Geoff Chappell, Software Analyst
The THROBJHEAD structure is the smallest header for user objects that can be owned by a thread. In some sense it begins all such objects, since the larger header for thread-owned objects either has an unnamed THROBJHEAD as its first member or reproduces the THROBJHEAD members. Of user objects whose names and structural details are known from public symbol files, only the SVR_INSTANCE_INFO and TOUCHINPUTINFO begin with a THROBJHEAD named head. It is presently thought, however, that the DDECONV, EVENTHOOK, GESTUREINFO, HIDDATA, SMWP and XSTATE also begin with a THROBJHEAD.
The THROBJHEAD changes size through the early versions but only from variations in its own header.
Version | Size (x86) | Size (x64) |
---|---|---|
3.51 | 0x10 | |
4.0 | 0x14 | |
5.0 to 10.0 | 0x0C | 0x18 |
The point to the THROBJHEAD is to add to the basic header the notion of an owning thread. It is here thought that the structure does not exist in version 3.10, which has ownership by either thread or process built in to the basic header.
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x00 | 0x00 |
HEAD; |
3.51 only |
SHROBJHEAD; |
4.0 only | ||
HEAD; |
5.0 and higher | ||
0x0C (3.51); 0x10 (4.0); 0x08 |
0x10 |
THREADINFO *pti; |
3.51 and higher |
See that even if the object is visible in user mode, the thread that owns the object is represented by the kernel-mode address of its THREADINFO.