Min version	2003/XP64 SP1	2003/XP64 SP2	2003/XP64 SP2	2003/XP64 SP2	Vista SP1	Vista SP2	7	7	7 SP1	7 SP1	8 Pre RTM	8	8.1	8.1 Update 1	8.1 Update 1	10 Pre RTM	10 Pre RTM	10
Max version					Vista SP2													10 TH2
x64 offset offset:bitpos	Field Name
0x0000	struct _DISPATCHER_HEADER Header
0x0018	struct _LIST_ENTRY MutantListHead				volatile uint64_t CycleTime						void * SListFaultAddress
0x0020					uint64_t QuantumTarget
0x0028	void * InitialStack
0x0030	void * StackLimit				void * volatile StackLimit
0x0038	void * KernelStack										void * StackBase
0x0040	uint64_t ThreadLock
0x0048	struct _KAPC_STATE ApcState						union _KWAIT_STATUS_REGISTER WaitRegister				volatile uint64_t CycleTime
0x0048	uint8_t[43] ApcStateFill
0x0049							volatile uint8_t Running
0x004A							uint8_t[2] Alerted
0x004C:0x00							unsigned long KernelStackResident
0x004C							long MiscFlags
0x004C:0x01							unsigned long ReadyTransition
0x004C:0x02							unsigned long ProcessReadyQueue
0x004C:0x03							unsigned long WaitNext
0x004C:0x04							unsigned long SystemAffinityActive
0x004C:0x05							unsigned long Alertable
0x004C:0x06							unsigned long GdiFlushActive
0x004C:0x07							unsigned long UserStackWalkActive
0x004C:0x08							unsigned long ApcInterruptRequest
0x004C:0x09							unsigned long ForceDeferSchedule
0x004C:0x0A							unsigned long QuantumEndMigrate
0x004C:0x0B							unsigned long UmsDirectedSwitchEnable
0x004C:0x0C							unsigned long TimerActive
0x004C:0x0D							unsigned long Reserved		unsigned long SystemThread
0x004C:0x0E									unsigned long Reserved
0x0050							struct _KAPC_STATE ApcState				unsigned long CurrentRunTime
0x0050							uint8_t[43] ApcStateFill
0x0054											unsigned long ExpectedRunTime
0x0058											void * KernelStack
0x0060											struct _XSAVE_FORMAT * StateSaveArea
0x0068											struct _KSCHEDULING_GROUP * volatile SchedulingGroup
0x0070											union _KWAIT_STATUS_REGISTER WaitRegister
0x0071											volatile uint8_t Running
0x0072											uint8_t[2] Alerted
0x0073	uint8_t ApcQueueable				char Priority
0x0074	volatile uint8_t NextProcessor				volatile uint16_t NextProcessor						unsigned long KernelStackResident				unsigned long SpareMiscFlag0	unsigned long AutoBoostActive
0x0074											long MiscFlags
0x0074:0x01											unsigned long ReadyTransition
0x0074:0x02											unsigned long ProcessReadyQueue							unsigned long WaitNext
0x0074:0x03											unsigned long WaitNext							unsigned long SystemAffinityActive
0x0074:0x04											unsigned long SystemAffinityActive							unsigned long Alertable
0x0074:0x05											unsigned long Alertable							unsigned long UserStackWalkActive
0x0074:0x06											unsigned long CodePatchInProgress		unsigned long UserStackWalkActive					unsigned long ApcInterruptRequest
0x0074:0x07											unsigned long UserStackWalkActive		unsigned long ApcInterruptRequest					unsigned long QuantumEndMigrate
0x0075	volatile uint8_t DeferredProcessor										unsigned long ApcInterruptRequest		unsigned long QuantumEndMigrate					unsigned long UmsDirectedSwitchEnable
0x0074:0x09											unsigned long QuantumEndMigrate		unsigned long UmsDirectedSwitchEnable					unsigned long TimerActive
0x0074:0x0A											unsigned long UmsDirectedSwitchEnable		unsigned long TimerActive					unsigned long SystemThread
0x0074:0x0B											unsigned long TimerActive		unsigned long SystemThread					unsigned long ProcessDetachActive
0x0074:0x0C											unsigned long SystemThread		unsigned long ProcessDetachActive					unsigned long CalloutActive
0x0074:0x0D											unsigned long ProcessDetachActive		unsigned long CalloutActive					unsigned long ScbReadyQueue
0x0074:0x0E											unsigned long CalloutActive		unsigned long ScbReadyQueue					unsigned long ApcQueueable
0x0074:0x0F											unsigned long ScbReadyQueue		unsigned long ApcQueueable					unsigned long ReservedStackInUse
0x0076	uint8_t AdjustReason				volatile uint16_t DeferredProcessor						unsigned long ApcQueueable		unsigned long ReservedStackInUse					unsigned long UmsPerformingSyscall
0x0074:0x11											unsigned long ReservedStackInUse		unsigned long UmsPerformingSyscall					unsigned long TimerSuspended
0x0074:0x12											unsigned long UmsPerformingSyscall		unsigned long ApcPendingReload					unsigned long SuspendedWaitMode
0x0074:0x13											unsigned long DisableStackCheck	unsigned long Reserved			unsigned long TimerSuspended			unsigned long SuspendSchedulerApcWait
0x0074:0x14											unsigned long Reserved				unsigned long SuspendedWaitMode			unsigned long Reserved
0x0074:0x15															unsigned long Reserved		unsigned long SuspendSchedulerApcWait
0x0074:0x16																	unsigned long Reserved
0x0077	char AdjustIncrement
0x0078	uint64_t ApcQueueLock										volatile unsigned long AutoAlignment	unsigned long AutoAlignment
0x0078											volatile long ThreadFlags
0x0078:0x01											volatile unsigned long DisableBoost	unsigned long DisableBoost
0x0078:0x02											volatile unsigned long UserAffinitySet	unsigned long UserAffinitySet						unsigned long ThreadFlagsSpare0
0x0078:0x03											volatile unsigned long AlertedByThreadId	unsigned long AlertedByThreadId
0x0078:0x04											volatile unsigned long QuantumDonation	unsigned long QuantumDonation
0x0078:0x05											volatile unsigned long EnableStackSwap	unsigned long EnableStackSwap
0x0078:0x06											volatile unsigned long GuiThread	unsigned long GuiThread
0x0078:0x07											volatile unsigned long DisableQuantum	unsigned long DisableQuantum
0x0078:0x08											volatile unsigned long ChargeOnlyGroup	unsigned long ChargeOnlyGroup	unsigned long ChargeOnlySchedulingGroup
0x0078:0x09											volatile unsigned long DeferPreemption	unsigned long DeferPreemption
0x0078:0x0A											volatile unsigned long QueueDeferPreemption	unsigned long QueueDeferPreemption
0x0078:0x0B											volatile unsigned long ForceDeferSchedule	unsigned long ForceDeferSchedule
0x0078:0x0C											volatile unsigned long ExplicitIdealProcessor	unsigned long ExplicitIdealProcessor	unsigned long SharedReadyQueueAffinity
0x0078:0x0D											volatile unsigned long FreezeCount	unsigned long FreezeCount
0x0078:0x0E											volatile unsigned long EtwStackTraceApcInserted	unsigned long EtwStackTraceApcInserted	unsigned long TerminationApcRequest
0x0078:0x0F													unsigned long EtwStackTraceApcInserted	unsigned long AutoBoostEntriesExhausted
0x0078:0x10														unsigned long EtwStackTraceApcInserted	unsigned long KernelStackResident
0x0078:0x11															unsigned long EtwStackTraceApcInserted	unsigned long ThreadFlagsSpare	unsigned long CommitFailTerminateRequest
0x0078:0x12																	unsigned long ProcessStackCountDecremented
0x0078:0x13																	unsigned long ThreadFlagsSpare
0x0078:0x16											volatile unsigned long ReservedFlags	unsigned long ReservedFlags
0x0078:0x17													unsigned long ReservedFlags
0x007B							char Priority							unsigned long ReservedFlags		unsigned long EtwStackTraceApcInserted
0x0078:0x19															unsigned long ReservedFlags
0x007C							volatile unsigned long NextProcessor				unsigned long Spare0					volatile uint8_t Tag
0x007D																uint8_t SystemHeteroCpuPolicy
0x007E:0x00																uint8_t UserHeteroCpuPolicy
0x007E:0x07																uint8_t ExplicitSystemHeteroCpuPolicy
0x007F																uint8_t[1] Spare0		uint8_t Spare0
0x0080	int64_t WaitStatus						volatile unsigned long DeferredProcessor				unsigned long SystemCallNumber
0x0084											unsigned long Spare1					unsigned long Spare10
0x0088	struct _KWAIT_BLOCK * WaitBlockList						uint64_t ApcQueueLock				void * FirstArgument
0x0088	struct _KGATE * GateObject
0x0090	uint8_t Alertable				unsigned long KernelStackResident		volatile int64_t WaitStatus				struct _KTRAP_FRAME * TrapFrame
0x0090					long MiscFlags
0x0090:0x01					unsigned long ReadyTransition
0x0090:0x02					unsigned long ProcessReadyQueue
0x0090:0x03					unsigned long WaitNext
0x0090:0x04					unsigned long SystemAffinityActive
0x0090:0x05					unsigned long Alertable
0x0090:0x06					unsigned long GdiFlushActive
0x0090:0x07					unsigned long UserStackWalkActive
0x0091	uint8_t WaitNext				unsigned long Reserved
0x0092	uint8_t WaitReason
0x0093	char Priority
0x0094	uint8_t EnableStackSwap				uint8_t WaitReason
0x0095	volatile uint8_t SwapBusy
0x0096	uint8_t[2] Alerted
0x0098	struct _LIST_ENTRY WaitListEntry						struct _KWAIT_BLOCK * WaitBlockList				struct _KAPC_STATE ApcState
0x0098	struct _SINGLE_LIST_ENTRY SwapListEntry										uint8_t[43] ApcStateFill
0x00A0							struct _LIST_ENTRY WaitListEntry
0x00A0							struct _SINGLE_LIST_ENTRY SwapListEntry
0x00A8	struct _KQUEUE * Queue
0x00B0	void * Teb						struct _KQUEUE * volatile Queue
0x00B8	struct _KTIMER Timer						void * Teb
0x00B8	uint8_t[60] TimerFill
0x00C0							struct _KTIMER Timer
0x00C3											char Priority
0x00C4											unsigned long UserIdealProcessor
0x00C8											volatile int64_t WaitStatus
0x00D0											struct _KWAIT_BLOCK * WaitBlockList
0x00D8											struct _LIST_ENTRY WaitListEntry
0x00D8											struct _SINGLE_LIST_ENTRY SwapListEntry
0x00E8											struct _KQUEUE * volatile Queue		struct _DISPATCHER_HEADER * volatile Queue
0x00F0											void * Teb
0x00F4:0x00	long AutoAlignment	unsigned long AutoAlignment			volatile unsigned long AutoAlignment
0x00F4	long ThreadFlags				volatile long ThreadFlags
0x00F4:0x01	long DisableBoost	unsigned long DisableBoost			volatile unsigned long DisableBoost
0x00F4:0x02	long ReservedFlags	unsigned long GuiThread			volatile unsigned long EtwStackTraceApc1Inserted
0x00F4:0x03		unsigned long ReservedFlags	unsigned long EtwStackTraceApc1Inserted	unsigned long VdmSafe	volatile unsigned long EtwStackTraceApc2Inserted
0x00F4:0x04			unsigned long VdmSafe	unsigned long ReservedFlags	volatile unsigned long CycleChargePending
0x00F4:0x05			unsigned long ReservedFlags		volatile unsigned long CalloutActive
0x00F4:0x06					volatile unsigned long ApcQueueable
0x00F4:0x07					volatile unsigned long EnableStackSwap
0x00F4:0x08					volatile unsigned long GuiThread
0x00F4:0x09					volatile unsigned long ReservedFlags	volatile unsigned long VdmSafe
0x00F4:0x0A						volatile unsigned long ReservedFlags
0x00F8	struct _KWAIT_BLOCK[4] WaitBlock										struct _KTIMER Timer	uint64_t RelativeTimerBias
0x00F8	uint8_t[43] WaitBlockFill0
0x00F8	uint8_t[91] WaitBlockFill1
0x00F8	uint8_t[139] WaitBlockFill2
0x00F8	uint8_t[187] WaitBlockFill3
0x00F8	uint8_t[44] WaitBlockFill4
0x00F8	uint8_t[92] WaitBlockFill5
0x00F8	uint8_t[140] WaitBlockFill6
0x00F8	uint8_t[188] WaitBlockFill7
0x0100:0x00							volatile unsigned long AutoAlignment					struct _KTIMER Timer
0x0100							volatile long ThreadFlags
0x0100:0x01							volatile unsigned long DisableBoost
0x0100:0x02							volatile unsigned long EtwStackTraceApc1Inserted
0x0100:0x03							volatile unsigned long EtwStackTraceApc2Inserted
0x0100:0x04							volatile unsigned long CalloutActive
0x0100:0x05							volatile unsigned long ApcQueueable
0x0100:0x06							volatile unsigned long EnableStackSwap
0x0100:0x07							volatile unsigned long GuiThread
0x0100:0x08							volatile unsigned long UmsPerformingSyscall
0x0100:0x09							volatile unsigned long ReservedFlags	volatile unsigned long VdmSafe
0x0100:0x0A								volatile unsigned long ReservedFlags	volatile unsigned long UmsDispatched
0x0100:0x0B									volatile unsigned long ReservedFlags
0x0104							unsigned long Spare0
0x0108							struct _KWAIT_BLOCK[4] WaitBlock
0x0108							uint8_t[44] WaitBlockFill4
0x0108							uint8_t[92] WaitBlockFill5
0x0108							uint8_t[140] WaitBlockFill6
0x0108							uint8_t[168] WaitBlockFill7
0x0108							uint8_t[188] WaitBlockFill8
0x0123	uint8_t SystemAffinityActive				uint8_t IdealProcessor
0x0124	unsigned long ContextSwitches
0x0134							unsigned long ContextSwitches
0x0138											struct _KWAIT_BLOCK[4] WaitBlock
0x0138											uint8_t[20] WaitBlockFill4
0x0138											uint8_t[68] WaitBlockFill5
0x0138											uint8_t[116] WaitBlockFill6
0x0138											uint8_t[164] WaitBlockFill7
0x0138											uint8_t[40] WaitBlockFill8
0x0138											uint8_t[88] WaitBlockFill9
0x0138											uint8_t[136] WaitBlockFill10
0x0138											uint8_t[176] WaitBlockFill11
0x0140												struct _KWAIT_BLOCK[4] WaitBlock
0x0140												uint8_t[20] WaitBlockFill4
0x0140												uint8_t[68] WaitBlockFill5
0x0140												uint8_t[116] WaitBlockFill6
0x0140												uint8_t[164] WaitBlockFill7
0x0140												uint8_t[40] WaitBlockFill8
0x0140												uint8_t[88] WaitBlockFill9
0x0140												uint8_t[136] WaitBlockFill10
0x0140												uint8_t[176] WaitBlockFill11
0x014C											unsigned long ContextSwitches
0x0153	char PreviousMode
0x0154	volatile uint8_t State											unsigned long ContextSwitches
0x0155	uint8_t NpxState
0x0156	uint8_t WaitIrql
0x0157	char WaitMode
0x0160											struct _KTHREAD_COUNTERS * ThreadCounters
0x0164							volatile uint8_t State
0x0165							char NpxState
0x0166							uint8_t WaitIrql
0x0167							char WaitMode
0x0168												struct _KTHREAD_COUNTERS * ThreadCounters
0x017C											volatile uint8_t State
0x017D											char NpxState
0x017E											uint8_t WaitIrql
0x017F											char WaitMode
0x0183	uint8_t ResourceIndex
0x0184	unsigned long WaitTime											volatile uint8_t State
0x0185												char NpxState						char Spare13
0x0186												uint8_t WaitIrql
0x0187												char WaitMode
0x0190											struct _XSTATE_SAVE * XStateSave
0x0194							unsigned long WaitTime
0x0198												struct _XSTATE_SAVE * XStateSave
0x01AC											unsigned long WaitTime
0x01B0							void * TebMappedLowVa
0x01B3	uint8_t LargeStack
0x01B4	int16_t KernelApcDisable											unsigned long WaitTime
0x01B4	unsigned long CombinedApcDisable
0x01B6	int16_t SpecialApcDisable
0x01B8	struct _LIST_ENTRY QueueListEntry						struct _UMS_CONTROL_BLOCK * Ucb
0x01C0											void * volatile Win32Thread
0x01C4							int16_t KernelApcDisable
0x01C4							unsigned long CombinedApcDisable
0x01C6							int16_t SpecialApcDisable
0x01C8	struct _KTRAP_FRAME * TrapFrame						struct _LIST_ENTRY QueueListEntry					void * volatile Win32Thread
0x01D0	void * CallbackStack				void * FirstArgument
0x01D8	void * ServiceTable	uint8_t ApcStateIndex			void * CallbackStack		struct _KTRAP_FRAME * TrapFrame
0x01D8					uint64_t CallbackDepth
0x01D9		uint8_t IdealProcessor
0x01DA		uint8_t Preempted
0x01DB		uint8_t ProcessReadyQueue
0x01DC		uint8_t KernelStackResident									int16_t KernelApcDisable
0x01DC											unsigned long CombinedApcDisable
0x01DD		char BasePriority
0x01DE		char PriorityDecrement									int16_t SpecialApcDisable
0x01DF		char Saturation
0x01E0	unsigned long KernelLimit	uint64_t UserAffinity			uint8_t ApcStateIndex		void * FirstArgument
0x01E1					char BasePriority
0x01E2					char PriorityDecrement
0x01E3					uint8_t Preempted
0x01E4	uint8_t ApcStateIndex				uint8_t AdjustReason							int16_t KernelApcDisable
0x01E4												unsigned long CombinedApcDisable
0x01E5	uint8_t IdealProcessor				char AdjustIncrement
0x01E6	uint8_t Preempted				uint8_t Spare01							int16_t SpecialApcDisable
0x01E7	uint8_t ProcessReadyQueue				char Saturation
0x01E8	void * Win32kTable	struct _KPROCESS * Process			unsigned long SystemCallNumber		void * CallbackStack				struct _UMS_CONTROL_BLOCK * Ucb
0x01E8							uint64_t CallbackDepth
0x01EC					unsigned long FreezeCount
0x01F0	unsigned long Win32kLimit	uint64_t Affinity	volatile uint64_t Affinity	uint64_t Affinity	uint64_t UserAffinity		uint8_t ApcStateIndex				struct _KUMS_CONTEXT_HEADER * volatile Uch	struct _UMS_CONTROL_BLOCK * Ucb
0x01F1							char BasePriority
0x01F2							char PriorityDecrement
0x01F2:0x00							uint8_t ForegroundBoost
0x01F2:0x04							uint8_t UnusualBoost
0x01F3							uint8_t Preempted
0x01F4	uint8_t KernelStackResident						uint8_t AdjustReason
0x01F5	char BasePriority						char AdjustIncrement
0x01F6	char PriorityDecrement						char PreviousMode
0x01F7	char Saturation						char Saturation
0x01F8	uint64_t UserAffinity	struct _KAPC_STATE *[2] ApcStatePointer			struct _KPROCESS * Process		unsigned long SystemCallNumber				void * TebMappedLowVa	struct _KUMS_CONTEXT_HEADER * volatile Uch
0x01FC							unsigned long FreezeCount
0x0200	struct _KPROCESS * Process				volatile uint64_t Affinity		volatile struct _GROUP_AFFINITY UserAffinity				struct _LIST_ENTRY QueueListEntry	void * TebMappedLowVa
0x0208	uint64_t Affinity	struct _KAPC_STATE SavedApcState			struct _KAPC_STATE *[2] ApcStatePointer							struct _LIST_ENTRY QueueListEntry
0x0208		uint8_t[43] SavedApcStateFill
0x0210	struct _KAPC_STATE *[2] ApcStatePointer						struct _KPROCESS * Process				volatile unsigned long NextProcessor
0x0214											volatile unsigned long DeferredProcessor
0x0218					struct _KAPC_STATE SavedApcState		volatile struct _GROUP_AFFINITY Affinity				struct _KPROCESS * Process	volatile unsigned long NextProcessor	volatile unsigned long NextProcessor
0x0218					uint8_t[43] SavedApcStateFill								unsigned long NextProcessorNumber
0x0218:0x1F													unsigned long SharedReadyQueue
0x021C												volatile unsigned long DeferredProcessor	long QueuePriority
0x0220	struct _KAPC_STATE SavedApcState										volatile struct _GROUP_AFFINITY UserAffinity	struct _KPROCESS * Process
0x0220	uint8_t[43] SavedApcStateFill										uint8_t[10] UserAffinityFill
0x0228							unsigned long IdealProcessor					volatile struct _GROUP_AFFINITY UserAffinity	struct _GROUP_AFFINITY UserAffinity
0x0228												uint8_t[10] UserAffinityFill
0x022A											char PreviousMode
0x022B											char BasePriority
0x022C							unsigned long UserIdealProcessor				char PriorityDecrement
0x022C:0x00											uint8_t ForegroundBoost
0x022C:0x04											uint8_t UnusualBoost
0x022D											uint8_t Preempted
0x022E											uint8_t AdjustReason
0x022F											char AdjustIncrement
0x0230							struct _KAPC_STATE *[2] ApcStatePointer				volatile struct _GROUP_AFFINITY Affinity
0x0230											uint8_t[10] AffinityFill
0x0232												char PreviousMode
0x0233		char FreezeCount										char BasePriority
0x0234		char SuspendCount										char PriorityDecrement
0x0234:0x00												uint8_t ForegroundBoost
0x0234:0x04												uint8_t UnusualBoost
0x0235		uint8_t UserIdealProcessor										uint8_t Preempted
0x0236		uint8_t CalloutActive										uint8_t AdjustReason
0x0237		uint8_t CodePatchInProgress										char AdjustIncrement
0x0238		void * Win32Thread										volatile struct _GROUP_AFFINITY Affinity	struct _GROUP_AFFINITY Affinity					uint64_t AffinityVersion
0x0238												uint8_t[10] AffinityFill
0x023A											uint8_t ApcStateIndex
0x023B											uint8_t WaitBlockCount
0x023C											unsigned long IdealProcessor
0x0240		void * StackBase					struct _KAPC_STATE SavedApcState				struct _KAPC_STATE *[2] ApcStatePointer							struct _GROUP_AFFINITY Affinity
0x0240							uint8_t[43] SavedApcStateFill											uint8_t[10] AffinityFill
0x0242												uint8_t ApcStateIndex
0x0243					uint8_t Spare02							uint8_t WaitBlockCount
0x0244					char SuspendCount							unsigned long IdealProcessor
0x0245					uint8_t UserIdealProcessor
0x0246					uint8_t Spare03
0x0247					uint8_t CodePatchInProgress
0x0248		struct _KAPC SuspendApc			void * volatile Win32Thread							struct _KAPC_STATE *[2] ApcStatePointer
0x0248		uint8_t[1] SuspendApcFill0
0x0248		uint8_t[3] SuspendApcFill1
0x0248		uint8_t[4] SuspendApcFill2
0x0248		uint8_t[64] SuspendApcFill3
0x0248		uint8_t[72] SuspendApcFill4
0x0248		uint8_t[83] SuspendApcFill5
0x0249		char Quantum
0x024A																		uint8_t ApcStateIndex
0x024B	char FreezeCount	uint8_t QuantumReset																uint8_t WaitBlockCount
0x024C	char SuspendCount	unsigned long KernelTime																unsigned long IdealProcessor
0x024D	uint8_t UserIdealProcessor
0x024E	uint8_t CalloutActive
0x024F	uint8_t CodePatchInProgress
0x0250	void * Win32Thread				void * StackBase						struct _KAPC_STATE SavedApcState							uint64_t NpxState
0x0250											uint8_t[43] SavedApcStateFill
0x0258	void * StackBase				struct _KAPC SuspendApc							struct _KAPC_STATE SavedApcState
0x0258					uint8_t[1] SuspendApcFill0							uint8_t[43] SavedApcStateFill
0x0258					uint8_t[3] SuspendApcFill1
0x0258					uint8_t[4] SuspendApcFill2
0x0258					uint8_t[64] SuspendApcFill3
0x0258					uint8_t[72] SuspendApcFill4
0x0258					uint8_t[83] SuspendApcFill5
0x0259					char Spare04
0x025B					uint8_t QuantumReset
0x025C					unsigned long KernelTime
0x0260	struct _KAPC SuspendApc
0x0260	uint8_t[1] SuspendApcFill0
0x0260	uint8_t[3] SuspendApcFill1
0x0260	uint8_t[4] SuspendApcFill2
0x0260	uint8_t[64] SuspendApcFill3
0x0260	uint8_t[72] SuspendApcFill4
0x0260	uint8_t[83] SuspendApcFill5
0x0261	char Quantum
0x0263	uint8_t QuantumReset
0x0264	unsigned long KernelTime
0x026B							uint8_t WaitReason
0x026C							char SuspendCount
0x026D							char Spare1
0x026E							uint8_t CodePatchInProgress
0x0270							void * volatile Win32Thread
0x0278							void * StackBase
0x027B											uint8_t WaitReason
0x027C											char SuspendCount
0x027D											char Saturation
0x027E											uint16_t SListFaultCount
0x0280							struct _KAPC SuspendApc				struct _KAPC SchedulerApc
0x0280							uint8_t[1] SuspendApcFill0				uint8_t[1] SchedulerApcFill0
0x0280							uint8_t[3] SuspendApcFill1				uint8_t[3] SchedulerApcFill1
0x0280							uint8_t[4] SuspendApcFill2				uint8_t[4] SchedulerApcFill2
0x0280							uint8_t[64] SuspendApcFill3				uint8_t[64] SchedulerApcFill3
0x0280							uint8_t[72] SuspendApcFill4				uint8_t[72] SchedulerApcFill4
0x0280							uint8_t[83] SuspendApcFill5				uint8_t[83] SchedulerApcFill5
0x0281							uint8_t ResourceIndex
0x0283							uint8_t QuantumReset					uint8_t WaitReason
0x0284							unsigned long KernelTime					char SuspendCount
0x0285												char Saturation
0x0286												uint16_t SListFaultCount
0x0288		void * TlsArray										struct _KAPC SchedulerApc
0x0288												uint8_t[1] SchedulerApcFill0
0x0288												uint8_t[3] SchedulerApcFill1
0x0288												uint8_t[4] SchedulerApcFill2
0x0288												uint8_t[64] SchedulerApcFill3
0x0288												uint8_t[72] SchedulerApcFill4
0x0288												uint8_t[83] SchedulerApcFill5
0x0289												uint8_t ResourceIndex
0x028B												uint8_t QuantumReset
0x028C												unsigned long KernelTime
0x0290		void * LegoData
0x0298					struct _KPRCB * WaitPrcb
0x029B		uint8_t PowerState
0x029C		unsigned long UserTime
0x02A0	void * TlsArray	struct _KSEMAPHORE SuspendSemaphore			void * LegoData
0x02A0		uint8_t[28] SuspendSemaphorefill
0x02A8	void * LegoData
0x02AB					uint8_t PowerState
0x02AC					unsigned long UserTime
0x02B0					struct _KSEMAPHORE SuspendSemaphore
0x02B0					uint8_t[28] SuspendSemaphorefill
0x02B3	uint8_t PowerState
0x02B4	unsigned long UserTime
0x02B8	struct _KSEMAPHORE SuspendSemaphore
0x02B8	uint8_t[28] SuspendSemaphorefill
0x02BC		unsigned long SListFaultCount
0x02C0		struct _LIST_ENTRY ThreadListEntry					struct _KPRCB * volatile WaitPrcb
0x02C8							void * LegoData					struct _KPRCB * volatile WaitPrcb
0x02CC					unsigned long SListFaultCount
0x02D0		void * SListFaultAddress			struct _LIST_ENTRY ThreadListEntry							void * LegoData
0x02D3							uint8_t LargeStack				uint8_t CallbackNestingLevel
0x02D4	unsigned long SListFaultCount						unsigned long UserTime
0x02D8	struct _LIST_ENTRY ThreadListEntry	int64_t ReadOperationCount					struct _KSEMAPHORE SuspendSemaphore				struct _KEVENT SuspendEvent
0x02D8							uint8_t[28] SuspendSemaphorefill
0x02DB												uint8_t CallbackNestingLevel
0x02DC												unsigned long UserTime
0x02E0		int64_t WriteOperationCount			struct _LIST_ENTRY MutantListHead							struct _KEVENT SuspendEvent
0x02E8	void * SListFaultAddress	int64_t OtherOperationCount
0x02F0	int64_t ReadOperationCount	int64_t ReadTransferCount			void * SListFaultAddress						struct _LIST_ENTRY ThreadListEntry
0x02F4							unsigned long SListFaultCount
0x02F8	int64_t WriteOperationCount	int64_t WriteTransferCount			int64_t ReadOperationCount		struct _LIST_ENTRY ThreadListEntry					struct _LIST_ENTRY ThreadListEntry
0x0300	int64_t OtherOperationCount	int64_t OtherTransferCount			int64_t WriteOperationCount						struct _LIST_ENTRY MutantListHead
0x0308	int64_t ReadTransferCount				int64_t OtherOperationCount		struct _LIST_ENTRY MutantListHead					struct _LIST_ENTRY MutantListHead
0x0310	int64_t WriteTransferCount				int64_t ReadTransferCount						int64_t ReadOperationCount
0x0318	int64_t OtherTransferCount				int64_t WriteTransferCount		void * SListFaultAddress				int64_t WriteOperationCount	int64_t ReadOperationCount	struct _SINGLE_LIST_ENTRY LockEntriesFreeList			uint8_t AbEntrySummary
0x0319																uint8_t AbWaitEntryCount
0x031A																uint16_t Spare20
0x031C																unsigned long SecureThreadCookie
0x0320					int64_t OtherTransferCount		int64_t ReadOperationCount				int64_t OtherOperationCount	int64_t WriteOperationCount	struct _KLOCK_ENTRY[5] LockEntries	struct _KLOCK_ENTRY[6] LockEntries
0x0328					void * volatile MdlForLockedTeb		int64_t WriteOperationCount				int64_t ReadTransferCount	int64_t OtherOperationCount
0x0330							int64_t OtherOperationCount				int64_t WriteTransferCount	int64_t ReadTransferCount
0x0338							int64_t ReadTransferCount				int64_t OtherTransferCount	int64_t WriteTransferCount
0x0340							int64_t WriteTransferCount					int64_t OtherTransferCount
0x0348							int64_t OtherTransferCount
0x0350							struct _KTHREAD_COUNTERS * ThreadCounters
0x0358							struct _XSTATE_SAVE * XStateSave			struct _XSAVE_FORMAT * StateSaveArea
0x0360										struct _XSTATE_SAVE * XStateSave
0x0500													struct _SINGLE_LIST_ENTRY PropagateBoostsEntry
0x0508													struct _SINGLE_LIST_ENTRY IoSelfBoostsEntry
0x0510													uint8_t[16] PriorityFloorCounts
0x0520													unsigned long PriorityFloorSummary
0x0524													volatile long AbCompletedIoBoostCount
0x0528													volatile int16_t AbReferenceCount
0x052A													uint8_t AbFreeEntryCount
0x052B													uint8_t AbWaitEntryCount
0x052C													unsigned long ForegroundLossTime
0x0530													struct _LIST_ENTRY GlobalForegroundListEntry
0x0530													struct _SINGLE_LIST_ENTRY ForegroundDpcStackListEntry
0x0538													uint64_t InGlobalForegroundList
0x0540													uint16_t[20] Padding
0x0560														struct _SINGLE_LIST_ENTRY PropagateBoostsEntry
0x0568													int64_t ReadOperationCount	struct _SINGLE_LIST_ENTRY IoSelfBoostsEntry
0x0570													int64_t WriteOperationCount	uint8_t[16] PriorityFloorCounts
0x0578													int64_t OtherOperationCount
0x0580													int64_t ReadTransferCount	unsigned long PriorityFloorSummary
0x0584														volatile long AbCompletedIoBoostCount
0x0588													int64_t WriteTransferCount	volatile int16_t AbReferenceCount				volatile int16_t KeReferenceCount
0x058A														uint8_t AbFreeEntryCount		uint8_t AbOrphanedEntrySummary
0x058B														uint8_t AbWaitEntryCount		uint8_t AbOwnedEntryCount
0x058C														unsigned long ForegroundLossTime
0x0590													int64_t OtherTransferCount	struct _LIST_ENTRY GlobalForegroundListEntry
0x0590														struct _SINGLE_LIST_ENTRY ForegroundDpcStackListEntry
0x0598														uint64_t InGlobalForegroundList
0x05A0														int64_t ReadOperationCount
0x05A8														int64_t WriteOperationCount
0x05B0														int64_t OtherOperationCount
0x05B8														int64_t ReadTransferCount
0x05C0														int64_t WriteTransferCount
0x05C8														int64_t OtherTransferCount
0x05D0																	struct _KSCB * QueuedScb