Search notes:

Windows thread

A thread is a part of a process that Windows can schedule for execution on a CPU.

A thread is identified by a thread id.

Components of threads:

CPU state
Two stacks, one for kernel mode and one for user mode
Thread local storage (TLS)
run time libraries / DLLs
Access tokens

Important structures are

ETHREAD (kernel mode)
TEB, aka TIB (user mode)
CONTEXT (defined in winnt.h) which describes the state of the CPU (mostly registers and flags). It is accessed with the GetThreadContext()` function

Impersonation

A thread is said to impersonate, if it assumes a different security context than the process it belongs to.

It should be noted that all threads of a process share the same handle table. Thus, when an impersonating thread opens an object that other threads with their differing security contexts could not open, the other threads still have access to the opened object.

locale

Each thread is assigned a locale which initially is the system default locale (LOCALE_SYSTEM_DEFAULT, whose value ix 0x0800 ).

A thread's locale can be changed with the WinAPI function SetThreadLocale.

See also System.Globalization.RegionInfo::CurrentRegion.

Calling a thread's entry point

A thread's entry point is called by BaseThreadInitThunk whose prototype appears to be

void __fastcall BaseThreadInitThunk(
   ULONG Unknown,
   PVOID StartAddress,
   PVOID ThreadParameter
);

TODO: http://www.nynaeve.net/Code/LdrInitializeThunk.c and http://www.nynaeve.net/?p=205