| Min version | 2003/XP64 SP1 | Vista SP1 | Vista SP2 | 7 | 7 SP1 | 8 Pre RTM | 8 | 8.1 | 8.1 Update 1 | 10 Pre RTM | 10 Pre RTM | 10 | 10 TH2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Max version | 2003/XP64 SP2 | Vista SP2 | 7 SP1 | 8.1 Update 1 | |||||||||
| x64 offset offset:bitpos | Field Name | ||||||||||||
| 0x0000 | unsigned long TickCountLowDeprecated | ||||||||||||
| 0x0004 | unsigned long TickCountMultiplier | ||||||||||||
| 0x0008 | volatile struct _KSYSTEM_TIME InterruptTime | ||||||||||||
| 0x0014 | volatile struct _KSYSTEM_TIME SystemTime | ||||||||||||
| 0x0020 | volatile struct _KSYSTEM_TIME TimeZoneBias | ||||||||||||
| 0x002C | uint16_t ImageNumberLow | ||||||||||||
| 0x002E | uint16_t ImageNumberHigh | ||||||||||||
| 0x0030 | uint16_t[260] NtSystemRoot | wchar_t[260] NtSystemRoot | |||||||||||
| 0x0238 | unsigned long MaxStackTraceDepth | ||||||||||||
| 0x023C | unsigned long CryptoExponent | ||||||||||||
| 0x0240 | unsigned long TimeZoneId | ||||||||||||
| 0x0244 | unsigned long LargePageMinimum | ||||||||||||
| 0x0248 | unsigned long[7] Reserved2 | unsigned long AitSamplingValue | |||||||||||
| 0x024C | unsigned long AppCompatFlag | ||||||||||||
| 0x0250 | uint64_t RNGSeedVersion | ||||||||||||
| 0x0258 | unsigned long GlobalValidationRunlevel | ||||||||||||
| 0x025C | unsigned long[2] Reserved2 | volatile long TimeZoneBiasStamp | |||||||||||
| 0x0260 | unsigned long Reserved2 | unsigned long NtBuildNumber | |||||||||||
| 0x0264 | enum _NT_PRODUCT_TYPE NtProductType | ||||||||||||
| 0x0268 | uint8_t ProductTypeIsValid | ||||||||||||
| 0x0269 | uint8_t[1] Reserved0 | ||||||||||||
| 0x026A | uint16_t NativeProcessorArchitecture | ||||||||||||
| 0x026C | unsigned long NtMajorVersion | ||||||||||||
| 0x0270 | unsigned long NtMinorVersion | ||||||||||||
| 0x0274 | uint8_t[64] ProcessorFeatures | ||||||||||||
| 0x02B4 | unsigned long Reserved1 | ||||||||||||
| 0x02B8 | unsigned long Reserved3 | ||||||||||||
| 0x02BC | volatile unsigned long TimeSlip | ||||||||||||
| 0x02C0 | enum _ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture | ||||||||||||
| 0x02C4 | unsigned long[1] AltArchitecturePad | unsigned long BootId | |||||||||||
| 0x02C8 | union _LARGE_INTEGER SystemExpirationDate | ||||||||||||
| 0x02D0 | unsigned long SuiteMask | ||||||||||||
| 0x02D4 | uint8_t KdDebuggerEnabled | ||||||||||||
| 0x02D5 | uint8_t NXSupportPolicy | uint8_t MitigationPolicies | |||||||||||
| 0x02D5:0x00 | uint8_t NXSupportPolicy | ||||||||||||
| 0x02D5:0x02 | uint8_t SEHValidationPolicy | ||||||||||||
| 0x02D5:0x04 | uint8_t CurDirDevicesSkippedForDlls | ||||||||||||
| 0x02D5:0x06 | uint8_t Reserved | ||||||||||||
| 0x02D6 | uint8_t[2] Reserved6 | ||||||||||||
| 0x02D8 | volatile unsigned long ActiveConsoleId | ||||||||||||
| 0x02DC | volatile unsigned long DismountCount | ||||||||||||
| 0x02E0 | unsigned long ComPlusPackage | ||||||||||||
| 0x02E4 | unsigned long LastSystemRITEventTickCount | ||||||||||||
| 0x02E8 | unsigned long NumberOfPhysicalPages | ||||||||||||
| 0x02EC | uint8_t SafeBootMode | ||||||||||||
| 0x02ED | uint8_t TscQpcData | uint8_t[3] Reserved12 | |||||||||||
| 0x02ED:0x00 | uint8_t TscQpcEnabled | ||||||||||||
| 0x02ED:0x01 | uint8_t TscQpcSpareFlag | ||||||||||||
| 0x02ED:0x02 | uint8_t TscQpcShift | ||||||||||||
| 0x02EE | uint8_t[2] TscQpcPad | ||||||||||||
| 0x02F0 | unsigned long TraceLogging | unsigned long SharedDataFlags | |||||||||||
| 0x02F0:0x00 | unsigned long DbgErrorPortPresent | ||||||||||||
| 0x02F0:0x01 | unsigned long DbgElevationEnabled | ||||||||||||
| 0x02F0:0x02 | unsigned long DbgVirtEnabled | ||||||||||||
| 0x02F0:0x03 | unsigned long DbgInstallerDetectEnabled | ||||||||||||
| 0x02F0:0x04 | unsigned long DbgSystemDllRelocated | unsigned long DbgLkgEnabled | |||||||||||
| 0x02F0:0x05 | unsigned long DbgDynProcessorEnabled | ||||||||||||
| 0x02F0:0x06 | unsigned long DbgSEHValidationEnabled | unsigned long DbgConsoleBrokerEnabled | |||||||||||
| 0x02F0:0x07 | unsigned long SpareBits | unsigned long DbgSecureBootEnabled | |||||||||||
| 0x02F0:0x08 | unsigned long SpareBits | unsigned long DbgMultiSessionSku | |||||||||||
| 0x02F0:0x09 | unsigned long SpareBits | ||||||||||||
| 0x02F4 | unsigned long[1] DataFlagsPad | ||||||||||||
| 0x02F8 | uint64_t TestRetInstruction | ||||||||||||
| 0x0300 | unsigned long SystemCall | unsigned long Reserved9 | int64_t QpcFrequency | ||||||||||
| 0x0304 | unsigned long SystemCallReturn | unsigned long Reserved10 | |||||||||||
| 0x0308 | uint64_t[3] SystemCallPad | unsigned long SystemCall | |||||||||||
| 0x030C | unsigned long SystemCallPad0 | ||||||||||||
| 0x0310 | uint64_t[2] SystemCallPad | ||||||||||||
| 0x0320 | volatile struct _KSYSTEM_TIME TickCount | ||||||||||||
| 0x0320 | volatile uint64_t TickCountQuad | volatile uint64_t TickCountQuad | |||||||||||
| 0x0320 | unsigned long[3] ReservedTickCountOverlay | ||||||||||||
| 0x032C | unsigned long[1] TickCountPad | ||||||||||||
| 0x0330 | unsigned long Cookie | ||||||||||||
| 0x0334 | unsigned long[16] Wow64SharedInformation | unsigned long[1] CookiePad | |||||||||||
| 0x0338 | int64_t ConsoleSessionForegroundProcessId | ||||||||||||
| 0x0340 | unsigned long[16] Wow64SharedInformation | unsigned long[16] DEPRECATED_Wow64SharedInformation | unsigned long[16] Wow64SharedInformation | unsigned long[16] DEPRECATED_Wow64SharedInformation | volatile uint64_t TimeUpdateSequence | uint64_t TimeUpdateLock | |||||||
| 0x0348 | uint64_t LastTimeUpdateQpcValue | uint64_t BaselineSystemTimeQpc | |||||||||||
| 0x0350 | uint64_t LastInterruptTimeUpdateQpcValue | uint64_t BaselineInterruptTimeQpc | |||||||||||
| 0x0358 | uint64_t QpcTimeIncrement | uint64_t QpcSystemTimeIncrement | |||||||||||
| 0x0360 | unsigned long QpcTimeIncrement32 | uint64_t QpcInterruptTimeIncrement | |||||||||||
| 0x0364 | unsigned long[7] Reserved8 | ||||||||||||
| 0x0368 | unsigned long QpcSystemTimeIncrement32 | uint8_t QpcSystemTimeIncrementShift | |||||||||||
| 0x0369 | uint8_t QpcInterruptTimeIncrementShift | ||||||||||||
| 0x036A | uint16_t UnparkedProcessorCount | ||||||||||||
| 0x036C | unsigned long QpcInterruptTimeIncrement32 | uint8_t[20] Reserved8 | unsigned long[4] EnclaveFeatureMask | ||||||||||
| 0x0370 | uint8_t QpcSystemTimeIncrementShift | ||||||||||||
| 0x0371 | uint8_t QpcInterruptTimeIncrementShift | ||||||||||||
| 0x0372 | uint8_t[14] Reserved8 | uint16_t UnparkedProcessorCount | |||||||||||
| 0x0374 | uint8_t[12] Reserved8 | ||||||||||||
| 0x037C | unsigned long Reserved8 | ||||||||||||
| 0x0380 | uint16_t[8] UserModeGlobalLogger | uint16_t[16] UserModeGlobalLogger | |||||||||||
| 0x0390 | unsigned long[2] HeapTracingPid | ||||||||||||
| 0x0398 | unsigned long[2] CritSecTracingPid | ||||||||||||
| 0x03A0 | unsigned long ImageFileExecutionOptions | ||||||||||||
| 0x03A4 | unsigned long LangGenerationCount | ||||||||||||
| 0x03A8 | uint64_t AffinityPad | uint64_t Reserved5 | volatile uint64_t InterruptTimeBias | uint64_t Reserved4 | |||||||||
| 0x03A8 | uint64_t ActiveProcessorAffinity | ||||||||||||
| 0x03B0 | volatile uint64_t InterruptTimeBias | volatile uint64_t TscQpcBias | volatile uint64_t InterruptTimeBias | ||||||||||
| 0x03B8 | volatile uint64_t TscQpcBias | volatile unsigned long ActiveProcessorCount | volatile uint64_t TscQpcBias | volatile uint64_t QpcBias | |||||||||
| 0x03BC | volatile uint8_t ActiveGroupCount | ||||||||||||
| 0x03BD | uint8_t QpcTimeIncrementShift | ||||||||||||
| 0x03BE | uint16_t TscQpcData | ||||||||||||
| 0x03BE | volatile uint8_t TscQpcEnabled | ||||||||||||
| 0x03BF | uint8_t TscQpcShift | ||||||||||||
| 0x03C0 | volatile unsigned long ActiveProcessorCount | struct _XSTATE_CONFIGURATION XState | volatile unsigned long ActiveProcessorCount | unsigned long ActiveProcessorCount | |||||||||
| 0x03C4 | volatile uint16_t ActiveGroupCount | volatile uint8_t ActiveGroupCount | |||||||||||
| 0x03C5 | uint8_t Reserved9 | ||||||||||||
| 0x03C6 | uint16_t Reserved4 | uint16_t TscQpcData | uint16_t QpcData | ||||||||||
| 0x03C6 | volatile uint8_t TscQpcEnabled | volatile uint8_t QpcBypassEnabled | |||||||||||
| 0x03C7 | uint8_t TscQpcShift | uint8_t QpcShift | |||||||||||
| 0x03C8 | volatile unsigned long AitSamplingValue | union _LARGE_INTEGER TimeZoneBiasEffectiveStart | |||||||||||
| 0x03CC | volatile unsigned long AppCompatFlag | ||||||||||||
| 0x03D0 | uint64_t SystemDllNativeRelocation | uint64_t DEPRECATED_SystemDllNativeRelocation | union _LARGE_INTEGER TimeZoneBiasEffectiveEnd | ||||||||||
| 0x03D8 | unsigned long SystemDllWowRelocation | unsigned long DEPRECATED_SystemDllWowRelocation | struct _XSTATE_CONFIGURATION XState | ||||||||||
| 0x03DC | unsigned long[1] XStatePad | ||||||||||||
| 0x03E0 | struct _XSTATE_CONFIGURATION XState | ||||||||||||