Geoff Chappell, Software Analyst
SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED
The KTHREAD structure is the Kernel Core’s portion of the ETHREAD structure. The latter is the thread object as exposed through the Object Manager. The KTHREAD is the core of it.
The KTHREAD structure is plainly internal to the kernel and its layout changes greatly between Windows versions and even between builds. Some sense of the variability can be gained just from the structure’s changing size. In the following table, different builds of the same version are distinguished as early and late because they are known to vary the structure even if they don’t change the size. These descriptions, as early and late, are then used as a shorthand throughout this article and its companions.
Version | Size (x86) | Size (x64) |
---|---|---|
3.51 to 5.0 | 0x01B0 | |
5.1 | 0x01C0 | |
early 5.2 (before Windows Server 2003 SP1) | 0x01C8 | |
late 5.2 (Windows Server 2003 SP1 and higher) | 0x01B8 | 0x0320 |
early 6.0 (before Windows Vista SP1); late 6.0 (Windows Vista SP1 and higher) |
0x01E0 | 0x0330 |
6.1 | 0x0200 | 0x0360 |
6.2 | 0x01E8 | 0x0348 |
6.3 | 0x0338 | 0x05D0 |
10.0 | 0x0348 | 0x05D8 |
In all versions, the KTHREAD, being a dispatcher object, begins with a DISPATCHER_HEADER. The Type is 6, i.e., ThreadObject in the KOBJECTS enumeration. Beyond the header, the structure has not just varied as any implementation detail might. It has instead been treated to large-scale rearrangements that make a mess of any attempt to track a continuous history.