Cross-Thread Flags in the ETHREAD

Windows XP collected several single-byte booleans in the ETHREAD and made bit fields of them. Five went into a set that is overlaid by the CrossThreadFlags member, which is a ULONG for simultaneous access to all the bits described below. It has moved around a little.

Version Offset (x86) Offset (x64)
5.1 0x0248  
early 5.2 (before Windows Server 2003 SP1) 0x0250  
late 5.2 (Windows Server 2003 SP1) 0x0240 0x0414
very late 5.2 (Windows Server 2003 SP2) 0x0240 0x03FC
6.0 0x0260 0x0418
6.1 0x0280 0x0448
6.2 0x0268 0x042C
6.3 0x03B8 0x06B4
10.0 0x03C8 0x06BC

Bit Fields

Mask Definition Versions History
0x00000001
ULONG Terminated : 1;
5.1 and higher previously as ULONG named HasTerminated
0x00000002
ULONG DeadThread : 1;
5.1 to 5.2 previously as BOOLEAN
ULONG ThreadInserted : 1;
6.0 and higher  
0x00000004
ULONG HideFromDebugger : 1;
5.1 and higher previously as BOOLEAN
0x00000008
ULONG ActiveImpersonationInfo : 1;
5.1 and higher previously as BOOLEAN
0x00000010 (5.1 to 6.1)
ULONG SystemThread : 1;
5.1 to 6.1  
0x00000020 (5.1 to 6.1);
0x00000010
ULONG HardErrorsAreDisabled : 1;
5.1 and higher previously as BOOLEAN
0x00000040 (5.1 to 6.1);
0x00000020
ULONG BreakOnTermination : 1;
5.1 and higher  
0x00000080 (5.1 to 6.1);
0x00000040
ULONG SkipCreationMsg : 1;
5.1 and higher  
0x00000100 (5.1 to 6.1);
0x00000080
ULONG SkipTerminationMsg : 1;
5.1 and higher  
0x00000200 (5.1 to 6.1);
0x00000100
ULONG CopyTokenOnOpen : 1;
6.0 and higher  
0x00001C00 (5.1 to 6.1);
0x00000E00
ULONG ThreadIoPriority : 3;
6.0 and higher  
0x0000E000 (5.1 to 6.1);
0x00007000
ULONG ThreadPagePriority : 3;
6.0 and higher  
0x00010000 (5.1 to 6.1);
0x00008000
ULONG RundownFail : 1;
6.0 and higher  
0x00020000 (5.1 to 6.1);
0x00010000
ULONG NeedsWorkingSetAging : 1;
6.1 only  
ULONG UmsForceQueueTermination : 1;
6.2 and higher  
0x00020000
ULONG IndirectCpuSets : 1;
10.0 and higher  
 
ULONG ReservedCrossThreadFlags : 15;
6.2 to 6.3  
ULONG ReservedCrossThreadFlags : 14;
10.0 and higher