| Min version | XP SP2 | 2003/XP64 | 2003/XP64 SP1 | 2003/XP64 SP2 | Vista | Vista SP1 | Vista SP2 | 7 | 7 SP1 | 8 Pre RTM | 8 Pre RTM | 8.1 Update 1 | 8.1 Update 1 | 10 Pre RTM | 10 | 10 TH2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Max version | XP SP3 | 2003/XP64 SP2 | Vista SP2 | 7 SP1 | 8 | |||||||||||
| x86 offset offset:bitpos | Field Name | |||||||||||||||
| 0x0000 | volatile unsigned long TickCountLow | unsigned long TickCountLowDeprecated | ||||||||||||||
| 0x0004 | unsigned long TickCountMultiplier | |||||||||||||||
| 0x0008 | volatile struct _KSYSTEM_TIME InterruptTime | |||||||||||||||
| 0x0014 | volatile struct _KSYSTEM_TIME SystemTime | |||||||||||||||
| 0x0020 | volatile struct _KSYSTEM_TIME TimeZoneBias | |||||||||||||||
| 0x002C | uint16_t ImageNumberLow | |||||||||||||||
| 0x002E | uint16_t ImageNumberHigh | |||||||||||||||
| 0x0030 | uint16_t[260] NtSystemRoot | wchar_t[260] NtSystemRoot | ||||||||||||||
| 0x0238 | unsigned long MaxStackTraceDepth | |||||||||||||||
| 0x023C | unsigned long CryptoExponent | |||||||||||||||
| 0x0240 | unsigned long TimeZoneId | |||||||||||||||
| 0x0244 | unsigned long[8] Reserved2 | unsigned long LargePageMinimum | ||||||||||||||
| 0x0248 | unsigned long[7] Reserved2 | unsigned long AitSamplingValue | ||||||||||||||
| 0x024C | unsigned long AppCompatFlag | |||||||||||||||
| 0x0250 | uint64_t RNGSeedVersion | |||||||||||||||
| 0x0258 | unsigned long GlobalValidationRunlevel | |||||||||||||||
| 0x025C | unsigned long[2] Reserved2 | volatile long TimeZoneBiasStamp | ||||||||||||||
| 0x0260 | unsigned long Reserved2 | unsigned long NtBuildNumber | ||||||||||||||
| 0x0264 | enum _NT_PRODUCT_TYPE NtProductType | |||||||||||||||
| 0x0268 | uint8_t ProductTypeIsValid | |||||||||||||||
| 0x0269 | uint8_t[1] Reserved0 | |||||||||||||||
| 0x026A | uint16_t NativeProcessorArchitecture | |||||||||||||||
| 0x026C | unsigned long NtMajorVersion | |||||||||||||||
| 0x0270 | unsigned long NtMinorVersion | |||||||||||||||
| 0x0274 | uint8_t[64] ProcessorFeatures | |||||||||||||||
| 0x02B4 | unsigned long Reserved1 | |||||||||||||||
| 0x02B8 | unsigned long Reserved3 | |||||||||||||||
| 0x02BC | volatile unsigned long TimeSlip | |||||||||||||||
| 0x02C0 | enum _ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture | |||||||||||||||
| 0x02C4 | unsigned long[1] AltArchitecturePad | unsigned long BootId | ||||||||||||||
| 0x02C8 | union _LARGE_INTEGER SystemExpirationDate | |||||||||||||||
| 0x02D0 | unsigned long SuiteMask | |||||||||||||||
| 0x02D4 | uint8_t KdDebuggerEnabled | |||||||||||||||
| 0x02D5 | uint8_t NXSupportPolicy | uint8_t NXSupportPolicy | uint8_t MitigationPolicies | |||||||||||||
| 0x02D5:0x00 | uint8_t NXSupportPolicy | |||||||||||||||
| 0x02D5:0x02 | uint8_t SEHValidationPolicy | |||||||||||||||
| 0x02D5:0x04 | uint8_t CurDirDevicesSkippedForDlls | |||||||||||||||
| 0x02D5:0x06 | uint8_t Reserved | |||||||||||||||
| 0x02D6 | uint8_t[2] Reserved6 | |||||||||||||||
| 0x02D8 | volatile unsigned long ActiveConsoleId | |||||||||||||||
| 0x02DC | volatile unsigned long DismountCount | |||||||||||||||
| 0x02E0 | unsigned long ComPlusPackage | |||||||||||||||
| 0x02E4 | unsigned long LastSystemRITEventTickCount | |||||||||||||||
| 0x02E8 | unsigned long NumberOfPhysicalPages | |||||||||||||||
| 0x02EC | uint8_t SafeBootMode | |||||||||||||||
| 0x02ED | uint8_t TscQpcData | uint8_t[3] Reserved12 | ||||||||||||||
| 0x02ED:0x00 | uint8_t TscQpcEnabled | |||||||||||||||
| 0x02ED:0x01 | uint8_t TscQpcSpareFlag | |||||||||||||||
| 0x02ED:0x02 | uint8_t TscQpcShift | |||||||||||||||
| 0x02EE | uint8_t[2] TscQpcPad | |||||||||||||||
| 0x02F0 | unsigned long TraceLogging | unsigned long SharedDataFlags | ||||||||||||||
| 0x02F0:0x00 | unsigned long DbgErrorPortPresent | |||||||||||||||
| 0x02F0:0x01 | unsigned long DbgElevationEnabled | |||||||||||||||
| 0x02F0:0x02 | unsigned long DbgVirtEnabled | |||||||||||||||
| 0x02F0:0x03 | unsigned long DbgInstallerDetectEnabled | |||||||||||||||
| 0x02F0:0x04 | unsigned long SystemDllRelocated | unsigned long DbgSystemDllRelocated | unsigned long DbgLkgEnabled | |||||||||||||
| 0x02F0:0x05 | unsigned long SpareBits | unsigned long DbgDynProcessorEnabled | ||||||||||||||
| 0x02F0:0x06 | unsigned long DbgSEHValidationEnabled | unsigned long DbgConsoleBrokerEnabled | ||||||||||||||
| 0x02F0:0x07 | unsigned long SpareBits | unsigned long DbgSecureBootEnabled | ||||||||||||||
| 0x02F0:0x08 | unsigned long SpareBits | unsigned long DbgMultiSessionSku | ||||||||||||||
| 0x02F0:0x09 | unsigned long SpareBits | |||||||||||||||
| 0x02F4 | unsigned long[1] DataFlagsPad | |||||||||||||||
| 0x02F8 | uint64_t TestRetInstruction | uint64_t Fill0 | uint64_t TestRetInstruction | |||||||||||||
| 0x0300 | unsigned long SystemCall | uint64_t[4] SystemCall | unsigned long SystemCall | unsigned long Reserved9 | int64_t QpcFrequency | |||||||||||
| 0x0304 | unsigned long SystemCallReturn | unsigned long SystemCallReturn | unsigned long Reserved10 | |||||||||||||
| 0x0308 | uint64_t[3] SystemCallPad | uint64_t[3] SystemCallPad | unsigned long SystemCall | |||||||||||||
| 0x030C | unsigned long SystemCallPad0 | |||||||||||||||
| 0x0310 | uint64_t[2] SystemCallPad | |||||||||||||||
| 0x0320 | volatile struct _KSYSTEM_TIME TickCount | |||||||||||||||
| 0x0320 | volatile uint64_t TickCountQuad | volatile uint64_t TickCountQuad | ||||||||||||||
| 0x0320 | unsigned long[3] ReservedTickCountOverlay | |||||||||||||||
| 0x032C | unsigned long[1] TickCountPad | |||||||||||||||
| 0x0330 | unsigned long Cookie | unsigned long Cookie | ||||||||||||||
| 0x0334 | unsigned long[16] Wow64SharedInformation | unsigned long[1] CookiePad | ||||||||||||||
| 0x0338 | int64_t ConsoleSessionForegroundProcessId | |||||||||||||||
| 0x0340 | unsigned long[16] Wow64SharedInformation | unsigned long[16] DEPRECATED_Wow64SharedInformation | unsigned long[16] Wow64SharedInformation | unsigned long[16] DEPRECATED_Wow64SharedInformation | volatile uint64_t TimeUpdateSequence | uint64_t TimeUpdateLock | ||||||||||
| 0x0348 | uint64_t LastTimeUpdateQpcValue | uint64_t BaselineSystemTimeQpc | ||||||||||||||
| 0x0350 | uint64_t LastInterruptTimeUpdateQpcValue | uint64_t BaselineInterruptTimeQpc | ||||||||||||||
| 0x0358 | uint64_t QpcTimeIncrement | uint64_t QpcSystemTimeIncrement | ||||||||||||||
| 0x0360 | unsigned long QpcTimeIncrement32 | uint64_t QpcInterruptTimeIncrement | ||||||||||||||
| 0x0364 | unsigned long[7] Reserved8 | |||||||||||||||
| 0x0368 | unsigned long QpcSystemTimeIncrement32 | uint8_t QpcSystemTimeIncrementShift | ||||||||||||||
| 0x0369 | uint8_t QpcInterruptTimeIncrementShift | |||||||||||||||
| 0x036A | uint16_t UnparkedProcessorCount | |||||||||||||||
| 0x036C | unsigned long QpcInterruptTimeIncrement32 | uint8_t[20] Reserved8 | unsigned long[4] EnclaveFeatureMask | |||||||||||||
| 0x0370 | uint8_t QpcSystemTimeIncrementShift | |||||||||||||||
| 0x0371 | uint8_t QpcInterruptTimeIncrementShift | |||||||||||||||
| 0x0372 | uint8_t[14] Reserved8 | uint16_t UnparkedProcessorCount | ||||||||||||||
| 0x0374 | uint8_t[12] Reserved8 | |||||||||||||||
| 0x037C | unsigned long Reserved8 | |||||||||||||||
| 0x0380 | uint16_t[8] UserModeGlobalLogger | uint16_t[16] UserModeGlobalLogger | ||||||||||||||
| 0x0390 | unsigned long[2] HeapTracingPid | |||||||||||||||
| 0x0398 | unsigned long[2] CritSecTracingPid | |||||||||||||||
| 0x03A0 | unsigned long ImageFileExecutionOptions | |||||||||||||||
| 0x03A4 | unsigned long LangGenerationCount | |||||||||||||||
| 0x03A8 | uint64_t AffinityPad | uint64_t Reserved5 | volatile uint64_t InterruptTimeBias | uint64_t Reserved4 | ||||||||||||
| 0x03A8 | unsigned long ActiveProcessorAffinity | |||||||||||||||
| 0x03B0 | volatile uint64_t InterruptTimeBias | volatile uint64_t TscQpcBias | volatile uint64_t InterruptTimeBias | |||||||||||||
| 0x03B8 | volatile uint64_t TscQpcBias | volatile unsigned long ActiveProcessorCount | volatile uint64_t TscQpcBias | volatile uint64_t QpcBias | ||||||||||||
| 0x03BC | volatile uint8_t ActiveGroupCount | |||||||||||||||
| 0x03BD | uint8_t QpcTimeIncrementShift | |||||||||||||||
| 0x03BE | uint16_t TscQpcData | |||||||||||||||
| 0x03BE | volatile uint8_t TscQpcEnabled | |||||||||||||||
| 0x03BF | uint8_t TscQpcShift | |||||||||||||||
| 0x03C0 | volatile unsigned long ActiveProcessorCount | struct _XSTATE_CONFIGURATION XState | volatile unsigned long ActiveProcessorCount | unsigned long ActiveProcessorCount | ||||||||||||
| 0x03C4 | volatile uint16_t ActiveGroupCount | volatile uint8_t ActiveGroupCount | ||||||||||||||
| 0x03C5 | uint8_t Reserved9 | |||||||||||||||
| 0x03C6 | uint16_t Reserved4 | uint16_t TscQpcData | uint16_t QpcData | |||||||||||||
| 0x03C6 | volatile uint8_t TscQpcEnabled | volatile uint8_t QpcBypassEnabled | ||||||||||||||
| 0x03C7 | uint8_t TscQpcShift | uint8_t QpcShift | ||||||||||||||
| 0x03C8 | volatile unsigned long AitSamplingValue | union _LARGE_INTEGER TimeZoneBiasEffectiveStart | ||||||||||||||
| 0x03CC | volatile unsigned long AppCompatFlag | |||||||||||||||
| 0x03D0 | uint64_t SystemDllNativeRelocation | uint64_t DEPRECATED_SystemDllNativeRelocation | union _LARGE_INTEGER TimeZoneBiasEffectiveEnd | |||||||||||||
| 0x03D8 | unsigned long SystemDllWowRelocation | unsigned long DEPRECATED_SystemDllWowRelocation | struct _XSTATE_CONFIGURATION XState | |||||||||||||
| 0x03DC | unsigned long[1] XStatePad | |||||||||||||||
| 0x03E0 | struct _XSTATE_CONFIGURATION XState | |||||||||||||||