struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength;/* 0x0 4 */ unsigned long Length;/* 0x4 4 */ unsigned long Flags;/* 0x8 4 */ unsigned long DebugFlags;/* 0xc 4 */ void* ConsoleHandle;/* 0x10 8 */ unsigned long ConsoleFlags;/* 0x18 4 */ /* 4 bytes padding */ void* StandardInput;/* 0x20 8 */ void* StandardOutput;/* 0x28 8 */ void* StandardError;/* 0x30 8 */ struct _CURDIR CurrentDirectory;/* 0x38 24 */ /* ── cacheline 1 boundary (64 bytes) ── */ struct _UNICODE_STRING DllPath;/* 0x50 16 */ struct _UNICODE_STRING ImagePathName;/* 0x60 16 */ struct _UNICODE_STRING CommandLine;/* 0x70 16 */ /* ── cacheline 2 boundary (128 bytes) ── */ void* Environment;/* 0x80 8 */ unsigned long StartingX;/* 0x88 4 */ unsigned long StartingY;/* 0x8c 4 */ unsigned long CountX;/* 0x90 4 */ unsigned long CountY;/* 0x94 4 */ unsigned long CountCharsX;/* 0x98 4 */ unsigned long CountCharsY;/* 0x9c 4 */ unsigned long FillAttribute;/* 0xa0 4 */ unsigned long WindowFlags;/* 0xa4 4 */ unsigned long ShowWindowFlags;/* 0xa8 4 */ /* 4 bytes padding */ struct _UNICODE_STRING WindowTitle;/* 0xb0 16 */ /* ── cacheline 3 boundary (192 bytes) ── */ struct _UNICODE_STRING DesktopInfo;/* 0xc0 16 */ struct _UNICODE_STRING ShellInfo;/* 0xd0 16 */ struct _UNICODE_STRING RuntimeData;/* 0xe0 16 */ struct _RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];/* 0xf0 768 */ /* ── cacheline 15 boundary (960 bytes) ── */ unsigned __int64 EnvironmentSize;/* 0x3f0 8 */ unsigned __int64 EnvironmentVersion;/* 0x3f8 8 */ /* ── cacheline 16 boundary (1024 bytes) ── */ void* PackageDependencyData;/* 0x400 8 */ unsigned long ProcessGroupId;/* 0x408 4 */ unsigned long LoaderThreads;/* 0x40c 4 */ struct _UNICODE_STRING RedirectionDllName;/* 0x410 16 */ struct _UNICODE_STRING HeapPartitionName;/* 0x420 16 */ unsigned __int64* DefaultThreadpoolCpuSetMasks;/* 0x430 8 */ unsigned long DefaultThreadpoolCpuSetMaskCount;/* 0x438 4 */ unsigned long DefaultThreadpoolThreadMaximum;/* 0x43c 4 */ /* ── cacheline 17 boundary (1088 bytes) ── */ unsigned long HeapMemoryTypeMask;/* 0x440 4 */};size 1096 (0x448)39 members2 holes (8 bytes)padding 418 cachelines
Used in (1)