struct _EPROCESS { struct _KPROCESS Pcb;/* 0x0 224 */ /* ── cacheline 3 boundary (192 bytes) ── */ struct _EX_PUSH_LOCK ProcessLock;/* 0xe0 4 */ void* UniqueProcessId;/* 0xe4 4 */ struct _LIST_ENTRY ActiveProcessLinks;/* 0xe8 8 */ struct _EX_RUNDOWN_REF RundownProtect;/* 0xf0 4 */ void* VdmObjects;/* 0xf4 4 */ union { unsigned long Flags2;/* 0xf8 4 */ struct { unsigned long JobNotReallyActive : 1;/* 0xf8:0 4 */ unsigned long AccountingFolded : 1;/* 0xf8:1 4 */ unsigned long NewProcessReported : 1;/* 0xf8:2 4 */ unsigned long ExitProcessReported : 1;/* 0xf8:3 4 */ unsigned long ReportCommitChanges : 1;/* 0xf8:4 4 */ unsigned long LastReportMemory : 1;/* 0xf8:5 4 */ unsigned long ForceWakeCharge : 1;/* 0xf8:6 4 */ unsigned long CrossSessionCreate : 1;/* 0xf8:7 4 */ unsigned long NeedsHandleRundown : 1;/* 0xf8:8 4 */ unsigned long RefTraceEnabled : 1;/* 0xf8:9 4 */ unsigned long PicoCreated : 1;/* 0xf8:10 4 */ unsigned long EmptyJobEvaluated : 1;/* 0xf8:11 4 */ unsigned long DefaultPagePriority : 3;/* 0xf8:12 4 */ unsigned long PrimaryTokenFrozen : 1;/* 0xf8:15 4 */ unsigned long ProcessVerifierTarget : 1;/* 0xf8:16 4 */ unsigned long RestrictSetThreadContext : 1;/* 0xf8:17 4 */ unsigned long AffinityPermanent : 1;/* 0xf8:18 4 */ unsigned long AffinityUpdateEnable : 1;/* 0xf8:19 4 */ unsigned long PropagateNode : 1;/* 0xf8:20 4 */ unsigned long ExplicitAffinity : 1;/* 0xf8:21 4 */ unsigned long ProcessExecutionState : 2;/* 0xf8:22 4 */ unsigned long EnableReadVmLogging : 1;/* 0xf8:24 4 */ unsigned long EnableWriteVmLogging : 1;/* 0xf8:25 4 */ unsigned long FatalAccessTerminationRequested : 1;/* 0xf8:26 4 */ unsigned long DisableSystemAllowedCpuSet : 1;/* 0xf8:27 4 */ unsigned long ProcessStateChangeRequest : 2;/* 0xf8:28 4 */ unsigned long ProcessStateChangeInProgress : 1;/* 0xf8:30 4 */ unsigned long InPrivate : 1;/* 0xf8:31 4 */ };/* 0xf8 4 */ };/* 0xf8 4 */ union { unsigned long Flags;/* 0xfc 4 */ struct { unsigned long CreateReported : 1;/* 0xfc:0 4 */ unsigned long NoDebugInherit : 1;/* 0xfc:1 4 */ unsigned long ProcessExiting : 1;/* 0xfc:2 4 */ unsigned long ProcessDelete : 1;/* 0xfc:3 4 */ unsigned long ManageExecutableMemoryWrites : 1;/* 0xfc:4 4 */ unsigned long VmDeleted : 1;/* 0xfc:5 4 */ unsigned long OutswapEnabled : 1;/* 0xfc:6 4 */ unsigned long Outswapped : 1;/* 0xfc:7 4 */ unsigned long FailFastOnCommitFail : 1;/* 0xfc:8 4 */ unsigned long Wow64VaSpace4Gb : 1;/* 0xfc:9 4 */ unsigned long AddressSpaceInitialized : 2;/* 0xfc:10 4 */ unsigned long SetTimerResolution : 1;/* 0xfc:12 4 */ unsigned long BreakOnTermination : 1;/* 0xfc:13 4 */ unsigned long DeprioritizeViews : 1;/* 0xfc:14 4 */ unsigned long WriteWatch : 1;/* 0xfc:15 4 */ unsigned long ProcessInSession : 1;/* 0xfc:16 4 */ unsigned long OverrideAddressSpace : 1;/* 0xfc:17 4 */ unsigned long HasAddressSpace : 1;/* 0xfc:18 4 */ unsigned long LaunchPrefetched : 1;/* 0xfc:19 4 */ unsigned long Background : 1;/* 0xfc:20 4 */ unsigned long VmTopDown : 1;/* 0xfc:21 4 */ unsigned long ImageNotifyDone : 1;/* 0xfc:22 4 */ unsigned long PdeUpdateNeeded : 1;/* 0xfc:23 4 */ unsigned long VdmAllowed : 1;/* 0xfc:24 4 */ unsigned long ProcessRundown : 1;/* 0xfc:25 4 */ unsigned long ProcessInserted : 1;/* 0xfc:26 4 */ unsigned long DefaultIoPriority : 3;/* 0xfc:27 4 */ unsigned long ProcessSelfDelete : 1;/* 0xfc:30 4 */ unsigned long SetTimerResolutionLink : 1;/* 0xfc:31 4 */ };/* 0xfc 4 */ };/* 0xfc 4 */ /* ── cacheline 4 boundary (256 bytes) ── */ union _LARGE_INTEGER CreateTime;/* 0x100 8 */ unsigned long ProcessQuotaUsage[2];/* 0x108 8 */ unsigned long ProcessQuotaPeak[2];/* 0x110 8 */ unsigned long PeakVirtualSize;/* 0x118 4 */ unsigned long VirtualSize;/* 0x11c 4 */ struct _LIST_ENTRY SessionProcessLinks;/* 0x120 8 */ union { void* ExceptionPortData;/* 0x128 4 */ unsigned long ExceptionPortValue;/* 0x128 4 */ unsigned long ExceptionPortState : 3;/* 0x128:0 4 */ };/* 0x128 4 */ struct _EX_FAST_REF Token;/* 0x12c 4 */ unsigned long MmReserved;/* 0x130 4 */ struct _EX_PUSH_LOCK AddressCreationLock;/* 0x134 4 */ struct _EX_PUSH_LOCK PageTableCommitmentLock;/* 0x138 4 */ struct _ETHREAD* RotateInProgress;/* 0x13c 4 */ /* ── cacheline 5 boundary (320 bytes) ── */ struct _ETHREAD* ForkInProgress;/* 0x140 4 */ struct _EJOB* CommitChargeJob;/* 0x144 4 */ struct _RTL_AVL_TREE CloneRoot;/* 0x148 4 */ volatile unsigned long NumberOfPrivatePages;/* 0x14c 4 */ volatile unsigned long NumberOfLockedPages;/* 0x150 4 */ void* Win32Process;/* 0x154 4 */ struct _EJOB* Job;/* 0x158 4 */ void* SectionObject;/* 0x15c 4 */ void* SectionBaseAddress;/* 0x160 4 */ unsigned long Cookie;/* 0x164 4 */ struct _PAGEFAULT_HISTORY* WorkingSetWatch;/* 0x168 4 */ void* Win32WindowStation;/* 0x16c 4 */ void* InheritedFromUniqueProcessId;/* 0x170 4 */ void* LdtInformation;/* 0x174 4 */ volatile unsigned long OwnerProcessId;/* 0x178 4 */ struct _PEB* Peb;/* 0x17c 4 */ /* ── cacheline 6 boundary (384 bytes) ── */ struct _MM_SESSION_SPACE* Session;/* 0x180 4 */ void* Spare1;/* 0x184 4 */ struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;/* 0x188 4 */ struct _HANDLE_TABLE* ObjectTable;/* 0x18c 4 */ void* DebugPort;/* 0x190 4 */ void* PaeTop;/* 0x194 4 */ void* DeviceMap;/* 0x198 4 */ void* EtwDataSource;/* 0x19c 4 */ unsigned __int64 PageDirectoryPte;/* 0x1a0 8 */ struct _FILE_OBJECT* ImageFilePointer;/* 0x1a8 4 */ unsigned char ImageFileName[15];/* 0x1ac 15 */ unsigned char PriorityClass;/* 0x1bb 1 */ void* SecurityPort;/* 0x1bc 4 */ /* ── cacheline 7 boundary (448 bytes) ── */ struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;/* 0x1c0 4 */ struct _LIST_ENTRY JobLinks;/* 0x1c4 8 */ void* HighestUserAddress;/* 0x1cc 4 */ struct _LIST_ENTRY ThreadListHead;/* 0x1d0 8 */ volatile unsigned long ActiveThreads;/* 0x1d8 4 */ unsigned long ImagePathHash;/* 0x1dc 4 */ unsigned long DefaultHardErrorProcessing;/* 0x1e0 4 */ long LastThreadExitStatus;/* 0x1e4 4 */ struct _EX_FAST_REF PrefetchTrace;/* 0x1e8 4 */ void* LockedPagesList;/* 0x1ec 4 */ union _LARGE_INTEGER ReadOperationCount;/* 0x1f0 8 */ union _LARGE_INTEGER WriteOperationCount;/* 0x1f8 8 */ /* ── cacheline 8 boundary (512 bytes) ── */ union _LARGE_INTEGER OtherOperationCount;/* 0x200 8 */ union _LARGE_INTEGER ReadTransferCount;/* 0x208 8 */ union _LARGE_INTEGER WriteTransferCount;/* 0x210 8 */ union _LARGE_INTEGER OtherTransferCount;/* 0x218 8 */ unsigned long CommitChargeLimit;/* 0x220 4 */ volatile unsigned long CommitCharge;/* 0x224 4 */ volatile unsigned long CommitChargePeak;/* 0x228 4 */ /* 20 bytes padding */ /* ── cacheline 9 boundary (576 bytes) ── */ struct _MMSUPPORT_FULL Vm;/* 0x240 256 */ /* ── cacheline 13 boundary (832 bytes) ── */ struct _LIST_ENTRY MmProcessLinks;/* 0x340 8 */ unsigned long ModifiedPageCount;/* 0x348 4 */ long ExitStatus;/* 0x34c 4 */ struct _RTL_AVL_TREE VadRoot;/* 0x350 4 */ void* VadHint;/* 0x354 4 */ unsigned long VadCount;/* 0x358 4 */ volatile unsigned long VadPhysicalPages;/* 0x35c 4 */ unsigned long VadPhysicalPagesLimit;/* 0x360 4 */ struct _ALPC_PROCESS_CONTEXT AlpcContext;/* 0x364 16 */ struct _LIST_ENTRY TimerResolutionLink;/* 0x374 8 */ struct _PO_DIAG_STACK_RECORD* TimerResolutionStackRecord;/* 0x37c 4 */ /* ── cacheline 14 boundary (896 bytes) ── */ unsigned long RequestedTimerResolution;/* 0x380 4 */ unsigned long SmallestTimerResolution;/* 0x384 4 */ union _LARGE_INTEGER ExitTime;/* 0x388 8 */ unsigned long ActiveThreadsHighWatermark;/* 0x390 4 */ unsigned long LargePrivateVadCount;/* 0x394 4 */ struct _EX_PUSH_LOCK ThreadListLock;/* 0x398 4 */ void* WnfContext;/* 0x39c 4 */ struct _EJOB* ServerSilo;/* 0x3a0 4 */ unsigned char SignatureLevel;/* 0x3a4 1 */ unsigned char SectionSignatureLevel;/* 0x3a5 1 */ struct _PS_PROTECTION Protection;/* 0x3a6 1 */ unsigned char HangCount : 3;/* 0x3a7:0 1 */ unsigned char GhostCount : 3;/* 0x3a7:3 1 */ unsigned char PrefilterException : 1;/* 0x3a7:6 1 */ union { unsigned long Flags3;/* 0x3a8 4 */ struct { unsigned long Minimal : 1;/* 0x3a8:0 4 */ unsigned long ReplacingPageRoot : 1;/* 0x3a8:1 4 */ unsigned long Crashed : 1;/* 0x3a8:2 4 */ unsigned long JobVadsAreTracked : 1;/* 0x3a8:3 4 */ unsigned long VadTrackingDisabled : 1;/* 0x3a8:4 4 */ unsigned long AuxiliaryProcess : 1;/* 0x3a8:5 4 */ unsigned long SubsystemProcess : 1;/* 0x3a8:6 4 */ unsigned long IndirectCpuSets : 1;/* 0x3a8:7 4 */ unsigned long RelinquishedCommit : 1;/* 0x3a8:8 4 */ unsigned long HighGraphicsPriority : 1;/* 0x3a8:9 4 */ unsigned long CommitFailLogged : 1;/* 0x3a8:10 4 */ unsigned long ReserveFailLogged : 1;/* 0x3a8:11 4 */ unsigned long SystemProcess : 1;/* 0x3a8:12 4 */ unsigned long HideImageBaseAddresses : 1;/* 0x3a8:13 4 */ unsigned long AddressPolicyFrozen : 1;/* 0x3a8:14 4 */ unsigned long ProcessFirstResume : 1;/* 0x3a8:15 4 */ unsigned long ForegroundExternal : 1;/* 0x3a8:16 4 */ unsigned long ForegroundSystem : 1;/* 0x3a8:17 4 */ unsigned long HighMemoryPriority : 1;/* 0x3a8:18 4 */ unsigned long EnableProcessSuspendResumeLogging : 1;/* 0x3a8:19 4 */ unsigned long EnableThreadSuspendResumeLogging : 1;/* 0x3a8:20 4 */ unsigned long SecurityDomainChanged : 1;/* 0x3a8:21 4 */ unsigned long SecurityFreezeComplete : 1;/* 0x3a8:22 4 */ unsigned long VmProcessorHost : 1;/* 0x3a8:23 4 */ unsigned long VmProcessorHostTransition : 1;/* 0x3a8:24 4 */ unsigned long AltSyscall : 1;/* 0x3a8:25 4 */ unsigned long TimerResolutionIgnore : 1;/* 0x3a8:26 4 */ unsigned long DisallowUserTerminate : 1;/* 0x3a8:27 4 */ };/* 0x3a8 4 */ };/* 0x3a8 4 */ long DeviceAsid;/* 0x3ac 4 */ void* SvmData;/* 0x3b0 4 */ struct _EX_PUSH_LOCK SvmProcessLock;/* 0x3b4 4 */ unsigned long SvmLock;/* 0x3b8 4 */ struct _LIST_ENTRY SvmProcessDeviceListHead;/* 0x3bc 8 */ /* 4 bytes padding */ /* ── cacheline 15 boundary (960 bytes) ── */ unsigned __int64 LastFreezeInterruptTime;/* 0x3c8 8 */ struct _PROCESS_DISK_COUNTERS* DiskCounters;/* 0x3d0 4 */ void* PicoContext;/* 0x3d4 4 */ unsigned long HighPriorityFaultsAllowed;/* 0x3d8 4 */ void* InstrumentationCallback;/* 0x3dc 4 */ struct _PO_PROCESS_ENERGY_CONTEXT* EnergyContext;/* 0x3e0 4 */ void* VmContext;/* 0x3e4 4 */ unsigned __int64 SequenceNumber;/* 0x3e8 8 */ unsigned __int64 CreateInterruptTime;/* 0x3f0 8 */ unsigned __int64 CreateUnbiasedInterruptTime;/* 0x3f8 8 */ /* ── cacheline 16 boundary (1024 bytes) ── */ unsigned __int64 TotalUnbiasedFrozenTime;/* 0x400 8 */ unsigned __int64 LastAppStateUpdateTime;/* 0x408 8 */ unsigned __int64 LastAppStateUptime : 61;/* 0x410:0 8 */ unsigned __int64 LastAppState : 3;/* 0x410:61 8 */ volatile unsigned long SharedCommitCharge;/* 0x418 4 */ struct _EX_PUSH_LOCK SharedCommitLock;/* 0x41c 4 */ struct _LIST_ENTRY SharedCommitLinks;/* 0x420 8 */ union { struct { unsigned long AllowedCpuSets;/* 0x428 4 */ unsigned long DefaultCpuSets;/* 0x42c 4 */ };/* 0x428 8 */ struct { unsigned long* AllowedCpuSetsIndirect;/* 0x428 4 */ unsigned long* DefaultCpuSetsIndirect;/* 0x42c 4 */ };/* 0x428 8 */ };/* 0x428 8 */ void* DiskIoAttribution;/* 0x430 4 */ void* DxgProcess;/* 0x434 4 */ unsigned long Win32KFilterSet;/* 0x438 4 */ /* 4 bytes padding */ /* ── cacheline 17 boundary (1088 bytes) ── */ volatile union _PS_INTERLOCKED_TIMER_DELAY_VALUES ProcessTimerDelay;/* 0x440 8 */ volatile unsigned long KTimerSets;/* 0x448 4 */ volatile unsigned long KTimer2Sets;/* 0x44c 4 */ volatile unsigned long ThreadTimerSets;/* 0x450 4 */ unsigned long VirtualTimerListLock;/* 0x454 4 */ struct _LIST_ENTRY VirtualTimerListHead;/* 0x458 8 */ union { struct _WNF_STATE_NAME WakeChannel;/* 0x460 8 */ struct _PS_PROCESS_WAKE_INFORMATION WakeInfo;/* 0x460 48 */ };/* 0x460 48 */ /* ── cacheline 18 boundary (1152 bytes) ── */ union { unsigned long MitigationFlags;/* 0x490 4 */ struct { unsigned long ControlFlowGuardEnabled : 1;/* 0x490:0 4 */ unsigned long ControlFlowGuardExportSuppressionEnabled : 1;/* 0x490:1 4 */ unsigned long ControlFlowGuardStrict : 1;/* 0x490:2 4 */ unsigned long DisallowStrippedImages : 1;/* 0x490:3 4 */ unsigned long ForceRelocateImages : 1;/* 0x490:4 4 */ unsigned long HighEntropyASLREnabled : 1;/* 0x490:5 4 */ unsigned long StackRandomizationDisabled : 1;/* 0x490:6 4 */ unsigned long ExtensionPointDisable : 1;/* 0x490:7 4 */ unsigned long DisableDynamicCode : 1;/* 0x490:8 4 */ unsigned long DisableDynamicCodeAllowOptOut : 1;/* 0x490:9 4 */ unsigned long DisableDynamicCodeAllowRemoteDowngrade : 1;/* 0x490:10 4 */ unsigned long AuditDisableDynamicCode : 1;/* 0x490:11 4 */ unsigned long DisallowWin32kSystemCalls : 1;/* 0x490:12 4 */ unsigned long AuditDisallowWin32kSystemCalls : 1;/* 0x490:13 4 */ unsigned long EnableFilteredWin32kAPIs : 1;/* 0x490:14 4 */ unsigned long AuditFilteredWin32kAPIs : 1;/* 0x490:15 4 */ unsigned long DisableNonSystemFonts : 1;/* 0x490:16 4 */ unsigned long AuditNonSystemFontLoading : 1;/* 0x490:17 4 */ unsigned long PreferSystem32Images : 1;/* 0x490:18 4 */ unsigned long ProhibitRemoteImageMap : 1;/* 0x490:19 4 */ unsigned long AuditProhibitRemoteImageMap : 1;/* 0x490:20 4 */ unsigned long ProhibitLowILImageMap : 1;/* 0x490:21 4 */ unsigned long AuditProhibitLowILImageMap : 1;/* 0x490:22 4 */ unsigned long SignatureMitigationOptIn : 1;/* 0x490:23 4 */ unsigned long AuditBlockNonMicrosoftBinaries : 1;/* 0x490:24 4 */ unsigned long AuditBlockNonMicrosoftBinariesAllowStore : 1;/* 0x490:25 4 */ unsigned long LoaderIntegrityContinuityEnabled : 1;/* 0x490:26 4 */ unsigned long AuditLoaderIntegrityContinuity : 1;/* 0x490:27 4 */ unsigned long EnableModuleTamperingProtection : 1;/* 0x490:28 4 */ unsigned long EnableModuleTamperingProtectionNoInherit : 1;/* 0x490:29 4 */ unsigned long RestrictIndirectBranchPrediction : 1;/* 0x490:30 4 */ unsigned long IsolateSecurityDomain : 1;/* 0x490:31 4 */ } MitigationFlagsValues;/* 0x490 4 */ };/* 0x490 4 */ union { unsigned long MitigationFlags2;/* 0x494 4 */ struct { unsigned long EnableExportAddressFilter : 1;/* 0x494:0 4 */ unsigned long AuditExportAddressFilter : 1;/* 0x494:1 4 */ unsigned long EnableExportAddressFilterPlus : 1;/* 0x494:2 4 */ unsigned long AuditExportAddressFilterPlus : 1;/* 0x494:3 4 */ unsigned long EnableRopStackPivot : 1;/* 0x494:4 4 */ unsigned long AuditRopStackPivot : 1;/* 0x494:5 4 */ unsigned long EnableRopCallerCheck : 1;/* 0x494:6 4 */ unsigned long AuditRopCallerCheck : 1;/* 0x494:7 4 */ unsigned long EnableRopSimExec : 1;/* 0x494:8 4 */ unsigned long AuditRopSimExec : 1;/* 0x494:9 4 */ unsigned long EnableImportAddressFilter : 1;/* 0x494:10 4 */ unsigned long AuditImportAddressFilter : 1;/* 0x494:11 4 */ unsigned long DisablePageCombine : 1;/* 0x494:12 4 */ unsigned long SpeculativeStoreBypassDisable : 1;/* 0x494:13 4 */ unsigned long CetUserShadowStacks : 1;/* 0x494:14 4 */ unsigned long AuditCetUserShadowStacks : 1;/* 0x494:15 4 */ unsigned long AuditCetUserShadowStacksLogged : 1;/* 0x494:16 4 */ unsigned long UserCetSetContextIpValidation : 1;/* 0x494:17 4 */ unsigned long AuditUserCetSetContextIpValidation : 1;/* 0x494:18 4 */ unsigned long AuditUserCetSetContextIpValidationLogged : 1;/* 0x494:19 4 */ unsigned long CetUserShadowStacksStrictMode : 1;/* 0x494:20 4 */ unsigned long BlockNonCetBinaries : 1;/* 0x494:21 4 */ unsigned long BlockNonCetBinariesNonEhcont : 1;/* 0x494:22 4 */ unsigned long AuditBlockNonCetBinaries : 1;/* 0x494:23 4 */ unsigned long AuditBlockNonCetBinariesLogged : 1;/* 0x494:24 4 */ unsigned long Reserved1 : 1;/* 0x494:25 4 */ unsigned long Reserved2 : 1;/* 0x494:26 4 */ unsigned long Reserved3 : 1;/* 0x494:27 4 */ unsigned long Reserved4 : 1;/* 0x494:28 4 */ unsigned long Reserved5 : 1;/* 0x494:29 4 */ unsigned long CetDynamicApisOutOfProcOnly : 1;/* 0x494:30 4 */ unsigned long UserCetSetContextIpValidationRelaxedMode : 1;/* 0x494:31 4 */ } MitigationFlags2Values;/* 0x494 4 */ };/* 0x494 4 */ void* PartitionObject;/* 0x498 4 */ /* 4 bytes padding */ unsigned __int64 SecurityDomain;/* 0x4a0 8 */ unsigned __int64 ParentSecurityDomain;/* 0x4a8 8 */ void* CoverageSamplerContext;/* 0x4b0 4 */ void* MmHotPatchContext;/* 0x4b4 4 */ struct _RTL_AVL_TREE DynamicEHContinuationTargetsTree;/* 0x4b8 4 */ struct _EX_PUSH_LOCK DynamicEHContinuationTargetsLock;/* 0x4bc 4 */ /* ── cacheline 19 boundary (1216 bytes) ── */ struct _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES DynamicEnforcedCetCompatibleRanges;/* 0x4c0 8 */ unsigned long DisabledComponentFlags;/* 0x4c8 4 */ unsigned long* PathRedirectionHashes;/* 0x4cc 4 */ union { unsigned long MitigationFlags3;/* 0x4d0 4 */ struct { unsigned long RestrictCoreSharing : 1;/* 0x4d0:0 4 */ unsigned long DisallowFsctlSystemCalls : 1;/* 0x4d0:1 4 */ unsigned long AuditDisallowFsctlSystemCalls : 1;/* 0x4d0:2 4 */ unsigned long MitigationFlags3Spare : 29;/* 0x4d0:3 4 */ } MitigationFlags3Values;/* 0x4d0 4 */ };/* 0x4d0 4 */};size 1280 (0x500)235 members4 holes (32 bytes)padding 4420 cachelines
Used in (32)
_ALPC_COMPLETION_LIST_ALPC_PORT_DBGK_SILOSTATE_DIAGNOSTIC_CONTEXT_EPARTITION_ESERVERSILO_GLOBALS_ETW_REALTIME_CONSUMER_ETW_REG_ENTRY_HANDLE_TABLE_KALPC_MESSAGE_KALPC_SECTION_KALPC_SECURITY_DATA_KALPC_VIEW_KRESOURCEMANAGER_COMPLETION_BINDING_LOCK_TRACKER_LPCP_PORT_OBJECT_MDL_MI_PARTITION_STORES_MI_REVERSE_VIEW_MAP_MI_SESSION_STATE_MMVAD_MM_PAGE_ACCESS_INFO_HEADER_NONOPAQUE_OPLOCK_OBJECT_HANDLE_COUNT_ENTRY_OBJECT_HEADER_PROCESS_INFO_OB_DUPLICATE_OBJECT_STATE_POP_SHUTDOWN_BUG_CHECK_RH_OP_CONTEXT_WNF_NAME_INSTANCE_WNF_PROCESS_CONTEXT_WNF_SUBSCRIPTION_WORK_QUEUE_ENTRY