struct _EPROCESS { struct _KPROCESS Pcb;/* 0x0 440 */ /* ── cacheline 6 boundary (384 bytes) ── */ struct _EX_PUSH_LOCK ProcessLock;/* 0x1b8 8 */ /* ── cacheline 7 boundary (448 bytes) ── */ void* UniqueProcessId;/* 0x1c0 8 */ struct _LIST_ENTRY ActiveProcessLinks;/* 0x1c8 16 */ struct _EX_RUNDOWN_REF RundownProtect;/* 0x1d8 8 */ union { unsigned long Flags2;/* 0x1e0 4 */ struct { unsigned long JobNotReallyActive : 1;/* 0x1e0:0 4 */ unsigned long AccountingFolded : 1;/* 0x1e0:1 4 */ unsigned long NewProcessReported : 1;/* 0x1e0:2 4 */ unsigned long ExitProcessReported : 1;/* 0x1e0:3 4 */ unsigned long ReportCommitChanges : 1;/* 0x1e0:4 4 */ unsigned long LastReportMemory : 1;/* 0x1e0:5 4 */ unsigned long ForceWakeCharge : 1;/* 0x1e0:6 4 */ unsigned long CrossSessionCreate : 1;/* 0x1e0:7 4 */ unsigned long NeedsHandleRundown : 1;/* 0x1e0:8 4 */ unsigned long RefTraceEnabled : 1;/* 0x1e0:9 4 */ unsigned long PicoCreated : 1;/* 0x1e0:10 4 */ unsigned long EmptyJobEvaluated : 1;/* 0x1e0:11 4 */ unsigned long DefaultPagePriority : 3;/* 0x1e0:12 4 */ unsigned long PrimaryTokenFrozen : 1;/* 0x1e0:15 4 */ unsigned long ProcessVerifierTarget : 1;/* 0x1e0:16 4 */ unsigned long RestrictSetThreadContext : 1;/* 0x1e0:17 4 */ unsigned long AffinityPermanent : 1;/* 0x1e0:18 4 */ unsigned long AffinityUpdateEnable : 1;/* 0x1e0:19 4 */ unsigned long PropagateNode : 1;/* 0x1e0:20 4 */ unsigned long ExplicitAffinity : 1;/* 0x1e0:21 4 */ unsigned long Flags2Available1 : 2;/* 0x1e0:22 4 */ unsigned long EnableReadVmLogging : 1;/* 0x1e0:24 4 */ unsigned long EnableWriteVmLogging : 1;/* 0x1e0:25 4 */ unsigned long FatalAccessTerminationRequested : 1;/* 0x1e0:26 4 */ unsigned long DisableSystemAllowedCpuSet : 1;/* 0x1e0:27 4 */ unsigned long Flags2Available2 : 3;/* 0x1e0:28 4 */ unsigned long InPrivate : 1;/* 0x1e0:31 4 */ };/* 0x1e0 4 */ };/* 0x1e0 4 */ union { unsigned long Flags;/* 0x1e4 4 */ struct { unsigned long CreateReported : 1;/* 0x1e4:0 4 */ unsigned long NoDebugInherit : 1;/* 0x1e4:1 4 */ unsigned long ProcessExiting : 1;/* 0x1e4:2 4 */ unsigned long ProcessDelete : 1;/* 0x1e4:3 4 */ unsigned long ManageExecutableMemoryWrites : 1;/* 0x1e4:4 4 */ unsigned long VmDeleted : 1;/* 0x1e4:5 4 */ unsigned long OutswapEnabled : 1;/* 0x1e4:6 4 */ unsigned long Outswapped : 1;/* 0x1e4:7 4 */ unsigned long FailFastOnCommitFail : 1;/* 0x1e4:8 4 */ unsigned long Wow64VaSpace4Gb : 1;/* 0x1e4:9 4 */ unsigned long AddressSpaceInitialized : 2;/* 0x1e4:10 4 */ unsigned long SetTimerResolution : 1;/* 0x1e4:12 4 */ unsigned long BreakOnTermination : 1;/* 0x1e4:13 4 */ unsigned long DeprioritizeViews : 1;/* 0x1e4:14 4 */ unsigned long WriteWatch : 1;/* 0x1e4:15 4 */ unsigned long ProcessInSession : 1;/* 0x1e4:16 4 */ unsigned long OverrideAddressSpace : 1;/* 0x1e4:17 4 */ unsigned long HasAddressSpace : 1;/* 0x1e4:18 4 */ unsigned long LaunchPrefetched : 1;/* 0x1e4:19 4 */ unsigned long Reserved : 1;/* 0x1e4:20 4 */ unsigned long VmTopDown : 1;/* 0x1e4:21 4 */ unsigned long ImageNotifyDone : 1;/* 0x1e4:22 4 */ unsigned long PdeUpdateNeeded : 1;/* 0x1e4:23 4 */ unsigned long VdmAllowed : 1;/* 0x1e4:24 4 */ unsigned long ProcessRundown : 1;/* 0x1e4:25 4 */ unsigned long ProcessInserted : 1;/* 0x1e4:26 4 */ unsigned long DefaultIoPriority : 3;/* 0x1e4:27 4 */ unsigned long ProcessSelfDelete : 1;/* 0x1e4:30 4 */ unsigned long SetTimerResolutionLink : 1;/* 0x1e4:31 4 */ };/* 0x1e4 4 */ };/* 0x1e4 4 */ union _LARGE_INTEGER CreateTime;/* 0x1e8 8 */ unsigned __int64 ProcessQuotaUsage[2];/* 0x1f0 16 */ /* ── cacheline 8 boundary (512 bytes) ── */ unsigned __int64 ProcessQuotaPeak[2];/* 0x200 16 */ unsigned __int64 PeakVirtualSize;/* 0x210 8 */ unsigned __int64 VirtualSize;/* 0x218 8 */ struct _LIST_ENTRY SessionProcessLinks;/* 0x220 16 */ union { void* ExceptionPortData;/* 0x230 8 */ unsigned __int64 ExceptionPortValue;/* 0x230 8 */ unsigned __int64 ExceptionPortState : 3;/* 0x230:0 8 */ };/* 0x230 8 */ struct _EX_FAST_REF Token;/* 0x238 8 */ /* ── cacheline 9 boundary (576 bytes) ── */ unsigned __int64 MmReserved;/* 0x240 8 */ struct _EX_PUSH_LOCK AddressCreationLock;/* 0x248 8 */ struct _EX_PUSH_LOCK PageTableCommitmentLock;/* 0x250 8 */ struct _ETHREAD* RotateInProgress;/* 0x258 8 */ struct _ETHREAD* ForkInProgress;/* 0x260 8 */ struct _EJOB* CommitChargeJob;/* 0x268 8 */ struct _RTL_AVL_TREE CloneRoot;/* 0x270 8 */ volatile unsigned __int64 NumberOfPrivatePages;/* 0x278 8 */ /* ── cacheline 10 boundary (640 bytes) ── */ volatile unsigned __int64 NumberOfLockedPages;/* 0x280 8 */ void* Win32Process;/* 0x288 8 */ struct _EJOB* Job;/* 0x290 8 */ void* SectionObject;/* 0x298 8 */ void* SectionBaseAddress;/* 0x2a0 8 */ unsigned long Cookie;/* 0x2a8 4 */ /* 4 bytes padding */ struct _PAGEFAULT_HISTORY* WorkingSetWatch;/* 0x2b0 8 */ void* Win32WindowStation;/* 0x2b8 8 */ /* ── cacheline 11 boundary (704 bytes) ── */ void* InheritedFromUniqueProcessId;/* 0x2c0 8 */ volatile unsigned __int64 OwnerProcessId;/* 0x2c8 8 */ struct _PEB* Peb;/* 0x2d0 8 */ struct _PSP_SESSION_SPACE* Session;/* 0x2d8 8 */ void* Spare1;/* 0x2e0 8 */ struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;/* 0x2e8 8 */ struct _HANDLE_TABLE* ObjectTable;/* 0x2f0 8 */ void* DebugPort;/* 0x2f8 8 */ /* ── cacheline 12 boundary (768 bytes) ── */ struct _EWOW64PROCESS* WoW64Process;/* 0x300 8 */ struct _EX_FAST_REF DeviceMap;/* 0x308 8 */ void* EtwDataSource;/* 0x310 8 */ unsigned __int64 PageDirectoryPte;/* 0x318 8 */ struct _FILE_OBJECT* ImageFilePointer;/* 0x320 8 */ unsigned char ImageFileName[15];/* 0x328 15 */ unsigned char PriorityClass;/* 0x337 1 */ void* SecurityPort;/* 0x338 8 */ /* ── cacheline 13 boundary (832 bytes) ── */ struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;/* 0x340 8 */ struct _LIST_ENTRY JobLinks;/* 0x348 16 */ void* HighestUserAddress;/* 0x358 8 */ struct _LIST_ENTRY ThreadListHead;/* 0x360 16 */ volatile unsigned long ActiveThreads;/* 0x370 4 */ unsigned long ImagePathHash;/* 0x374 4 */ unsigned long DefaultHardErrorProcessing;/* 0x378 4 */ long LastThreadExitStatus;/* 0x37c 4 */ /* ── cacheline 14 boundary (896 bytes) ── */ struct _EX_FAST_REF PrefetchTrace;/* 0x380 8 */ void* LockedPagesList;/* 0x388 8 */ union _LARGE_INTEGER ReadOperationCount;/* 0x390 8 */ union _LARGE_INTEGER WriteOperationCount;/* 0x398 8 */ union _LARGE_INTEGER OtherOperationCount;/* 0x3a0 8 */ union _LARGE_INTEGER ReadTransferCount;/* 0x3a8 8 */ union _LARGE_INTEGER WriteTransferCount;/* 0x3b0 8 */ union _LARGE_INTEGER OtherTransferCount;/* 0x3b8 8 */ /* ── cacheline 15 boundary (960 bytes) ── */ unsigned __int64 CommitChargeLimit;/* 0x3c0 8 */ volatile unsigned __int64 CommitCharge;/* 0x3c8 8 */ volatile unsigned __int64 CommitChargePeak;/* 0x3d0 8 */ /* 40 bytes padding */ /* ── cacheline 16 boundary (1024 bytes) ── */ struct _MMSUPPORT_FULL Vm;/* 0x400 512 */ /* ── cacheline 24 boundary (1536 bytes) ── */ struct _LIST_ENTRY MmProcessLinks;/* 0x600 16 */ volatile unsigned long ModifiedPageCount;/* 0x610 4 */ long ExitStatus;/* 0x614 4 */ struct _RTL_AVL_TREE VadRoot;/* 0x618 8 */ void* VadHint;/* 0x620 8 */ unsigned __int64 VadCount;/* 0x628 8 */ volatile unsigned __int64 VadPhysicalPages;/* 0x630 8 */ unsigned __int64 VadPhysicalPagesLimit;/* 0x638 8 */ /* ── cacheline 25 boundary (1600 bytes) ── */ struct _ALPC_PROCESS_CONTEXT AlpcContext;/* 0x640 32 */ struct _LIST_ENTRY TimerResolutionLink;/* 0x660 16 */ struct _PO_DIAG_STACK_RECORD* TimerResolutionStackRecord;/* 0x670 8 */ unsigned long RequestedTimerResolution;/* 0x678 4 */ unsigned long SmallestTimerResolution;/* 0x67c 4 */ /* ── cacheline 26 boundary (1664 bytes) ── */ union _LARGE_INTEGER ExitTime;/* 0x680 8 */ struct _INVERTED_FUNCTION_TABLE_KERNEL_MODE* InvertedFunctionTable;/* 0x688 8 */ struct _EX_PUSH_LOCK InvertedFunctionTableLock;/* 0x690 8 */ unsigned long ActiveThreadsHighWatermark;/* 0x698 4 */ unsigned long LargePrivateVadCount;/* 0x69c 4 */ struct _EX_PUSH_LOCK ThreadListLock;/* 0x6a0 8 */ void* WnfContext;/* 0x6a8 8 */ struct _EJOB* ServerSilo;/* 0x6b0 8 */ unsigned char SignatureLevel;/* 0x6b8 1 */ unsigned char SectionSignatureLevel;/* 0x6b9 1 */ struct _PS_PROTECTION Protection;/* 0x6ba 1 */ unsigned char HangCount : 3;/* 0x6bb:0 1 */ unsigned char GhostCount : 3;/* 0x6bb:3 1 */ unsigned char PrefilterException : 1;/* 0x6bb:6 1 */ union { unsigned long Flags3;/* 0x6bc 4 */ struct { unsigned long Minimal : 1;/* 0x6bc:0 4 */ unsigned long ReplacingPageRoot : 1;/* 0x6bc:1 4 */ unsigned long Crashed : 1;/* 0x6bc:2 4 */ unsigned long JobVadsAreTracked : 1;/* 0x6bc:3 4 */ unsigned long VadTrackingDisabled : 1;/* 0x6bc:4 4 */ unsigned long AuxiliaryProcess : 1;/* 0x6bc:5 4 */ unsigned long SubsystemProcess : 1;/* 0x6bc:6 4 */ unsigned long IndirectCpuSets : 1;/* 0x6bc:7 4 */ unsigned long RelinquishedCommit : 1;/* 0x6bc:8 4 */ unsigned long HighGraphicsPriority : 1;/* 0x6bc:9 4 */ unsigned long CommitFailLogged : 1;/* 0x6bc:10 4 */ unsigned long ReserveFailLogged : 1;/* 0x6bc:11 4 */ unsigned long SystemProcess : 1;/* 0x6bc:12 4 */ unsigned long AllImagesAtBasePristineBase : 1;/* 0x6bc:13 4 */ unsigned long AddressPolicyFrozen : 1;/* 0x6bc:14 4 */ unsigned long ProcessFirstResume : 1;/* 0x6bc:15 4 */ unsigned long ForegroundExternal : 1;/* 0x6bc:16 4 */ unsigned long ForegroundSystem : 1;/* 0x6bc:17 4 */ unsigned long HighMemoryPriority : 1;/* 0x6bc:18 4 */ unsigned long EnableProcessSuspendResumeLogging : 1;/* 0x6bc:19 4 */ unsigned long EnableThreadSuspendResumeLogging : 1;/* 0x6bc:20 4 */ unsigned long SecurityDomainChanged : 1;/* 0x6bc:21 4 */ unsigned long SecurityFreezeComplete : 1;/* 0x6bc:22 4 */ unsigned long VmProcessorHost : 1;/* 0x6bc:23 4 */ unsigned long VmProcessorHostTransition : 1;/* 0x6bc:24 4 */ unsigned long AltSyscall : 1;/* 0x6bc:25 4 */ unsigned long TimerResolutionIgnore : 1;/* 0x6bc:26 4 */ unsigned long DisallowUserTerminate : 1;/* 0x6bc:27 4 */ unsigned long EnableProcessRemoteExecProtectVmLogging : 1;/* 0x6bc:28 4 */ unsigned long EnableProcessLocalExecProtectVmLogging : 1;/* 0x6bc:29 4 */ unsigned long MemoryCompressionProcess : 1;/* 0x6bc:30 4 */ unsigned long EnableProcessImpersonationLogging : 1;/* 0x6bc:31 4 */ };/* 0x6bc 4 */ };/* 0x6bc 4 */ /* ── cacheline 27 boundary (1728 bytes) ── */ long DeviceAsid;/* 0x6c0 4 */ /* 4 bytes padding */ void* SvmData;/* 0x6c8 8 */ struct _EX_PUSH_LOCK SvmProcessLock;/* 0x6d0 8 */ unsigned __int64 SvmLock;/* 0x6d8 8 */ struct _LIST_ENTRY SvmProcessDeviceListHead;/* 0x6e0 16 */ unsigned __int64 LastFreezeInterruptTime;/* 0x6f0 8 */ struct _PROCESS_DISK_COUNTERS* DiskCounters;/* 0x6f8 8 */ /* ── cacheline 28 boundary (1792 bytes) ── */ void* PicoContext;/* 0x700 8 */ void* EnclaveTable;/* 0x708 8 */ unsigned __int64 EnclaveNumber;/* 0x710 8 */ struct _EX_PUSH_LOCK EnclaveLock;/* 0x718 8 */ unsigned long HighPriorityFaultsAllowed;/* 0x720 4 */ /* 4 bytes padding */ struct _PO_PROCESS_ENERGY_CONTEXT* EnergyContext;/* 0x728 8 */ void* VmContext;/* 0x730 8 */ unsigned __int64 SequenceNumber;/* 0x738 8 */ /* ── cacheline 29 boundary (1856 bytes) ── */ unsigned __int64 CreateInterruptTime;/* 0x740 8 */ unsigned __int64 CreateUnbiasedInterruptTime;/* 0x748 8 */ unsigned __int64 TotalUnbiasedFrozenTime;/* 0x750 8 */ unsigned __int64 LastAppStateUpdateTime;/* 0x758 8 */ unsigned __int64 LastAppStateUptime : 61;/* 0x760:0 8 */ unsigned __int64 LastAppState : 3;/* 0x760:61 8 */ volatile unsigned __int64 SharedCommitCharge;/* 0x768 8 */ struct _EX_PUSH_LOCK SharedCommitLock;/* 0x770 8 */ struct _LIST_ENTRY SharedCommitLinks;/* 0x778 16 */ /* ── cacheline 30 boundary (1920 bytes) ── */ union { struct { unsigned __int64 AllowedCpuSets;/* 0x788 8 */ unsigned __int64 DefaultCpuSets;/* 0x790 8 */ };/* 0x788 16 */ struct { unsigned __int64* AllowedCpuSetsIndirect;/* 0x788 8 */ unsigned __int64* DefaultCpuSetsIndirect;/* 0x790 8 */ };/* 0x788 16 */ };/* 0x788 16 */ void* DiskIoAttribution;/* 0x798 8 */ void* DxgProcess;/* 0x7a0 8 */ unsigned long Win32KFilterSet;/* 0x7a8 4 */ unsigned short Machine;/* 0x7ac 2 */ unsigned char MmSlabIdentity;/* 0x7ae 1 */ unsigned char Spare0;/* 0x7af 1 */ volatile union _PS_INTERLOCKED_TIMER_DELAY_VALUES ProcessTimerDelay;/* 0x7b0 8 */ volatile unsigned long KTimerSets;/* 0x7b8 4 */ volatile unsigned long KTimer2Sets;/* 0x7bc 4 */ /* ── cacheline 31 boundary (1984 bytes) ── */ volatile unsigned long ThreadTimerSets;/* 0x7c0 4 */ /* 4 bytes padding */ unsigned __int64 VirtualTimerListLock;/* 0x7c8 8 */ struct _LIST_ENTRY VirtualTimerListHead;/* 0x7d0 16 */ union { struct _WNF_STATE_NAME WakeChannel;/* 0x7e0 8 */ struct _PS_PROCESS_WAKE_INFORMATION WakeInfo;/* 0x7e0 48 */ };/* 0x7e0 48 */ /* ── cacheline 32 boundary (2048 bytes) ── */ union { unsigned long MitigationFlags;/* 0x810 4 */ struct { unsigned long ControlFlowGuardEnabled : 1;/* 0x810:0 4 */ unsigned long ControlFlowGuardExportSuppressionEnabled : 1;/* 0x810:1 4 */ unsigned long ControlFlowGuardStrict : 1;/* 0x810:2 4 */ unsigned long DisallowStrippedImages : 1;/* 0x810:3 4 */ unsigned long ForceRelocateImages : 1;/* 0x810:4 4 */ unsigned long HighEntropyASLREnabled : 1;/* 0x810:5 4 */ unsigned long StackRandomizationDisabled : 1;/* 0x810:6 4 */ unsigned long ExtensionPointDisable : 1;/* 0x810:7 4 */ unsigned long DisableDynamicCode : 1;/* 0x810:8 4 */ unsigned long DisableDynamicCodeAllowOptOut : 1;/* 0x810:9 4 */ unsigned long DisableDynamicCodeAllowRemoteDowngrade : 1;/* 0x810:10 4 */ unsigned long AuditDisableDynamicCode : 1;/* 0x810:11 4 */ unsigned long DisallowWin32kSystemCalls : 1;/* 0x810:12 4 */ unsigned long AuditDisallowWin32kSystemCalls : 1;/* 0x810:13 4 */ unsigned long EnableFilteredWin32kAPIs : 1;/* 0x810:14 4 */ unsigned long AuditFilteredWin32kAPIs : 1;/* 0x810:15 4 */ unsigned long DisableNonSystemFonts : 1;/* 0x810:16 4 */ unsigned long AuditNonSystemFontLoading : 1;/* 0x810:17 4 */ unsigned long PreferSystem32Images : 1;/* 0x810:18 4 */ unsigned long ProhibitRemoteImageMap : 1;/* 0x810:19 4 */ unsigned long AuditProhibitRemoteImageMap : 1;/* 0x810:20 4 */ unsigned long ProhibitLowILImageMap : 1;/* 0x810:21 4 */ unsigned long AuditProhibitLowILImageMap : 1;/* 0x810:22 4 */ unsigned long SignatureMitigationOptIn : 1;/* 0x810:23 4 */ unsigned long AuditBlockNonMicrosoftBinaries : 1;/* 0x810:24 4 */ unsigned long AuditBlockNonMicrosoftBinariesAllowStore : 1;/* 0x810:25 4 */ unsigned long LoaderIntegrityContinuityEnabled : 1;/* 0x810:26 4 */ unsigned long AuditLoaderIntegrityContinuity : 1;/* 0x810:27 4 */ unsigned long EnableModuleTamperingProtection : 1;/* 0x810:28 4 */ unsigned long EnableModuleTamperingProtectionNoInherit : 1;/* 0x810:29 4 */ unsigned long RestrictIndirectBranchPrediction : 1;/* 0x810:30 4 */ unsigned long IsolateSecurityDomain : 1;/* 0x810:31 4 */ } MitigationFlagsValues;/* 0x810 4 */ };/* 0x810 4 */ union { unsigned long MitigationFlags2;/* 0x814 4 */ struct { unsigned long EnableExportAddressFilter : 1;/* 0x814:0 4 */ unsigned long AuditExportAddressFilter : 1;/* 0x814:1 4 */ unsigned long EnableExportAddressFilterPlus : 1;/* 0x814:2 4 */ unsigned long AuditExportAddressFilterPlus : 1;/* 0x814:3 4 */ unsigned long EnableRopStackPivot : 1;/* 0x814:4 4 */ unsigned long AuditRopStackPivot : 1;/* 0x814:5 4 */ unsigned long EnableRopCallerCheck : 1;/* 0x814:6 4 */ unsigned long AuditRopCallerCheck : 1;/* 0x814:7 4 */ unsigned long EnableRopSimExec : 1;/* 0x814:8 4 */ unsigned long AuditRopSimExec : 1;/* 0x814:9 4 */ unsigned long EnableImportAddressFilter : 1;/* 0x814:10 4 */ unsigned long AuditImportAddressFilter : 1;/* 0x814:11 4 */ unsigned long DisablePageCombine : 1;/* 0x814:12 4 */ unsigned long SpeculativeStoreBypassDisable : 1;/* 0x814:13 4 */ unsigned long CetUserShadowStacks : 1;/* 0x814:14 4 */ unsigned long AuditCetUserShadowStacks : 1;/* 0x814:15 4 */ unsigned long AuditCetUserShadowStacksLogged : 1;/* 0x814:16 4 */ unsigned long UserCetSetContextIpValidation : 1;/* 0x814:17 4 */ unsigned long AuditUserCetSetContextIpValidation : 1;/* 0x814:18 4 */ unsigned long AuditUserCetSetContextIpValidationLogged : 1;/* 0x814:19 4 */ unsigned long CetUserShadowStacksStrictMode : 1;/* 0x814:20 4 */ unsigned long BlockNonCetBinaries : 1;/* 0x814:21 4 */ unsigned long BlockNonCetBinariesNonEhcont : 1;/* 0x814:22 4 */ unsigned long AuditBlockNonCetBinaries : 1;/* 0x814:23 4 */ unsigned long AuditBlockNonCetBinariesLogged : 1;/* 0x814:24 4 */ unsigned long XtendedControlFlowGuard_Deprecated : 1;/* 0x814:25 4 */ unsigned long AuditXtendedControlFlowGuard_Deprecated : 1;/* 0x814:26 4 */ unsigned long PointerAuthUserIp : 1;/* 0x814:27 4 */ unsigned long AuditPointerAuthUserIp : 1;/* 0x814:28 4 */ unsigned long AuditPointerAuthUserIpLogged : 1;/* 0x814:29 4 */ unsigned long CetDynamicApisOutOfProcOnly : 1;/* 0x814:30 4 */ unsigned long UserCetSetContextIpValidationRelaxedMode : 1;/* 0x814:31 4 */ } MitigationFlags2Values;/* 0x814 4 */ };/* 0x814 4 */ void* PartitionObject;/* 0x818 8 */ unsigned __int64 SecurityDomain;/* 0x820 8 */ unsigned __int64 ParentSecurityDomain;/* 0x828 8 */ void* CoverageSamplerContext;/* 0x830 8 */ void* MmHotPatchContext;/* 0x838 8 */ /* ── cacheline 33 boundary (2112 bytes) ── */ struct _RTL_AVL_TREE DynamicEHContinuationTargetsTree;/* 0x840 8 */ struct _EX_PUSH_LOCK DynamicEHContinuationTargetsLock;/* 0x848 8 */ unsigned __int64 PointerAuthUserIpKey[2];/* 0x850 16 */ struct _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES DynamicEnforcedCetCompatibleRanges;/* 0x860 16 */ unsigned long DisabledComponentFlags;/* 0x870 4 */ volatile long PageCombineSequence;/* 0x874 4 */ unsigned long* PathRedirectionHashes;/* 0x878 8 */ /* ── cacheline 34 boundary (2176 bytes) ── */ void* SyscallProviderReserved[4];/* 0x880 32 */ union { unsigned long MitigationFlags3;/* 0x8a0 4 */ struct { unsigned long RestrictCoreSharing : 1;/* 0x8a0:0 4 */ unsigned long DisallowFsctlSystemCalls : 1;/* 0x8a0:1 4 */ unsigned long AuditDisallowFsctlSystemCalls : 1;/* 0x8a0:2 4 */ unsigned long MitigationFlags3Spare : 29;/* 0x8a0:3 4 */ } MitigationFlags3Values;/* 0x8a0 4 */ };/* 0x8a0 4 */ union { unsigned long Flags4;/* 0x8a4 4 */ struct { unsigned long ThreadWasActive : 1;/* 0x8a4:0 4 */ unsigned long MinimalTerminate : 1;/* 0x8a4:1 4 */ unsigned long ImageExpansionDisable : 1;/* 0x8a4:2 4 */ unsigned long SessionFirstProcess : 1;/* 0x8a4:3 4 */ };/* 0x8a4 4 */ };/* 0x8a4 4 */ union { unsigned long SyscallUsage;/* 0x8a8 4 */ struct { unsigned long SystemModuleInformation : 1;/* 0x8a8:0 4 */ unsigned long SystemModuleInformationEx : 1;/* 0x8a8:1 4 */ unsigned long SystemLocksInformation : 1;/* 0x8a8:2 4 */ unsigned long SystemStackTraceInformation : 1;/* 0x8a8:3 4 */ unsigned long SystemHandleInformation : 1;/* 0x8a8:4 4 */ unsigned long SystemExtendedHandleInformation : 1;/* 0x8a8:5 4 */ unsigned long SystemObjectInformation : 1;/* 0x8a8:6 4 */ unsigned long SystemBigPoolInformation : 1;/* 0x8a8:7 4 */ unsigned long SystemExtendedProcessInformation : 1;/* 0x8a8:8 4 */ unsigned long SystemSessionProcessInformation : 1;/* 0x8a8:9 4 */ unsigned long SystemMemoryTopologyInformation : 1;/* 0x8a8:10 4 */ unsigned long SystemMemoryChannelInformation : 1;/* 0x8a8:11 4 */ unsigned long SystemUnused : 1;/* 0x8a8:12 4 */ unsigned long SystemPlatformBinaryInformation : 1;/* 0x8a8:13 4 */ unsigned long SystemFirmwareTableInformation : 1;/* 0x8a8:14 4 */ unsigned long SystemBootMetadataInformation : 1;/* 0x8a8:15 4 */ unsigned long SystemWheaIpmiHardwareInformation : 1;/* 0x8a8:16 4 */ unsigned long SystemSuperfetchPrefetch : 1;/* 0x8a8:17 4 */ unsigned long SystemSuperfetchPfnQuery : 1;/* 0x8a8:18 4 */ unsigned long SystemSuperfetchPrivSourceQuery : 1;/* 0x8a8:19 4 */ unsigned long SystemSuperfetchMemoryListQuery : 1;/* 0x8a8:20 4 */ unsigned long SystemSuperfetchMemoryRangesQuery : 1;/* 0x8a8:21 4 */ unsigned long SystemSuperfetchPfnSetPriority : 1;/* 0x8a8:22 4 */ unsigned long SystemSuperfetchMovePages : 1;/* 0x8a8:23 4 */ unsigned long SystemSuperfetchPfnSetPageHeat : 1;/* 0x8a8:24 4 */ unsigned long SysDbgGetTriageDump : 1;/* 0x8a8:25 4 */ unsigned long SysDbgGetLiveKernelDump : 1;/* 0x8a8:26 4 */ unsigned long SyscallUsageValuesSpare : 5;/* 0x8a8:27 4 */ } SyscallUsageValues;/* 0x8a8 4 */ };/* 0x8a8 4 */ long SupervisorDeviceAsid;/* 0x8ac 4 */ void* SupervisorSvmData;/* 0x8b0 8 */ struct _PROCESS_NETWORK_COUNTERS* NetworkCounters;/* 0x8b8 8 */ /* ── cacheline 35 boundary (2240 bytes) ── */ union _PROCESS_EXECUTION Execution;/* 0x8c0 4 */ /* 4 bytes padding */ void* ThreadIndexTable;/* 0x8c8 8 */};size 2304 (0x900)258 members6 holes (60 bytes)padding 4836 cachelines
Used in (32)
_ALPC_COMPLETION_LIST_ALPC_PORT_DBGK_SILOSTATE_DIAGNOSTIC_CONTEXT_EPARTITION_ESERVERSILO_GLOBALS_ETW_REALTIME_CONSUMER_ETW_REG_ENTRY_HANDLE_TABLE_KALPC_MESSAGE_KALPC_SECTION_KALPC_SECURITY_DATA_KALPC_VIEW_KRESOURCEMANAGER_COMPLETION_BINDING_LOCK_TRACKER_MDL_MI_PARTITION_STORES_MI_REVERSE_VIEW_MAP_MMVAD_MM_PAGE_ACCESS_INFO_HEADER_NONOPAQUE_OPLOCK_OBJECT_HANDLE_COUNT_ENTRY_OBJECT_HEADER_PROCESS_INFO_OB_DUPLICATE_OBJECT_STATE_POOL_HEADER_POOL_TRACKER_BIG_PAGES_POP_SHUTDOWN_BUG_CHECK_RH_OP_CONTEXT_WNF_NAME_INSTANCE_WNF_PROCESS_CONTEXT_WNF_SUBSCRIPTION_WORK_QUEUE_ENTRY