[Autogenerated] we know that threads are kernel objects,
which means that they are managed by the current in some way.
The main data structure is called the thread for executive thread,
which is the one that represents all the details about a particular threat.
This is very similar,
at least in concept to the processed data structure
we've seen in a previous course.
And just like with an E process,
the first member of an E thread is a K a thread state
which stands for kernel thread,
which kind of represents the lower level aspects of a thread,
which are the responsibility of the lower kernel
rather than the upper executive.
And the only thing we can say for sure is that the K threat is always
the first member of the e thread and it's named TCB,
that's the thread control block.
And again, it might seem similar,
at least from a naming convention perspective comparing that to processes
where we have an e process that has the first member,
which is a K a process called PCB for process control blocks.
So this is kind of similar,
trying to give us a sense that there are two layers to a
thread in terms of actual management,
but the thread is the object that we need to refer to
when looking at threats in general.
Now there is no global list of threats in the system.
We know that there is a global list of processes in the system.
Instead threats are managed on the basis of their process,
the process,
they're part of the threat is always part of some process threats can't live
in the void and that's why every process has a threat list,
Head member,
which is a linked list pointing to the threats that
belong to this particular process.
So whenever you enumerate all the threads in the system using some
APIs Windows provides essentially what that does.
It works over all the processes and for each process it works
over all the threads within that process.
In user mode,
there is one data structure that is used to represent some
information which is mostly useful for user mode,
which is known as a threat environment block,
or TB.
And we've seen a little bit about that in a previous course,
let's look at some of these data structures in the debugger