x86 / ntdllntoskrnl /

_KPROCESS

← 10.0.18362.1016 27 builds latest →
struct _KPROCESS {
unsigned long DirectoryTableBase;/* 0x18 4 */
unsigned long ProcessLock;/* 0x34 4 */
unsigned __int64 DeepFreezeStartTime;/* 0x38 8 */
/* ── cacheline 1 boundary (64 bytes) ── */
union {
struct {
unsigned long AutoAlignment : 1;/* 0x64:0 4 */
unsigned long DisableBoost : 1;/* 0x64:1 4 */
unsigned long DisableQuantum : 1;/* 0x64:2 4 */
unsigned long DeepFreeze : 1;/* 0x64:3 4 */
unsigned long TimerVirtualization : 1;/* 0x64:4 4 */
unsigned long CheckStackExtents : 1;/* 0x64:5 4 */
unsigned long CacheIsolationEnabled : 1;/* 0x64:6 4 */
unsigned long PpmPolicy : 3;/* 0x64:7 4 */
unsigned long VaSpaceDeleted : 1;/* 0x64:10 4 */
unsigned long ReservedFlags : 21;/* 0x64:11 4 */
};/* 0x64 4 */
volatile long ProcessFlags;/* 0x64 4 */
};/* 0x64 4 */
char BasePriority;/* 0x68 1 */
char QuantumReset;/* 0x69 1 */
char Visited;/* 0x6a 1 */
unsigned short ThreadSeed[1];/* 0x6c 2 */
unsigned short IdealProcessor[1];/* 0x6e 2 */
unsigned short IdealNode[1];/* 0x70 2 */
unsigned short IdealGlobalNode;/* 0x72 2 */
unsigned short Spare1;/* 0x74 2 */
unsigned short IopmOffset;/* 0x76 2 */
/* ── cacheline 2 boundary (128 bytes) ── */
unsigned __int64 CycleTime;/* 0x88 8 */
unsigned __int64 ContextSwitches;/* 0x90 8 */
unsigned long FreezeCount;/* 0x98 4 */
unsigned long KernelTime;/* 0x9c 4 */
unsigned long UserTime;/* 0xa0 4 */
unsigned long ReadyTime;/* 0xa4 4 */
void* VdmTrapcHandler;/* 0xa8 4 */
unsigned long ProcessTimerDelay;/* 0xac 4 */
unsigned __int64 KernelWaitTime;/* 0xb0 8 */
unsigned __int64 UserWaitTime;/* 0xb8 8 */
/* ── cacheline 3 boundary (192 bytes) ── */
unsigned long EndPadding[8];/* 0xc0 32 */
};
size 224 (0xe0)47 members0 holespadding 04 cachelines
Used in (3)