_ACCESS_STATE

Metadatacopy
struct _ACCESS_STATE {
    struct _LUID OperationID;/* 0x0  8 */
    unsigned char SecurityEvaluated;/* 0x8  1 */
    unsigned char GenerateAudit;/* 0x9  1 */
    unsigned char GenerateOnClose;/* 0xa  1 */
    unsigned char PrivilegesAllocated;/* 0xb  1 */
    unsigned long Flags;/* 0xc  4 */
    unsigned long RemainingDesiredAccess;/* 0x10  4 */
    unsigned long PreviouslyGrantedAccess;/* 0x14  4 */
    unsigned long OriginalDesiredAccess;/* 0x18  4 */
    struct _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;/* 0x1c  16 */
    void* SecurityDescriptor;/* 0x2c  4 */
    void* AuxData;/* 0x30  4 */
    union {
        struct _INITIAL_PRIVILEGE_SET InitialPrivilegeSet;/* 0x34  44 */
        struct _PRIVILEGE_SET PrivilegeSet;/* 0x34  20 */
    } Privileges;/* 0x34  44 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned char AuditPrivileges;/* 0x60  1 */
    /* 3 bytes padding */
    struct _UNICODE_STRING ObjectName;/* 0x64  8 */
    struct _UNICODE_STRING ObjectTypeName;/* 0x6c  8 */
};
/* source: NT 4.0 DDK (August 1996) PPC LIBCNTPR.LIB CodeView type records; _EPROCESS/_ETHREAD offsets match KDEXTPPC.DLL (NT 4.0 Server CD) */