Hartmut Birr wrote:
Hi,
our current thread and process structures have two thread lists, one in KPROCESS/KTHREAD and another in EPROCESS/ETHREAD. Do we need both lists?
Hi,
Yes, both lists are used on Windows and enumerated at different times (kernel code enumerates KPROCESS/KTHREAD, executive code enumerates EPROCESS/ETHREAD).
Best regards, Alex Ionescu