_MM_SESSION_SPACE

Metadatacopy
struct _MM_SESSION_SPACE {
    volatile long ReferenceCount;/* 0x0  4 */
    union {
        unsigned long LongFlags;/* 0x4  4 */
        struct _MM_SESSION_SPACE_FLAGS Flags;/* 0x4  4 */
    } u;/* 0x4  4 */
    unsigned long SessionId;/* 0x8  4 */
    volatile long ProcessReferenceToSession;/* 0xc  4 */
    struct _LIST_ENTRY ProcessList;/* 0x10  16 */
    union _LARGE_INTEGER LastProcessSwappedOutTime;/* 0x20  8 */
    unsigned __int64 SessionPageDirectoryIndex;/* 0x28  8 */
    volatile unsigned __int64 NonPagablePages;/* 0x30  8 */
    volatile unsigned __int64 CommittedPages;/* 0x38  8 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    void* PagedPoolStart;/* 0x40  8 */
    void* PagedPoolEnd;/* 0x48  8 */
    void* SessionObject;/* 0x50  8 */
    void* SessionObjectHandle;/* 0x58  8 */
    volatile long ResidentProcessCount;/* 0x60  4 */
    volatile long ImageLoadingCount;/* 0x64  4 */
    unsigned long SessionPoolAllocationFailures[4];/* 0x68  16 */
    struct _LIST_ENTRY ImageList;/* 0x78  16 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long LocaleId;/* 0x88  4 */
    unsigned long AttachCount;/* 0x8c  4 */
    struct _KGATE AttachGate;/* 0x90  24 */
    struct _LIST_ENTRY WsListEntry;/* 0xa8  16 */
    /* 72 bytes padding */
    /* ── cacheline 4 boundary (256 bytes) ── */
    struct _GENERAL_LOOKASIDE Lookaside[53];/* 0x100  6784 */
    /* ── cacheline 110 boundary (7040 bytes) ── */
    struct _MMSESSION Session;/* 0x1b80  88 */
    /* ── cacheline 111 boundary (7104 bytes) ── */
    struct _MM_PAGED_POOL_INFO PagedPoolInfo;/* 0x1bd8  104 */
    /* ── cacheline 113 boundary (7232 bytes) ── */
    struct _MMSUPPORT Vm;/* 0x1c40  104 */
    /* ── cacheline 114 boundary (7296 bytes) ── */
    struct _MMWSLE* Wsle;/* 0x1ca8  8 */
    void (*DriverUnload)(struct _DRIVER_OBJECT*);/* 0x1cb0  8 */
    struct _POOL_DESCRIPTOR PagedPool;/* 0x1cb8  8264 */
    /* ── cacheline 244 boundary (15616 bytes) ── */
    struct _MMPTE PageDirectory;/* 0x3d00  8 */
    struct _KGUARDED_MUTEX SessionVaLock;/* 0x3d08  56 */
    /* ── cacheline 245 boundary (15680 bytes) ── */
    struct _RTL_BITMAP DynamicVaBitMap;/* 0x3d40  16 */
    unsigned long DynamicVaHint;/* 0x3d50  4 */
    /* 4 bytes padding */
    struct _MI_SPECIAL_POOL SpecialPool;/* 0x3d58  48 */
    /* ── cacheline 246 boundary (15744 bytes) ── */
    struct _KGUARDED_MUTEX SessionPteLock;/* 0x3d88  56 */
    /* ── cacheline 247 boundary (15808 bytes) ── */
    long PoolBigEntriesInUse;/* 0x3dc0  4 */
    unsigned long PagedPoolPdeCount;/* 0x3dc4  4 */
    unsigned long SpecialPoolPdeCount;/* 0x3dc8  4 */
    unsigned long DynamicSessionPdeCount;/* 0x3dcc  4 */
    struct _MI_SYSTEM_PTE_TYPE SystemPteInfo;/* 0x3dd0  72 */
    /* ── cacheline 248 boundary (15872 bytes) ── */
    void* PoolTrackTableExpansion;/* 0x3e18  8 */
    unsigned __int64 PoolTrackTableExpansionSize;/* 0x3e20  8 */
    void* PoolTrackBigPages;/* 0x3e28  8 */
    unsigned __int64 PoolTrackBigPagesSize;/* 0x3e30  8 */
    struct _REGION_MAP_INFO SessionMapInfo;/* 0x3e38  16 */
    /* ── cacheline 249 boundary (15936 bytes) ── */
    unsigned __int64 PageDirectoryParentPage;/* 0x3e48  8 */
};