_TOKEN

Metadatacopy
struct _TOKEN {
    struct _TOKEN_SOURCE TokenSource;/* 0x0  16 */
    struct _LUID TokenId;/* 0x10  8 */
    struct _LUID AuthenticationId;/* 0x18  8 */
    struct _LUID ParentTokenId;/* 0x20  8 */
    union _LARGE_INTEGER ExpirationTime;/* 0x28  8 */
    struct _ERESOURCE* TokenLock;/* 0x30  4 */
    struct _LUID ModifiedId;/* 0x34  8 */
    /* 4 bytes padding */
    /* ── cacheline 1 boundary (64 bytes) ── */
    struct _SEP_TOKEN_PRIVILEGES Privileges;/* 0x40  24 */
    struct _SEP_AUDIT_POLICY AuditPolicy;/* 0x58  31 */
    /* 1 byte padding */
    unsigned long SessionId;/* 0x78  4 */
    unsigned long UserAndGroupCount;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long RestrictedSidCount;/* 0x80  4 */
    unsigned long VariableLength;/* 0x84  4 */
    unsigned long DynamicCharged;/* 0x88  4 */
    unsigned long DynamicAvailable;/* 0x8c  4 */
    unsigned long DefaultOwnerIndex;/* 0x90  4 */
    struct _SID_AND_ATTRIBUTES* UserAndGroups;/* 0x94  4 */
    struct _SID_AND_ATTRIBUTES* RestrictedSids;/* 0x98  4 */
    void* PrimaryGroup;/* 0x9c  4 */
    unsigned long* DynamicPart;/* 0xa0  4 */
    struct _ACL* DefaultDacl;/* 0xa4  4 */
    enum _TOKEN_TYPE TokenType;/* 0xa8  4 */
    enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;/* 0xac  4 */
    unsigned long TokenFlags;/* 0xb0  4 */
    unsigned char TokenInUse;/* 0xb4  1 */
    /* 3 bytes padding */
    unsigned long IntegrityLevelIndex;/* 0xb8  4 */
    unsigned long MandatoryPolicy;/* 0xbc  4 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    struct _SEP_LOGON_SESSION_REFERENCES* LogonSession;/* 0xc0  4 */
    struct _LUID OriginatingLogonSession;/* 0xc4  8 */
    struct _SID_AND_ATTRIBUTES_HASH SidHash;/* 0xcc  136 */
    /* ── cacheline 5 boundary (320 bytes) ── */
    struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash;/* 0x154  136 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes;/* 0x1dc  4 */
    void* Package;/* 0x1e0  4 */
    struct _SID_AND_ATTRIBUTES* Capabilities;/* 0x1e4  4 */
    unsigned long CapabilityCount;/* 0x1e8  4 */
    struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash;/* 0x1ec  136 */
    /* ── cacheline 9 boundary (576 bytes) ── */
    struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry;/* 0x274  4 */
    struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry;/* 0x278  4 */
    struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes;/* 0x27c  4 */
    /* ── cacheline 10 boundary (640 bytes) ── */
    void* TrustLevelSid;/* 0x280  4 */
    struct _TOKEN* TrustLinkedToken;/* 0x284  4 */
    void* IntegrityLevelSidValue;/* 0x288  4 */
    struct _SEP_SID_VALUES_BLOCK* TokenSidValues;/* 0x28c  4 */
    struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry;/* 0x290  4 */
    struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo;/* 0x294  4 */
    struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry;/* 0x298  4 */
    void* SessionObject;/* 0x29c  4 */
    unsigned long VariablePart;/* 0x2a0  4 */
};