Min version2003/XP64 SP1Vista SP1Vista SP277 SP18 Pre RTM88.18.1 Update 110 Pre RTM10 Pre RTM1010 TH2
Max version2003/XP64 SP2Vista SP27 SP18.1 Update 1
x64 offset
offset:bitpos
Field Name
0x0000unsigned long
TickCountLowDeprecated
0x0004unsigned long
TickCountMultiplier
0x0008volatile struct _KSYSTEM_TIME
InterruptTime
0x0014volatile struct _KSYSTEM_TIME
SystemTime
0x0020volatile struct _KSYSTEM_TIME
TimeZoneBias
0x002Cuint16_t
ImageNumberLow
0x002Euint16_t
ImageNumberHigh
0x0030uint16_t[260]
NtSystemRoot
wchar_t[260]
NtSystemRoot
0x0238unsigned long
MaxStackTraceDepth
0x023Cunsigned long
CryptoExponent
0x0240unsigned long
TimeZoneId
0x0244unsigned long
LargePageMinimum
0x0248unsigned long[7]
Reserved2
unsigned long
AitSamplingValue
0x024Cunsigned long
AppCompatFlag
0x0250uint64_t
RNGSeedVersion
0x0258unsigned long
GlobalValidationRunlevel
0x025Cunsigned long[2]
Reserved2
volatile long
TimeZoneBiasStamp
0x0260unsigned long
Reserved2
unsigned long
NtBuildNumber
0x0264enum _NT_PRODUCT_TYPE
NtProductType
0x0268uint8_t
ProductTypeIsValid
0x0269uint8_t[1]
Reserved0
0x026Auint16_t
NativeProcessorArchitecture
0x026Cunsigned long
NtMajorVersion
0x0270unsigned long
NtMinorVersion
0x0274uint8_t[64]
ProcessorFeatures
0x02B4unsigned long
Reserved1
0x02B8unsigned long
Reserved3
0x02BCvolatile unsigned long
TimeSlip
0x02C0enum _ALTERNATIVE_ARCHITECTURE_TYPE
AlternativeArchitecture
0x02C4unsigned long[1]
AltArchitecturePad
unsigned long
BootId
0x02C8union _LARGE_INTEGER
SystemExpirationDate
0x02D0unsigned long
SuiteMask
0x02D4uint8_t
KdDebuggerEnabled
0x02D5uint8_t
NXSupportPolicy
uint8_t
MitigationPolicies
0x02D5:0x00uint8_t
NXSupportPolicy
0x02D5:0x02uint8_t
SEHValidationPolicy
0x02D5:0x04uint8_t
CurDirDevicesSkippedForDlls
0x02D5:0x06uint8_t
Reserved
0x02D6uint8_t[2]
Reserved6
0x02D8volatile unsigned long
ActiveConsoleId
0x02DCvolatile unsigned long
DismountCount
0x02E0unsigned long
ComPlusPackage
0x02E4unsigned long
LastSystemRITEventTickCount
0x02E8unsigned long
NumberOfPhysicalPages
0x02ECuint8_t
SafeBootMode
0x02EDuint8_t
TscQpcData
uint8_t[3]
Reserved12
0x02ED:0x00uint8_t
TscQpcEnabled
0x02ED:0x01uint8_t
TscQpcSpareFlag
0x02ED:0x02uint8_t
TscQpcShift
0x02EEuint8_t[2]
TscQpcPad
0x02F0unsigned long
TraceLogging
unsigned long
SharedDataFlags
0x02F0:0x00unsigned long
DbgErrorPortPresent
0x02F0:0x01unsigned long
DbgElevationEnabled
0x02F0:0x02unsigned long
DbgVirtEnabled
0x02F0:0x03unsigned long
DbgInstallerDetectEnabled
0x02F0:0x04unsigned long
DbgSystemDllRelocated
unsigned long
DbgLkgEnabled
0x02F0:0x05unsigned long
DbgDynProcessorEnabled
0x02F0:0x06unsigned long
DbgSEHValidationEnabled
unsigned long
DbgConsoleBrokerEnabled
0x02F0:0x07unsigned long
SpareBits
unsigned long
DbgSecureBootEnabled
0x02F0:0x08unsigned long
SpareBits
unsigned long
DbgMultiSessionSku
0x02F0:0x09unsigned long
SpareBits
0x02F4unsigned long[1]
DataFlagsPad
0x02F8uint64_t
TestRetInstruction
0x0300unsigned long
SystemCall
unsigned long
Reserved9
int64_t
QpcFrequency
0x0304unsigned long
SystemCallReturn
unsigned long
Reserved10
0x0308uint64_t[3]
SystemCallPad
unsigned long
SystemCall
0x030Cunsigned long
SystemCallPad0
0x0310uint64_t[2]
SystemCallPad
0x0320volatile struct _KSYSTEM_TIME
TickCount
0x0320volatile uint64_t
TickCountQuad
volatile uint64_t
TickCountQuad
0x0320unsigned long[3]
ReservedTickCountOverlay
0x032Cunsigned long[1]
TickCountPad
0x0330unsigned long
Cookie
0x0334unsigned long[16]
Wow64SharedInformation
unsigned long[1]
CookiePad
0x0338int64_t
ConsoleSessionForegroundProcessId
0x0340unsigned long[16]
Wow64SharedInformation
unsigned long[16]
DEPRECATED_Wow64SharedInformation
unsigned long[16]
Wow64SharedInformation
unsigned long[16]
DEPRECATED_Wow64SharedInformation
volatile uint64_t
TimeUpdateSequence
uint64_t
TimeUpdateLock
0x0348uint64_t
LastTimeUpdateQpcValue
uint64_t
BaselineSystemTimeQpc
0x0350uint64_t
LastInterruptTimeUpdateQpcValue
uint64_t
BaselineInterruptTimeQpc
0x0358uint64_t
QpcTimeIncrement
uint64_t
QpcSystemTimeIncrement
0x0360unsigned long
QpcTimeIncrement32
uint64_t
QpcInterruptTimeIncrement
0x0364unsigned long[7]
Reserved8
0x0368unsigned long
QpcSystemTimeIncrement32
uint8_t
QpcSystemTimeIncrementShift
0x0369uint8_t
QpcInterruptTimeIncrementShift
0x036Auint16_t
UnparkedProcessorCount
0x036Cunsigned long
QpcInterruptTimeIncrement32
uint8_t[20]
Reserved8
unsigned long[4]
EnclaveFeatureMask
0x0370uint8_t
QpcSystemTimeIncrementShift
0x0371uint8_t
QpcInterruptTimeIncrementShift
0x0372uint8_t[14]
Reserved8
uint16_t
UnparkedProcessorCount
0x0374uint8_t[12]
Reserved8
0x037Cunsigned long
Reserved8
0x0380uint16_t[8]
UserModeGlobalLogger
uint16_t[16]
UserModeGlobalLogger
0x0390unsigned long[2]
HeapTracingPid
0x0398unsigned long[2]
CritSecTracingPid
0x03A0unsigned long
ImageFileExecutionOptions
0x03A4unsigned long
LangGenerationCount
0x03A8uint64_t
AffinityPad
uint64_t
Reserved5
volatile uint64_t
InterruptTimeBias
uint64_t
Reserved4
0x03A8uint64_t
ActiveProcessorAffinity
0x03B0volatile uint64_t
InterruptTimeBias
volatile uint64_t
TscQpcBias
volatile uint64_t
InterruptTimeBias
0x03B8volatile uint64_t
TscQpcBias
volatile unsigned long
ActiveProcessorCount
volatile uint64_t
TscQpcBias
volatile uint64_t
QpcBias
0x03BCvolatile uint8_t
ActiveGroupCount
0x03BDuint8_t
QpcTimeIncrementShift
0x03BEuint16_t
TscQpcData
0x03BEvolatile uint8_t
TscQpcEnabled
0x03BFuint8_t
TscQpcShift
0x03C0volatile unsigned long
ActiveProcessorCount
struct _XSTATE_CONFIGURATION
XState
volatile unsigned long
ActiveProcessorCount
unsigned long
ActiveProcessorCount
0x03C4volatile uint16_t
ActiveGroupCount
volatile uint8_t
ActiveGroupCount
0x03C5uint8_t
Reserved9
0x03C6uint16_t
Reserved4
uint16_t
TscQpcData
uint16_t
QpcData
0x03C6volatile uint8_t
TscQpcEnabled
volatile uint8_t
QpcBypassEnabled
0x03C7uint8_t
TscQpcShift
uint8_t
QpcShift
0x03C8volatile unsigned long
AitSamplingValue
union _LARGE_INTEGER
TimeZoneBiasEffectiveStart
0x03CCvolatile unsigned long
AppCompatFlag
0x03D0uint64_t
SystemDllNativeRelocation
uint64_t
DEPRECATED_SystemDllNativeRelocation
union _LARGE_INTEGER
TimeZoneBiasEffectiveEnd
0x03D8unsigned long
SystemDllWowRelocation
unsigned long
DEPRECATED_SystemDllWowRelocation
struct _XSTATE_CONFIGURATION
XState
0x03DCunsigned long[1]
XStatePad
0x03E0struct _XSTATE_CONFIGURATION
XState