Changes

Jump to navigation Jump to search
559 bytes added ,  10:11, 31 January 2015
add information
Line 21: Line 21:  
| u32
 
| u32
 
| Number of threads owned by the process
 
| Number of threads owned by the process
 +
|-
 +
| 0xC
 +
| char[8]
 +
| Used to track the usage of thread local regions in the local page.
 +
|-
 +
| 0x14
 +
| u32
 +
| Zero
 
|}
 
|}
 +
 +
 +
The 8-byte array used to track the regions in use in the page works like so:
 +
 +
Each char is either 1 or 0, and there's one char per thread local region.  0x200 bytes per region * 8 regions is 0x1000 bytes or 1 full page.  The chars are set to 1 to indicate the region is unused and 0 to indicate the region is in use.
 +
 +
Processes with more than 8 threads have multiple associated KThreadLocalPages which are linked together with KLinkedListNodes.
374

edits

Navigation menu