typedef struct _ETHREAD                                              // 88 elements, 0x2B8 bytes (sizeof)
          {
/*0x000*/     struct _KTHREAD Tcb;                                             // 114 elements, 0x200 bytes (sizeof)
/*0x200*/     union _LARGE_INTEGER CreateTime;                                 // 4 elements, 0x8 bytes (sizeof)
              union                                                            // 2 elements, 0x8 bytes (sizeof)
              {
/*0x208*/         union _LARGE_INTEGER ExitTime;                               // 4 elements, 0x8 bytes (sizeof)
/*0x208*/         struct _LIST_ENTRY KeyedWaitChain;                           // 2 elements, 0x8 bytes (sizeof)
              };
/*0x210*/     LONG32       ExitStatus;
              union                                                            // 2 elements, 0x8 bytes (sizeof)
              {
/*0x214*/         struct _LIST_ENTRY PostBlockList;                            // 2 elements, 0x8 bytes (sizeof)
                  struct                                                       // 2 elements, 0x8 bytes (sizeof)
                  {
/*0x214*/             VOID*        ForwardLinkShadow;
/*0x218*/             VOID*        StartAddress;
                  };
              };
              union                                                            // 3 elements, 0x4 bytes (sizeof)
              {
/*0x21C*/         struct _TERMINATION_PORT* TerminationPort;
/*0x21C*/         struct _ETHREAD* ReaperLink;
/*0x21C*/         VOID*        KeyedWaitValue;
              };
/*0x220*/     ULONG32      ActiveTimerListLock;
/*0x224*/     struct _LIST_ENTRY ActiveTimerListHead;                          // 2 elements, 0x8 bytes (sizeof)
/*0x22C*/     struct _CLIENT_ID Cid;                                           // 2 elements, 0x8 bytes (sizeof)
              union                                                            // 2 elements, 0x14 bytes (sizeof)
              {
/*0x234*/         struct _KSEMAPHORE KeyedWaitSemaphore;                       // 2 elements, 0x14 bytes (sizeof)
/*0x234*/         struct _KSEMAPHORE AlpcWaitSemaphore;                        // 2 elements, 0x14 bytes (sizeof)
              };
/*0x248*/     union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;                // 4 elements, 0x4 bytes (sizeof)
/*0x24C*/     struct _LIST_ENTRY IrpList;                                      // 2 elements, 0x8 bytes (sizeof)
/*0x254*/     ULONG32      TopLevelIrp;
/*0x258*/     struct _DEVICE_OBJECT* DeviceToVerify;
/*0x25C*/     union _PSP_CPU_QUOTA_APC* CpuQuotaApc;
/*0x260*/     VOID*        Win32StartAddress;
/*0x264*/     VOID*        LegacyPowerObject;
/*0x268*/     struct _LIST_ENTRY ThreadListEntry;                              // 2 elements, 0x8 bytes (sizeof)
/*0x270*/     struct _EX_RUNDOWN_REF RundownProtect;                           // 2 elements, 0x4 bytes (sizeof)
/*0x274*/     struct _EX_PUSH_LOCK ThreadLock;                                 // 7 elements, 0x4 bytes (sizeof)
/*0x278*/     ULONG32      ReadClusterSize;
/*0x27C*/     LONG32       MmLockOrdering;
              union                                                            // 2 elements, 0x4 bytes (sizeof)
              {
/*0x280*/         ULONG32      CrossThreadFlags;
                  struct                                                       // 14 elements, 0x4 bytes (sizeof)
                  {
/*0x280*/             ULONG32      Terminated : 1;                             // 0 BitPosition
/*0x280*/             ULONG32      ThreadInserted : 1;                         // 1 BitPosition
/*0x280*/             ULONG32      HideFromDebugger : 1;                       // 2 BitPosition
/*0x280*/             ULONG32      ActiveImpersonationInfo : 1;                // 3 BitPosition
/*0x280*/             ULONG32      SystemThread : 1;                           // 4 BitPosition
/*0x280*/             ULONG32      HardErrorsAreDisabled : 1;                  // 5 BitPosition
/*0x280*/             ULONG32      BreakOnTermination : 1;                     // 6 BitPosition
/*0x280*/             ULONG32      SkipCreationMsg : 1;                        // 7 BitPosition
/*0x280*/             ULONG32      SkipTerminationMsg : 1;                     // 8 BitPosition
/*0x280*/             ULONG32      CopyTokenOnOpen : 1;                        // 9 BitPosition
/*0x280*/             ULONG32      ThreadIoPriority : 3;                       // 10 BitPosition
/*0x280*/             ULONG32      ThreadPagePriority : 3;                     // 13 BitPosition
/*0x280*/             ULONG32      RundownFail : 1;                            // 16 BitPosition
/*0x280*/             ULONG32      NeedsWorkingSetAging : 1;                   // 17 BitPosition
                  };
              };
              union                                                            // 2 elements, 0x4 bytes (sizeof)
              {
/*0x284*/         ULONG32      SameThreadPassiveFlags;
                  struct                                                       // 7 elements, 0x4 bytes (sizeof)
                  {
/*0x284*/             ULONG32      ActiveExWorker : 1;                         // 0 BitPosition
/*0x284*/             ULONG32      ExWorkerCanWaitUser : 1;                    // 1 BitPosition
/*0x284*/             ULONG32      MemoryMaker : 1;                            // 2 BitPosition
/*0x284*/             ULONG32      ClonedThread : 1;                           // 3 BitPosition
/*0x284*/             ULONG32      KeyedEventInUse : 1;                        // 4 BitPosition
/*0x284*/             ULONG32      RateApcState : 2;                           // 5 BitPosition
/*0x284*/             ULONG32      SelfTerminate : 1;                          // 7 BitPosition
                  };
              };
              union                                                            // 2 elements, 0x4 bytes (sizeof)
              {
/*0x288*/         ULONG32      SameThreadApcFlags;
                  struct                                                       // 4 elements, 0x4 bytes (sizeof)
                  {
                      struct                                                   // 8 elements, 0x1 bytes (sizeof)
                      {
/*0x288*/                 UINT8        Spare : 1;                              // 0 BitPosition
/*0x288*/                 UINT8        StartAddressInvalid : 1;                // 1 BitPosition
/*0x288*/                 UINT8        EtwPageFaultCalloutActive : 1;          // 2 BitPosition
/*0x288*/                 UINT8        OwnsProcessWorkingSetExclusive : 1;     // 3 BitPosition
/*0x288*/                 UINT8        OwnsProcessWorkingSetShared : 1;        // 4 BitPosition
/*0x288*/                 UINT8        OwnsSystemCacheWorkingSetExclusive : 1; // 5 BitPosition
/*0x288*/                 UINT8        OwnsSystemCacheWorkingSetShared : 1;    // 6 BitPosition
/*0x288*/                 UINT8        OwnsSessionWorkingSetExclusive : 1;     // 7 BitPosition
                      };
                      struct                                                   // 8 elements, 0x1 bytes (sizeof)
                      {
/*0x289*/                 UINT8        OwnsSessionWorkingSetShared : 1;        // 0 BitPosition
/*0x289*/                 UINT8        OwnsProcessAddressSpaceExclusive : 1;   // 1 BitPosition
/*0x289*/                 UINT8        OwnsProcessAddressSpaceShared : 1;      // 2 BitPosition
/*0x289*/                 UINT8        SuppressSymbolLoad : 1;                 // 3 BitPosition
/*0x289*/                 UINT8        Prefetching : 1;                        // 4 BitPosition
/*0x289*/                 UINT8        OwnsDynamicMemoryShared : 1;            // 5 BitPosition
/*0x289*/                 UINT8        OwnsChangeControlAreaExclusive : 1;     // 6 BitPosition
/*0x289*/                 UINT8        OwnsChangeControlAreaShared : 1;        // 7 BitPosition
                      };
                      struct                                                   // 6 elements, 0x1 bytes (sizeof)
                      {
/*0x28A*/                 UINT8        OwnsPagedPoolWorkingSetExclusive : 1;   // 0 BitPosition
/*0x28A*/                 UINT8        OwnsPagedPoolWorkingSetShared : 1;      // 1 BitPosition
/*0x28A*/                 UINT8        OwnsSystemPtesWorkingSetExclusive : 1;  // 2 BitPosition
/*0x28A*/                 UINT8        OwnsSystemPtesWorkingSetShared : 1;     // 3 BitPosition
/*0x28A*/                 UINT8        TrimTrigger : 2;                        // 4 BitPosition
/*0x28A*/                 UINT8        Spare1 : 2;                             // 6 BitPosition
                      };
/*0x28B*/             UINT8        PriorityRegionActive;
                  };
              };
/*0x28C*/     UINT8        CacheManagerActive;
/*0x28D*/     UINT8        DisablePageFaultClustering;
/*0x28E*/     UINT8        ActiveFaultCount;
/*0x28F*/     UINT8        LockOrderState;
/*0x290*/     ULONG32      AlpcMessageId;
              union                                                            // 2 elements, 0x4 bytes (sizeof)
              {
/*0x294*/         VOID*        AlpcMessage;
/*0x294*/         ULONG32      AlpcReceiveAttributeSet;
              };
/*0x298*/     struct _LIST_ENTRY AlpcWaitListEntry;                            // 2 elements, 0x8 bytes (sizeof)
/*0x2A0*/     ULONG32      CacheManagerCount;
/*0x2A4*/     ULONG32      IoBoostCount;
/*0x2A8*/     ULONG32      IrpListLock;
/*0x2AC*/     VOID*        ReservedForSynchTracking;
/*0x2B0*/     struct _SINGLE_LIST_ENTRY CmCallbackListHead;                    // 1 elements, 0x4 bytes (sizeof)
/*0x2B4*/     UINT8        _PADDING0_[0x4];
          }ETHREAD, *PETHREAD;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.