Hartmut Birr wrote:
Hi,
our current thread and process structures have two thread lists, one in
KPROCESS/KTHREAD and another in EPROCESS/ETHREAD. Do we need both lists?
Hi,
Yes, both lists are used on Windows and enumerated at different times
(kernel code enumerates KPROCESS/KTHREAD, executive code enumerates
EPROCESS/ETHREAD).
Best regards,
Alex Ionescu