Min versionXP2003/XP64 SP1
Max version2003/XP64 SP210 TH2
x86 offset
offset:bitpos
Field Name
0x0000struct _LUID
OperationID
0x0008uint8_t
SecurityEvaluated
0x0009uint8_t
GenerateAudit
0x000Auint8_t
GenerateOnClose
0x000Buint8_t
PrivilegesAllocated
0x000Cunsigned long
Flags
0x0010unsigned long
RemainingDesiredAccess
0x0014unsigned long
PreviouslyGrantedAccess
0x0018unsigned long
OriginalDesiredAccess
0x001Cstruct _SECURITY_SUBJECT_CONTEXT
SubjectSecurityContext
0x002Cvoid *
SecurityDescriptor
0x0030void *
AuxData
0x0034union __unnamed
Privileges
union <unnamed-tag>
Privileges
0x0060uint8_t
AuditPrivileges
0x0064struct _UNICODE_STRING
ObjectName
0x006Cstruct _UNICODE_STRING
ObjectTypeName