【旧文章搬运】Windows内核常见数据结构(线程相关)

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

原文发表于百度空间，2008-7-24
==========================================================================

线程是进程的实际存在，每个进程中至少会有一个线程．
线程相关的数据结构比较多，一个一个看．
首先是ETHREAD：
lkd> dt _ETHREAD
nt!_ETHREAD
+0x000 Tcb              : _KTHREAD       //线程控制块
+0x1c0 CreateTime       : _LARGE_INTEGER
+0x1c0 NestedFaultCount : Pos 0, 2 Bits
+0x1c0 ApcNeeded        : Pos 2, 1 Bit
+0x1c8 ExitTime         : _LARGE_INTEGER
+0x1c8 LpcReplyChain    : _LIST_ENTRY
+0x1c8 KeyedWaitChain   : _LIST_ENTRY
+0x1d0 ExitStatus       : Int4B
+0x1d0 OfsChain         : Ptr32 Void
+0x1d4 PostBlockList    : _LIST_ENTRY
+0x1dc TerminationPort : Ptr32 _TERMINATION_PORT
+0x1dc ReaperLink       : Ptr32 _ETHREAD
+0x1dc KeyedWaitValue   : Ptr32 Void
+0x1e0 ActiveTimerListLock : Uint4B
+0x1e4 ActiveTimerListHead : _LIST_ENTRY
+0x1ec Cid              : _CLIENT_ID //这里包括所属进程的PID和当前线程的TID
+0x1f4 LpcReplySemaphore : _KSEMAPHORE
+0x1f4 KeyedWaitSemaphore : _KSEMAPHORE
+0x208 LpcReplyMessage : Ptr32 Void
+0x208 LpcWaitingOnPort : Ptr32 Void
+0x20c ImpersonationInfo : Ptr32 _PS_IMPERSONATION_INFORMATION
+0x210 IrpList          : _LIST_ENTRY
+0x218 TopLevelIrp      : Uint4B
+0x21c DeviceToVerify   : Ptr32 _DEVICE_OBJECT
+0x220 ThreadsProcess   : Ptr32 _EPROCESS    //该线程所属进程的EPROCESS
+0x224 StartAddress     : Ptr32 Void       //线程的起始地址
+0x228 Win32StartAddress : Ptr32 Void
+0x228 LpcReceivedMessageId : Uint4B
+0x22c ThreadListEntry : _LIST_ENTRY //线程链表
+0x234 RundownProtect   : _EX_RUNDOWN_REF
+0x238 ThreadLock       : _EX_PUSH_LOCK
+0x23c LpcReplyMessageId : Uint4B
+0x240 ReadClusterSize : Uint4B
+0x244 GrantedAccess    : Uint4B
+0x248 CrossThreadFlags : Uint4B
+0x248 Terminated       : Pos 0, 1 Bit        //从这里开始就是标志位
+0x248 DeadThread       : Pos 1, 1 Bit
+0x248 HideFromDebugger : Pos 2, 1 Bit
+0x248 ActiveImpersonationInfo : Pos 3, 1 Bit
+0x248 SystemThread     : Pos 4, 1 Bit　　　//设置此标志，那么PspTerminateThredbyPoniter就不好使了，好像就是炉子大哥搞的那个
+0x248 HardErrorsAreDisabled : Pos 5, 1 Bit
+0x248 BreakOnTermination : Pos 6, 1 Bit
+0x248 SkipCreationMsg : Pos 7, 1 Bit
+0x248 SkipTerminationMsg : Pos 8, 1 Bit
+0x24c SameThreadPassiveFlags : Uint4B
+0x24c ActiveExWorker   : Pos 0, 1 Bit
+0x24c ExWorkerCanWaitUser : Pos 1, 1 Bit
+0x24c MemoryMaker      : Pos 2, 1 Bit
+0x250 SameThreadApcFlags : Uint4B
+0x250 LpcReceivedMsgIdValid : Pos 0, 1 Bit
+0x250 LpcExitThreadCalled : Pos 1, 1 Bit
+0x250 AddressSpaceOwner : Pos 2, 1 Bit
+0x254 ForwardClusterOnly : UChar
+0x255 DisablePageFaultClustering : UChar

线程控制块:
lkd> dt _KTHREAD
nt!_KTHREAD
+0x000 Header           : _DISPATCHER_HEADER
+0x010 MutantListHead   : _LIST_ENTRY
+0x018 InitialStack     : Ptr32 Void
+0x01c StackLimit       : Ptr32 Void
+0x020 Teb              : Ptr32 Void     //线程环境块
+0x024 TlsArray         : Ptr32 Void
+0x028 KernelStack      : Ptr32 Void
+0x02c DebugActive      : UChar
+0x02d State            : UChar
+0x02e Alerted          : [2] UChar
+0x030 Iopl             : UChar
+0x031 NpxState         : UChar
+0x032 Saturation       : Char
+0x033 Priority         : Char
+0x034 ApcState         : _KAPC_STATE
+0x04c ContextSwitches : Uint4B          //上下文切换计数
+0x050 IdleSwapBlock    : UChar
+0x051 Spare0           : [3] UChar
+0x054 WaitStatus       : Int4B
+0x058 WaitIrql         : UChar
+0x059 WaitMode         : Char
+0x05a WaitNext         : UChar
+0x05b WaitReason       : UChar
+0x05c WaitBlockList    : Ptr32 _KWAIT_BLOCK
+0x060 WaitListEntry    : _LIST_ENTRY
+0x060 SwapListEntry    : _SINGLE_LIST_ENTRY
+0x068 WaitTime         : Uint4B
+0x06c BasePriority     : Char
+0x06d DecrementCount   : UChar
+0x06e PriorityDecrement : Char
+0x06f Quantum          : Char
+0x070 WaitBlock        : [4] _KWAIT_BLOCK
+0x0d0 LegoData         : Ptr32 Void
+0x0d4 KernelApcDisable : Uint4B
+0x0d8 UserAffinity     : Uint4B
+0x0dc SystemAffinityActive : UChar
+0x0dd PowerState       : UChar
+0x0de NpxIrql          : UChar
+0x0df InitialNode      : UChar
+0x0e0 ServiceTable     : Ptr32 Void
+0x0e4 Queue            : Ptr32 _KQUEUE
+0x0e8 ApcQueueLock     : Uint4B
+0x0f0 Timer            : _KTIMER
+0x118 QueueListEntry   : _LIST_ENTRY
+0x120 SoftAffinity     : Uint4B
+0x124 Affinity         : Uint4B
+0x128 Preempted        : UChar
+0x129 ProcessReadyQueue : UChar
+0x12a KernelStackResident : UChar
+0x12b NextProcessor    : UChar
+0x12c CallbackStack    : Ptr32 Void
+0x130 Win32Thread      : Ptr32 Void
+0x134 TrapFrame        : Ptr32 _KTRAP_FRAME
+0x138 ApcStatePointer : [2] Ptr32 _KAPC_STATE
+0x140 PreviousMode     : Char
+0x141 EnableStackSwap : UChar
+0x142 LargeStack       : UChar
+0x143 ResourceIndex    : UChar
+0x144 KernelTime       : Uint4B
+0x148 UserTime         : Uint4B
+0x14c SavedApcState    : _KAPC_STATE
+0x164 Alertable        : UChar
+0x165 ApcStateIndex    : UChar
+0x166 ApcQueueable     : UChar
+0x167 AutoAlignment    : UChar
+0x168 StackBase        : Ptr32 Void
+0x16c SuspendApc       : _KAPC
+0x19c SuspendSemaphore : _KSEMAPHORE
+0x1b0 ThreadListEntry : _LIST_ENTRY         //线程双向链表
+0x1b8 FreezeCount      : Char
+0x1b9 SuspendCount     : Char
+0x1ba IdealProcessor   : UChar
+0x1bb DisableBoost     : UChar

线程环境块TEB：
lkd> dt _TEB
nt!_TEB
+0x000 NtTib            : _NT_TIB
+0x01c EnvironmentPointer : Ptr32 Void
+0x020 ClientId         : _CLIENT_ID
+0x028 ActiveRpcHandle : Ptr32 Void
+0x02c ThreadLocalStoragePointer : Ptr32 Void
+0x030 ProcessEnvironmentBlock : Ptr32 _PEB
+0x034 LastErrorValue   : Uint4B
+0x038 CountOfOwnedCriticalSections : Uint4B
+0x03c CsrClientThread : Ptr32 Void
+0x040 Win32ThreadInfo : Ptr32 Void
+0x044 User32Reserved   : [26] Uint4B
+0x0ac UserReserved     : [5] Uint4B
+0x0c0 WOW32Reserved    : Ptr32 Void
+0x0c4 CurrentLocale    : Uint4B
+0x0c8 FpSoftwareStatusRegister : Uint4B
+0x0cc SystemReserved1 : [54] Ptr32 Void
+0x1a4 ExceptionCode    : Int4B
+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK
+0x1bc SpareBytes1      : [24] UChar
+0x1d4 GdiTebBatch      : _GDI_TEB_BATCH
+0x6b4 RealClientId     : _CLIENT_ID
+0x6bc GdiCachedProcessHandle : Ptr32 Void
+0x6c0 GdiClientPID     : Uint4B
+0x6c4 GdiClientTID     : Uint4B
+0x6c8 GdiThreadLocalInfo : Ptr32 Void
+0x6cc Win32ClientInfo : [62] Uint4B
+0x7c4 glDispatchTable : [233] Ptr32 Void
+0xb68 glReserved1      : [29] Uint4B
+0xbdc glReserved2      : Ptr32 Void
+0xbe0 glSectionInfo    : Ptr32 Void
+0xbe4 glSection        : Ptr32 Void
+0xbe8 glTable          : Ptr32 Void
+0xbec glCurrentRC      : Ptr32 Void
+0xbf0 glContext        : Ptr32 Void
+0xbf4 LastStatusValue : Uint4B
+0xbf8 StaticUnicodeString : _UNICODE_STRING
+0xc00 StaticUnicodeBuffer : [261] Uint2B
+0xe0c DeallocationStack : Ptr32 Void
+0xe10 TlsSlots         : [64] Ptr32 Void
+0xf10 TlsLinks         : _LIST_ENTRY
+0xf18 Vdm              : Ptr32 Void
+0xf1c ReservedForNtRpc : Ptr32 Void
+0xf20 DbgSsReserved    : [2] Ptr32 Void
+0xf28 HardErrorsAreDisabled : Uint4B
+0xf2c Instrumentation : [16] Ptr32 Void
+0xf6c WinSockData      : Ptr32 Void
+0xf70 GdiBatchCount    : Uint4B
+0xf74 InDbgPrint       : UChar
+0xf75 FreeStackOnTermination : UChar
+0xf76 HasFiberData     : UChar
+0xf77 IdealProcessor   : UChar
+0xf78 Spare3           : Uint4B
+0xf7c ReservedForPerf : Ptr32 Void
+0xf80 ReservedForOle   : Ptr32 Void
+0xf84 WaitingOnLoaderLock : Uint4B
+0xf88 Wx86Thread       : _Wx86ThreadState
+0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
+0xf98 ImpersonationLocale : Uint4B
+0xf9c IsImpersonating : Uint4B
+0xfa0 NlsCache         : Ptr32 Void
+0xfa4 pShimData        : Ptr32 Void
+0xfa8 HeapVirtualAffinity : Uint4B
+0xfac CurrentTransactionHandle : Ptr32 Void
+0xfb0 ActiveFrame      : Ptr32 _TEB_ACTIVE_FRAME
+0xfb4 SafeThunkCall    : UChar
+0xfb5 BooleanSpare     : [3] UChar

TIB的结构：
lkd> dt _NT_TIB
nt!_NT_TIB
+0x000 ExceptionList    : Ptr32 _EXCEPTION_REGISTRATION_RECORD
+0x004 StackBase        : Ptr32 Void　//线程栈基址
+0x008 StackLimit       : Ptr32 Void     //线程栈大小
+0x00c SubSystemTib     : Ptr32 Void
+0x010 FiberData        : Ptr32 Void
+0x010 Version          : Uint4B
+0x014 ArbitraryUserPointer : Ptr32 Void
+0x018 Self             : Ptr32 _NT_TIB   //指向自身