SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED

KTHREAD

The KTHREAD structure is the Kernel Core’s portion of the ETHREAD structure. The latter is the thread object as exposed through the Object Manager. The KTHREAD is the core of it.

Variability

The KTHREAD structure is plainly internal to the kernel and its layout changes greatly between Windows versions and even between builds. Some sense of the variability can be gained just from the structure’s changing size. In the following table, different builds of the same version are distinguished as early and late because they are known to vary the structure even if they don’t change the size. These descriptions, as early and late, are then used as a shorthand throughout this article and its companions.

Version Size (x86) Size (x64)
3.51 to 5.0 0x01B0  
5.1 0x01C0  
early 5.2 (before Windows Server 2003 SP1) 0x01C8  
late 5.2 (Windows Server 2003 SP1 and higher) 0x01B8 0x0320
early 6.0 (before Windows Vista SP1);
late 6.0 (Windows Vista SP1 and higher)
0x01E0 0x0330
6.1 0x0200 0x0360
6.2 0x01E8 0x0348
6.3 0x0338 0x05D0
10.0 0x0348 0x05D8

In all versions, the KTHREAD, being a dispatcher object, begins with a DISPATCHER_HEADER. The Type is 6, i.e., ThreadObject in the KOBJECTS enumeration. Beyond the header, the structure has not just varied as any implementation detail might. It has instead been treated to large-scale rearrangements that make a mess of any attempt to track a continuous history.