Geoff Chappell - Software Analyst
From the very beginning of Windows, each thread has a one-byte summary of its state. The KTHREAD keeps this as its State member. Though this State is formally a UCHAR (and is volatile, starting with version 5.2), it takes its values from the KTHREAD_STATE enumeration.
Microsoft does not document the KTHREAD_STATE but Microsoft’s names and values are known from public symbol files for the kernel, starting with Windows Server 2003 (but excluding some versions, including Windows Server 2003 SP1 and Windows 7, for who knows what reason).
Value | Name | Versions |
---|---|---|
0x00 | Initialized | all |
0x01 | Ready | all |
0x02 | Running | all |
0x03 | Standby | all |
0x04 | Terminated | all |
0x05 | Waiting | all |
0x06 | Transition | all |
0x07 | DeferredReady | 5.2 and higher |
0x08 | GateWait | 5.2 SP1 and higher |
GateWaitObsolete | 6.2 and higher | |
0x09 | WaitingForProcessInSwap | 10.0 and higher |