Min versionVista
Max version10 TH2
x86 offset
offset:bitpos
Field Name
0x0000struct _SINGLE_LIST_ENTRY
Link
0x0004enum _MM_PAGE_ACCESS_TYPE
Type
0x0008unsigned long
EmptySequenceNumber
0x0008unsigned long
CurrentFileIndex
0x0010uint64_t
CreateTime
0x0018uint64_t
EmptyTime
0x0018struct _MM_PAGE_ACCESS_INFO *
TempEntry
0x0020struct _MM_PAGE_ACCESS_INFO *
PageEntry
0x0020unsigned long *
PageFrameEntry
0x0024unsigned long *
FileEntry
0x0024unsigned long *
LastPageFrameEntry
0x0028unsigned long *
FirstFileEntry
0x002Cstruct _EPROCESS *
Process
0x0030unsigned long
SessionId