x64x86arm64ia64 / ntdllntoskrnl

_KPROCESS

← 5.2.3790.3959 3 builds latest →
struct _KPROCESS {
unsigned __int64 DirectoryTableBase;/* 0x28 8 */
unsigned __int64 Unused0;/* 0x30 8 */
/* ── cacheline 1 boundary (64 bytes) ── */
unsigned __int64 SessionParentBase;/* 0x50 8 */
volatile unsigned __int64 ActiveProcessors;/* 0x58 8 */
unsigned long KernelTime;/* 0x60 4 */
unsigned long UserTime;/* 0x64 4 */
/* ── cacheline 2 boundary (128 bytes) ── */
void* Reserved1;/* 0x80 8 */
unsigned __int64 ProcessLock;/* 0x98 8 */
unsigned __int64 Affinity;/* 0xa0 8 */
union {
struct {
volatile long AutoAlignment : 1;/* 0xa8:0 4 */
volatile long DisableBoost : 1;/* 0xa8:1 4 */
volatile long DisableQuantum : 1;/* 0xa8:2 4 */
volatile long ReservedFlags : 29;/* 0xa8:3 4 */
};/* 0xa8 4 */
volatile long ProcessFlags;/* 0xa8 4 */
};/* 0xa8 4 */
char BasePriority;/* 0xac 1 */
char QuantumReset;/* 0xad 1 */
unsigned char State;/* 0xae 1 */
unsigned char ThreadSeed;/* 0xaf 1 */
unsigned char PowerState;/* 0xb0 1 */
unsigned char IdealNode;/* 0xb1 1 */
unsigned char Visited;/* 0xb2 1 */
union {
unsigned char ExecuteOptions;/* 0xb3 1 */
};/* 0xb3 1 */
/* 4 bytes padding */
/* ── cacheline 3 boundary (192 bytes) ── */
unsigned __int64 StackCount;/* 0xc0 8 */
volatile unsigned __int64 CycleTime;/* 0xd8 8 */
};
size 224 (0xe0)34 members1 hole (4 bytes)padding 04 cachelines
Used in (3)