struct _ETHREAD { struct _KTHREAD Tcb;/* 0x0 640 */ /* ── cacheline 10 boundary (640 bytes) ── */ union _LARGE_INTEGER CreateTime;/* 0x280 8 */ union { union _LARGE_INTEGER ExitTime;/* 0x288 8 */ struct _LIST_ENTRY KeyedWaitChain;/* 0x288 8 */ };/* 0x288 8 */ void* ChargeOnlySession;/* 0x290 4 */ union { struct _LIST_ENTRY PostBlockList;/* 0x294 8 */ struct { void* ForwardLinkShadow;/* 0x294 4 */ void* StartAddress;/* 0x298 4 */ };/* 0x294 8 */ };/* 0x294 8 */ union { struct _TERMINATION_PORT* TerminationPort;/* 0x29c 4 */ struct _ETHREAD* ReaperLink;/* 0x29c 4 */ void* KeyedWaitValue;/* 0x29c 4 */ };/* 0x29c 4 */ unsigned long ActiveTimerListLock;/* 0x2a0 4 */ struct _LIST_ENTRY ActiveTimerListHead;/* 0x2a4 8 */ struct _CLIENT_ID Cid;/* 0x2ac 8 */ union { struct _KSEMAPHORE KeyedWaitSemaphore;/* 0x2b4 20 */ struct _KSEMAPHORE AlpcWaitSemaphore;/* 0x2b4 20 */ };/* 0x2b4 20 */ /* ── cacheline 11 boundary (704 bytes) ── */ union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;/* 0x2c8 4 */ struct _LIST_ENTRY IrpList;/* 0x2cc 8 */ unsigned long TopLevelIrp;/* 0x2d4 4 */ struct _DEVICE_OBJECT* DeviceToVerify;/* 0x2d8 4 */ void* Win32StartAddress;/* 0x2dc 4 */ void* LegacyPowerObject;/* 0x2e0 4 */ struct _LIST_ENTRY ThreadListEntry;/* 0x2e4 8 */ struct _EX_RUNDOWN_REF RundownProtect;/* 0x2ec 4 */ struct _EX_PUSH_LOCK ThreadLock;/* 0x2f0 4 */ unsigned long ReadClusterSize;/* 0x2f4 4 */ volatile long MmLockOrdering;/* 0x2f8 4 */ union { unsigned long CrossThreadFlags;/* 0x2fc 4 */ struct { unsigned long Terminated : 1;/* 0x2fc:0 4 */ unsigned long ThreadInserted : 1;/* 0x2fc:1 4 */ unsigned long HideFromDebugger : 1;/* 0x2fc:2 4 */ unsigned long ActiveImpersonationInfo : 1;/* 0x2fc:3 4 */ unsigned long HardErrorsAreDisabled : 1;/* 0x2fc:4 4 */ unsigned long BreakOnTermination : 1;/* 0x2fc:5 4 */ unsigned long SkipCreationMsg : 1;/* 0x2fc:6 4 */ unsigned long SkipTerminationMsg : 1;/* 0x2fc:7 4 */ unsigned long CopyTokenOnOpen : 1;/* 0x2fc:8 4 */ unsigned long ThreadIoPriority : 3;/* 0x2fc:9 4 */ unsigned long ThreadPagePriority : 3;/* 0x2fc:12 4 */ unsigned long RundownFail : 1;/* 0x2fc:15 4 */ unsigned long UmsForceQueueTermination : 1;/* 0x2fc:16 4 */ unsigned long IndirectCpuSets : 1;/* 0x2fc:17 4 */ unsigned long DisableDynamicCodeOptOut : 1;/* 0x2fc:18 4 */ unsigned long ExplicitCaseSensitivity : 1;/* 0x2fc:19 4 */ unsigned long PicoNotifyExit : 1;/* 0x2fc:20 4 */ unsigned long DbgWerUserReportActive : 1;/* 0x2fc:21 4 */ unsigned long ForcedSelfTrimActive : 1;/* 0x2fc:22 4 */ unsigned long SamplingCoverage : 1;/* 0x2fc:23 4 */ unsigned long ReservedCrossThreadFlags : 8;/* 0x2fc:24 4 */ };/* 0x2fc 4 */ };/* 0x2fc 4 */ /* ── cacheline 12 boundary (768 bytes) ── */ union { unsigned long SameThreadPassiveFlags;/* 0x300 4 */ struct { unsigned long ActiveExWorker : 1;/* 0x300:0 4 */ unsigned long MemoryMaker : 1;/* 0x300:1 4 */ unsigned long StoreLockThread : 2;/* 0x300:2 4 */ unsigned long ClonedThread : 1;/* 0x300:4 4 */ unsigned long KeyedEventInUse : 1;/* 0x300:5 4 */ unsigned long SelfTerminate : 1;/* 0x300:6 4 */ unsigned long RespectIoPriority : 1;/* 0x300:7 4 */ unsigned long ActivePageLists : 1;/* 0x300:8 4 */ unsigned long SecureContext : 1;/* 0x300:9 4 */ unsigned long ZeroPageThread : 1;/* 0x300:10 4 */ unsigned long WorkloadClass : 1;/* 0x300:11 4 */ unsigned long ReservedSameThreadPassiveFlags : 20;/* 0x300:12 4 */ };/* 0x300 4 */ };/* 0x300 4 */ union { unsigned long SameThreadApcFlags;/* 0x304 4 */ struct { unsigned char OwnsProcessAddressSpaceExclusive : 1;/* 0x304:0 1 */ unsigned char OwnsProcessAddressSpaceShared : 1;/* 0x304:1 1 */ unsigned char HardFaultBehavior : 1;/* 0x304:2 1 */ volatile unsigned char StartAddressInvalid : 1;/* 0x304:3 1 */ unsigned char EtwCalloutActive : 1;/* 0x304:4 1 */ unsigned char SuppressSymbolLoad : 1;/* 0x304:5 1 */ unsigned char Prefetching : 1;/* 0x304:6 1 */ unsigned char OwnsVadExclusive : 1;/* 0x304:7 1 */ unsigned char SystemPagePriorityActive : 1;/* 0x305:0 1 */ unsigned char SystemPagePriority : 3;/* 0x305:1 1 */ unsigned char AllowUserWritesToExecutableMemory : 1;/* 0x305:4 1 */ unsigned char AllowKernelWritesToExecutableMemory : 1;/* 0x305:5 1 */ unsigned char OwnsVadShared : 1;/* 0x305:6 1 */ };/* 0x304 2 */ };/* 0x304 4 */ unsigned char CacheManagerActive;/* 0x308 1 */ unsigned char DisablePageFaultClustering;/* 0x309 1 */ unsigned char ActiveFaultCount;/* 0x30a 1 */ unsigned char LockOrderState;/* 0x30b 1 */ unsigned long PerformanceCountLowReserved;/* 0x30c 4 */ long PerformanceCountHighReserved;/* 0x310 4 */ unsigned long AlpcMessageId;/* 0x314 4 */ union { void* AlpcMessage;/* 0x318 4 */ unsigned long AlpcReceiveAttributeSet;/* 0x318 4 */ };/* 0x318 4 */ struct _LIST_ENTRY AlpcWaitListEntry;/* 0x31c 8 */ long ExitStatus;/* 0x324 4 */ unsigned long CacheManagerCount;/* 0x328 4 */ unsigned long IoBoostCount;/* 0x32c 4 */ unsigned long IoQoSBoostCount;/* 0x330 4 */ unsigned long IoQoSThrottleCount;/* 0x334 4 */ unsigned long KernelStackReference;/* 0x338 4 */ struct _LIST_ENTRY BoostList;/* 0x33c 8 */ /* ── cacheline 13 boundary (832 bytes) ── */ struct _LIST_ENTRY DeboostList;/* 0x344 8 */ unsigned long BoostListLock;/* 0x34c 4 */ unsigned long IrpListLock;/* 0x350 4 */ void* ReservedForSynchTracking;/* 0x354 4 */ struct _SINGLE_LIST_ENTRY CmCallbackListHead;/* 0x358 4 */ const struct _GUID* ActivityId;/* 0x35c 4 */ struct _SINGLE_LIST_ENTRY SeLearningModeListHead;/* 0x360 4 */ void* VerifierContext;/* 0x364 4 */ void* AdjustedClientToken;/* 0x368 4 */ void* WorkOnBehalfThread;/* 0x36c 4 */ struct _PS_PROPERTY_SET PropertySet;/* 0x370 12 */ void* PicoContext;/* 0x37c 4 */ /* ── cacheline 14 boundary (896 bytes) ── */ unsigned long UserFsBase;/* 0x380 4 */ unsigned long UserGsBase;/* 0x384 4 */ struct _THREAD_ENERGY_VALUES* EnergyValues;/* 0x388 4 */ union { unsigned long SelectedCpuSets;/* 0x38c 4 */ unsigned long* SelectedCpuSetsIndirect;/* 0x38c 4 */ };/* 0x38c 4 */ struct _EJOB* Silo;/* 0x390 4 */ struct _UNICODE_STRING* ThreadName;/* 0x394 4 */ void* SparePointer;/* 0x398 4 */ unsigned long LastExpectedRunTime;/* 0x39c 4 */ unsigned long HeapData;/* 0x3a0 4 */ struct _LIST_ENTRY OwnerEntryListHead;/* 0x3a4 8 */ unsigned long DisownedOwnerEntryListLock;/* 0x3ac 4 */ struct _LIST_ENTRY DisownedOwnerEntryListHead;/* 0x3b0 8 */ struct _KLOCK_ENTRY LockEntries[6];/* 0x3b8 288 */ /* ── cacheline 19 boundary (1216 bytes) ── */ void* CmDbgInfo;/* 0x4d8 4 */};size 1248 (0x4e0)120 members0 holespadding 420 cachelines
Used in (28)
_ALPC_DISPATCH_CONTEXT_CC_PARTITION_CM_DIRTY_VECTOR_LOG_ENTRY_EPROCESS_ETW_GUID_ENTRY_ETW_STACK_TRACE_BLOCK_HIVE_WRITE_WAIT_QUEUE_IOV_FORCED_PENDING_TRACE_IO_WORKITEM_IRP_KALPC_MESSAGE_LPCP_MESSAGE_LPCP_PORT_OBJECT_MI_PARTITION_MODWRITES_MI_PARTITION_STORES_MI_SHUTDOWN_STATE_MI_SYSTEM_IMAGE_STATE_MI_VAD_EVENT_BLOCK_MMINPAGE_SUPPORT_NONOPAQUE_OPLOCK_POP_IRP_WORKER_ENTRY_POP_SHUTDOWN_BUG_CHECK_RH_OP_CONTEXT_VF_KE_CRITICAL_REGION_TRACE_VF_POOL_TRACE_VI_FAULT_TRACE_WMI_LOGGER_CONTEXT_WORK_QUEUE_ENTRY