_KPROCESS

Metadatacopy
struct _KPROCESS {
    struct _DISPATCHER_HEADER Header;/* 0x0  24 */
    struct _LIST_ENTRY ProfileListHead;/* 0x18  16 */
    unsigned __int64 DirectoryTableBase;/* 0x28  8 */
    struct _LIST_ENTRY ThreadListHead;/* 0x30  16 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    unsigned long ProcessLock;/* 0x40  4 */
    unsigned long ProcessTimerDelay;/* 0x44  4 */
    unsigned __int64 DeepFreezeStartTime;/* 0x48  8 */
    struct _KAFFINITY_EX* Affinity;/* 0x50  8 */
    union {
        struct {
            void* AutoBoostState2;/* 0x58  8 */
            unsigned long Spare5;/* 0x60  4 */
        };/* 0x58  12 */
        struct _KAB_UM_PROCESS_CONTEXT AutoBoostState;/* 0x58  16 */
    };/* 0x58  16 */
    struct _LIST_ENTRY ReadyListHead;/* 0x68  16 */
    struct _SINGLE_LIST_ENTRY SwapListEntry;/* 0x78  8 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    volatile struct _KAFFINITY_EX* ActiveProcessors;/* 0x80  8 */
    union {
        struct {
            unsigned long AutoAlignment : 1;/* 0x88:0  4 */
            unsigned long DisableBoost : 1;/* 0x88:1  4 */
            unsigned long DisableQuantum : 1;/* 0x88:2  4 */
            unsigned long DeepFreeze : 1;/* 0x88:3  4 */
            unsigned long TimerVirtualization : 1;/* 0x88:4  4 */
            unsigned long CheckStackExtents : 1;/* 0x88:5  4 */
            unsigned long CacheIsolationEnabled : 1;/* 0x88:6  4 */
            unsigned long ProcessPpmPolicy : 4;/* 0x88:7  4 */
            unsigned long VaSpaceDeleted : 1;/* 0x88:11  4 */
            unsigned long MultiGroup : 1;/* 0x88:12  4 */
            unsigned long ForegroundProcess : 1;/* 0x88:13  4 */
            unsigned long ReservedFlags : 18;/* 0x88:14  4 */
        };/* 0x88  4 */
        volatile long ProcessFlags;/* 0x88  4 */
    };/* 0x88  4 */
    unsigned long Spare0c;/* 0x8c  4 */
    signed char BasePriority;/* 0x90  1 */
    signed char QuantumReset;/* 0x91  1 */
    char Visited;/* 0x92  1 */
    union _KEXECUTE_OPTIONS Flags;/* 0x93  1 */
    /* 4 bytes padding */
    struct _KGROUP_MASK ActiveGroupsMask;/* 0x98  16 */
    unsigned __int64 ActiveGroupPadding[2];/* 0xa8  16 */
    struct _KI_IDEAL_PROCESSOR_ASSIGNMENT_BLOCK* IdealProcessorAssignmentBlock;/* 0xb8  8 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    unsigned __int64 Padding[6];/* 0xc0  48 */
    unsigned long Spare0e;/* 0xf0  4 */
    unsigned long SchedulerAssistYieldBoostCount;/* 0xf4  4 */
    __int64 SchedulerAssistYieldBoostAllowedTime;/* 0xf8  8 */
    /* ── cacheline 4 boundary (256 bytes) ── */
    unsigned long Spare0d;/* 0x100  4 */
    volatile unsigned short IdealGlobalNode;/* 0x104  2 */
    unsigned short Spare1;/* 0x106  2 */
    volatile union _KSTACK_COUNT StackCount;/* 0x108  4 */
    /* 4 bytes padding */
    struct _LIST_ENTRY ProcessListEntry;/* 0x110  16 */
    unsigned __int64 CycleTime;/* 0x120  8 */
    unsigned __int64 ContextSwitches;/* 0x128  8 */
    struct _KSCHEDULING_GROUP* SchedulingGroup;/* 0x130  8 */
    unsigned __int64 KernelTime;/* 0x138  8 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    unsigned __int64 UserTime;/* 0x140  8 */
    unsigned __int64 ReadyTime;/* 0x148  8 */
    unsigned long FreezeCount;/* 0x150  4 */
    unsigned long Spare4;/* 0x154  4 */
    unsigned __int64 UserDirectoryTableBase;/* 0x158  8 */
    unsigned char AddressPolicy;/* 0x160  1 */
    unsigned char Spare2[7];/* 0x161  7 */
    void* InstrumentationCallback;/* 0x168  8 */
    union _KPROCESS_SECURE_STATE SecureState;/* 0x170  8 */
    unsigned __int64 KernelWaitTime;/* 0x178  8 */
    /* ── cacheline 6 boundary (384 bytes) ── */
    unsigned __int64 UserWaitTime;/* 0x180  8 */
    unsigned __int64 LastRebalanceQpc;/* 0x188  8 */
    void* PerProcessorCycleTimes;/* 0x190  8 */
    unsigned __int64 ExtendedFeatureDisableMask;/* 0x198  8 */
    unsigned short PrimaryGroup;/* 0x1a0  2 */
    unsigned short Spare3[3];/* 0x1a2  6 */
    void* UserCetLogging;/* 0x1a8  8 */
    struct _LIST_ENTRY CpuPartitionList;/* 0x1b0  16 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    struct _KPROCESS_AVAILABLE_CPU_STATE* AvailableCpuState;/* 0x1c0  8 */
};