Geoff Chappell - Software Analyst
Windows XP gave the ETHREAD three sets of bit fields. The set that is overlaid by the SameThreadPassiveFlags member, which is a ULONG for simultaneous access to all the bits described below, has moved around a little within the ETHREAD and some flags have shifted:
| Mask | Definition | Versions |
|---|---|---|
| 0x00000001 |
ULONG ActiveExWorker : 1; |
5.1 and higher |
| 0x00000002 (5.1 to 6.1) |
ULONG ExWorkerCanWaitUser : 1; |
5.1 to 6.1 |
| 0x00000004 (5.1 to 6.1); 0x00000002 |
ULONG MemoryMaker : 1; |
5.1 and higher |
| 0x00000004 (1511); 0x0000000C |
ULONG StoreLockThread : 1; |
1511 only |
ULONG StoreLockThread : 2; |
1607 and higher | |
| 0x00000008 (5.1 to 6.1); 0x00000004 (6.2 to 10.0); 0x00000008 (1511); 0x00000010 |
ULONG ClonedThread : 1; |
6.0 and higher |
| 0x00000008 (5.2); 0x00000010 (6.0 to 6.1); 0x00000008 (6.2 to 10.0); 0x00000010 (1511); 0x00000020 |
ULONG KeyedEventInUse : 1; |
5.2 and higher |
| 0x00000060 (6.0 to 6.1) |
ULONG RateApcState : 2; |
6.0 to 6.1 |
| 0x00000080 (6.0 to 6.1); 0x00000010 (6.2 to 10.0); 0x00000020 (1511); 0x00000040 |
ULONG SelfTerminate : 1; |
6.0 and higher |
| 0x00000020 (10.0); 0x00000040 (1511); 0x00000080 |
ULONG RespectIoPriority : 1; |
10.0 and higher |
| 0x00000100 |
ULONG ActivePageLists : 1; |
1607 and higher |
| 0x00000200 |
ULONG SecureContext : 1; |
1709 and higher |
| 0x00000400 |
ULONG ZeroPageThread : 1; |
1709 and higher |
| 0x00000800 |
ULONG WorkloadClass : 1; |
1809 and higher |
ULONG ReservedSameThreadPassiveFlags : 26; |
10.0 only | |
ULONG ReservedSameThreadPassiveFlags : 25; |
1511 only | |
ULONG ReservedSameThreadPassiveFlags : 23; |
1607 to 1703 | |
ULONG ReservedSameThreadPassiveFlags : 21; |
1709 to 1803 | |
ULONG ReservedSameThreadPassiveFlags : 20; |
1809 and higher |