_EPROCESS

Metadatacopy
struct _EPROCESS {
    struct _KPROCESS Pcb;/* 0x0  84 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    long ExitStatus;/* 0x54  4 */
    struct _KEVENT LockEvent;/* 0x58  16 */
    unsigned long LockCount;/* 0x68  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER CreateTime;/* 0x70  8 */
    union _LARGE_INTEGER ExitTime;/* 0x78  8 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    struct _KTHREAD* LockOwner;/* 0x80  4 */
    void* UniqueProcessId;/* 0x84  4 */
    struct _LIST_ENTRY ActiveProcessLinks;/* 0x88  8 */
    unsigned long QuotaPeakPoolUsage[2];/* 0x90  8 */
    unsigned long QuotaPoolUsage[2];/* 0x98  8 */
    unsigned long PagefileUsage;/* 0xa0  4 */
    unsigned long CommitCharge;/* 0xa4  4 */
    unsigned long PeakPagefileUsage;/* 0xa8  4 */
    unsigned long PeakVirtualSize;/* 0xac  4 */
    unsigned long VirtualSize;/* 0xb0  4 */
    /* 4 bytes padding */
    struct _MMSUPPORT Vm;/* 0xb8  48 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    void* LastProtoPteFault;/* 0xe8  4 */
    void* DebugPort;/* 0xec  4 */
    void* ExceptionPort;/* 0xf0  4 */
    struct _HANDLE_TABLE* ObjectTable;/* 0xf4  4 */
    void* Token;/* 0xf8  4 */
    struct _FAST_MUTEX WorkingSetLock;/* 0xfc  32 */
    /* ── cacheline 4 boundary (256 bytes) ── */
    unsigned long WorkingSetPage;/* 0x11c  4 */
    unsigned char ProcessOutswapEnabled;/* 0x120  1 */
    unsigned char ProcessOutswapped;/* 0x121  1 */
    unsigned char AddressSpaceInitialized;/* 0x122  1 */
    unsigned char AddressSpaceDeleted;/* 0x123  1 */
    struct _FAST_MUTEX AddressCreationLock;/* 0x124  32 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned long HyperSpaceLock;/* 0x144  4 */
    struct _ETHREAD* ForkInProgress;/* 0x148  4 */
    unsigned short VmOperation;/* 0x14c  2 */
    unsigned char ForkWasSuccessful;/* 0x14e  1 */
    unsigned char MmAgressiveWsTrimMask;/* 0x14f  1 */
    struct _KEVENT* VmOperationEvent;/* 0x150  4 */
    struct _HARDWARE_PTE PageDirectoryPte;/* 0x154  4 */
    unsigned long LastFaultCount;/* 0x158  4 */
    unsigned long ModifiedPageCount;/* 0x15c  4 */
    void* VadRoot;/* 0x160  4 */
    void* VadHint;/* 0x164  4 */
    void* CloneRoot;/* 0x168  4 */
    unsigned long NumberOfPrivatePages;/* 0x16c  4 */
    unsigned long NumberOfLockedPages;/* 0x170  4 */
    unsigned short NextPageColor;/* 0x174  2 */
    unsigned char ExitProcessCalled;/* 0x176  1 */
    unsigned char CreateProcessReported;/* 0x177  1 */
    void* SectionHandle;/* 0x178  4 */
    struct _PEB* Peb;/* 0x17c  4 */
    /* ── cacheline 6 boundary (384 bytes) ── */
    void* SectionBaseAddress;/* 0x180  4 */
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;/* 0x184  4 */
    long LastThreadExitStatus;/* 0x188  4 */
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;/* 0x18c  4 */
    void* Win32WindowStation;/* 0x190  4 */
    void* InheritedFromUniqueProcessId;/* 0x194  4 */
    unsigned long GrantedAccess;/* 0x198  4 */
    unsigned long DefaultHardErrorProcessing;/* 0x19c  4 */
    void* LdtInformation;/* 0x1a0  4 */
    void* VadFreeHint;/* 0x1a4  4 */
    void* VdmObjects;/* 0x1a8  4 */
    struct _KMUTANT ProcessMutant;/* 0x1ac  32 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    unsigned char ImageFileName[16];/* 0x1cc  16 */
    unsigned long VmTrimFaultValue;/* 0x1dc  4 */
    unsigned char SetTimerResolution;/* 0x1e0  1 */
    unsigned char PriorityClass;/* 0x1e1  1 */
    union {
        struct {
            unsigned char SubSystemMinorVersion;/* 0x1e2  1 */
            unsigned char SubSystemMajorVersion;/* 0x1e3  1 */
        };/* 0x1e2  2 */
        unsigned short SubSystemVersion;/* 0x1e2  2 */
    };/* 0x1e2  2 */
    void* Win32Process;/* 0x1e4  4 */
};
/* source: NT 4.0 DDK (August 1996) MIPS LIBCNTPR.LIB CodeView type records; _EPROCESS/_ETHREAD offsets match KDEXTMIP.DLL (NT 4.0 Server CD) */