_EPROCESS

Metadatacopy
struct _EPROCESS {
    struct _KPROCESS Pcb;/* 0x0  104 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    long ExitStatus;/* 0x68  4 */
    struct _KEVENT LockEvent;/* 0x6c  16 */
    unsigned long LockCount;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    union _LARGE_INTEGER CreateTime;/* 0x80  8 */
    union _LARGE_INTEGER ExitTime;/* 0x88  8 */
    struct _KTHREAD* LockOwner;/* 0x90  4 */
    void* UniqueProcessId;/* 0x94  4 */
    struct _LIST_ENTRY ActiveProcessLinks;/* 0x98  8 */
    unsigned long QuotaPeakPoolUsage[2];/* 0xa0  8 */
    unsigned long QuotaPoolUsage[2];/* 0xa8  8 */
    unsigned long PagefileUsage;/* 0xb0  4 */
    unsigned long CommitCharge;/* 0xb4  4 */
    unsigned long PeakPagefileUsage;/* 0xb8  4 */
    unsigned long PeakVirtualSize;/* 0xbc  4 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    unsigned long VirtualSize;/* 0xc0  4 */
    /* 4 bytes padding */
    struct _MMSUPPORT Vm;/* 0xc8  72 */
    /* ── cacheline 4 boundary (256 bytes) ── */
    struct _LIST_ENTRY SessionProcessLinks;/* 0x110  8 */
    void* DebugPort;/* 0x118  4 */
    void* ExceptionPort;/* 0x11c  4 */
    struct _HANDLE_TABLE* ObjectTable;/* 0x120  4 */
    void* Token;/* 0x124  4 */
    struct _FAST_MUTEX WorkingSetLock;/* 0x128  32 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned long WorkingSetPage;/* 0x148  4 */
    unsigned char ProcessOutswapEnabled;/* 0x14c  1 */
    unsigned char ProcessOutswapped;/* 0x14d  1 */
    unsigned char AddressSpaceInitialized;/* 0x14e  1 */
    unsigned char AddressSpaceDeleted;/* 0x14f  1 */
    struct _FAST_MUTEX AddressCreationLock;/* 0x150  32 */
    unsigned long HyperSpaceLock;/* 0x170  4 */
    struct _ETHREAD* ForkInProgress;/* 0x174  4 */
    unsigned short VmOperation;/* 0x178  2 */
    unsigned char ForkWasSuccessful;/* 0x17a  1 */
    unsigned char MmAgressiveWsTrimMask;/* 0x17b  1 */
    struct _KEVENT* VmOperationEvent;/* 0x17c  4 */
    /* ── cacheline 6 boundary (384 bytes) ── */
    void* PaeTop;/* 0x180  4 */
    unsigned long LastFaultCount;/* 0x184  4 */
    unsigned long ModifiedPageCount;/* 0x188  4 */
    void* VadRoot;/* 0x18c  4 */
    void* VadHint;/* 0x190  4 */
    void* CloneRoot;/* 0x194  4 */
    unsigned long NumberOfPrivatePages;/* 0x198  4 */
    unsigned long NumberOfLockedPages;/* 0x19c  4 */
    unsigned short NextPageColor;/* 0x1a0  2 */
    unsigned char ExitProcessCalled;/* 0x1a2  1 */
    unsigned char CreateProcessReported;/* 0x1a3  1 */
    void* SectionHandle;/* 0x1a4  4 */
    struct _PEB* Peb;/* 0x1a8  4 */
    void* SectionBaseAddress;/* 0x1ac  4 */
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;/* 0x1b0  4 */
    long LastThreadExitStatus;/* 0x1b4  4 */
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;/* 0x1b8  4 */
    void* Win32WindowStation;/* 0x1bc  4 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    void* InheritedFromUniqueProcessId;/* 0x1c0  4 */
    unsigned long GrantedAccess;/* 0x1c4  4 */
    unsigned long DefaultHardErrorProcessing;/* 0x1c8  4 */
    void* LdtInformation;/* 0x1cc  4 */
    void* VadFreeHint;/* 0x1d0  4 */
    void* VdmObjects;/* 0x1d4  4 */
    void* DeviceMap;/* 0x1d8  4 */
    unsigned long SessionId;/* 0x1dc  4 */
    struct _LIST_ENTRY PhysicalVadList;/* 0x1e0  8 */
    union {
        struct _HARDWARE_PTE PageDirectoryPte;/* 0x1e8  4 */
        unsigned __int64 Filler;/* 0x1e8  8 */
    };/* 0x1e8  8 */
    unsigned long PaePageDirectoryPage;/* 0x1f0  4 */
    unsigned char ImageFileName[16];/* 0x1f4  16 */
    /* ── cacheline 8 boundary (512 bytes) ── */
    unsigned long VmTrimFaultValue;/* 0x204  4 */
    unsigned char SetTimerResolution;/* 0x208  1 */
    unsigned char PriorityClass;/* 0x209  1 */
    union {
        struct {
            unsigned char SubSystemMinorVersion;/* 0x20a  1 */
            unsigned char SubSystemMajorVersion;/* 0x20b  1 */
        };/* 0x20a  2 */
        unsigned short SubSystemVersion;/* 0x20a  2 */
    };/* 0x20a  2 */
    void* Win32Process;/* 0x20c  4 */
    struct _EJOB* Job;/* 0x210  4 */
    unsigned long JobStatus;/* 0x214  4 */
    struct _LIST_ENTRY JobLinks;/* 0x218  8 */
    void* LockedPagesList;/* 0x220  4 */
    union {
        void* SecurityPort;/* 0x224  4 */
        struct _UNICODE_STRING* AuditImageName;/* 0x224  4 */
    };/* 0x224  4 */
    struct _WOW64_PROCESS* Wow64Process;/* 0x228  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ReadOperationCount;/* 0x230  8 */
    union _LARGE_INTEGER WriteOperationCount;/* 0x238  8 */
    /* ── cacheline 9 boundary (576 bytes) ── */
    union _LARGE_INTEGER OtherOperationCount;/* 0x240  8 */
    union _LARGE_INTEGER ReadTransferCount;/* 0x248  8 */
    union _LARGE_INTEGER WriteTransferCount;/* 0x250  8 */
    union _LARGE_INTEGER OtherTransferCount;/* 0x258  8 */
    unsigned long CommitChargeLimit;/* 0x260  4 */
    unsigned long CommitChargePeak;/* 0x264  4 */
    struct _LIST_ENTRY ThreadListHead;/* 0x268  8 */
    struct _RTL_BITMAP* VadPhysicalPagesBitMap;/* 0x270  4 */
    unsigned long VadPhysicalPages;/* 0x274  4 */
    unsigned long AweLock;/* 0x278  4 */
};
/* source: Windows 2000 RC2 DDK Alpha libcntpr.lib CodeView type records; build 2128 per the DDK's ntverp.h */