#ifndef _NTPEBTEB_H

// rev // Per-thread state for the NT thread pool (TEB->ThreadPoolData)
typedef struct _TPP_THREAD_DATA
{
    PVOID ActiveCallbackObject;             // Pointer to the TP object (TP_WORK/TP_TIMER/TP_IO/TP_WAIT) currently executing on this thread; NULL between callbacks
    ULONG Flags;                            // Lifecycle flags: 0x3 = allocated, 0x4 = freeing
    ULONG CallbackRecordIndex;              // Ring index (0 or 1) selecting which CallbackRecords slot to write next
    ULONGLONG CallbackCount;                // Total callbacks dispatched on this thread
    ULONGLONG ThreadStartTimestamp;         // InterruptTime at TppAllocThreadData
    TPP_CALLBACK_RECORD CallbackRecords[2]; // Last two callback invocations (ring buffer keyed by CallbackRecordIndex)
    TPP_CALLER_RECORD CallerRecords[2];     // Last two TpCaptureCaller snapshots (ring buffer keyed by CallerRecordIndex)
    ULONG CallerRecordIndex;                // Ring index (0 or 1) selecting which CallerRecords slot to write next
    ULONG Reserved;
} TPP_THREAD_DATA, *PTPP_THREAD_DATA;

#endif
View code on GitHub