Subclass of BaseRecord.
A Windows thread, as threads, !thread, and all scheduler listings
show it. A field that the walk could not read is None.
-
property base_priority: int | None
-
property eprocess: int | None
The owning _EPROCESS.
-
property ethread: int
The _ETHREAD address, which identifies the thread.
-
property kernel_stack: int | None
_KTHREAD.KernelStack, the saved stack pointer of a thread that is
not running.
-
property kernel_stack_resident: bool | None
-
property kthread: int
The _KTHREAD address.
-
property pending_irps: list[int] | None
The IRPs on the thread’s IrpList.
-
property pid: int | None
The ID of the process that owns the thread.
-
property priority: int | None
The current scheduling priority.
-
property process_name: str | None
The image name of the owning process.
-
property stack_base: int | None
-
property stack_limit: int | None
-
property start_address: int | None
-
property state: int | None
_KTHREAD.State.
-
property state_name: str | None
The name of the state (Running, Waiting, …).
-
property teb: int | None
-
property tid: int | None
The thread ID, or None if the thread has no ID (for example, an
idle thread).
-
property trap_frame: int | None
-
property wait_irql: int | None
-
property wait_reason: int | None
_KTHREAD.WaitReason.
-
property wait_reason_name: str | None
The name of the wait reason (Executive, UserRequest, …).
-
property win32_start_address: int | None