LastSoftParkElectionRunningType;/* 0x726 1 */ unsigned char MmSlabIdentity;/* 0x727 1 */ };/* 0x720 8 */ struct { unsigned char UpdateTebApcFill3[64];/* 0x720 64 */ union _RTL_THREAD_RNG_STATE RngState;/* 0x760 16 */ };/* 0x720 80 */ struct { unsigned char UpdateTebApcFill4[72];/* 0x720 72 */ void* UsedByRngState;/* 0x768 8 */ };/* 0x720 80 */ struct { unsigned char UpdateTebApcFill5[83];/* 0x720 83 */ unsigned char UpdateTebSpareByte2;/* 0x773 1 */ unsigned long HeapData;/* 0x774 4 */ };/* 0x720 88 */ };/* 0x720 88 */ /* ── cacheline 29 boundary (1856 bytes) ── */ unsigned __int64 Win32kThreadLock;/* 0x778 8 */ /* ── cacheline 30 boundary (1920 bytes) ── */ void* ThreadIndex;/* 0x780 8 */ void* MmFaultClusterContexts[2];/* 0x788 16 */ struct _EX_FAST_REF ProcessFastRef;/* 0x798 8 */};size 1952 (0x7a0)150 members0 holespadding 031 cachelines
Used in (27)
_ALPC_DISPATCH_CONTEXT_CC_PARTITION_CM_DIRTY_VECTOR_LOG_ENTRY_EPROCESS_ETW_APC_POOL_ETW_GUID_ENTRY_HIVE_WRITE_WAIT_QUEUE_IOV_FORCED_PENDING_TRACE_IO_WORKITEM_IRP_KALPC_MESSAGE_MI_LDR_DATA_TABLE_ENTRY_MI_PARTITION_MODWRITES_MI_PARTITION_STORES_MI_VAD_EVENT_BLOCK_MI_WORKING_SET_CONTROL_MMINPAGE_SUPPORT_NONOPAQUE_OPLOCK_POP_IRP_WORKER_ENTRY_POP_SHUTDOWN_BUG_CHECK_PSP_CRITICAL_PROCESS_DEATH_INFO_1_RH_OP_CONTEXT_VF_KE_CRITICAL_REGION_TRACE_VF_POOL_TRACE_VI_FAULT_TRACE_WMI_LOGGER_CONTEXT_WORK_QUEUE_ENTRY