_MM_SESSION_SPACE

Metadatacopy
struct _MM_SESSION_SPACE {
    volatile long ReferenceCount;/* 0x0  4 */
    union {
        unsigned long LongFlags;/* 0x4  4 */
        struct _MM_SESSION_SPACE_FLAGS Flags;/* 0x4  4 */
    } u;/* 0x4  4 */
    unsigned long SessionId;/* 0x8  4 */
    volatile long ProcessReferenceToSession;/* 0xc  4 */
    struct _LIST_ENTRY ProcessList;/* 0x10  8 */
    unsigned long SessionPageDirectoryIndex;/* 0x18  4 */
    volatile unsigned long NonPagablePages;/* 0x1c  4 */
    volatile unsigned long CommittedPages;/* 0x20  4 */
    void* PagedPoolStart;/* 0x24  4 */
    void* PagedPoolEnd;/* 0x28  4 */
    void* SessionObject;/* 0x2c  4 */
    void* SessionObjectHandle;/* 0x30  4 */
    struct _RTL_AVL_TREE ImageTree;/* 0x34  4 */
    unsigned long LocaleId;/* 0x38  4 */
    unsigned long AttachCount;/* 0x3c  4 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    struct _KGATE AttachGate;/* 0x40  16 */
    struct _LIST_ENTRY WsListEntry;/* 0x50  8 */
    struct _RTL_BALANCED_NODE WsTreeEntry;/* 0x58  12 */
    struct _MM_PAGED_POOL_INFO PagedPoolInfo;/* 0x64  12 */
    struct _MMSESSION Session;/* 0x70  20 */
    /* 4 bytes padding */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned __int64 CombineDomain;/* 0x88  8 */
    /* 48 bytes padding */
    /* ── cacheline 3 boundary (192 bytes) ── */
    struct _MMSUPPORT_FULL Vm;/* 0xc0  256 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    struct _MMWSL_INSTANCE WorkingSetList;/* 0x1c0  24 */
    void* HeapState;/* 0x1d8  4 */
    struct _MI_SESSION_DRIVER_UNLOAD DriverUnload;/* 0x1dc  4 */
    unsigned long TopLevelPteLockBits[128];/* 0x1e0  512 */
    /* ── cacheline 15 boundary (960 bytes) ── */
    struct _MMPTE PageTables[1024];/* 0x3e0  8192 */
    /* ── cacheline 143 boundary (9152 bytes) ── */
    struct _EX_PUSH_LOCK SessionPteLock;/* 0x23e0  4 */
    long PoolBigEntriesInUse;/* 0x23e4  4 */
    volatile long PagedPoolPdeCount;/* 0x23e8  4 */
    unsigned long DynamicSessionPdeCount;/* 0x23ec  4 */
    struct _MI_SYSTEM_PTE_TYPE SystemPteInfo;/* 0x23f0  52 */
    /* ── cacheline 144 boundary (9216 bytes) ── */
    void* PoolTrackTableExpansion;/* 0x2424  4 */
    unsigned long PoolTrackTableExpansionSize;/* 0x2428  4 */
    void* PoolTrackBigPages;/* 0x242c  4 */
    unsigned long PoolTrackBigPagesSize;/* 0x2430  4 */
    struct _RTL_AVL_TREE PermittedFaultsTree;/* 0x2434  4 */
    enum _IO_SESSION_STATE IoState;/* 0x2438  4 */
    unsigned long IoStateSequence;/* 0x243c  4 */
    /* ── cacheline 145 boundary (9280 bytes) ── */
    struct _KEVENT IoNotificationEvent;/* 0x2440  16 */
    struct _EJOB* ServerSilo;/* 0x2450  4 */
    /* 4 bytes padding */
    unsigned __int64 CreateTime;/* 0x2458  8 */
    /* 2976 bytes padding */
    /* ── cacheline 192 boundary (12288 bytes) ── */
    unsigned char PoolTags[16384];/* 0x3000  16384 */
};