Thread_V2_TypeGroup1 class

This class is the event type class for thread start and end events.

The following syntax is simplified from MOF code.

Syntax

[EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}]
class Thread_V2_TypeGroup1 : Thread_V2
{
  uint32 ProcessId;
  uint32 TThreadId;
  uint32 StackBase;
  uint32 StackLimit;
  uint32 UserStackBase;
  uint32 UserStackLimit;
  uint32 StartAddr;
  uint32 Win32StartAddr;
  uint32 TebBase;
  uint32 SubProcessTag;
};

Members

The Thread_V2_TypeGroup1 class has these types of members:

• Properties

Properties

The Thread_V2_TypeGroup1 class has these properties.

ProcessId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Format("x")

Process identifier of the thread involved in the event.

StackBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3), Pointer

Base address of the thread's stack.

StackLimit

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4), Pointer

Limit of the thread's stack.

StartAddr

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(7), Pointer

Memory address at which the trace starts.

SubProcessTag

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(10), Format("x")

Identifies the service if the thread is owned by a service; otherwise, zero.

TebBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(9), Pointer

Thread environment block base address.

TThreadId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Format("x")

Thread identifier of the thread involved in the event.

UserStackBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(5), Pointer

Base address of the thread's user-mode stack.

UserStackLimit

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(6), Pointer

Limit of the thread's user-mode stack.

Win32StartAddr

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(8), Pointer

Starting address of the function to be executed by this thread.

Remarks

The DCStart and DCEnd event types enumerate the threads that are currently running at the time the kernel session starts and ends, respectively.

Requirements

See also

Thread

Thread_V2