typedef struct _KTHREAD { DISPATCHER_HEADER Header; volatile unsigned __int64 CycleTime; unsigned __int64 QuantumTarget; void *InitialStack; void *StackLimit; void *KernelStack; unsigned __int64 ThreadLock; KWAIT_STATUS_REGISTER WaitRegister; volatile unsigned char Running; unsigned char Alerted[2]; union { struct { unsigned long KernelStackResident : 1; unsigned long ReadyTransition : 1; unsigned long ProcessReadyQueue : 1; unsigned long WaitNext : 1; unsigned long SystemAffinityActive : 1; unsigned long Alertable : 1; unsigned long GdiFlushActive : 1; unsigned long UserStackWalkActive : 1; unsigned long ApcInterruptRequest : 1; unsigned long ForceDeferSchedule : 1; unsigned long QuantumEndMigrate : 1; unsigned long UmsDirectedSwitchEnable : 1; unsigned long TimerActive : 1; unsigned long SystemThread : 1; unsigned long Reserved : 18; }; long MiscFlags; }; union { KAPC_STATE ApcState; struct { unsigned char ApcStateFill[43]; char Priority; volatile unsigned long NextProcessor; }; }; volatile unsigned long DeferredProcessor; unsigned __int64 ApcQueueLock; volatile __int64 WaitStatus; KWAIT_BLOCK *WaitBlockList; union { LIST_ENTRY WaitListEntry; SINGLE_LIST_ENTRY SwapListEntry; }; KQUEUE *Queue; void *Teb; KTIMER Timer; union { struct { volatile unsigned long AutoAlignment : 1; volatile unsigned long DisableBoost : 1; volatile unsigned long EtwStackTraceApc1Inserted : 1; volatile unsigned long EtwStackTraceApc2Inserted : 1; volatile unsigned long CalloutActive : 1; volatile unsigned long ApcQueueable : 1; volatile unsigned long EnableStackSwap : 1; volatile unsigned long GuiThread : 1; volatile unsigned long UmsPerformingSyscall : 1; volatile unsigned long VdmSafe : 1; volatile unsigned long UmsDispatched : 1; volatile unsigned long ReservedFlags : 21; }; volatile long ThreadFlags; }; unsigned long Spare0; union { KWAIT_BLOCK WaitBlock[4]; struct { unsigned char WaitBlockFill4[44]; unsigned long ContextSwitches; }; struct { unsigned char WaitBlockFill5[92]; volatile unsigned char State; char NpxState; unsigned char WaitIrql; char WaitMode; }; struct { unsigned char WaitBlockFill6[140]; unsigned long WaitTime; }; struct { unsigned char WaitBlockFill7[168]; void *TebMappedLowVa; UMS_CONTROL_BLOCK *Ucb; }; struct { unsigned char WaitBlockFill8[188]; union { struct { short KernelApcDisable; short SpecialApcDisable; }; unsigned long CombinedApcDisable; }; }; }; LIST_ENTRY QueueListEntry; KTRAP_FRAME *TrapFrame; void *FirstArgument; union { void *CallbackStack; unsigned __int64 CallbackDepth; }; unsigned char ApcStateIndex; char BasePriority; union { char PriorityDecrement; struct { unsigned char ForegroundBoost : 4; unsigned char UnusualBoost : 4; }; }; unsigned char Preempted; unsigned char AdjustReason; char AdjustIncrement; char PreviousMode; char Saturation; unsigned long SystemCallNumber; unsigned long FreezeCount; GROUP_AFFINITY UserAffinity; KPROCESS *Process; GROUP_AFFINITY Affinity; unsigned long IdealProcessor; unsigned long UserIdealProcessor; KAPC_STATE *ApcStatePointer[2]; union { KAPC_STATE SavedApcState; struct { unsigned char SavedApcStateFill[43]; unsigned char WaitReason; char SuspendCount; char Spare1; unsigned char CodePatchInProgress; }; }; void *Win32Thread; void *StackBase; union { KAPC SuspendApc; struct { unsigned char SuspendApcFill0[1]; unsigned char ResourceIndex; }; struct { unsigned char SuspendApcFill1[3]; unsigned char QuantumReset; }; struct { unsigned char SuspendApcFill2[4]; unsigned long KernelTime; }; struct { unsigned char SuspendApcFill3[64]; KPRCB *WaitPrcb; }; struct { unsigned char SuspendApcFill4[72]; void *LegoData; }; struct { unsigned char SuspendApcFill5[83]; unsigned char LargeStack; unsigned long UserTime; }; }; union { KSEMAPHORE SuspendSemaphore; struct { unsigned char SuspendSemaphorefill[28]; unsigned long SListFaultCount; }; }; LIST_ENTRY ThreadListEntry; LIST_ENTRY MutantListHead; void *SListFaultAddress; __int64 ReadOperationCount; __int64 WriteOperationCount; __int64 OtherOperationCount; __int64 ReadTransferCount; __int64 WriteTransferCount; __int64 OtherTransferCount; KTHREAD_COUNTERS *ThreadCounters; XSAVE_FORMAT *StateSaveArea; XSTATE_SAVE *XStateSave; } KTHREAD, *PKTHREAD;