struct _EPROCESS { struct _KPROCESS Pcb;/* 0x0 224 */ /* ── cacheline 3 boundary (192 bytes) ── */ struct _EX_PUSH_LOCK ProcessLock;/* 0xe0 8 */ union _LARGE_INTEGER CreateTime;/* 0xe8 8 */ union _LARGE_INTEGER ExitTime;/* 0xf0 8 */ struct _EX_RUNDOWN_REF RundownProtect;/* 0xf8 8 */ /* ── cacheline 4 boundary (256 bytes) ── */ void* UniqueProcessId;/* 0x100 8 */ struct _LIST_ENTRY ActiveProcessLinks;/* 0x108 16 */ unsigned __int64 QuotaUsage[3];/* 0x118 24 */ unsigned __int64 QuotaPeak[3];/* 0x130 24 */ /* ── cacheline 5 boundary (320 bytes) ── */ volatile unsigned __int64 CommitCharge;/* 0x148 8 */ unsigned __int64 PeakVirtualSize;/* 0x150 8 */ unsigned __int64 VirtualSize;/* 0x158 8 */ struct _LIST_ENTRY SessionProcessLinks;/* 0x160 16 */ void* DebugPort;/* 0x170 8 */ union { void* ExceptionPortData;/* 0x178 8 */ unsigned __int64 ExceptionPortValue;/* 0x178 8 */ unsigned __int64 ExceptionPortState : 3;/* 0x178:0 8 */ };/* 0x178 8 */ /* ── cacheline 6 boundary (384 bytes) ── */ struct _HANDLE_TABLE* ObjectTable;/* 0x180 8 */ struct _EX_FAST_REF Token;/* 0x188 8 */ unsigned __int64 WorkingSetPage;/* 0x190 8 */ struct _EX_PUSH_LOCK AddressCreationLock;/* 0x198 8 */ struct _ETHREAD* RotateInProgress;/* 0x1a0 8 */ struct _ETHREAD* ForkInProgress;/* 0x1a8 8 */ unsigned __int64 HardwareTrigger;/* 0x1b0 8 */ struct _MM_AVL_TABLE* PhysicalVadRoot;/* 0x1b8 8 */ /* ── cacheline 7 boundary (448 bytes) ── */ void* CloneRoot;/* 0x1c0 8 */ volatile unsigned __int64 NumberOfPrivatePages;/* 0x1c8 8 */ volatile unsigned __int64 NumberOfLockedPages;/* 0x1d0 8 */ void* Win32Process;/* 0x1d8 8 */ struct _EJOB* Job;/* 0x1e0 8 */ void* SectionObject;/* 0x1e8 8 */ void* SectionBaseAddress;/* 0x1f0 8 */ struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;/* 0x1f8 8 */ /* ── cacheline 8 boundary (512 bytes) ── */ struct _PAGEFAULT_HISTORY* WorkingSetWatch;/* 0x200 8 */ void* Win32WindowStation;/* 0x208 8 */ void* InheritedFromUniqueProcessId;/* 0x210 8 */ void* LdtInformation;/* 0x218 8 */ struct _EX_PUSH_LOCK AlternateTableLock;/* 0x220 8 */ void* VdmObjects;/* 0x228 8 */ void* DeviceMap;/* 0x230 8 */ void* EtwDataSource;/* 0x238 8 */ /* ── cacheline 9 boundary (576 bytes) ── */ void* FreeTebHint;/* 0x240 8 */ union { struct _HARDWARE_PTE PageDirectoryPte;/* 0x248 8 */ unsigned __int64 Filler;/* 0x248 8 */ };/* 0x248 8 */ void* Session;/* 0x250 8 */ unsigned char ImageFileName[16];/* 0x258 16 */ struct _LIST_ENTRY JobLinks;/* 0x268 16 */ void* LockedPagesList;/* 0x278 8 */ /* ── cacheline 10 boundary (640 bytes) ── */ struct _LIST_ENTRY ThreadListHead;/* 0x280 16 */ void* SecurityPort;/* 0x290 8 */ void* Wow64Process;/* 0x298 8 */ volatile unsigned long ActiveThreads;/* 0x2a0 4 */ unsigned long ImagePathHash;/* 0x2a4 4 */ unsigned long DefaultHardErrorProcessing;/* 0x2a8 4 */ long LastThreadExitStatus;/* 0x2ac 4 */ struct _PEB* Peb;/* 0x2b0 8 */ struct _EX_FAST_REF PrefetchTrace;/* 0x2b8 8 */ /* ── cacheline 11 boundary (704 bytes) ── */ union _LARGE_INTEGER ReadOperationCount;/* 0x2c0 8 */ union _LARGE_INTEGER WriteOperationCount;/* 0x2c8 8 */ union _LARGE_INTEGER OtherOperationCount;/* 0x2d0 8 */ union _LARGE_INTEGER ReadTransferCount;/* 0x2d8 8 */ union _LARGE_INTEGER WriteTransferCount;/* 0x2e0 8 */ union _LARGE_INTEGER OtherTransferCount;/* 0x2e8 8 */ unsigned __int64 CommitChargeLimit;/* 0x2f0 8 */ volatile unsigned __int64 CommitChargePeak;/* 0x2f8 8 */ /* ── cacheline 12 boundary (768 bytes) ── */ void* AweInfo;/* 0x300 8 */ struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;/* 0x308 8 */ struct _MMSUPPORT Vm;/* 0x310 104 */ /* ── cacheline 13 boundary (832 bytes) ── */ struct _LIST_ENTRY MmProcessLinks;/* 0x378 16 */ /* ── cacheline 14 boundary (896 bytes) ── */ unsigned long ModifiedPageCount;/* 0x388 4 */ union { unsigned long Flags2;/* 0x38c 4 */ struct { unsigned long JobNotReallyActive : 1;/* 0x38c:0 4 */ unsigned long AccountingFolded : 1;/* 0x38c:1 4 */ unsigned long NewProcessReported : 1;/* 0x38c:2 4 */ unsigned long ExitProcessReported : 1;/* 0x38c:3 4 */ unsigned long ReportCommitChanges : 1;/* 0x38c:4 4 */ unsigned long LastReportMemory : 1;/* 0x38c:5 4 */ unsigned long ReportPhysicalPageChanges : 1;/* 0x38c:6 4 */ unsigned long HandleTableRundown : 1;/* 0x38c:7 4 */ unsigned long NeedsHandleRundown : 1;/* 0x38c:8 4 */ unsigned long RefTraceEnabled : 1;/* 0x38c:9 4 */ unsigned long NumaAware : 1;/* 0x38c:10 4 */ unsigned long ProtectedProcess : 1;/* 0x38c:11 4 */ unsigned long DefaultPagePriority : 3;/* 0x38c:12 4 */ unsigned long PrimaryTokenFrozen : 1;/* 0x38c:15 4 */ unsigned long ProcessVerifierTarget : 1;/* 0x38c:16 4 */ unsigned long StackRandomizationDisabled : 1;/* 0x38c:17 4 */ unsigned long AffinityPermanent : 1;/* 0x38c:18 4 */ unsigned long AffinityUpdateEnable : 1;/* 0x38c:19 4 */ unsigned long CrossSessionCreate : 1;/* 0x38c:20 4 */ };/* 0x38c 4 */ };/* 0x38c 4 */ union { unsigned long Flags;/* 0x390 4 */ struct { unsigned long CreateReported : 1;/* 0x390:0 4 */ unsigned long NoDebugInherit : 1;/* 0x390:1 4 */ unsigned long ProcessExiting : 1;/* 0x390:2 4 */ unsigned long ProcessDelete : 1;/* 0x390:3 4 */ unsigned long Wow64SplitPages : 1;/* 0x390:4 4 */ unsigned long VmDeleted : 1;/* 0x390:5 4 */ unsigned long OutswapEnabled : 1;/* 0x390:6 4 */ unsigned long Outswapped : 1;/* 0x390:7 4 */ unsigned long ForkFailed : 1;/* 0x390:8 4 */ unsigned long Wow64VaSpace4Gb : 1;/* 0x390:9 4 */ unsigned long AddressSpaceInitialized : 2;/* 0x390:10 4 */ unsigned long SetTimerResolution : 1;/* 0x390:12 4 */ unsigned long BreakOnTermination : 1;/* 0x390:13 4 */ unsigned long DeprioritizeViews : 1;/* 0x390:14 4 */ unsigned long WriteWatch : 1;/* 0x390:15 4 */ unsigned long ProcessInSession : 1;/* 0x390:16 4 */ unsigned long OverrideAddressSpace : 1;/* 0x390:17 4 */ unsigned long HasAddressSpace : 1;/* 0x390:18 4 */ unsigned long LaunchPrefetched : 1;/* 0x390:19 4 */ unsigned long InjectInpageErrors : 1;/* 0x390:20 4 */ unsigned long VmTopDown : 1;/* 0x390:21 4 */ unsigned long ImageNotifyDone : 1;/* 0x390:22 4 */ unsigned long PdeUpdateNeeded : 1;/* 0x390:23 4 */ unsigned long VdmAllowed : 1;/* 0x390:24 4 */ unsigned long SmapAllowed : 1;/* 0x390:25 4 */ unsigned long ProcessInserted : 1;/* 0x390:26 4 */ unsigned long DefaultIoPriority : 3;/* 0x390:27 4 */ unsigned long ProcessSelfDelete : 1;/* 0x390:30 4 */ unsigned long SpareProcessFlags : 1;/* 0x390:31 4 */ };/* 0x390 4 */ };/* 0x390 4 */ long ExitStatus;/* 0x394 4 */ unsigned short Spare7;/* 0x398 2 */ union { struct { unsigned char SubSystemMinorVersion;/* 0x39a 1 */ unsigned char SubSystemMajorVersion;/* 0x39b 1 */ };/* 0x39a 2 */ unsigned short SubSystemVersion;/* 0x39a 2 */ };/* 0x39a 2 */ unsigned char PriorityClass;/* 0x39c 1 */ /* 3 bytes padding */ struct _MM_AVL_TABLE VadRoot;/* 0x3a0 64 */ /* ── cacheline 15 boundary (960 bytes) ── */ unsigned long Cookie;/* 0x3e0 4 */ /* 4 bytes padding */ struct _ALPC_PROCESS_CONTEXT AlpcContext;/* 0x3e8 32 */};size 1032 (0x408)129 members2 holes (7 bytes)padding 017 cachelines
Used in (17)