Geoff Chappell, Software Analyst
The SYSTEM_EXTENDED_THREAD_INFORMATION structure is an irregularly recurring element in what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemExtendedProcessInformation (0x39) or SystemFullProcessInformation (0x94).
These information classes produce descriptions not just of the running processes but also of those processes’ threads. A quick summary is that the information for each process is a fixed-size SYSTEM_PROCESS_INFORMATION structure and the following variable-size data:
The totality of the output for all processes is a sequence of these sets, one per process. In each set, the NextEntryOffset member at the beginning of the SYSTEM_PROCESS_INFORMATION tells how many bytes to advance from that SYSTEM_PROCESS_INFORMATION to the next, or is zero in the last. The NumberOfThreads member in a SYSTEM_PROCESS_INFORMATION tells how many SYSTEM_EXTENDED_THREAD_INFORMATION structures are in the array that immediately follows the SYSTEM_PROCESS_INFORMATION.
The SYSTEM_EXTENDED_THREAD_INFORMATION structure is not documented.
The SYSTEM_EXTENDED_THREAD_INFORMATION is 0x60 or 0x88 bytes in 32-bit and 64-bit Windows, respectively.
|Offset (x86)||Offset (x64)||Definition|