THROBJHEAD

The THROBJHEAD structure is the smallest header for user objects that can be owned by a thread. In some sense it begins all such objects, since the larger header for thread-owned objects either has an unnamed THROBJHEAD as its first member or reproduces the THROBJHEAD members. Of user objects whose names and structural details are known from public symbol files, only the SVR_INSTANCE_INFO and TOUCHINPUTINFO begin with a THROBJHEAD named head. It is presently thought, however, that the DDECONV, EVENTHOOK, GESTUREINFO, HIDDATA, SMWP and XSTATE also begin with a THROBJHEAD.

The THROBJHEAD changes size through the early versions but only from variations in its own header.

Version Size (x86) Size (x64)
3.51 0x10  
4.0 0x14  
5.0 to 10.0 0x0C 0x18

The point to the THROBJHEAD is to add to the basic header the notion of an owning thread. It is here thought that the structure does not exist in version 3.10, which has ownership by either thread or process built in to the basic header.

Offset (x86) Offset (x64) Definition Versions
0x00 0x00
HEAD;
3.51 only
SHROBJHEAD;
4.0 only
HEAD;
5.0 and higher
0x0C (3.51);
0x10 (4.0);
0x08
0x10
THREADINFO *pti;
3.51 and higher

See that even if the object is visible in user mode, the thread that owns the object is represented by the kernel-mode address of its THREADINFO.