You can use NtQuerySystemInformation - with InformationClass = SystemProcessAndThreadInformation - to enumerate every non-hidden processes and their own threads .
But the returned thread structures will not contain the KTHREAD pointer, you can still get the KTHREAD pointer by invoking PsLookupThreadByThreadId with the thread Id .
Of course i did NOT use this method in KernelDetective .
