typedef struct _ETHREAD                                          // 61 elements, 0x410 bytes (sizeof)
          {
/*0x000*/     struct _KTHREAD Tcb;                                         // 106 elements, 0x308 bytes (sizeof)
/*0x308*/     union _LARGE_INTEGER CreateTime;                             // 4 elements, 0x8 bytes (sizeof)
              union                                                        // 3 elements, 0x10 bytes (sizeof)
              {
/*0x310*/         union _LARGE_INTEGER ExitTime;                           // 4 elements, 0x8 bytes (sizeof)
/*0x310*/         struct _LIST_ENTRY LpcReplyChain;                        // 2 elements, 0x10 bytes (sizeof)
/*0x310*/         struct _LIST_ENTRY KeyedWaitChain;                       // 2 elements, 0x10 bytes (sizeof)
              };
              union                                                        // 2 elements, 0x8 bytes (sizeof)
              {
/*0x320*/         LONG32       ExitStatus;
/*0x320*/         VOID*        OfsChain;
              };
/*0x328*/     struct _LIST_ENTRY PostBlockList;                            // 2 elements, 0x10 bytes (sizeof)
              union                                                        // 3 elements, 0x8 bytes (sizeof)
              {
/*0x338*/         struct _TERMINATION_PORT* TerminationPort;
/*0x338*/         struct _ETHREAD* ReaperLink;
/*0x338*/         VOID*        KeyedWaitValue;
              };
/*0x340*/     UINT64       ActiveTimerListLock;
/*0x348*/     struct _LIST_ENTRY ActiveTimerListHead;                      // 2 elements, 0x10 bytes (sizeof)
/*0x358*/     struct _CLIENT_ID Cid;                                       // 2 elements, 0x10 bytes (sizeof)
              union                                                        // 2 elements, 0x20 bytes (sizeof)
              {
/*0x368*/         struct _KSEMAPHORE LpcReplySemaphore;                    // 2 elements, 0x20 bytes (sizeof)
/*0x368*/         struct _KSEMAPHORE KeyedWaitSemaphore;                   // 2 elements, 0x20 bytes (sizeof)
              };
              union                                                        // 2 elements, 0x8 bytes (sizeof)
              {
/*0x388*/         VOID*        LpcReplyMessage;
/*0x388*/         VOID*        LpcWaitingOnPort;
              };
/*0x390*/     struct _PS_IMPERSONATION_INFORMATION* ImpersonationInfo;
/*0x398*/     struct _LIST_ENTRY IrpList;                                  // 2 elements, 0x10 bytes (sizeof)
/*0x3A8*/     UINT64       TopLevelIrp;
/*0x3B0*/     struct _DEVICE_OBJECT* DeviceToVerify;
/*0x3B8*/     struct _EPROCESS* ThreadsProcess;
/*0x3C0*/     VOID*        StartAddress;
              union                                                        // 2 elements, 0x8 bytes (sizeof)
              {
/*0x3C8*/         VOID*        Win32StartAddress;
/*0x3C8*/         ULONG32      LpcReceivedMessageId;
              };
/*0x3D0*/     struct _LIST_ENTRY ThreadListEntry;                          // 2 elements, 0x10 bytes (sizeof)
/*0x3E0*/     struct _EX_RUNDOWN_REF RundownProtect;                       // 2 elements, 0x8 bytes (sizeof)
/*0x3E8*/     struct _EX_PUSH_LOCK ThreadLock;                             // 7 elements, 0x8 bytes (sizeof)
/*0x3F0*/     ULONG32      LpcReplyMessageId;
/*0x3F4*/     ULONG32      ReadClusterSize;
/*0x3F8*/     ULONG32      GrantedAccess;
              union                                                        // 2 elements, 0x4 bytes (sizeof)
              {
/*0x3FC*/         ULONG32      CrossThreadFlags;
                  struct                                                   // 9 elements, 0x4 bytes (sizeof)
                  {
/*0x3FC*/             ULONG32      Terminated : 1;                         // 0 BitPosition
/*0x3FC*/             ULONG32      DeadThread : 1;                         // 1 BitPosition
/*0x3FC*/             ULONG32      HideFromDebugger : 1;                   // 2 BitPosition
/*0x3FC*/             ULONG32      ActiveImpersonationInfo : 1;            // 3 BitPosition
/*0x3FC*/             ULONG32      SystemThread : 1;                       // 4 BitPosition
/*0x3FC*/             ULONG32      HardErrorsAreDisabled : 1;              // 5 BitPosition
/*0x3FC*/             ULONG32      BreakOnTermination : 1;                 // 6 BitPosition
/*0x3FC*/             ULONG32      SkipCreationMsg : 1;                    // 7 BitPosition
/*0x3FC*/             ULONG32      SkipTerminationMsg : 1;                 // 8 BitPosition
                  };
              };
              union                                                        // 2 elements, 0x4 bytes (sizeof)
              {
/*0x400*/         ULONG32      SameThreadPassiveFlags;
                  struct                                                   // 4 elements, 0x4 bytes (sizeof)
                  {
/*0x400*/             ULONG32      ActiveExWorker : 1;                     // 0 BitPosition
/*0x400*/             ULONG32      ExWorkerCanWaitUser : 1;                // 1 BitPosition
/*0x400*/             ULONG32      MemoryMaker : 1;                        // 2 BitPosition
/*0x400*/             ULONG32      KeyedEventInUse : 1;                    // 3 BitPosition
                  };
              };
              union                                                        // 2 elements, 0x4 bytes (sizeof)
              {
/*0x404*/         ULONG32      SameThreadApcFlags;
                  struct                                                   // 2 elements, 0x4 bytes (sizeof)
                  {
                      struct                                               // 8 elements, 0x1 bytes (sizeof)
                      {
/*0x404*/                 UINT8        LpcReceivedMsgIdValid : 1;          // 0 BitPosition
/*0x404*/                 UINT8        LpcExitThreadCalled : 1;            // 1 BitPosition
/*0x404*/                 UINT8        AddressSpaceOwner : 1;              // 2 BitPosition
/*0x404*/                 UINT8        OwnsProcessWorkingSetExclusive : 1; // 3 BitPosition
/*0x404*/                 UINT8        OwnsProcessWorkingSetShared : 1;    // 4 BitPosition
/*0x404*/                 UINT8        OwnsSystemWorkingSetExclusive : 1;  // 5 BitPosition
/*0x404*/                 UINT8        OwnsSystemWorkingSetShared : 1;     // 6 BitPosition
/*0x404*/                 UINT8        OwnsSessionWorkingSetExclusive : 1; // 7 BitPosition
                      };
                      struct                                               // 2 elements, 0x1 bytes (sizeof)
                      {
/*0x405*/                 UINT8        OwnsSessionWorkingSetShared : 1;    // 0 BitPosition
/*0x405*/                 UINT8        ApcNeeded : 1;                      // 1 BitPosition
                      };
                  };
              };
/*0x408*/     UINT8        ForwardClusterOnly;
/*0x409*/     UINT8        DisablePageFaultClustering;
/*0x40A*/     UINT8        ActiveFaultCount;
/*0x40B*/     UINT8        _PADDING0_[0x5];
          }ETHREAD, *PETHREAD;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.