| Min version | XP | 2003/XP64 | 2003/XP64 SP1 | 2003/XP64 SP2 | Vista | Vista SP1 | Vista SP2 | 7 | 7 SP1 | 7 SP1 | 8 Pre RTM | 8 Pre RTM | 8.1 Update 1 | 10 Pre RTM | 10 Pre RTM | 10 Pre RTM | 10 | 10 TH2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Max version | XP SP3 | 2003/XP64 SP2 | Vista SP2 | 8 | ||||||||||||||
| x86 offset offset:bitpos | Field Name | |||||||||||||||||
| 0x0000 | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | struct _KTHREAD Tcb | ||||||||
| 0x01B8 | union _LARGE_INTEGER CreateTime | |||||||||||||||||
| 0x01C0 | union _LARGE_INTEGER CreateTime | union _LARGE_INTEGER ExitTime | ||||||||||||||||
| 0x01C0:0x00 | uint32_t NestedFaultCount | struct _LIST_ENTRY LpcReplyChain | ||||||||||||||||
| 0x01C0 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x01C0:0x02 | uint32_t ApcNeeded | |||||||||||||||||
| 0x01C8 | union _LARGE_INTEGER ExitTime | union _LARGE_INTEGER CreateTime | long ExitStatus | |||||||||||||||
| 0x01C8 | struct _LIST_ENTRY LpcReplyChain | uint32_t NestedFaultCount | void * OfsChain | |||||||||||||||
| 0x01C8 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x01C8:0x02 | uint32_t ApcNeeded | |||||||||||||||||
| 0x01CC | struct _LIST_ENTRY PostBlockList | |||||||||||||||||
| 0x01D0 | long ExitStatus | union _LARGE_INTEGER ExitTime | ||||||||||||||||
| 0x01D0 | void * OfsChain | struct _LIST_ENTRY LpcReplyChain | ||||||||||||||||
| 0x01D0 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x01D4 | struct _LIST_ENTRY PostBlockList | struct _TERMINATION_PORT * TerminationPort | ||||||||||||||||
| 0x01D4 | struct _ETHREAD * ReaperLink | |||||||||||||||||
| 0x01D4 | void * KeyedWaitValue | |||||||||||||||||
| 0x01D8 | long ExitStatus | unsigned long ActiveTimerListLock | ||||||||||||||||
| 0x01D8 | void * OfsChain | |||||||||||||||||
| 0x01DC | struct _TERMINATION_PORT * TerminationPort | struct _LIST_ENTRY PostBlockList | struct _LIST_ENTRY ActiveTimerListHead | |||||||||||||||
| 0x01DC | struct _ETHREAD * ReaperLink | |||||||||||||||||
| 0x01DC | void * KeyedWaitValue | |||||||||||||||||
| 0x01E0 | unsigned long ActiveTimerListLock | union _LARGE_INTEGER CreateTime | union _LARGE_INTEGER CreateTime | |||||||||||||||
| 0x01E4 | struct _LIST_ENTRY ActiveTimerListHead | struct _TERMINATION_PORT * TerminationPort | struct _CLIENT_ID Cid | |||||||||||||||
| 0x01E4 | struct _ETHREAD * ReaperLink | |||||||||||||||||
| 0x01E4 | void * KeyedWaitValue | |||||||||||||||||
| 0x01E8 | unsigned long ActiveTimerListLock | union _LARGE_INTEGER ExitTime | union _LARGE_INTEGER ExitTime | union _LARGE_INTEGER CreateTime | ||||||||||||||
| 0x01E8 | struct _LIST_ENTRY KeyedWaitChain | struct _LIST_ENTRY KeyedWaitChain | ||||||||||||||||
| 0x01EC | struct _CLIENT_ID Cid | struct _LIST_ENTRY ActiveTimerListHead | struct _KSEMAPHORE LpcReplySemaphore | |||||||||||||||
| 0x01EC | struct _KSEMAPHORE KeyedWaitSemaphore | |||||||||||||||||
| 0x01F0 | long ExitStatus | void * ChargeOnlySession | union _LARGE_INTEGER ExitTime | |||||||||||||||
| 0x01F0 | void * OfsChain | struct _LIST_ENTRY KeyedWaitChain | ||||||||||||||||
| 0x01F4 | struct _KSEMAPHORE LpcReplySemaphore | struct _CLIENT_ID Cid | struct _LIST_ENTRY PostBlockList | struct _LIST_ENTRY PostBlockList | ||||||||||||||
| 0x01F4 | struct _KSEMAPHORE KeyedWaitSemaphore | void * ForwardLinkShadow | void * ForwardLinkShadow | |||||||||||||||
| 0x01F8 | void * StartAddress | void * StartAddress | void * ChargeOnlySession | |||||||||||||||
| 0x01FC | struct _KSEMAPHORE LpcReplySemaphore | struct _TERMINATION_PORT * TerminationPort | struct _TERMINATION_PORT * TerminationPort | struct _LIST_ENTRY PostBlockList | ||||||||||||||
| 0x01FC | struct _KSEMAPHORE KeyedWaitSemaphore | struct _ETHREAD * ReaperLink | struct _ETHREAD * ReaperLink | void * ForwardLinkShadow | ||||||||||||||
| 0x01FC | void * KeyedWaitValue | void * KeyedWaitValue | ||||||||||||||||
| 0x01FC | void * Win32StartParameter | |||||||||||||||||
| 0x0200 | void * LpcReplyMessage | unsigned long ActiveTimerListLock | union _LARGE_INTEGER CreateTime | unsigned long ActiveTimerListLock | void * StartAddress | |||||||||||||
| 0x0200 | void * LpcWaitingOnPort | |||||||||||||||||
| 0x0204 | struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo | struct _LIST_ENTRY ActiveTimerListHead | struct _LIST_ENTRY ActiveTimerListHead | struct _TERMINATION_PORT * TerminationPort | ||||||||||||||
| 0x0204 | struct _ETHREAD * ReaperLink | |||||||||||||||||
| 0x0204 | void * KeyedWaitValue | |||||||||||||||||
| 0x0208 | void * LpcReplyMessage | struct _LIST_ENTRY IrpList | union _LARGE_INTEGER ExitTime | unsigned long ActiveTimerListLock | ||||||||||||||
| 0x0208 | void * LpcWaitingOnPort | struct _LIST_ENTRY KeyedWaitChain | ||||||||||||||||
| 0x020C | struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo | struct _CLIENT_ID Cid | struct _CLIENT_ID Cid | struct _LIST_ENTRY ActiveTimerListHead | ||||||||||||||
| 0x0210 | struct _LIST_ENTRY IrpList | void * LpcReplyMessage | unsigned long TopLevelIrp | long ExitStatus | ||||||||||||||
| 0x0210 | void * LpcWaitingOnPort | |||||||||||||||||
| 0x0214 | struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo | struct _DEVICE_OBJECT * DeviceToVerify | struct _KSEMAPHORE KeyedWaitSemaphore | struct _LIST_ENTRY PostBlockList | struct _KSEMAPHORE KeyedWaitSemaphore | struct _CLIENT_ID Cid | ||||||||||||
| 0x0214 | struct _KSEMAPHORE AlpcWaitSemaphore | void * ForwardLinkShadow | struct _KSEMAPHORE AlpcWaitSemaphore | |||||||||||||||
| 0x0218 | unsigned long TopLevelIrp | struct _LIST_ENTRY IrpList | struct _EPROCESS * ThreadsProcess | void * StartAddress | ||||||||||||||
| 0x021C | struct _DEVICE_OBJECT * DeviceToVerify | void * StartAddress | struct _TERMINATION_PORT * TerminationPort | struct _KSEMAPHORE KeyedWaitSemaphore | ||||||||||||||
| 0x021C | struct _ETHREAD * ReaperLink | struct _KSEMAPHORE AlpcWaitSemaphore | ||||||||||||||||
| 0x021C | void * KeyedWaitValue | |||||||||||||||||
| 0x0220 | struct _EPROCESS * ThreadsProcess | unsigned long TopLevelIrp | void * Win32StartAddress | unsigned long ActiveTimerListLock | ||||||||||||||
| 0x0220 | unsigned long LpcReceivedMessageId | |||||||||||||||||
| 0x0224 | void * StartAddress | struct _DEVICE_OBJECT * DeviceToVerify | struct _LIST_ENTRY ThreadListEntry | struct _LIST_ENTRY ActiveTimerListHead | ||||||||||||||
| 0x0228 | void * Win32StartAddress | struct _EPROCESS * ThreadsProcess | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | ||||||||||||||
| 0x0228 | unsigned long LpcReceivedMessageId | |||||||||||||||||
| 0x022C | struct _LIST_ENTRY ThreadListEntry | void * StartAddress | struct _EX_RUNDOWN_REF RundownProtect | struct _LIST_ENTRY IrpList | struct _CLIENT_ID Cid | struct _LIST_ENTRY IrpList | ||||||||||||
| 0x0230 | void * Win32StartAddress | struct _EX_PUSH_LOCK ThreadLock | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | |||||||||||||||
| 0x0230 | unsigned long LpcReceivedMessageId | |||||||||||||||||
| 0x0234 | struct _EX_RUNDOWN_REF RundownProtect | struct _LIST_ENTRY ThreadListEntry | unsigned long LpcReplyMessageId | unsigned long TopLevelIrp | struct _KSEMAPHORE KeyedWaitSemaphore | unsigned long TopLevelIrp | struct _LIST_ENTRY IrpList | |||||||||||
| 0x0234 | struct _KSEMAPHORE AlpcWaitSemaphore | |||||||||||||||||
| 0x0238 | struct _EX_PUSH_LOCK ThreadLock | unsigned long ReadClusterSize | struct _DEVICE_OBJECT * DeviceToVerify | struct _DEVICE_OBJECT * DeviceToVerify | ||||||||||||||
| 0x023C | unsigned long LpcReplyMessageId | struct _EX_RUNDOWN_REF RundownProtect | unsigned long GrantedAccess | union _PSP_RATE_APC * RateControlApc | void * SparePointer | unsigned long TopLevelIrp | ||||||||||||
| 0x0240 | unsigned long ReadClusterSize | struct _EX_PUSH_LOCK ThreadLock | unsigned long CrossThreadFlags | void * Win32StartAddress | void * Win32StartAddress | struct _DEVICE_OBJECT * DeviceToVerify | ||||||||||||
| 0x0240:0x00 | unsigned long Terminated | |||||||||||||||||
| 0x0240:0x01 | unsigned long DeadThread | |||||||||||||||||
| 0x0240:0x02 | unsigned long HideFromDebugger | |||||||||||||||||
| 0x0240:0x03 | unsigned long ActiveImpersonationInfo | |||||||||||||||||
| 0x0240:0x04 | unsigned long SystemThread | |||||||||||||||||
| 0x0240:0x05 | unsigned long HardErrorsAreDisabled | |||||||||||||||||
| 0x0240:0x06 | unsigned long BreakOnTermination | |||||||||||||||||
| 0x0240:0x07 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x0240:0x08 | unsigned long SkipTerminationMsg | |||||||||||||||||
| 0x0244 | unsigned long GrantedAccess | unsigned long LpcReplyMessageId | unsigned long SameThreadPassiveFlags | void * SparePtr0 | void * LegacyPowerObject | void * Win32StartAddress | ||||||||||||
| 0x0244:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x0244:0x01 | unsigned long ExWorkerCanWaitUser | |||||||||||||||||
| 0x0244:0x02 | unsigned long MemoryMaker | |||||||||||||||||
| 0x0244:0x03 | unsigned long KeyedEventInUse | |||||||||||||||||
| 0x0248 | unsigned long CrossThreadFlags | unsigned long ReadClusterSize | unsigned long SameThreadApcFlags | struct _LIST_ENTRY ThreadListEntry | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | struct _LIST_ENTRY ThreadListEntry | void * LegacyPowerObject | |||||||||||
| 0x0248:0x00 | unsigned long Terminated | uint8_t LpcReceivedMsgIdValid | ||||||||||||||||
| 0x0248:0x01 | unsigned long DeadThread | uint8_t LpcExitThreadCalled | ||||||||||||||||
| 0x0248:0x02 | unsigned long HideFromDebugger | uint8_t AddressSpaceOwner | ||||||||||||||||
| 0x0248:0x03 | unsigned long ActiveImpersonationInfo | uint8_t OwnsProcessWorkingSetExclusive | ||||||||||||||||
| 0x0248:0x04 | unsigned long SystemThread | uint8_t OwnsProcessWorkingSetShared | ||||||||||||||||
| 0x0248:0x05 | unsigned long HardErrorsAreDisabled | uint8_t OwnsSystemWorkingSetExclusive | ||||||||||||||||
| 0x0248:0x06 | unsigned long BreakOnTermination | uint8_t OwnsSystemWorkingSetShared | ||||||||||||||||
| 0x0248:0x07 | unsigned long SkipCreationMsg | uint8_t OwnsSessionWorkingSetExclusive | ||||||||||||||||
| 0x0248:0x08 | unsigned long SkipTerminationMsg | uint8_t OwnsSessionWorkingSetShared | ||||||||||||||||
| 0x0249:0x01 | uint8_t ApcNeeded | |||||||||||||||||
| 0x024C | unsigned long SameThreadPassiveFlags | unsigned long GrantedAccess | uint8_t ForwardClusterOnly | struct _LIST_ENTRY IrpList | struct _LIST_ENTRY ThreadListEntry | |||||||||||||
| 0x024C:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x024C:0x01 | unsigned long ExWorkerCanWaitUser | |||||||||||||||||
| 0x024C:0x02 | unsigned long MemoryMaker | |||||||||||||||||
| 0x024D | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x024E | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x0250 | unsigned long SameThreadApcFlags | unsigned long CrossThreadFlags | unsigned long KernelStackReference | struct _EX_RUNDOWN_REF RundownProtect | struct _EX_RUNDOWN_REF RundownProtect | |||||||||||||
| 0x0250:0x00 | uint8_t LpcReceivedMsgIdValid | unsigned long Terminated | ||||||||||||||||
| 0x0250:0x01 | uint8_t LpcExitThreadCalled | unsigned long DeadThread | ||||||||||||||||
| 0x0250:0x02 | uint8_t AddressSpaceOwner | unsigned long HideFromDebugger | ||||||||||||||||
| 0x0250:0x03 | unsigned long ActiveImpersonationInfo | |||||||||||||||||
| 0x0250:0x04 | unsigned long SystemThread | |||||||||||||||||
| 0x0250:0x05 | unsigned long HardErrorsAreDisabled | |||||||||||||||||
| 0x0250:0x06 | unsigned long BreakOnTermination | |||||||||||||||||
| 0x0250:0x07 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x0250:0x08 | unsigned long SkipTerminationMsg | |||||||||||||||||
| 0x0254 | uint8_t ForwardClusterOnly | unsigned long SameThreadPassiveFlags | struct _EX_PUSH_LOCK ThreadLock | unsigned long TopLevelIrp | struct _EX_PUSH_LOCK ThreadLock | struct _EX_RUNDOWN_REF RundownProtect | ||||||||||||
| 0x0254:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x0254:0x01 | unsigned long ExWorkerCanWaitUser | |||||||||||||||||
| 0x0254:0x02 | unsigned long MemoryMaker | |||||||||||||||||
| 0x0254:0x03 | unsigned long KeyedEventInUse | |||||||||||||||||
| 0x0255 | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x0258 | unsigned long SameThreadApcFlags | unsigned long ReadClusterSize | struct _DEVICE_OBJECT * DeviceToVerify | unsigned long ReadClusterSize | struct _EX_PUSH_LOCK ThreadLock | |||||||||||||
| 0x0258:0x00 | uint8_t LpcReceivedMsgIdValid | |||||||||||||||||
| 0x0258:0x01 | uint8_t LpcExitThreadCalled | |||||||||||||||||
| 0x0258:0x02 | uint8_t AddressSpaceOwner | |||||||||||||||||
| 0x025C | uint8_t ForwardClusterOnly | volatile long MmLockOrdering | union _PSP_CPU_QUOTA_APC * CpuQuotaApc | volatile long MmLockOrdering | unsigned long ReadClusterSize | |||||||||||||
| 0x025D | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x0260 | unsigned long CrossThreadFlags | void * Win32StartAddress | volatile long CmLockOrdering | volatile long MmLockOrdering | ||||||||||||||
| 0x0260:0x00 | unsigned long Terminated | |||||||||||||||||
| 0x0260:0x01 | unsigned long ThreadInserted | |||||||||||||||||
| 0x0260:0x02 | unsigned long HideFromDebugger | |||||||||||||||||
| 0x0260:0x03 | unsigned long ActiveImpersonationInfo | |||||||||||||||||
| 0x0260:0x04 | unsigned long SystemThread | |||||||||||||||||
| 0x0260:0x05 | unsigned long HardErrorsAreDisabled | |||||||||||||||||
| 0x0260:0x06 | unsigned long BreakOnTermination | |||||||||||||||||
| 0x0260:0x07 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x0260:0x08 | unsigned long SkipTerminationMsg | |||||||||||||||||
| 0x0260:0x09 | unsigned long CopyTokenOnOpen | |||||||||||||||||
| 0x0260:0x0A | unsigned long ThreadIoPriority | |||||||||||||||||
| 0x0260:0x0D | unsigned long ThreadPagePriority | |||||||||||||||||
| 0x0260:0x10 | unsigned long RundownFail | |||||||||||||||||
| 0x0264 | unsigned long SameThreadPassiveFlags | void * LegacyPowerObject | unsigned long CrossThreadFlags | volatile long CmLockOrdering | ||||||||||||||
| 0x0264:0x00 | unsigned long ActiveExWorker | unsigned long Terminated | ||||||||||||||||
| 0x0264:0x01 | unsigned long ExWorkerCanWaitUser | unsigned long ThreadInserted | ||||||||||||||||
| 0x0264:0x02 | unsigned long MemoryMaker | unsigned long HideFromDebugger | ||||||||||||||||
| 0x0264:0x03 | unsigned long ClonedThread | unsigned long ActiveImpersonationInfo | ||||||||||||||||
| 0x0264:0x04 | unsigned long KeyedEventInUse | unsigned long HardErrorsAreDisabled | ||||||||||||||||
| 0x0264:0x05 | unsigned long RateApcState | unsigned long BreakOnTermination | ||||||||||||||||
| 0x0264:0x06 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x0264:0x07 | unsigned long SelfTerminate | unsigned long SkipTerminationMsg | ||||||||||||||||
| 0x0264:0x08 | unsigned long CopyTokenOnOpen | |||||||||||||||||
| 0x0264:0x09 | unsigned long ThreadIoPriority | |||||||||||||||||
| 0x0264:0x0C | unsigned long ThreadPagePriority | |||||||||||||||||
| 0x0264:0x0F | unsigned long RundownFail | |||||||||||||||||
| 0x0264:0x10 | unsigned long UmsForceQueueTermination | |||||||||||||||||
| 0x0264:0x11 | unsigned long ReservedCrossThreadFlags | |||||||||||||||||
| 0x0268 | unsigned long SameThreadApcFlags | struct _LIST_ENTRY ThreadListEntry | unsigned long SameThreadPassiveFlags | unsigned long CrossThreadFlags | ||||||||||||||
| 0x0268:0x00 | uint8_t Spare | unsigned long ActiveExWorker | unsigned long Terminated | |||||||||||||||
| 0x0268:0x01 | volatile uint8_t StartAddressInvalid | unsigned long MemoryMaker | unsigned long ThreadInserted | |||||||||||||||
| 0x0268:0x02 | uint8_t EtwPageFaultCalloutActive | unsigned long ClonedThread | unsigned long HideFromDebugger | |||||||||||||||
| 0x0268:0x03 | uint8_t OwnsProcessWorkingSetExclusive | unsigned long KeyedEventInUse | unsigned long ActiveImpersonationInfo | |||||||||||||||
| 0x0268:0x04 | uint8_t OwnsProcessWorkingSetShared | unsigned long SelfTerminate | unsigned long HardErrorsAreDisabled | |||||||||||||||
| 0x0268:0x05 | uint8_t OwnsSystemWorkingSetExclusive | unsigned long BreakOnTermination | ||||||||||||||||
| 0x0268:0x06 | uint8_t OwnsSystemWorkingSetShared | unsigned long SkipCreationMsg | ||||||||||||||||
| 0x0268:0x07 | uint8_t OwnsSessionWorkingSetExclusive | unsigned long SkipTerminationMsg | ||||||||||||||||
| 0x0269:0x00 | uint8_t OwnsSessionWorkingSetShared | unsigned long CopyTokenOnOpen | ||||||||||||||||
| 0x0269:0x01 | uint8_t OwnsProcessAddressSpaceExclusive | unsigned long ThreadIoPriority | ||||||||||||||||
| 0x0269:0x02 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x0269:0x03 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x0269:0x04 | uint8_t Prefetching | unsigned long ThreadPagePriority | ||||||||||||||||
| 0x0269:0x05 | uint8_t OwnsDynamicMemoryShared | |||||||||||||||||
| 0x0269:0x06 | uint8_t OwnsChangeControlAreaExclusive | |||||||||||||||||
| 0x0269:0x07 | uint8_t OwnsChangeControlAreaShared | unsigned long RundownFail | ||||||||||||||||
| 0x026A:0x00 | uint16_t PriorityRegionActive | uint8_t Spare1 | unsigned long UmsForceQueueTermination | |||||||||||||||
| 0x0268:0x11 | unsigned long ReservedCrossThreadFlags | |||||||||||||||||
| 0x026B | uint8_t PriorityRegionActive | |||||||||||||||||
| 0x026C | uint8_t CacheManagerActive | unsigned long SameThreadApcFlags | unsigned long SameThreadPassiveFlags | |||||||||||||||
| 0x026C:0x00 | uint8_t Spare | unsigned long ActiveExWorker | ||||||||||||||||
| 0x026C:0x01 | volatile uint8_t StartAddressInvalid | unsigned long MemoryMaker | ||||||||||||||||
| 0x026C:0x02 | uint8_t EtwCalloutActive | unsigned long ClonedThread | ||||||||||||||||
| 0x026C:0x03 | uint8_t OwnsProcessWorkingSetExclusive | unsigned long KeyedEventInUse | ||||||||||||||||
| 0x026C:0x04 | uint8_t OwnsProcessWorkingSetShared | unsigned long SelfTerminate | ||||||||||||||||
| 0x026C:0x05 | uint8_t OwnsSystemCacheWorkingSetExclusive | |||||||||||||||||
| 0x026C:0x06 | uint8_t OwnsSystemCacheWorkingSetShared | |||||||||||||||||
| 0x026C:0x07 | uint8_t OwnsSessionWorkingSetExclusive | |||||||||||||||||
| 0x026D | uint8_t DisablePageFaultClustering | uint8_t OwnsSessionWorkingSetShared | ||||||||||||||||
| 0x026D:0x01 | uint8_t OwnsProcessAddressSpaceExclusive | |||||||||||||||||
| 0x026D:0x02 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x026D:0x03 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x026D:0x04 | uint8_t Prefetching | |||||||||||||||||
| 0x026D:0x05 | uint8_t OwnsVadExclusive | |||||||||||||||||
| 0x026D:0x06 | uint8_t OwnsChangeControlAreaExclusive | |||||||||||||||||
| 0x026D:0x07 | uint8_t OwnsChangeControlAreaShared | |||||||||||||||||
| 0x026E | uint8_t ActiveFaultCount | uint8_t OwnsPagedPoolWorkingSetExclusive | ||||||||||||||||
| 0x026E:0x01 | uint8_t OwnsPagedPoolWorkingSetShared | |||||||||||||||||
| 0x026E:0x02 | uint8_t OwnsSystemPtesWorkingSetExclusive | |||||||||||||||||
| 0x026E:0x03 | uint8_t OwnsSystemPtesWorkingSetShared | |||||||||||||||||
| 0x026E:0x04 | uint8_t TrimTrigger | |||||||||||||||||
| 0x026E:0x06 | uint8_t Spare2 | |||||||||||||||||
| 0x026F | uint8_t PriorityRegionActive | |||||||||||||||||
| 0x0270 | unsigned long AlpcMessageId | struct _EX_RUNDOWN_REF RundownProtect | uint8_t CacheManagerActive | unsigned long SameThreadApcFlags | ||||||||||||||
| 0x0270:0x00 | uint8_t Spare | |||||||||||||||||
| 0x0270:0x01 | volatile uint8_t StartAddressInvalid | |||||||||||||||||
| 0x0270:0x02 | uint8_t EtwCalloutActive | |||||||||||||||||
| 0x0270:0x03 | uint8_t OwnsProcessWorkingSetExclusive | |||||||||||||||||
| 0x0270:0x04 | uint8_t OwnsProcessWorkingSetShared | |||||||||||||||||
| 0x0270:0x05 | uint8_t OwnsSystemCacheWorkingSetExclusive | |||||||||||||||||
| 0x0270:0x06 | uint8_t OwnsSystemCacheWorkingSetShared | |||||||||||||||||
| 0x0270:0x07 | uint8_t OwnsSessionWorkingSetExclusive | |||||||||||||||||
| 0x0271 | uint8_t DisablePageFaultClustering | uint8_t OwnsSessionWorkingSetShared | ||||||||||||||||
| 0x0271:0x01 | uint8_t OwnsProcessAddressSpaceExclusive | |||||||||||||||||
| 0x0271:0x02 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x0271:0x03 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x0271:0x04 | uint8_t Prefetching | |||||||||||||||||
| 0x0271:0x05 | uint8_t OwnsVadExclusive | |||||||||||||||||
| 0x0271:0x06 | uint8_t OwnsChangeControlAreaExclusive | |||||||||||||||||
| 0x0271:0x07 | uint8_t OwnsChangeControlAreaShared | |||||||||||||||||
| 0x0272 | uint8_t ActiveFaultCount | uint8_t OwnsPagedPoolWorkingSetExclusive | ||||||||||||||||
| 0x0272:0x01 | uint8_t OwnsPagedPoolWorkingSetShared | |||||||||||||||||
| 0x0272:0x02 | uint8_t OwnsSystemPtesWorkingSetExclusive | |||||||||||||||||
| 0x0272:0x03 | uint8_t OwnsSystemPtesWorkingSetShared | |||||||||||||||||
| 0x0272:0x04 | uint8_t TrimTrigger | |||||||||||||||||
| 0x0272:0x06 | uint8_t Spare2 | |||||||||||||||||
| 0x0273 | uint8_t LockOrderState | uint8_t PriorityRegionActive | ||||||||||||||||
| 0x0274 | void * AlpcMessage | struct _EX_PUSH_LOCK ThreadLock | unsigned long AlpcMessageId | uint8_t CacheManagerActive | ||||||||||||||
| 0x0274 | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x0275 | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x0276 | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x0277 | uint8_t LockOrderState | |||||||||||||||||
| 0x0278 | struct _LIST_ENTRY AlpcWaitListEntry | unsigned long ReadClusterSize | void * AlpcMessage | unsigned long AlpcMessageId | ||||||||||||||
| 0x0278 | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x027C | volatile long MmLockOrdering | long ExitStatus | void * AlpcMessage | |||||||||||||||
| 0x027C | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x0280 | unsigned long CacheManagerCount | unsigned long CrossThreadFlags | struct _LIST_ENTRY AlpcWaitListEntry | long ExitStatus | ||||||||||||||
| 0x0280:0x00 | unsigned long Terminated | |||||||||||||||||
| 0x0280:0x01 | unsigned long ThreadInserted | |||||||||||||||||
| 0x0280:0x02 | unsigned long HideFromDebugger | |||||||||||||||||
| 0x0280:0x03 | unsigned long ActiveImpersonationInfo | |||||||||||||||||
| 0x0280:0x04 | unsigned long SystemThread | unsigned long Reserved | ||||||||||||||||
| 0x0280:0x05 | unsigned long HardErrorsAreDisabled | |||||||||||||||||
| 0x0280:0x06 | unsigned long BreakOnTermination | |||||||||||||||||
| 0x0280:0x07 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x0280:0x08 | unsigned long SkipTerminationMsg | |||||||||||||||||
| 0x0280:0x09 | unsigned long CopyTokenOnOpen | |||||||||||||||||
| 0x0280:0x0A | unsigned long ThreadIoPriority | |||||||||||||||||
| 0x0280:0x0D | unsigned long ThreadPagePriority | |||||||||||||||||
| 0x0280:0x10 | unsigned long RundownFail | |||||||||||||||||
| 0x0280:0x11 | unsigned long NeedsWorkingSetAging | |||||||||||||||||
| 0x0284 | unsigned long KernelStackReference | unsigned long SameThreadPassiveFlags | struct _LIST_ENTRY AlpcWaitListEntry | |||||||||||||||
| 0x0284:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x0284:0x01 | unsigned long ExWorkerCanWaitUser | |||||||||||||||||
| 0x0284:0x02 | unsigned long MemoryMaker | |||||||||||||||||
| 0x0284:0x03 | unsigned long ClonedThread | |||||||||||||||||
| 0x0284:0x04 | unsigned long KeyedEventInUse | |||||||||||||||||
| 0x0284:0x05 | unsigned long RateApcState | |||||||||||||||||
| 0x0284:0x07 | unsigned long SelfTerminate | |||||||||||||||||
| 0x0288 | unsigned long SameThreadApcFlags | unsigned long CacheManagerCount | ||||||||||||||||
| 0x0288:0x00 | uint8_t Spare | |||||||||||||||||
| 0x0288:0x01 | volatile uint8_t StartAddressInvalid | |||||||||||||||||
| 0x0288:0x02 | uint8_t EtwPageFaultCalloutActive | |||||||||||||||||
| 0x0288:0x03 | uint8_t OwnsProcessWorkingSetExclusive | |||||||||||||||||
| 0x0288:0x04 | uint8_t OwnsProcessWorkingSetShared | |||||||||||||||||
| 0x0288:0x05 | uint8_t OwnsSystemCacheWorkingSetExclusive | |||||||||||||||||
| 0x0288:0x06 | uint8_t OwnsSystemCacheWorkingSetShared | |||||||||||||||||
| 0x0288:0x07 | uint8_t OwnsSessionWorkingSetExclusive | |||||||||||||||||
| 0x0289:0x00 | uint8_t OwnsSessionWorkingSetShared | |||||||||||||||||
| 0x0289:0x01 | uint8_t OwnsProcessAddressSpaceExclusive | |||||||||||||||||
| 0x0289:0x02 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x0289:0x03 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x0289:0x04 | uint8_t Prefetching | |||||||||||||||||
| 0x0289:0x05 | uint8_t OwnsDynamicMemoryShared | |||||||||||||||||
| 0x0289:0x06 | uint8_t OwnsChangeControlAreaExclusive | |||||||||||||||||
| 0x0289:0x07 | uint8_t OwnsChangeControlAreaShared | |||||||||||||||||
| 0x028A:0x00 | uint8_t OwnsPagedPoolWorkingSetExclusive | |||||||||||||||||
| 0x028A:0x01 | uint8_t OwnsPagedPoolWorkingSetShared | |||||||||||||||||
| 0x028A:0x02 | uint8_t OwnsSystemPtesWorkingSetExclusive | |||||||||||||||||
| 0x028A:0x03 | uint8_t OwnsSystemPtesWorkingSetShared | |||||||||||||||||
| 0x028A:0x04 | uint8_t TrimTrigger | |||||||||||||||||
| 0x028A:0x06 | uint8_t Spare1 | |||||||||||||||||
| 0x028B | uint8_t PriorityRegionActive | |||||||||||||||||
| 0x028C | uint8_t CacheManagerActive | unsigned long IoBoostCount | unsigned long CacheManagerCount | |||||||||||||||
| 0x028D | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x028E | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x028F | uint8_t LockOrderState | |||||||||||||||||
| 0x0290 | unsigned long AlpcMessageId | unsigned long IrpListLock | unsigned long IoBoostCount | |||||||||||||||
| 0x0294 | void * AlpcMessage | void * ReservedForSynchTracking | struct _LIST_ENTRY BoostList | |||||||||||||||
| 0x0294 | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x0298 | struct _LIST_ENTRY AlpcWaitListEntry | struct _SINGLE_LIST_ENTRY CmCallbackListHead | ||||||||||||||||
| 0x029C | const struct _GUID * ActivityId | struct _LIST_ENTRY DeboostList | ||||||||||||||||
| 0x02A0 | unsigned long CacheManagerCount | void * WnfContext | ||||||||||||||||
| 0x02A4 | unsigned long IoBoostCount | struct _SINGLE_LIST_ENTRY SeLearningModeListHead | unsigned long BoostListLock | |||||||||||||||
| 0x02A8 | unsigned long IrpListLock | uint64_t RelativeTimerBias | unsigned long IrpListLock | |||||||||||||||
| 0x02AC | void * ReservedForSynchTracking | void * ReservedForSynchTracking | ||||||||||||||||
| 0x02B0 | struct _SINGLE_LIST_ENTRY CmCallbackListHead | struct _SINGLE_LIST_ENTRY CmCallbackListHead | ||||||||||||||||
| 0x02B4 | unsigned long KernelStackReference | const struct _GUID * ActivityId | ||||||||||||||||
| 0x02B8 | void * WnfContext | |||||||||||||||||
| 0x02BC | unsigned long KernelStackReference | |||||||||||||||||
| 0x0338 | union _LARGE_INTEGER CreateTime | |||||||||||||||||
| 0x0340 | union _LARGE_INTEGER ExitTime | union _LARGE_INTEGER CreateTime | ||||||||||||||||
| 0x0340 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x0348 | void * ChargeOnlySession | union _LARGE_INTEGER ExitTime | union _LARGE_INTEGER CreateTime | |||||||||||||||
| 0x0348 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x034C | struct _LIST_ENTRY PostBlockList | |||||||||||||||||
| 0x034C | void * ForwardLinkShadow | |||||||||||||||||
| 0x0350 | void * StartAddress | void * ChargeOnlySession | union _LARGE_INTEGER ExitTime | |||||||||||||||
| 0x0350 | struct _LIST_ENTRY KeyedWaitChain | |||||||||||||||||
| 0x0354 | struct _TERMINATION_PORT * TerminationPort | struct _LIST_ENTRY PostBlockList | ||||||||||||||||
| 0x0354 | struct _ETHREAD * ReaperLink | void * ForwardLinkShadow | ||||||||||||||||
| 0x0354 | void * KeyedWaitValue | |||||||||||||||||
| 0x0358 | unsigned long ActiveTimerListLock | void * StartAddress | void * ChargeOnlySession | |||||||||||||||
| 0x035C | struct _LIST_ENTRY ActiveTimerListHead | struct _TERMINATION_PORT * TerminationPort | struct _LIST_ENTRY PostBlockList | |||||||||||||||
| 0x035C | struct _ETHREAD * ReaperLink | void * ForwardLinkShadow | ||||||||||||||||
| 0x035C | void * KeyedWaitValue | |||||||||||||||||
| 0x0360 | unsigned long ActiveTimerListLock | void * StartAddress | ||||||||||||||||
| 0x0364 | struct _CLIENT_ID Cid | struct _LIST_ENTRY ActiveTimerListHead | struct _TERMINATION_PORT * TerminationPort | |||||||||||||||
| 0x0364 | struct _ETHREAD * ReaperLink | |||||||||||||||||
| 0x0364 | void * KeyedWaitValue | |||||||||||||||||
| 0x0368 | unsigned long ActiveTimerListLock | |||||||||||||||||
| 0x036C | struct _KSEMAPHORE KeyedWaitSemaphore | struct _CLIENT_ID Cid | struct _LIST_ENTRY ActiveTimerListHead | |||||||||||||||
| 0x036C | struct _KSEMAPHORE AlpcWaitSemaphore | |||||||||||||||||
| 0x0374 | struct _KSEMAPHORE KeyedWaitSemaphore | struct _CLIENT_ID Cid | ||||||||||||||||
| 0x0374 | struct _KSEMAPHORE AlpcWaitSemaphore | |||||||||||||||||
| 0x037C | struct _KSEMAPHORE KeyedWaitSemaphore | |||||||||||||||||
| 0x037C | struct _KSEMAPHORE AlpcWaitSemaphore | |||||||||||||||||
| 0x0380 | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | |||||||||||||||||
| 0x0384 | struct _LIST_ENTRY IrpList | |||||||||||||||||
| 0x0388 | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | |||||||||||||||||
| 0x038C | unsigned long TopLevelIrp | struct _LIST_ENTRY IrpList | ||||||||||||||||
| 0x0390 | struct _DEVICE_OBJECT * DeviceToVerify | union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity | ||||||||||||||||
| 0x0394 | void * Win32StartAddress | unsigned long TopLevelIrp | struct _LIST_ENTRY IrpList | |||||||||||||||
| 0x0398 | void * LegacyPowerObject | struct _DEVICE_OBJECT * DeviceToVerify | ||||||||||||||||
| 0x039C | struct _LIST_ENTRY ThreadListEntry | void * Win32StartAddress | unsigned long TopLevelIrp | |||||||||||||||
| 0x03A0 | void * LegacyPowerObject | struct _DEVICE_OBJECT * DeviceToVerify | ||||||||||||||||
| 0x03A4 | struct _EX_RUNDOWN_REF RundownProtect | struct _LIST_ENTRY ThreadListEntry | void * Win32StartAddress | |||||||||||||||
| 0x03A8 | struct _EX_PUSH_LOCK ThreadLock | void * LegacyPowerObject | ||||||||||||||||
| 0x03AC | unsigned long ReadClusterSize | struct _EX_RUNDOWN_REF RundownProtect | struct _LIST_ENTRY ThreadListEntry | |||||||||||||||
| 0x03B0 | volatile long MmLockOrdering | struct _EX_PUSH_LOCK ThreadLock | ||||||||||||||||
| 0x03B4 | volatile long CmLockOrdering | unsigned long ReadClusterSize | struct _EX_RUNDOWN_REF RundownProtect | |||||||||||||||
| 0x03B8 | unsigned long CrossThreadFlags | volatile long MmLockOrdering | struct _EX_PUSH_LOCK ThreadLock | |||||||||||||||
| 0x03B8:0x00 | unsigned long Terminated | |||||||||||||||||
| 0x03B8:0x01 | unsigned long ThreadInserted | |||||||||||||||||
| 0x03B8:0x02 | unsigned long HideFromDebugger | |||||||||||||||||
| 0x03B8:0x03 | unsigned long ActiveImpersonationInfo | |||||||||||||||||
| 0x03B8:0x04 | unsigned long HardErrorsAreDisabled | |||||||||||||||||
| 0x03B8:0x05 | unsigned long BreakOnTermination | |||||||||||||||||
| 0x03B8:0x06 | unsigned long SkipCreationMsg | |||||||||||||||||
| 0x03B8:0x07 | unsigned long SkipTerminationMsg | |||||||||||||||||
| 0x03B8:0x08 | unsigned long CopyTokenOnOpen | |||||||||||||||||
| 0x03B8:0x09 | unsigned long ThreadIoPriority | |||||||||||||||||
| 0x03B8:0x0C | unsigned long ThreadPagePriority | |||||||||||||||||
| 0x03B8:0x0F | unsigned long RundownFail | |||||||||||||||||
| 0x03B8:0x10 | unsigned long UmsForceQueueTermination | |||||||||||||||||
| 0x03B8:0x11 | unsigned long ReservedCrossThreadFlags | |||||||||||||||||
| 0x03BC | unsigned long SameThreadPassiveFlags | volatile long CmLockOrdering | unsigned long ReadClusterSize | |||||||||||||||
| 0x03BC:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x03BC:0x01 | unsigned long MemoryMaker | |||||||||||||||||
| 0x03BC:0x02 | unsigned long ClonedThread | |||||||||||||||||
| 0x03BC:0x03 | unsigned long KeyedEventInUse | |||||||||||||||||
| 0x03BC:0x04 | unsigned long SelfTerminate | |||||||||||||||||
| 0x03C0 | unsigned long SameThreadApcFlags | unsigned long CrossThreadFlags | volatile long MmLockOrdering | |||||||||||||||
| 0x03C0:0x00 | uint8_t HardFaultBehavior | unsigned long Terminated | ||||||||||||||||
| 0x03C0:0x01 | volatile uint8_t StartAddressInvalid | unsigned long ThreadInserted | ||||||||||||||||
| 0x03C0:0x02 | uint8_t EtwCalloutActive | unsigned long HideFromDebugger | ||||||||||||||||
| 0x03C0:0x03 | uint8_t OwnsProcessWorkingSetExclusive | unsigned long ActiveImpersonationInfo | ||||||||||||||||
| 0x03C0:0x04 | uint8_t OwnsProcessWorkingSetShared | unsigned long HardErrorsAreDisabled | ||||||||||||||||
| 0x03C0:0x05 | uint8_t OwnsSystemCacheWorkingSetExclusive | unsigned long BreakOnTermination | ||||||||||||||||
| 0x03C0:0x06 | uint8_t OwnsSystemCacheWorkingSetShared | unsigned long SkipCreationMsg | ||||||||||||||||
| 0x03C0:0x07 | uint8_t OwnsSessionWorkingSetExclusive | unsigned long SkipTerminationMsg | ||||||||||||||||
| 0x03C1:0x00 | uint8_t OwnsSessionWorkingSetShared | unsigned long CopyTokenOnOpen | ||||||||||||||||
| 0x03C1:0x01 | uint8_t OwnsProcessAddressSpaceExclusive | unsigned long ThreadIoPriority | ||||||||||||||||
| 0x03C1:0x02 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x03C1:0x03 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x03C1:0x04 | uint8_t Prefetching | unsigned long ThreadPagePriority | ||||||||||||||||
| 0x03C1:0x05 | uint8_t OwnsVadExclusive | |||||||||||||||||
| 0x03C1:0x06 | uint8_t OwnsChangeControlAreaExclusive | |||||||||||||||||
| 0x03C1:0x07 | uint8_t OwnsChangeControlAreaShared | unsigned long RundownFail | ||||||||||||||||
| 0x03C2:0x00 | uint8_t OwnsPagedPoolWorkingSetExclusive | unsigned long UmsForceQueueTermination | ||||||||||||||||
| 0x03C2:0x01 | uint8_t OwnsPagedPoolWorkingSetShared | unsigned long ReservedCrossThreadFlags | ||||||||||||||||
| 0x03C2:0x02 | uint8_t OwnsSystemPtesWorkingSetExclusive | |||||||||||||||||
| 0x03C2:0x03 | uint8_t OwnsSystemPtesWorkingSetShared | |||||||||||||||||
| 0x03C2:0x04 | uint8_t TrimTrigger | |||||||||||||||||
| 0x03C2:0x06 | uint8_t Spare2 | |||||||||||||||||
| 0x03C3:0x00 | uint8_t SystemPagePriorityActive | |||||||||||||||||
| 0x03C3:0x01 | uint8_t SystemPagePriority | |||||||||||||||||
| 0x03C3:0x04 | uint8_t Spare3 | |||||||||||||||||
| 0x03C4 | uint8_t CacheManagerActive | unsigned long SameThreadPassiveFlags | volatile long CmLockOrdering | |||||||||||||||
| 0x03C4:0x00 | unsigned long ActiveExWorker | |||||||||||||||||
| 0x03C4:0x01 | unsigned long MemoryMaker | |||||||||||||||||
| 0x03C4:0x02 | unsigned long ClonedThread | |||||||||||||||||
| 0x03C4:0x03 | unsigned long KeyedEventInUse | |||||||||||||||||
| 0x03C4:0x04 | unsigned long SelfTerminate | |||||||||||||||||
| 0x03C5 | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x03C6 | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x03C7 | uint8_t LockOrderState | |||||||||||||||||
| 0x03C8 | unsigned long AlpcMessageId | unsigned long SameThreadApcFlags | unsigned long CrossThreadFlags | |||||||||||||||
| 0x03C8:0x00 | uint8_t OwnsProcessAddressSpaceExclusive | unsigned long Terminated | ||||||||||||||||
| 0x03C8:0x01 | uint8_t OwnsProcessAddressSpaceShared | unsigned long ThreadInserted | ||||||||||||||||
| 0x03C8:0x02 | uint8_t HardFaultBehavior | unsigned long HideFromDebugger | ||||||||||||||||
| 0x03C8:0x03 | volatile uint8_t StartAddressInvalid | unsigned long ActiveImpersonationInfo | ||||||||||||||||
| 0x03C8:0x04 | uint8_t EtwCalloutActive | unsigned long HardErrorsAreDisabled | ||||||||||||||||
| 0x03C8:0x05 | uint8_t SuppressSymbolLoad | unsigned long BreakOnTermination | ||||||||||||||||
| 0x03C8:0x06 | uint8_t Prefetching | unsigned long SkipCreationMsg | ||||||||||||||||
| 0x03C8:0x07 | uint8_t OwnsVadExclusive | unsigned long SkipTerminationMsg | ||||||||||||||||
| 0x03C9:0x00 | uint8_t SystemPagePriorityActive | unsigned long CopyTokenOnOpen | ||||||||||||||||
| 0x03C9:0x01 | uint8_t SystemPagePriority | unsigned long ThreadIoPriority | ||||||||||||||||
| 0x03C8:0x0C | unsigned long ThreadPagePriority | |||||||||||||||||
| 0x03C8:0x0F | unsigned long RundownFail | |||||||||||||||||
| 0x03C8:0x10 | unsigned long UmsForceQueueTermination | |||||||||||||||||
| 0x03C8:0x11 | unsigned long ReservedCrossThreadFlags | unsigned long IndirectCpuSets | ||||||||||||||||
| 0x03C8:0x12 | unsigned long ReservedCrossThreadFlags | |||||||||||||||||
| 0x03CC | void * AlpcMessage | uint8_t CacheManagerActive | unsigned long SameThreadPassiveFlags | |||||||||||||||
| 0x03CC | unsigned long AlpcReceiveAttributeSet | unsigned long ActiveExWorker | ||||||||||||||||
| 0x03CC:0x01 | unsigned long MemoryMaker | |||||||||||||||||
| 0x03CC:0x02 | unsigned long ClonedThread | unsigned long StoreLockThread | ||||||||||||||||
| 0x03CC:0x03 | unsigned long KeyedEventInUse | unsigned long ClonedThread | ||||||||||||||||
| 0x03CC:0x04 | unsigned long SelfTerminate | unsigned long KeyedEventInUse | ||||||||||||||||
| 0x03CC:0x05 | unsigned long RespectIoPriority | unsigned long SelfTerminate | ||||||||||||||||
| 0x03CC:0x06 | unsigned long ReservedSameThreadPassiveFlags | unsigned long RespectIoPriority | ||||||||||||||||
| 0x03CC:0x07 | unsigned long ReservedSameThreadPassiveFlags | |||||||||||||||||
| 0x03CD | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x03CE | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x03CF | uint8_t LockOrderState | |||||||||||||||||
| 0x03D0 | long ExitStatus | unsigned long AlpcMessageId | unsigned long SameThreadApcFlags | |||||||||||||||
| 0x03D0:0x00 | uint8_t OwnsProcessAddressSpaceExclusive | |||||||||||||||||
| 0x03D0:0x01 | uint8_t OwnsProcessAddressSpaceShared | |||||||||||||||||
| 0x03D0:0x02 | uint8_t HardFaultBehavior | |||||||||||||||||
| 0x03D0:0x03 | volatile uint8_t StartAddressInvalid | |||||||||||||||||
| 0x03D0:0x04 | uint8_t EtwCalloutActive | |||||||||||||||||
| 0x03D0:0x05 | uint8_t SuppressSymbolLoad | |||||||||||||||||
| 0x03D0:0x06 | uint8_t Prefetching | |||||||||||||||||
| 0x03D0:0x07 | uint8_t OwnsVadExclusive | |||||||||||||||||
| 0x03D1:0x00 | uint8_t SystemPagePriorityActive | |||||||||||||||||
| 0x03D1:0x01 | uint8_t SystemPagePriority | |||||||||||||||||
| 0x03D4 | struct _LIST_ENTRY AlpcWaitListEntry | void * AlpcMessage | uint8_t CacheManagerActive | |||||||||||||||
| 0x03D4 | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x03D5 | uint8_t DisablePageFaultClustering | |||||||||||||||||
| 0x03D6 | uint8_t ActiveFaultCount | |||||||||||||||||
| 0x03D7 | uint8_t LockOrderState | |||||||||||||||||
| 0x03D8 | long ExitStatus | unsigned long AlpcMessageId | ||||||||||||||||
| 0x03DC | unsigned long CacheManagerCount | struct _LIST_ENTRY AlpcWaitListEntry | void * AlpcMessage | |||||||||||||||
| 0x03DC | unsigned long AlpcReceiveAttributeSet | |||||||||||||||||
| 0x03E0 | unsigned long IoBoostCount | long ExitStatus | ||||||||||||||||
| 0x03E4 | struct _LIST_ENTRY BoostList | unsigned long CacheManagerCount | struct _LIST_ENTRY AlpcWaitListEntry | |||||||||||||||
| 0x03E8 | unsigned long IoBoostCount | |||||||||||||||||
| 0x03EC | struct _LIST_ENTRY DeboostList | struct _LIST_ENTRY BoostList | unsigned long CacheManagerCount | |||||||||||||||
| 0x03F0 | unsigned long IoBoostCount | |||||||||||||||||
| 0x03F4 | unsigned long BoostListLock | struct _LIST_ENTRY DeboostList | struct _LIST_ENTRY BoostList | |||||||||||||||
| 0x03F8 | unsigned long IrpListLock | |||||||||||||||||
| 0x03FC | void * ReservedForSynchTracking | unsigned long BoostListLock | struct _LIST_ENTRY DeboostList | |||||||||||||||
| 0x0400 | struct _SINGLE_LIST_ENTRY CmCallbackListHead | unsigned long IrpListLock | ||||||||||||||||
| 0x0404 | const struct _GUID * ActivityId | void * ReservedForSynchTracking | unsigned long BoostListLock | |||||||||||||||
| 0x0408 | struct _SINGLE_LIST_ENTRY SeLearningModeListHead | struct _SINGLE_LIST_ENTRY CmCallbackListHead | unsigned long IrpListLock | |||||||||||||||
| 0x040C | void * VerifierContext | const struct _GUID * ActivityId | void * ReservedForSynchTracking | |||||||||||||||
| 0x0410 | unsigned long KernelStackReference | struct _SINGLE_LIST_ENTRY SeLearningModeListHead | struct _SINGLE_LIST_ENTRY CmCallbackListHead | |||||||||||||||
| 0x0414 | void * AdjustedClientToken | void * VerifierContext | const struct _GUID * ActivityId | |||||||||||||||
| 0x0418 | unsigned long KernelStackReference | struct _SINGLE_LIST_ENTRY SeLearningModeListHead | ||||||||||||||||
| 0x041C | void * AdjustedClientToken | void * VerifierContext | ||||||||||||||||
| 0x0420 | void * WorkingOnBehalfClient | unsigned long KernelStackReference | ||||||||||||||||
| 0x0424 | struct _PS_PROPERTY_SET PropertySet | void * AdjustedClientToken | ||||||||||||||||
| 0x0428 | void * WorkingOnBehalfClient | |||||||||||||||||
| 0x042C | struct _PS_PROPERTY_SET PropertySet | |||||||||||||||||
| 0x0430 | struct _THREAD_ENERGY_VALUES * EnergyValues | void * PicoContext | ||||||||||||||||
| 0x0434 | unsigned long UserFsBase | |||||||||||||||||
| 0x0438 | unsigned long UserGsBase | void * PicoContext | ||||||||||||||||
| 0x043C | struct _THREAD_ENERGY_VALUES * EnergyValues | unsigned long UserFsBase | ||||||||||||||||
| 0x0440 | volatile unsigned long CmCellReferences | unsigned long UserGsBase | ||||||||||||||||
| 0x0444 | struct _THREAD_ENERGY_VALUES * EnergyValues | |||||||||||||||||
| 0x0448 | volatile unsigned long CmCellReferences | |||||||||||||||||
| 0x044C | unsigned long SelectedCpuSets | unsigned long SelectedCpuSets | ||||||||||||||||
| 0x044C | unsigned long * SelectedCpuSetsIndirect | |||||||||||||||||
| 0x0450 | struct _ESILO * Silo | struct _EJOB * Silo | ||||||||||||||||