Techwiki:Win32k/THREADINFO

THREADINFO from Windows XP

#define CWINHOOKS WH_MAX - WH_MIN + 1 // 16, see sdk/winuser.h and reference 5 below.

typedef struct _THREADINFO
{
  /* 000 */ W32THREAD;
  /* 028 */ PTL                 ptl;
  /* 02c */ PPROCESSINFO        ppi;
  /* 030 */ PQ                  pq; //Input Queue (Messages from mouse, keyboard and SendInput) 
  /* 034 */ PKL                 spklActive;
  /* 038 */ PCLIENTTHREADINFO   pcti;
  /* 03c */ PDESKTOP            rpdesk;
  /* 040 */ PDESKTOPINFO        pDeskInfo;
  /* 044 */ PCLIENTINFO         pClientInfo;
  /* 048 */ ULONG               TIF_flags;
  /* 04c */ PUNICODE_STRING     pstrAppName;
  /* 050 */ PSMS                psmsSent; //Send Message Queue
  /* 054 */ PSMS                psmsCurrent;
  /* 058 */ PSMS                psmsReceiveList;
  /* 05c */ LONG                timeLast;
  /* 060 */ ULONG_PTR           idLast;
            union
            {
  /* 064 */   INT               cQuit;
  /* 064 */   INT               exitCode;
            };
  /* 068 */ HDESK               hdesk;
  /* 06c */ INT                 cPaintsReady;
  /* 070 */ UINT                cTimersReady;
  /* 074 */ PMENUSTATE          pMenuState;
            union
            {
  /* 078 */   PTDB              ptdb;
  /* 078 */   PWINDOWSTATION    pwinsta;
            };
  /* 07c */ PSVR_INSTANCE_INFO  psiiList;
  /* 080 */ ULONG               dwExpWinVer;
  /* 084 */ ULONG               dwCompatFlags;
  /* 088 */ ULONG               dwCompatFlags2;
  /* 08c */ PQ                  pqAttach;
  /* 090 */ PTHREADINFO         ptiSibling;
  /* 094 */ PMOVESIZEDATA       pmsd;
  /* 098 */ ULONG               fsHooks;
  /* 09c */ PHOOK               sphkCurrent;
  /* 0a0 */ PSBTRACK            pSBTrack;
  /* 0a4 */ HANDLE              hEventQueueClient;
  /* 0a8 */ PKEVENT             pEventQueueServer;
  /* 0ac */ LIST_ENTRY          PtiLink; // list member in DESKTOP.PtiList
  /* 0b4 */ INT                 iCursorLevel;
  /* 0b8 */ POINT               ptLast; // int b[2];
  /* 0c0 */ PWND                spwndDefaultIme;
  /* 0c4 */ PIMC                spDefaultImc;
  /* 0c8 */ HKL                 hklPrev;
  /* 0cc */ INT                 cEnterCount;
  /* 0d0 */ MLIST               mlPost; //Post Message Queue
  /* 0dc */ USHORT              fsChangeBitsRemoved;
  /* 0de */ WCHAR               wchInjected;
  /* 0e0 */ ULONG               fsReserveKeys;
  /* 0e4 */ PKEVENT             *apEvent;
  /* 0e8 */ ACCESS_MASK         amdesk;
  /* 0ec */ UINT                cWindows;
  /* 0f0 */ UINT                cVisWindows;
  /* 0f4 */ PHOOK               aphkStart[CWINHOOKS];
  /* 134 */ CLIENTTHREADINFO    cti;  // Used only when no Desktop or pcti NULL.
} THREADINFO, *PTHREADINFO; // W32ThreadSize == 0x14C Xp Size.

TIF flags:

#define TIF_INCLEANUP               0x00000001
#define TIF_16BIT                   0x00000002
#define TIF_SYSTEMTHREAD            0x00000004
#define TIF_CSRSSTHREAD             0x00000008
#define TIF_TRACKRECTVISIBLE        0x00000010
#define TIF_ALLOWFOREGROUNDACTIVATE 0x00000020
#define TIF_DONTATTACHQUEUE         0x00000040
#define TIF_DONTJOURNALATTACH       0x00000080
#define TIF_WOW64                   0x00000100
#define TIF_INACTIVATEAPPMSG        0x00000200
#define TIF_SPINNING                0x00000400
#define TIF_PALETTEAWARE            0x00000800
#define TIF_SHAREDWOW               0x00001000
#define TIF_FIRSTIDLE               0x00002000
#define TIF_WAITFORINPUTIDLE        0x00004000
#define TIF_MOVESIZETRACKING        0x00008000
#define TIF_VDMAPP                  0x00010000
#define TIF_DOSEMULATOR             0x00020000
#define TIF_GLOBALHOOKER            0x00040000
#define TIF_DELAYEDEVENT            0x00080000
#define TIF_MSGPOSCHANGED           0x00100000
#define TIF_SHUTDOWNCOMPLETE        0x00200000
#define TIF_IGNOREPLAYBACKDELAY     0x00400000
#define TIF_ALLOWOTHERACCOUNTHOOK   0x00800000
#define TIF_GUITHREADINITIALIZED    0x02000000
#define TIF_DISABLEIME              0x04000000
#define TIF_INGETTEXTLENGTH         0x08000000
#define TIF_ANSILENGTH              0x10000000
#define TIF_DISABLEHOOKS            0x20000000

References

• 1 http://www.woodmann.com/forum/showthread.php?p=72755
• 2 http://bbs.driverdevelop.com/htm_data/87/0711/107275.html
• 3 http://chpie.tistory.com/entry/Blocking-Global-message-hook
• 4 http://rsdn.ru/forum/message/2816416.1.aspx
• 5 http://msdn2.microsoft.com/en-us/library/ms644959(VS.85).aspx
• 6 Windows Symbol files, userkdx.dll