_KUSER_SHARED_DATA

Metadatacopy
struct _KUSER_SHARED_DATA {
    unsigned long TickCountLowDeprecated;/* 0x0  4 */
    unsigned long TickCountMultiplier;/* 0x4  4 */
    volatile struct _KSYSTEM_TIME InterruptTime;/* 0x8  12 */
    volatile struct _KSYSTEM_TIME SystemTime;/* 0x14  12 */
    volatile struct _KSYSTEM_TIME TimeZoneBias;/* 0x20  12 */
    unsigned short ImageNumberLow;/* 0x2c  2 */
    unsigned short ImageNumberHigh;/* 0x2e  2 */
    wchar_t NtSystemRoot[260];/* 0x30  520 */
    /* ── cacheline 8 boundary (512 bytes) ── */
    unsigned long MaxStackTraceDepth;/* 0x238  4 */
    unsigned long CryptoExponent;/* 0x23c  4 */
    /* ── cacheline 9 boundary (576 bytes) ── */
    unsigned long TimeZoneId;/* 0x240  4 */
    unsigned long LargePageMinimum;/* 0x244  4 */
    unsigned long Reserved2[7];/* 0x248  28 */
    enum _NT_PRODUCT_TYPE NtProductType;/* 0x264  4 */
    unsigned char ProductTypeIsValid;/* 0x268  1 */
    /* 3 bytes padding */
    unsigned long NtMajorVersion;/* 0x26c  4 */
    unsigned long NtMinorVersion;/* 0x270  4 */
    unsigned char ProcessorFeatures[64];/* 0x274  64 */
    /* ── cacheline 10 boundary (640 bytes) ── */
    unsigned long Reserved1;/* 0x2b4  4 */
    unsigned long Reserved3;/* 0x2b8  4 */
    volatile unsigned long TimeSlip;/* 0x2bc  4 */
    /* ── cacheline 11 boundary (704 bytes) ── */
    enum _ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;/* 0x2c0  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER SystemExpirationDate;/* 0x2c8  8 */
    unsigned long SuiteMask;/* 0x2d0  4 */
    unsigned char KdDebuggerEnabled;/* 0x2d4  1 */
    unsigned char NXSupportPolicy;/* 0x2d5  1 */
    /* 2 bytes padding */
    volatile unsigned long ActiveConsoleId;/* 0x2d8  4 */
    volatile unsigned long DismountCount;/* 0x2dc  4 */
    unsigned long ComPlusPackage;/* 0x2e0  4 */
    unsigned long LastSystemRITEventTickCount;/* 0x2e4  4 */
    unsigned long NumberOfPhysicalPages;/* 0x2e8  4 */
    unsigned char SafeBootMode;/* 0x2ec  1 */
    /* 3 bytes padding */
    union {
        unsigned long SharedDataFlags;/* 0x2f0  4 */
        struct {
            unsigned long DbgErrorPortPresent : 1;/* 0x2f0:0  4 */
            unsigned long DbgElevationEnabled : 1;/* 0x2f0:1  4 */
            unsigned long DbgVirtEnabled : 1;/* 0x2f0:2  4 */
            unsigned long DbgInstallerDetectEnabled : 1;/* 0x2f0:3  4 */
            unsigned long DbgSystemDllRelocated : 1;/* 0x2f0:4  4 */
            unsigned long DbgDynProcessorEnabled : 1;/* 0x2f0:5  4 */
            unsigned long DbgSEHValidationEnabled : 1;/* 0x2f0:6  4 */
            unsigned long SpareBits : 25;/* 0x2f0:7  4 */
        };/* 0x2f0  4 */
    };/* 0x2f0  4 */
    /* 4 bytes padding */
    unsigned __int64 TestRetInstruction;/* 0x2f8  8 */
    /* ── cacheline 12 boundary (768 bytes) ── */
    unsigned long SystemCall;/* 0x300  4 */
    unsigned long SystemCallReturn;/* 0x304  4 */
    unsigned __int64 SystemCallPad[3];/* 0x308  24 */
    union {
        volatile struct _KSYSTEM_TIME TickCount;/* 0x320  12 */
        volatile unsigned __int64 TickCountQuad;/* 0x320  8 */
    };/* 0x320  12 */
    /* 4 bytes padding */
    unsigned long Cookie;/* 0x330  4 */
    /* 4 bytes padding */
    __int64 ConsoleSessionForegroundProcessId;/* 0x338  8 */
    /* ── cacheline 13 boundary (832 bytes) ── */
    unsigned long Wow64SharedInformation[16];/* 0x340  64 */
    /* ── cacheline 14 boundary (896 bytes) ── */
    unsigned short UserModeGlobalLogger[8];/* 0x380  16 */
    unsigned long HeapTracingPid[2];/* 0x390  8 */
    unsigned long CritSecTracingPid[2];/* 0x398  8 */
    unsigned long ImageFileExecutionOptions;/* 0x3a0  4 */
    unsigned long LangGenerationCount;/* 0x3a4  4 */
    union {
        unsigned __int64 AffinityPad;/* 0x3a8  8 */
        unsigned __int64 ActiveProcessorAffinity;/* 0x3a8  8 */
    };/* 0x3a8  8 */
    volatile unsigned __int64 InterruptTimeBias;/* 0x3b0  8 */
};