Geoff Chappell, Software Analyst
Windows Vista started a new series of bit fields in the KTHREAD, presumably to complement the slightly older Thread Flags. Curiously, some of the bit fields that started as Miscellaneous Flags have moved to the Thread Flags, and vice versa.
The MiscFlags member, which is a LONG for simultaneous access to all the bits described below, has moved around a little within the KTHREAD:
Version | Offset (x86) | Offset (x64) |
---|---|---|
early 6.0 (before Windows Vista SP1); late 6.0 (Windows Vista SP1 and higher) |
0x68 | 0x90 |
6.1 | 0x3C | 0x4C |
6.2 and higher | 0x58 | 0x74 |
See that even though the MiscFlags don’t move for builds within version 6.0, one new bit is defined.
Mask | Definition | Versions | Remarks |
---|---|---|---|
0x00000001 |
ULONG KernelStackResident : 1; |
6.0 to 6.3 | previously as BOOLEAN; next as bit in ThreadFlags |
ULONG AutoBoostActive : 1; |
10.0 and higher | ||
0x00000002 |
ULONG ReadyTransition : 1; |
6.0 and higher | |
0x00000004 |
ULONG ProcessReadyQueue : 1; |
6.0 to 6.3 | previously as BOOLEAN |
0x00000008 (6.0 to 6.3); 0x00000004 |
ULONG WaitNext : 1; |
6.0 and higher | previously as BOOLEAN |
0x00000010 (6.0 to 6.3); 0x00000008 |
ULONG SystemAffinityActive : 1; |
6.0 and higher | previously as BOOLEAN |
0x00000020 (6.0 to 6.3); 0x00000010 |
ULONG Alertable : 1; |
6.0 and higher | previously as BOOLEAN |
0x00000040 |
ULONG GdiFlushActive : 1; |
6.0 to 6.1 | |
ULONG CodePatchInProgress : 1; |
6.2 only | previously as BOOLEAN | |
0x00000080 (late 6.0 to 6.2); 0x00000040 (6.3); 0x00000020 |
ULONG UserStackWalkActive : 1; |
late 6.0 and higher | |
0x00000100 (6.1 to 6.2); 0x00000080 (6.3); 0x00000040 |
ULONG ApcInterruptRequest : 1; |
6.1 and higher | |
0x00000200 (6.1) |
ULONG ForceDeferSchedule : 1; |
6.1 only | next as bit in ThreadFlags |
0x00000400 (6.1); 0x00000200 (6.2); 0x00000100 (6.3); 0x00000080 |
ULONG QuantumEndMigrate : 1; |
6.1 and higher | |
0x00000800 (6.1); 0x00000400 (6.2); 0x00000200 (6.3); 0x00000100 |
ULONG UmsDirectedSwitchEnable : 1; |
6.1 and higher | |
0x00001000 (6.1); 0x00000800 (6.2); 0x00000400 (6.3); 0x00000200 |
ULONG TimerActive : 1; |
6.1 and higher | |
0x00001000 (6.2); 0x00000800 (6.3); 0x00000400 |
ULONG SystemThread : 1; |
6.2 and higher | |
0x00002000 (6.2); 0x00001000 (6.3); 0x00000800 |
ULONG ProcessDetachActive : 1; |
6.2 and higher | |
0x00004000 (6.2); 0x00002000 (6.3); 0x00001000 |
ULONG CalloutActive : 1; |
6.2 and higher | previously as bit in ThreadFlags |
0x00008000 (6.2); 0x00004000 (6.3); 0x00002000 |
ULONG ScbReadyQueue : 1; |
6.2 and higher | |
0x00010000 (6.2); 0x00008000 (6.3); 0x00004000 |
ULONG ApcQueueable : 1; |
6.2 and higher | previously as bit in ThreadFlags |
0x00020000 (6.2); 0x00010000 (6.3); 0x00008000 |
ULONG ReservedStackInUse : 1; |
6.2 and higher | |
0x00040000 (6.2); 0x00020000 (6.3); 0x00010000 |
ULONG UmsPerformingSyscall : 1; |
6.2 and higher | previously as bit in ThreadFlags |
0x00040000 (6.3); 0x00020000 |
ULONG ApcPendingReload : 1; |
6.3 only | |
ULONG TimerSuspended : 1; |
10.0 and higher | ||
0x00040000 |
ULONG SuspendedWaitMode : 1; |
10.0 and higher | |
0x00080000 |
ULONG SuspendApcSchedulerWait : 1; |
10.0 and higher | |
ULONG Reserved : 25; |
early 6.0 only | ||
ULONG Reserved : 24; |
late 6.0 only | ||
ULONG Reserved : 19; |
6.1 only | ||
ULONG Reserved : 13; |
6.2 to 6.3 | ||
ULONG Reserved : 12; |
10.0 and higher |