KTHREAD (Early 5.2)

The KTHREAD structure is the Kernel Core’s portion of the ETHREAD structure. The latter is the thread object as exposed through the Object Manager. The KTHREAD is the core of it.

Variability

The KTHREAD structure is plainly internal to the kernel and its layout varies greatly between Windows versions and even between builds. Indeed, it is the most highly variable of all significant kernel-mode structures—so much so that tracking its history looks to be imposisble on one page and is therefore spread over several:

• versions 3.10 to 3.50;
• versions 3.51 to 5.1;
• version 5.2 before SP1;
• versions 5.2 SP1 to 6.1;
• versions 6.2 and higher.

Through versions 3.51 to 5.1, the KTHREAD was relatively stable. Windows Server 2003, however, brought so many rearrangements, especially of small members, that tracking them from the earlier versions gets very messy—and then the very first service pack rearranged the structure at least as much all over again. This page lays out the KTHREAD just for the original build of version 5.2. Its size in this build is 0x01C8 bytes.

For each member that survives to the next build of version 5.2—only NpxIrql does not—the History column points the way to that member’s continuations (for 32-bit and 64-bit builds, respectively) on the separate page for late builds of version 5.2.

Layout

Offsets, types and names in the table that follows, are from Microsoft’s symbol files for the kernel.

It is well known that the KTHREAD is a kernel object that can be waited on until it gets signalled, as happens when the thread ends its execution. In the DISPATCHER_HEADER at the beginning of a KTHREAD, the Type is ThreadObject in the KOBJECTS enumeration. Version 5.2 started specialising this Header for thread objects, the DebugActive member having moved there (from offset 0x2C in version 5.1).

DISPATCHER_HEADER Header;

LIST_ENTRY MutantListHead;

PVOID InitialStack;

PVOID StackLimit;

PVOID KernelStack;

KSPIN_LOCK ThreadLock;

ULONG ContextSwitches;

UCHAR volatile State;

UCHAR NpxState;

KIRQL WaitIrql;

KPROCESSOR_MODE WaitMode;

PVOID Teb;

KAPC_STATE ApcState;

KSPIN_LOCK ApcQueueLock;

LONG WaitStatus;

KWAIT_BLOCK *WaitBlockList;

BOOLEAN Alertable;

BOOLEAN WaitNext;

UCHAR WaitReason;

CHAR Priority;

BOOLEAN EnableStackSwap;

UCHAR volatile SwapBusy;

BOOLEAN Alerted [2];

union {
    LIST_ENTRY WaitListEntry;
    SINGLE_LIST_ENTRY SwapListEntry;
};

KQUEUE *Queue;

ULONG WaitTime;

union {
    struct {
        SHORT KernelApcDisable;
        SHORT SpecialApcDisable;
    };
    ULONG CombinedApcDisable;
};

KTIMER Timer;

KWAIT_BLOCK WaitBlock [4];

LIST_ENTRY QueueListEntry;

UCHAR ApcStateIndex;

BOOLEAN ApcQueueable;

BOOLEAN Preempted;

BOOLEAN ProcessReadyQueue;

BOOLEAN KernelStackResident;

CHAR Saturation;

UCHAR IdealProcessor;

UCHAR NextProcessor;

CHAR BasePriority;

UCHAR Spare4;

CHAR PriorityDecrement;

CHAR Quantum;

BOOLEAN SystemAffinityActive;

KPROCESSOR_MODE PreviousMode;

UCHAR ResourceIndex;

BOOLEAN DisableBoost;

KAFFINITY UserAffinity;

KPROCESS *Process;

KAFFINITY Affinity;

PVOID ServiceTable;

KAPC_STATE *ApcStatePointer [2];

KAPC_STATE SavedApcState;

PVOID CallbackStack;

PVOID Win32Thread;

KTRAP_FRAME *TrapFrame;

ULONG KernelTime;

ULONG UserTime;

PVOID StackBase;

KAPC SuspendApc;

KSEMAPHORE SuspendSemaphore;

PVOID TlsArray;

PVOID LegoData;

LIST_ENTRY ThreadListEntry;

BOOLEAN LargeStack;

UCHAR PowerState;

KIRQL NpxIrql;

UCHAR Spare5;

UCHAR AutoAlignment;

UCHAR Iopl;

CHAR FreezeCount;

CHAR SuspendCount;

UCHAR Spare0 [1];

UCHAR UserIdealProcessor;

UCHAR volatile DeferredProcessor;

UCHAR AdjustReason;

CHAR AdjustIncrement;

UCHAR Spare2 [3];