x86 / ntdllntoskrnl
_EPROCESS_ETHREAD_TOKEN