typedef struct _ETHREAD                                            // 79 elements, 0x450 bytes (sizeof)
          {
/*0x000*/     struct _KTHREAD Tcb;                                           // 123 elements, 0x330 bytes (sizeof)
/*0x330*/     union _LARGE_INTEGER CreateTime;                               // 4 elements, 0x8 bytes (sizeof)
              union                                                          // 2 elements, 0x10 bytes (sizeof)
              {
/*0x338*/         union _LARGE_INTEGER ExitTime;                             // 4 elements, 0x8 bytes (sizeof)
/*0x338*/         struct _LIST_ENTRY KeyedWaitChain;                         // 2 elements, 0x10 bytes (sizeof)
              };
              union                                                          // 2 elements, 0x8 bytes (sizeof)
              {
/*0x348*/         LONG32       ExitStatus;
/*0x348*/         VOID*        OfsChain;
              };
              union                                                          // 2 elements, 0x10 bytes (sizeof)
              {
/*0x350*/         struct _LIST_ENTRY PostBlockList;                          // 2 elements, 0x10 bytes (sizeof)
                  struct                                                     // 2 elements, 0x10 bytes (sizeof)
                  {
/*0x350*/             VOID*        ForwardLinkShadow;
/*0x358*/             VOID*        StartAddress;
                  };
              };
              union                                                          // 4 elements, 0x8 bytes (sizeof)
              {
/*0x360*/         struct _TERMINATION_PORT* TerminationPort;
/*0x360*/         struct _ETHREAD* ReaperLink;
/*0x360*/         VOID*        KeyedWaitValue;
/*0x360*/         VOID*        Win32StartParameter;
              };
/*0x368*/     UINT64       ActiveTimerListLock;
/*0x370*/     struct _LIST_ENTRY ActiveTimerListHead;                        // 2 elements, 0x10 bytes (sizeof)
/*0x380*/     struct _CLIENT_ID Cid;                                         // 2 elements, 0x10 bytes (sizeof)
              union                                                          // 2 elements, 0x20 bytes (sizeof)
              {
/*0x390*/         struct _KSEMAPHORE KeyedWaitSemaphore;                     // 2 elements, 0x20 bytes (sizeof)
/*0x390*/         struct _KSEMAPHORE AlpcWaitSemaphore;                      // 2 elements, 0x20 bytes (sizeof)
              };
/*0x3B0*/     union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity;              // 4 elements, 0x8 bytes (sizeof)
/*0x3B8*/     struct _LIST_ENTRY IrpList;                                    // 2 elements, 0x10 bytes (sizeof)
/*0x3C8*/     UINT64       TopLevelIrp;
/*0x3D0*/     struct _DEVICE_OBJECT* DeviceToVerify;
/*0x3D8*/     union _PSP_RATE_APC* RateControlApc;
/*0x3E0*/     VOID*        Win32StartAddress;
/*0x3E8*/     VOID*        SparePtr0;
/*0x3F0*/     struct _LIST_ENTRY ThreadListEntry;                            // 2 elements, 0x10 bytes (sizeof)
/*0x400*/     struct _EX_RUNDOWN_REF RundownProtect;                         // 2 elements, 0x8 bytes (sizeof)
/*0x408*/     struct _EX_PUSH_LOCK ThreadLock;                               // 7 elements, 0x8 bytes (sizeof)
/*0x410*/     ULONG32      ReadClusterSize;
/*0x414*/     LONG32       MmLockOrdering;
              union                                                          // 2 elements, 0x4 bytes (sizeof)
              {
/*0x418*/         ULONG32      CrossThreadFlags;
                  struct                                                     // 13 elements, 0x4 bytes (sizeof)
                  {
/*0x418*/             ULONG32      Terminated : 1;                           // 0 BitPosition
/*0x418*/             ULONG32      ThreadInserted : 1;                       // 1 BitPosition
/*0x418*/             ULONG32      HideFromDebugger : 1;                     // 2 BitPosition
/*0x418*/             ULONG32      ActiveImpersonationInfo : 1;              // 3 BitPosition
/*0x418*/             ULONG32      SystemThread : 1;                         // 4 BitPosition
/*0x418*/             ULONG32      HardErrorsAreDisabled : 1;                // 5 BitPosition
/*0x418*/             ULONG32      BreakOnTermination : 1;                   // 6 BitPosition
/*0x418*/             ULONG32      SkipCreationMsg : 1;                      // 7 BitPosition
/*0x418*/             ULONG32      SkipTerminationMsg : 1;                   // 8 BitPosition
/*0x418*/             ULONG32      CopyTokenOnOpen : 1;                      // 9 BitPosition
/*0x418*/             ULONG32      ThreadIoPriority : 3;                     // 10 BitPosition
/*0x418*/             ULONG32      ThreadPagePriority : 3;                   // 13 BitPosition
/*0x418*/             ULONG32      RundownFail : 1;                          // 16 BitPosition
                  };
              };
              union                                                          // 2 elements, 0x4 bytes (sizeof)
              {
/*0x41C*/         ULONG32      SameThreadPassiveFlags;
                  struct                                                     // 7 elements, 0x4 bytes (sizeof)
                  {
/*0x41C*/             ULONG32      ActiveExWorker : 1;                       // 0 BitPosition
/*0x41C*/             ULONG32      ExWorkerCanWaitUser : 1;                  // 1 BitPosition
/*0x41C*/             ULONG32      MemoryMaker : 1;                          // 2 BitPosition
/*0x41C*/             ULONG32      ClonedThread : 1;                         // 3 BitPosition
/*0x41C*/             ULONG32      KeyedEventInUse : 1;                      // 4 BitPosition
/*0x41C*/             ULONG32      RateApcState : 2;                         // 5 BitPosition
/*0x41C*/             ULONG32      SelfTerminate : 1;                        // 7 BitPosition
                  };
              };
              union                                                          // 2 elements, 0x4 bytes (sizeof)
              {
/*0x420*/         ULONG32      SameThreadApcFlags;
                  struct                                                     // 4 elements, 0x4 bytes (sizeof)
                  {
                      struct                                                 // 8 elements, 0x1 bytes (sizeof)
                      {
/*0x420*/                 UINT8        Spare : 1;                            // 0 BitPosition
/*0x420*/                 UINT8        StartAddressInvalid : 1;              // 1 BitPosition
/*0x420*/                 UINT8        EtwPageFaultCalloutActive : 1;        // 2 BitPosition
/*0x420*/                 UINT8        OwnsProcessWorkingSetExclusive : 1;   // 3 BitPosition
/*0x420*/                 UINT8        OwnsProcessWorkingSetShared : 1;      // 4 BitPosition
/*0x420*/                 UINT8        OwnsSystemWorkingSetExclusive : 1;    // 5 BitPosition
/*0x420*/                 UINT8        OwnsSystemWorkingSetShared : 1;       // 6 BitPosition
/*0x420*/                 UINT8        OwnsSessionWorkingSetExclusive : 1;   // 7 BitPosition
                      };
                      struct                                                 // 8 elements, 0x1 bytes (sizeof)
                      {
/*0x421*/                 UINT8        OwnsSessionWorkingSetShared : 1;      // 0 BitPosition
/*0x421*/                 UINT8        OwnsProcessAddressSpaceExclusive : 1; // 1 BitPosition
/*0x421*/                 UINT8        OwnsProcessAddressSpaceShared : 1;    // 2 BitPosition
/*0x421*/                 UINT8        SuppressSymbolLoad : 1;               // 3 BitPosition
/*0x421*/                 UINT8        Prefetching : 1;                      // 4 BitPosition
/*0x421*/                 UINT8        OwnsDynamicMemoryShared : 1;          // 5 BitPosition
/*0x421*/                 UINT8        OwnsChangeControlAreaExclusive : 1;   // 6 BitPosition
/*0x421*/                 UINT8        OwnsChangeControlAreaShared : 1;      // 7 BitPosition
                      };
/*0x422*/             UINT8        Spare1 : 8;                               // 0 BitPosition
/*0x423*/             UINT8        PriorityRegionActive;
                  };
              };
/*0x424*/     UINT8        CacheManagerActive;
/*0x425*/     UINT8        DisablePageFaultClustering;
/*0x426*/     UINT8        ActiveFaultCount;
/*0x427*/     UINT8        _PADDING0_[0x1];
/*0x428*/     UINT64       AlpcMessageId;
              union                                                          // 2 elements, 0x8 bytes (sizeof)
              {
/*0x430*/         VOID*        AlpcMessage;
/*0x430*/         ULONG32      AlpcReceiveAttributeSet;
              };
/*0x438*/     struct _LIST_ENTRY AlpcWaitListEntry;                          // 2 elements, 0x10 bytes (sizeof)
/*0x448*/     ULONG32      CacheManagerCount;
/*0x44C*/     UINT8        _PADDING1_[0x4];
          }ETHREAD, *PETHREAD;
Return to structures/enums list.
Return to O.S. version list.

(c) MoonSols 2010.