alpha / ntoskrnl /

_TOKEN

← first 1 build latest →

incomplete member names and offsets of _EPROCESS, _ETHREAD and _TOKEN only, as the kernel debugger extension prints them: no types, no sizes


struct _TOKEN {
    /* type unknown */ TokenSource;/* 0x0 */
    /* type unknown */ AuthenticationId;/* 0x18 */
    /* type unknown */ ExpirationTime;/* 0x20 */
    /* type unknown */ ModifiedId;/* 0x28 */
    /* type unknown */ UserAndGroupCount;/* 0x30 */
    /* type unknown */ PrivilegeCount;/* 0x34 */
    /* type unknown */ VariableLength;/* 0x38 */
    /* type unknown */ DynamicCharged;/* 0x3c */
    /* type unknown */ DynamicAvailable;/* 0x40 */
    /* type unknown */ DefaultOwnerIndex;/* 0x44 */
    /* type unknown */ TokenType;/* 0x5c */
    /* type unknown */ ImpersonationLevel;/* 0x60 */
    /* type unknown */ TokenFlags;/* 0x64 */
    /* type unknown */ TokenInUse;/* 0x65 */
    /* type unknown */ VariablePart;/* 0x68 */
};
/* source: NT 3.51 Workstation CD, SUPPORT/DEBUG/I386/KDEXTALP.DLL !processfields, !threadfields and !tokenfields output */

15 memberssize unknown