Min version	XP	2003/XP64	2003/XP64 SP1	2003/XP64 SP2	2003/XP64 SP2	Vista	Vista SP1		Vista SP2		7		7 SP1		8 Pre RTM		8 Pre RTM	8	8.1	8.1 Update 1		10 Pre RTM	10 Pre RTM	10 Pre RTM		10 Pre RTM	10		10 TH2
Max version	XP SP3		2003/XP64 SP2				Vista SP2										8
Architecture	x86	x86	x86	x64	x86	x86	x86	x64	x86	x64	x86	x64	x86	x64	x86	x64	x86	x64	x64	x86	x64	x64	x86	x86	x64	x86	x86	x64	x86	x64
x86 offset offset:bitpos	Field Name																														x64 offset offset:bitpos
0x0000	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb			struct _KTHREAD Tcb		struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb		struct _KTHREAD Tcb		struct _KTHREAD Tcb		struct _KTHREAD Tcb	struct _KTHREAD Tcb		struct _KTHREAD Tcb	struct _KTHREAD Tcb	struct _KTHREAD Tcb	0x0000
0x01B8			union _LARGE_INTEGER CreateTime																												0x0308
0x01C0	union _LARGE_INTEGER CreateTime		union _LARGE_INTEGER ExitTime																												0x0310
0x01C0	uint32_t NestedFaultCount		struct _LIST_ENTRY LpcReplyChain																												0x0310
0x01C0			struct _LIST_ENTRY KeyedWaitChain																												0x0310
0x01C0:0x02	uint32_t ApcNeeded
0x01C8	union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER CreateTime	long ExitStatus																												0x0320
0x01C8	struct _LIST_ENTRY LpcReplyChain	uint32_t NestedFaultCount	void * OfsChain																												0x0320
0x01C8	struct _LIST_ENTRY KeyedWaitChain
0x01C8:0x02		uint32_t ApcNeeded
0x01CC			struct _LIST_ENTRY PostBlockList																												0x0328
0x01D0	long ExitStatus	union _LARGE_INTEGER ExitTime
0x01D0	void * OfsChain	struct _LIST_ENTRY LpcReplyChain
0x01D0		struct _LIST_ENTRY KeyedWaitChain
0x01D4	struct _LIST_ENTRY PostBlockList		struct _TERMINATION_PORT * TerminationPort																												0x0338
0x01D4			struct _ETHREAD * ReaperLink																												0x0338
0x01D4			void * KeyedWaitValue																												0x0338
0x01D8		long ExitStatus	uintptr_t ActiveTimerListLock																												0x0340
0x01D8		void * OfsChain
0x01DC	struct _TERMINATION_PORT * TerminationPort	struct _LIST_ENTRY PostBlockList	struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead																										0x0348
0x01DC	struct _ETHREAD * ReaperLink
0x01DC	void * KeyedWaitValue
0x01E0	unsigned long ActiveTimerListLock					union _LARGE_INTEGER CreateTime		union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime																					0x0330
0x01E0															union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime															0x0340
0x01E4	struct _LIST_ENTRY ActiveTimerListHead	struct _TERMINATION_PORT * TerminationPort	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid																										0x0358
0x01E4		struct _ETHREAD * ReaperLink
0x01E4		void * KeyedWaitValue
0x01E8							union _LARGE_INTEGER ExitTime																								0x0338
0x01E8							struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain																					0x0338
0x01E8		unsigned long ActiveTimerListLock				union _LARGE_INTEGER ExitTime									union _LARGE_INTEGER ExitTime		union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime													0x0348
0x01E8						struct _LIST_ENTRY KeyedWaitChain									struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain															0x0348
0x01EC	struct _CLIENT_ID Cid	struct _LIST_ENTRY ActiveTimerListHead	struct _KSEMAPHORE LpcReplySemaphore																												0x0368
0x01EC			struct _KSEMAPHORE KeyedWaitSemaphore	struct _KSEMAPHORE KeyedWaitSemaphore	struct _KSEMAPHORE KeyedWaitSemaphore																										0x0368
0x01F0						long ExitStatus																									0x0348
0x01F0						void * OfsChain		void * OfsChain	void * OfsChain	void * OfsChain																					0x0348
0x01F0																	union _LARGE_INTEGER ExitTime														0x0350
0x01F0																	struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain													0x0350
0x01F0															void * ChargeOnlySession																0x0358
0x01F4	struct _KSEMAPHORE LpcReplySemaphore	struct _CLIENT_ID Cid				struct _LIST_ENTRY PostBlockList																									0x0350
0x01F4	struct _KSEMAPHORE KeyedWaitSemaphore					void * ForwardLinkShadow		void * ForwardLinkShadow	void * ForwardLinkShadow	void * ForwardLinkShadow																					0x0350
0x01F4															struct _LIST_ENTRY PostBlockList																0x0360
0x01F4															void * ForwardLinkShadow																0x0360
0x01F8							void * StartAddress	void * StartAddress	void * StartAddress	void * StartAddress																					0x0358
0x01F8						void * StartAddress											void * ChargeOnlySession	void * ChargeOnlySession													0x0360
0x01F8															void * StartAddress																0x0368
0x01FC							struct _TERMINATION_PORT * TerminationPort																								0x0360
0x01FC							struct _ETHREAD * ReaperLink																								0x0360
0x01FC							void * KeyedWaitValue																								0x0360
0x01FC							void * Win32StartParameter	void * Win32StartParameter	void * Win32StartParameter	void * Win32StartParameter																					0x0360
0x01FC						void * Win32StartParameter											struct _LIST_ENTRY PostBlockList														0x0368
0x01FC																	void * ForwardLinkShadow	void * ForwardLinkShadow													0x0368
0x01FC		struct _KSEMAPHORE LpcReplySemaphore				struct _TERMINATION_PORT * TerminationPort									struct _TERMINATION_PORT * TerminationPort																0x0370
0x01FC		struct _KSEMAPHORE KeyedWaitSemaphore				struct _ETHREAD * ReaperLink									struct _ETHREAD * ReaperLink																0x0370
0x01FC						void * KeyedWaitValue									void * KeyedWaitValue																0x0370
0x0200											union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime																			0x0360
0x0200					void * LpcWaitingOnPort		uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock			union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime																	0x0368
0x0200					void * LpcReplyMessage	unsigned long ActiveTimerListLock											void * StartAddress	void * StartAddress													0x0370
0x0200															uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock															0x0378
0x0200			void * LpcReplyMessage																												0x0388
0x0200			void * LpcWaitingOnPort																												0x0388
0x0204							struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead																					0x0370
0x0204																	struct _TERMINATION_PORT * TerminationPort														0x0378
0x0204																	struct _ETHREAD * ReaperLink														0x0378
0x0204																	void * KeyedWaitValue	void * KeyedWaitValue													0x0378
0x0204															struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead			0x0380
0x0204			struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo			struct _LIST_ENTRY ActiveTimerListHead													0x0390
0x0208	void * LpcReplyMessage				struct _LIST_ENTRY IrpList						union _LARGE_INTEGER ExitTime								0x0368
0x0208	void * LpcWaitingOnPort										struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain							0x0368
0x0208													union _LARGE_INTEGER ExitTime						0x0370
0x0208													struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain					0x0370
0x0208																	uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock	0x0380
0x0208			struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList															0x0398
0x020C							struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid									0x0380
0x020C	struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo					struct _CLIENT_ID Cid											struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	0x0388
0x020C															struct _CLIENT_ID Cid	struct _CLIENT_ID Cid			0x0390
0x0210	struct _LIST_ENTRY IrpList	void * LpcReplyMessage			unsigned long TopLevelIrp						long ExitStatus	long ExitStatus							0x0378
0x0210		void * LpcWaitingOnPort											long ExitStatus	long ExitStatus					0x0380
0x0210			uintptr_t TopLevelIrp																0x03A8
0x0214											struct _LIST_ENTRY PostBlockList								0x0380
0x0214											void * ForwardLinkShadow	void * ForwardLinkShadow							0x0380
0x0214													struct _LIST_ENTRY PostBlockList						0x0388
0x0214													void * ForwardLinkShadow	void * ForwardLinkShadow					0x0388
0x0214							struct _KSEMAPHORE KeyedWaitSemaphore												0x0390
0x0214							struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore									0x0390
0x0214																	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	0x0398
0x0214						struct _KSEMAPHORE AlpcWaitSemaphore									struct _KSEMAPHORE KeyedWaitSemaphore				0x03A0
0x0214															struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore			0x03A0
0x0214		struct _PS_IMPERSONATION_INFORMATION * ImpersonationInfo	struct _DEVICE_OBJECT * DeviceToVerify			struct _KSEMAPHORE KeyedWaitSemaphore													0x03B0
0x0218											void * StartAddress	void * StartAddress							0x0388
0x0218	unsigned long TopLevelIrp	struct _LIST_ENTRY IrpList			struct _EPROCESS * ThreadsProcess								void * StartAddress	void * StartAddress					0x0390
0x0218			struct _EPROCESS * ThreadsProcess																0x03B8
0x021C											struct _TERMINATION_PORT * TerminationPort								0x0390
0x021C											struct _ETHREAD * ReaperLink								0x0390
0x021C											void * KeyedWaitValue	void * KeyedWaitValue							0x0390
0x021C	struct _DEVICE_OBJECT * DeviceToVerify				void * StartAddress								struct _TERMINATION_PORT * TerminationPort						0x0398
0x021C													struct _ETHREAD * ReaperLink						0x0398
0x021C													void * KeyedWaitValue	void * KeyedWaitValue					0x0398
0x021C																	struct _KSEMAPHORE KeyedWaitSemaphore		0x03A8
0x021C																	struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore	0x03A8
0x021C			void * StartAddress																0x03C0
0x0220											uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock							0x0398
0x0220	struct _EPROCESS * ThreadsProcess	unsigned long TopLevelIrp			void * Win32StartAddress								uintptr_t ActiveTimerListLock	uintptr_t ActiveTimerListLock					0x03A0
0x0220			void * Win32StartAddress		unsigned long LpcReceivedMessageId														0x03C8
0x0220			unsigned long LpcReceivedMessageId																0x03C8
0x0224											struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead							0x03A0
0x0224													struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead					0x03A8
0x0224	void * StartAddress	struct _DEVICE_OBJECT * DeviceToVerify	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry														0x03D0
0x0228	void * Win32StartAddress	struct _EPROCESS * ThreadsProcess				union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity		union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity									0x03B0
0x0228	unsigned long LpcReceivedMessageId														union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity				0x03C0
0x022C											struct _CLIENT_ID Cid	struct _CLIENT_ID Cid							0x03B0
0x022C							struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList			struct _CLIENT_ID Cid	struct _CLIENT_ID Cid					0x03B8
0x022C	struct _LIST_ENTRY ThreadListEntry	void * StartAddress			struct _EX_RUNDOWN_REF RundownProtect	struct _LIST_ENTRY IrpList									struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList			0x03C8
0x022C			struct _EX_RUNDOWN_REF RundownProtect																0x03E0
0x0230		unsigned long LpcReceivedMessageId															union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	0x03C8
0x0230		void * Win32StartAddress	struct _EX_PUSH_LOCK ThreadLock																0x03E8
0x0234											struct _KSEMAPHORE KeyedWaitSemaphore								0x03C0
0x0234											struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore							0x03C0
0x0234							uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	uintptr_t TopLevelIrp			struct _KSEMAPHORE KeyedWaitSemaphore						0x03C8
0x0234													struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore					0x03C8
0x0234	struct _EX_RUNDOWN_REF RundownProtect	struct _LIST_ENTRY ThreadListEntry			unsigned long LpcReplyMessageId	unsigned long TopLevelIrp											struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	0x03D0
0x0234															uintptr_t TopLevelIrp	uintptr_t TopLevelIrp			0x03D8
0x0234			unsigned long LpcReplyMessageId																0x03F0
0x0238							struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify									0x03D0
0x0238	struct _EX_PUSH_LOCK ThreadLock				unsigned long ReadClusterSize	struct _DEVICE_OBJECT * DeviceToVerify									struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify			0x03E0
0x0238			unsigned long ReadClusterSize																0x03F4
0x023C							union _PSP_RATE_APC * RateControlApc	union _PSP_RATE_APC * RateControlApc	union _PSP_RATE_APC * RateControlApc	union _PSP_RATE_APC * RateControlApc									0x03D8
0x023C	unsigned long LpcReplyMessageId	struct _EX_RUNDOWN_REF RundownProtect			unsigned long GrantedAccess	union _PSP_RATE_APC * RateControlApc											uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	0x03E0
0x023C															void * SparePointer	void * SparePointer			0x03E8
0x023C			unsigned long GrantedAccess																0x03F8
0x0240					unsigned long Terminated		void * Win32StartAddress	void * Win32StartAddress	void * Win32StartAddress	void * Win32StartAddress									0x03E0
0x0240	unsigned long ReadClusterSize	struct _EX_PUSH_LOCK ThreadLock			unsigned long CrossThreadFlags	void * Win32StartAddress											struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify	0x03E8
0x0240															void * Win32StartAddress	void * Win32StartAddress			0x03F0
0x0240			unsigned long CrossThreadFlags																0x03FC
0x0240:0x00			unsigned long Terminated																0x03FC:0x00
0x0240:0x01			unsigned long DeadThread																0x03FC:0x01
0x0240:0x02			unsigned long HideFromDebugger																0x03FC:0x02
0x0240:0x03			unsigned long ActiveImpersonationInfo																0x03FC:0x03
0x0240:0x04			unsigned long SystemThread																0x03FC:0x04
0x0240:0x05			unsigned long HardErrorsAreDisabled																0x03FC:0x05
0x0240:0x06			unsigned long BreakOnTermination																0x03FC:0x06
0x0240:0x07			unsigned long SkipCreationMsg																0x03FC:0x07
0x0240:0x08			unsigned long SkipTerminationMsg																0x03FC:0x08
0x0244							void * SparePtr0	void * SparePtr0	void * SparePtr0	void * SparePtr0									0x03E8
0x0244	unsigned long GrantedAccess	unsigned long LpcReplyMessageId			unsigned long SameThreadPassiveFlags	void * SparePtr0											void * Win32StartAddress	void * Win32StartAddress	0x03F0
0x0244					unsigned long ActiveExWorker										void * LegacyPowerObject	void * LegacyPowerObject			0x03F8
0x0244			unsigned long SameThreadPassiveFlags																0x0400
0x0244:0x00			unsigned long ActiveExWorker																0x0400:0x00
0x0244:0x01			unsigned long ExWorkerCanWaitUser																0x0400:0x01
0x0244:0x02			unsigned long MemoryMaker																0x0400:0x02
0x0244:0x03			unsigned long KeyedEventInUse																0x0400:0x03
0x0248	unsigned long Terminated				uint8_t LpcReceivedMsgIdValid						union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity							0x03E0
0x0248													union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity					0x03E8
0x0248	unsigned long CrossThreadFlags	unsigned long ReadClusterSize			unsigned long SameThreadApcFlags	struct _LIST_ENTRY ThreadListEntry		struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry									0x03F0
0x0248																	void * LegacyPowerObject	void * LegacyPowerObject	0x03F8
0x0248															struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry			0x0400
0x0248			unsigned long SameThreadApcFlags																0x0404
0x0248:0x00			uint8_t LpcReceivedMsgIdValid																0x0404:0x00
0x0248:0x01	unsigned long DeadThread		uint8_t LpcExitThreadCalled																0x0404:0x01
0x0248:0x02	unsigned long HideFromDebugger		uint8_t AddressSpaceOwner																0x0404:0x02
0x0248:0x03	unsigned long ActiveImpersonationInfo		uint8_t OwnsProcessWorkingSetExclusive																0x0404:0x03
0x0248:0x04	unsigned long SystemThread		uint8_t OwnsProcessWorkingSetShared																0x0404:0x04
0x0248:0x05	unsigned long HardErrorsAreDisabled		uint8_t OwnsSystemWorkingSetExclusive																0x0404:0x05
0x0248:0x06	unsigned long BreakOnTermination		uint8_t OwnsSystemWorkingSetShared																0x0404:0x06
0x0248:0x07	unsigned long SkipCreationMsg		uint8_t OwnsSessionWorkingSetExclusive																0x0404:0x07
0x0249:0x00	unsigned long SkipTerminationMsg		uint8_t OwnsSessionWorkingSetShared																0x0405:0x00
0x0249:0x01			uint8_t ApcNeeded																0x0405:0x01
0x024C											struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList							0x03E8
0x024C	unsigned long ActiveExWorker												struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList					0x03F0
0x024C																	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry	0x0400
0x024C	unsigned long SameThreadPassiveFlags	unsigned long GrantedAccess	uint8_t ForwardClusterOnly																0x0408
0x024C:0x01	unsigned long ExWorkerCanWaitUser
0x024C:0x02	unsigned long MemoryMaker
0x024D			uint8_t DisablePageFaultClustering																0x0409
0x024E			uint8_t ActiveFaultCount																0x040A
0x0250	unsigned long SameThreadApcFlags	unsigned long CrossThreadFlags			unsigned long KernelStackReference	struct _EX_RUNDOWN_REF RundownProtect		struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect									0x0400
0x0250	uint8_t LpcReceivedMsgIdValid	unsigned long Terminated													struct _EX_RUNDOWN_REF RundownProtect				0x0410
0x0250:0x01	uint8_t LpcExitThreadCalled	unsigned long DeadThread
0x0250:0x02	uint8_t AddressSpaceOwner	unsigned long HideFromDebugger
0x0250:0x03		unsigned long ActiveImpersonationInfo
0x0250:0x04		unsigned long SystemThread
0x0250:0x05		unsigned long HardErrorsAreDisabled
0x0250:0x06		unsigned long BreakOnTermination
0x0250:0x07		unsigned long SkipCreationMsg
0x0250:0x08		unsigned long SkipTerminationMsg
0x0254	uint8_t ForwardClusterOnly	unsigned long SameThreadPassiveFlags				struct _EX_PUSH_LOCK ThreadLock					uintptr_t TopLevelIrp	uintptr_t TopLevelIrp							0x03F8
0x0254													uintptr_t TopLevelIrp	uintptr_t TopLevelIrp					0x0400
0x0254							struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock									0x0408
0x0254		unsigned long ActiveExWorker															struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	0x0410
0x0254															struct _EX_PUSH_LOCK ThreadLock				0x0418
0x0254:0x01		unsigned long ExWorkerCanWaitUser
0x0254:0x02		unsigned long MemoryMaker
0x0254:0x03		unsigned long KeyedEventInUse
0x0255	uint8_t DisablePageFaultClustering
0x0258		unsigned long SameThreadApcFlags				unsigned long ReadClusterSize					struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify							0x0400
0x0258													struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify					0x0408
0x0258		uint8_t LpcReceivedMsgIdValid					unsigned long ReadClusterSize	unsigned long ReadClusterSize	unsigned long ReadClusterSize	unsigned long ReadClusterSize									0x0410
0x0258																	struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	0x0418
0x0258															unsigned long ReadClusterSize				0x0420
0x0258:0x01		uint8_t LpcExitThreadCalled
0x0258:0x02		uint8_t AddressSpaceOwner
0x025C											union _PSP_CPU_QUOTA_APC * CpuQuotaApc	union _PSP_CPU_QUOTA_APC * CpuQuotaApc							0x0408
0x025C													union _PSP_CPU_QUOTA_APC * CpuQuotaApc	union _PSP_CPU_QUOTA_APC * CpuQuotaApc					0x0410
0x025C							volatile long MmLockOrdering	volatile long MmLockOrdering	volatile long MmLockOrdering	volatile long MmLockOrdering									0x0414
0x025C		uint8_t ForwardClusterOnly				volatile long MmLockOrdering											unsigned long ReadClusterSize	unsigned long ReadClusterSize	0x0420
0x025C															volatile long MmLockOrdering				0x0424
0x025D		uint8_t DisablePageFaultClustering
0x0260						unsigned long CrossThreadFlags					void * Win32StartAddress	void * Win32StartAddress							0x0410
0x0260							unsigned long CrossThreadFlags						void * Win32StartAddress	void * Win32StartAddress					0x0418
0x0260:0x00							unsigned long Terminated	unsigned long Terminated	unsigned long Terminated	unsigned long Terminated									0x0418:0x00
0x0260						unsigned long Terminated											volatile long MmLockOrdering	volatile long MmLockOrdering	0x0424
0x0260															volatile long CmLockOrdering	volatile long CmLockOrdering			0x0428
0x0260:0x01						unsigned long ThreadInserted													0x0418:0x01
0x0260:0x02						unsigned long HideFromDebugger													0x0418:0x02
0x0260:0x03						unsigned long ActiveImpersonationInfo													0x0418:0x03
0x0260:0x04						unsigned long SystemThread													0x0418:0x04
0x0260:0x05						unsigned long HardErrorsAreDisabled													0x0418:0x05
0x0260:0x06						unsigned long BreakOnTermination													0x0418:0x06
0x0260:0x07						unsigned long SkipCreationMsg													0x0418:0x07
0x0260:0x08						unsigned long SkipTerminationMsg													0x0418:0x08
0x0260:0x09						unsigned long CopyTokenOnOpen													0x0418:0x09
0x0260:0x0A						unsigned long ThreadIoPriority													0x0418:0x0A
0x0260:0x0D						unsigned long ThreadPagePriority													0x0418:0x0D
0x0260:0x10						unsigned long RundownFail													0x0418:0x10
0x0264						unsigned long SameThreadPassiveFlags					void * LegacyPowerObject	void * LegacyPowerObject							0x0418
0x0264							unsigned long SameThreadPassiveFlags												0x041C
0x0264:0x00							unsigned long ActiveExWorker	unsigned long ActiveExWorker	unsigned long ActiveExWorker	unsigned long ActiveExWorker									0x041C:0x00
0x0264													void * LegacyPowerObject	void * LegacyPowerObject					0x0420
0x0264																	volatile long CmLockOrdering	volatile long CmLockOrdering	0x0428
0x0264						unsigned long ActiveExWorker									unsigned long CrossThreadFlags				0x042C
0x0264:0x00															unsigned long Terminated				0x042C:0x00
0x0264:0x01							unsigned long ExWorkerCanWaitUser	unsigned long ExWorkerCanWaitUser	unsigned long ExWorkerCanWaitUser	unsigned long ExWorkerCanWaitUser									0x041C:0x01
0x0264:0x01						unsigned long ExWorkerCanWaitUser									unsigned long ThreadInserted				0x042C:0x01
0x0264:0x02							unsigned long MemoryMaker	unsigned long MemoryMaker	unsigned long MemoryMaker	unsigned long MemoryMaker									0x041C:0x02
0x0264:0x02						unsigned long MemoryMaker									unsigned long HideFromDebugger				0x042C:0x02
0x0264:0x03						unsigned long ClonedThread		unsigned long ClonedThread	unsigned long ClonedThread	unsigned long ClonedThread									0x041C:0x03
0x0264:0x03															unsigned long ActiveImpersonationInfo				0x042C:0x03
0x0264:0x04							unsigned long KeyedEventInUse	unsigned long KeyedEventInUse	unsigned long KeyedEventInUse	unsigned long KeyedEventInUse									0x041C:0x04
0x0264:0x04						unsigned long KeyedEventInUse									unsigned long HardErrorsAreDisabled				0x042C:0x04
0x0264:0x05				unsigned long RateApcState		unsigned long RateApcState	unsigned long RateApcState	unsigned long RateApcState							0x041C:0x05
0x0264:0x05			unsigned long RateApcState						unsigned long BreakOnTermination						0x042C:0x05
0x0264:0x06									unsigned long SkipCreationMsg						0x042C:0x06
0x0264:0x07			unsigned long SelfTerminate			unsigned long SelfTerminate	unsigned long SelfTerminate	unsigned long SelfTerminate							0x041C:0x07
0x0264:0x07									unsigned long SkipTerminationMsg						0x042C:0x07
0x0264:0x08									unsigned long CopyTokenOnOpen						0x042C:0x08
0x0264:0x09									unsigned long ThreadIoPriority						0x042C:0x09
0x0264:0x0C									unsigned long ThreadPagePriority						0x042C:0x0C
0x0264:0x0F									unsigned long RundownFail						0x042C:0x0F
0x0264:0x10									unsigned long UmsForceQueueTermination						0x042C:0x10
0x0264:0x11					unsigned long ReservedCrossThreadFlags				0x042C:0x11
0x0268				unsigned long SameThreadApcFlags				struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry						0x0420
0x0268:0x00				uint8_t Spare	uint8_t Spare	uint8_t Spare	uint8_t Spare								0x0420:0x00
0x0268			unsigned long SameThreadApcFlags							struct _LIST_ENTRY ThreadListEntry				struct _LIST_ENTRY ThreadListEntry	0x0428
0x0268			uint8_t Spare										unsigned long CrossThreadFlags		0x042C
0x0268:0x00													unsigned long Terminated	unsigned long Terminated	0x042C:0x00
0x0268											unsigned long SameThreadPassiveFlags				0x0430
0x0268:0x00											unsigned long ActiveExWorker				0x0430:0x00
0x0268:0x01				volatile uint8_t StartAddressInvalid	volatile uint8_t StartAddressInvalid	volatile uint8_t StartAddressInvalid	volatile uint8_t StartAddressInvalid									0x0420:0x01
0x0268:0x01							unsigned long ThreadInserted							unsigned long ThreadInserted	0x042C:0x01
0x0268:0x01			volatile uint8_t StartAddressInvalid									unsigned long MemoryMaker			0x0430:0x01
0x0268:0x02			uint8_t EtwPageFaultCalloutActive	uint8_t EtwPageFaultCalloutActive	uint8_t EtwPageFaultCalloutActive	uint8_t EtwPageFaultCalloutActive							0x0420:0x02
0x0268:0x02	uint8_t EtwPageFaultCalloutActive											unsigned long HideFromDebugger	unsigned long HideFromDebugger	0x042C:0x02
0x0268:0x02							unsigned long ClonedThread							0x0430:0x02
0x0268:0x03	uint8_t OwnsProcessWorkingSetExclusive		uint8_t OwnsProcessWorkingSetExclusive	uint8_t OwnsProcessWorkingSetExclusive	uint8_t OwnsProcessWorkingSetExclusive							0x0420:0x03
0x0268:0x03								unsigned long ActiveImpersonationInfo				unsigned long ActiveImpersonationInfo	0x042C:0x03
0x0268:0x03						unsigned long KeyedEventInUse							0x0430:0x03
0x0268:0x04		uint8_t OwnsProcessWorkingSetShared	uint8_t OwnsProcessWorkingSetShared	uint8_t OwnsProcessWorkingSetShared	uint8_t OwnsProcessWorkingSetShared								0x0420:0x04
0x0268:0x04	uint8_t OwnsProcessWorkingSetShared							unsigned long HardErrorsAreDisabled				unsigned long HardErrorsAreDisabled	0x042C:0x04
0x0268:0x04						unsigned long SelfTerminate							0x0430:0x04
0x0268:0x05	uint8_t OwnsSystemWorkingSetExclusive		uint8_t OwnsSystemWorkingSetExclusive	uint8_t OwnsSystemWorkingSetExclusive	uint8_t OwnsSystemWorkingSetExclusive								0x0420:0x05
0x0268:0x05								unsigned long BreakOnTermination				0x042C:0x05
0x0268:0x06		uint8_t OwnsSystemWorkingSetShared	uint8_t OwnsSystemWorkingSetShared	uint8_t OwnsSystemWorkingSetShared	uint8_t OwnsSystemWorkingSetShared							0x0420:0x06
0x0268:0x06	uint8_t OwnsSystemWorkingSetShared							unsigned long SkipCreationMsg				0x042C:0x06
0x0268:0x07		uint8_t OwnsSessionWorkingSetExclusive	uint8_t OwnsSessionWorkingSetExclusive	uint8_t OwnsSessionWorkingSetExclusive	uint8_t OwnsSessionWorkingSetExclusive							0x0420:0x07
0x0268:0x07	uint8_t OwnsSessionWorkingSetExclusive							unsigned long SkipTerminationMsg				0x042C:0x07
0x0269:0x00		uint8_t OwnsSessionWorkingSetShared	uint8_t OwnsSessionWorkingSetShared	uint8_t OwnsSessionWorkingSetShared	uint8_t OwnsSessionWorkingSetShared							0x0421:0x00
0x0268:0x08	uint8_t OwnsSessionWorkingSetShared							unsigned long CopyTokenOnOpen				0x042C:0x08
0x0269:0x01		uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive							0x0421:0x01
0x0268:0x09	uint8_t OwnsProcessAddressSpaceExclusive							unsigned long ThreadIoPriority	unsigned long ThreadIoPriority			0x042C:0x09
0x0269:0x02	uint8_t OwnsProcessAddressSpaceShared											0x0421:0x02
0x0269:0x03	uint8_t SuppressSymbolLoad											0x0421:0x03
0x0269:0x04		uint8_t Prefetching	uint8_t Prefetching	uint8_t Prefetching	uint8_t Prefetching							0x0421:0x04
0x0268:0x0C	uint8_t Prefetching							unsigned long ThreadPagePriority	unsigned long ThreadPagePriority			0x042C:0x0C
0x0269:0x05	uint8_t OwnsDynamicMemoryShared											0x0421:0x05
0x0269:0x06	uint8_t OwnsChangeControlAreaExclusive											0x0421:0x06
0x0269:0x07	uint8_t OwnsChangeControlAreaShared		uint8_t OwnsChangeControlAreaShared	uint8_t OwnsChangeControlAreaShared	uint8_t OwnsChangeControlAreaShared							0x0421:0x07
0x0268:0x0F								unsigned long RundownFail				0x042C:0x0F
0x026A:0x00		uint8_t Spare1	uint8_t Spare1	uint8_t Spare1	uint8_t Spare1							0x0422:0x00
0x0268:0x10	uint16_t PriorityRegionActive							unsigned long UmsForceQueueTermination				0x042C:0x10
0x0268:0x11								unsigned long ReservedCrossThreadFlags	unsigned long ReservedCrossThreadFlags			0x042C:0x11
0x026B		uint8_t PriorityRegionActive										0x0423
0x026C		uint8_t CacheManagerActive	uint8_t CacheManagerActive	uint8_t CacheManagerActive	uint8_t CacheManagerActive							0x0424
0x026C								unsigned long SameThreadPassiveFlags				0x0430
0x026C:0x00								unsigned long ActiveExWorker	unsigned long ActiveExWorker			0x0430:0x00
0x026C	uint8_t CacheManagerActive					unsigned long SameThreadApcFlags						0x0434
0x026C:0x00						uint8_t Spare						0x0434:0x00
0x026C:0x01								unsigned long MemoryMaker	unsigned long MemoryMaker			0x0430:0x01
0x026C:0x01						volatile uint8_t StartAddressInvalid						0x0434:0x01
0x026C:0x02								unsigned long ClonedThread	unsigned long ClonedThread			0x0430:0x02
0x026C:0x02						uint8_t EtwCalloutActive						0x0434:0x02
0x026C:0x03								unsigned long KeyedEventInUse	unsigned long KeyedEventInUse			0x0430:0x03
0x026C:0x03						uint8_t OwnsProcessWorkingSetExclusive						0x0434:0x03
0x026C:0x04								unsigned long SelfTerminate	unsigned long SelfTerminate			0x0430:0x04
0x026C:0x04						uint8_t OwnsProcessWorkingSetShared						0x0434:0x04
0x026C:0x05						uint8_t OwnsSystemCacheWorkingSetExclusive						0x0434:0x05
0x026C:0x06						uint8_t OwnsSystemCacheWorkingSetShared						0x0434:0x06
0x026C:0x07						uint8_t OwnsSessionWorkingSetExclusive						0x0434:0x07
0x026D	uint8_t DisablePageFaultClustering		uint8_t DisablePageFaultClustering	uint8_t DisablePageFaultClustering	uint8_t DisablePageFaultClustering							0x0425
0x026D:0x00						uint8_t OwnsSessionWorkingSetShared						0x0435:0x00
0x026D:0x01						uint8_t OwnsProcessAddressSpaceExclusive						0x0435:0x01
0x026D:0x02						uint8_t OwnsProcessAddressSpaceShared						0x0435:0x02
0x026D:0x03						uint8_t SuppressSymbolLoad						0x0435:0x03
0x026D:0x04						uint8_t Prefetching						0x0435:0x04
0x026D:0x05						uint8_t OwnsVadExclusive						0x0435:0x05
0x026D:0x06						uint8_t OwnsChangeControlAreaExclusive						0x0435:0x06
0x026D:0x07						uint8_t OwnsChangeControlAreaShared						0x0435:0x07
0x026E		uint8_t ActiveFaultCount	uint8_t ActiveFaultCount	uint8_t ActiveFaultCount	uint8_t ActiveFaultCount					0x0426
0x026E:0x00	uint8_t ActiveFaultCount					uint8_t OwnsPagedPoolWorkingSetExclusive				0x0436:0x00
0x026E:0x01						uint8_t OwnsPagedPoolWorkingSetShared				0x0436:0x01
0x026E:0x02						uint8_t OwnsSystemPtesWorkingSetExclusive				0x0436:0x02
0x026E:0x03						uint8_t OwnsSystemPtesWorkingSetShared				0x0436:0x03
0x026E:0x04						uint8_t TrimTrigger				0x0436:0x04
0x026E:0x06						uint8_t Spare2				0x0436:0x06
0x026F						uint8_t PriorityRegionActive				0x0437
0x0270	uintptr_t AlpcMessageId		uintptr_t AlpcMessageId	uintptr_t AlpcMessageId	uintptr_t AlpcMessageId							0x0428
0x0270						struct _EX_RUNDOWN_REF RundownProtect						struct _EX_RUNDOWN_REF RundownProtect	0x0430
0x0270								unsigned long SameThreadApcFlags					0x0434
0x0270:0x00								uint8_t Spare	uint8_t Spare				0x0434:0x00
0x0270									struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	uint8_t CacheManagerActive	uint8_t CacheManagerActive		0x0438
0x0270:0x01												volatile uint8_t StartAddressInvalid		0x0434:0x01
0x0270:0x02												uint8_t EtwCalloutActive		0x0434:0x02
0x0270:0x03												uint8_t OwnsProcessWorkingSetExclusive		0x0434:0x03
0x0270:0x04												uint8_t OwnsProcessWorkingSetShared		0x0434:0x04
0x0270:0x05												uint8_t OwnsSystemCacheWorkingSetExclusive		0x0434:0x05
0x0270:0x06												uint8_t OwnsSystemCacheWorkingSetShared		0x0434:0x06
0x0270:0x07												uint8_t OwnsSessionWorkingSetExclusive		0x0434:0x07
0x0271:0x00												uint8_t OwnsSessionWorkingSetShared	uint8_t OwnsSessionWorkingSetShared	0x0435:0x00
0x0271										uint8_t DisablePageFaultClustering	uint8_t DisablePageFaultClustering			0x0439
0x0271:0x01												uint8_t OwnsProcessAddressSpaceExclusive		0x0435:0x01
0x0271:0x02												uint8_t OwnsProcessAddressSpaceShared		0x0435:0x02
0x0271:0x03												uint8_t SuppressSymbolLoad		0x0435:0x03
0x0271:0x04												uint8_t Prefetching		0x0435:0x04
0x0271:0x05												uint8_t OwnsVadExclusive		0x0435:0x05
0x0271:0x06												uint8_t OwnsChangeControlAreaExclusive		0x0435:0x06
0x0271:0x07												uint8_t OwnsChangeControlAreaShared		0x0435:0x07
0x0272:0x00												uint8_t OwnsPagedPoolWorkingSetExclusive	uint8_t OwnsPagedPoolWorkingSetExclusive	0x0436:0x00
0x0272										uint8_t ActiveFaultCount	uint8_t ActiveFaultCount			0x043A
0x0272:0x01												uint8_t OwnsPagedPoolWorkingSetShared		0x0436:0x01
0x0272:0x02												uint8_t OwnsSystemPtesWorkingSetExclusive		0x0436:0x02
0x0272:0x03												uint8_t OwnsSystemPtesWorkingSetShared		0x0436:0x03
0x0272:0x04												uint8_t TrimTrigger		0x0436:0x04
0x0272:0x06												uint8_t Spare2		0x0436:0x06
0x0273												uint8_t PriorityRegionActive	uint8_t PriorityRegionActive	0x0437
0x0273										uint8_t LockOrderState				0x043B
0x0274	void * AlpcMessage													0x0430
0x0274	unsigned long AlpcReceiveAttributeSet		unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet									0x0430
0x0274						struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock					uint8_t CacheManagerActive	uint8_t CacheManagerActive	0x0438
0x0274								struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	uintptr_t AlpcMessageId	uintptr_t AlpcMessageId			0x0440
0x0275												uint8_t DisablePageFaultClustering		0x0439
0x0276												uint8_t ActiveFaultCount		0x043A
0x0277												uint8_t LockOrderState		0x043B
0x0278		struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry									0x0438
0x0278						unsigned long ReadClusterSize	unsigned long ReadClusterSize					uintptr_t AlpcMessageId	uintptr_t AlpcMessageId	0x0440
0x0278	struct _LIST_ENTRY AlpcWaitListEntry							unsigned long ReadClusterSize		void * AlpcMessage				0x0448
0x0278										unsigned long AlpcReceiveAttributeSet				0x0448
0x027C						volatile long MmLockOrdering	volatile long MmLockOrdering							0x0444
0x027C												void * AlpcMessage		0x0448
0x027C												unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet	0x0448
0x027C								volatile long MmLockOrdering	volatile long MmLockOrdering					0x044C
0x027C										long ExitStatus				0x0450
0x0280		unsigned long CacheManagerCount	unsigned long CacheManagerCount	unsigned long CacheManagerCount	unsigned long CacheManagerCount	unsigned long CrossThreadFlags								0x0448
0x0280:0x00						unsigned long Terminated	unsigned long Terminated							0x0448:0x00
0x0280								unsigned long CrossThreadFlags				long ExitStatus	long ExitStatus	0x0450
0x0280:0x00								unsigned long Terminated	unsigned long Terminated					0x0450:0x00
0x0280	unsigned long CacheManagerCount									struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry			0x0458
0x0280:0x01						unsigned long ThreadInserted	unsigned long ThreadInserted							0x0448:0x01
0x0280:0x01								unsigned long ThreadInserted						0x0450:0x01
0x0280:0x02						unsigned long HideFromDebugger	unsigned long HideFromDebugger							0x0448:0x02
0x0280:0x02								unsigned long HideFromDebugger						0x0450:0x02
0x0280:0x03						unsigned long ActiveImpersonationInfo	unsigned long ActiveImpersonationInfo							0x0448:0x03
0x0280:0x03								unsigned long ActiveImpersonationInfo						0x0450:0x03
0x0280:0x04						unsigned long SystemThread	unsigned long SystemThread							0x0448:0x04
0x0280:0x04								unsigned long Reserved						0x0450:0x04
0x0280:0x05						unsigned long HardErrorsAreDisabled	unsigned long HardErrorsAreDisabled							0x0448:0x05
0x0280:0x05								unsigned long HardErrorsAreDisabled						0x0450:0x05
0x0280:0x06						unsigned long BreakOnTermination	unsigned long BreakOnTermination							0x0448:0x06
0x0280:0x06								unsigned long BreakOnTermination						0x0450:0x06
0x0280:0x07						unsigned long SkipCreationMsg	unsigned long SkipCreationMsg							0x0448:0x07
0x0280:0x07								unsigned long SkipCreationMsg						0x0450:0x07
0x0280:0x08						unsigned long SkipTerminationMsg	unsigned long SkipTerminationMsg							0x0448:0x08
0x0280:0x08								unsigned long SkipTerminationMsg						0x0450:0x08
0x0280:0x09						unsigned long CopyTokenOnOpen	unsigned long CopyTokenOnOpen							0x0448:0x09
0x0280:0x09								unsigned long CopyTokenOnOpen						0x0450:0x09
0x0280:0x0A						unsigned long ThreadIoPriority	unsigned long ThreadIoPriority							0x0448:0x0A
0x0280:0x0A								unsigned long ThreadIoPriority						0x0450:0x0A
0x0280:0x0D						unsigned long ThreadPagePriority	unsigned long ThreadPagePriority							0x0448:0x0D
0x0280:0x0D								unsigned long ThreadPagePriority						0x0450:0x0D
0x0280:0x10						unsigned long RundownFail	unsigned long RundownFail							0x0448:0x10
0x0280:0x10								unsigned long RundownFail						0x0450:0x10
0x0280:0x11						unsigned long NeedsWorkingSetAging	unsigned long NeedsWorkingSetAging							0x0448:0x11
0x0280:0x11								unsigned long NeedsWorkingSetAging						0x0450:0x11
0x0284				unsigned long KernelStackReference	unsigned long KernelStackReference	unsigned long SameThreadPassiveFlags								0x044C
0x0284:0x00						unsigned long ActiveExWorker	unsigned long ActiveExWorker							0x044C:0x00
0x0284								unsigned long SameThreadPassiveFlags						0x0454
0x0284:0x00								unsigned long ActiveExWorker	unsigned long ActiveExWorker					0x0454:0x00
0x0284												struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry	0x0458
0x0284:0x01						unsigned long ExWorkerCanWaitUser	unsigned long ExWorkerCanWaitUser							0x044C:0x01
0x0284:0x01								unsigned long ExWorkerCanWaitUser						0x0454:0x01
0x0284:0x02						unsigned long MemoryMaker	unsigned long MemoryMaker							0x044C:0x02
0x0284:0x02								unsigned long MemoryMaker						0x0454:0x02
0x0284:0x03						unsigned long ClonedThread	unsigned long ClonedThread							0x044C:0x03
0x0284:0x03								unsigned long ClonedThread						0x0454:0x03
0x0284:0x04						unsigned long KeyedEventInUse	unsigned long KeyedEventInUse							0x044C:0x04
0x0284:0x04								unsigned long KeyedEventInUse						0x0454:0x04
0x0284:0x05						unsigned long RateApcState	unsigned long RateApcState							0x044C:0x05
0x0284:0x05								unsigned long RateApcState						0x0454:0x05
0x0284:0x07						unsigned long SelfTerminate	unsigned long SelfTerminate							0x044C:0x07
0x0284:0x07								unsigned long SelfTerminate						0x0454:0x07
0x0288						unsigned long SameThreadApcFlags								0x0450
0x0288:0x00						uint8_t Spare	uint8_t Spare							0x0450:0x00
0x0288								unsigned long SameThreadApcFlags						0x0458
0x0288:0x00								uint8_t Spare	uint8_t Spare					0x0458:0x00
0x0288										unsigned long CacheManagerCount	unsigned long CacheManagerCount			0x0468
0x0288:0x01						volatile uint8_t StartAddressInvalid	volatile uint8_t StartAddressInvalid							0x0450:0x01
0x0288:0x01								volatile uint8_t StartAddressInvalid						0x0458:0x01
0x0288:0x02						uint8_t EtwPageFaultCalloutActive	uint8_t EtwPageFaultCalloutActive							0x0450:0x02
0x0288:0x02								uint8_t EtwPageFaultCalloutActive						0x0458:0x02
0x0288:0x03						uint8_t OwnsProcessWorkingSetExclusive	uint8_t OwnsProcessWorkingSetExclusive							0x0450:0x03
0x0288:0x03								uint8_t OwnsProcessWorkingSetExclusive						0x0458:0x03
0x0288:0x04						uint8_t OwnsProcessWorkingSetShared	uint8_t OwnsProcessWorkingSetShared							0x0450:0x04
0x0288:0x04								uint8_t OwnsProcessWorkingSetShared						0x0458:0x04
0x0288:0x05						uint8_t OwnsSystemCacheWorkingSetExclusive	uint8_t OwnsSystemCacheWorkingSetExclusive							0x0450:0x05
0x0288:0x05								uint8_t OwnsSystemCacheWorkingSetExclusive						0x0458:0x05
0x0288:0x06						uint8_t OwnsSystemCacheWorkingSetShared	uint8_t OwnsSystemCacheWorkingSetShared							0x0450:0x06
0x0288:0x06								uint8_t OwnsSystemCacheWorkingSetShared						0x0458:0x06
0x0288:0x07						uint8_t OwnsSessionWorkingSetExclusive	uint8_t OwnsSessionWorkingSetExclusive							0x0450:0x07
0x0288:0x07							uint8_t OwnsSessionWorkingSetExclusive		0x0458:0x07
0x0289:0x00			uint8_t OwnsSessionWorkingSetShared			uint8_t OwnsSessionWorkingSetShared			0x0451:0x00
0x0289:0x00							uint8_t OwnsSessionWorkingSetShared		0x0459:0x00
0x0289:0x01			uint8_t OwnsProcessAddressSpaceExclusive			uint8_t OwnsProcessAddressSpaceExclusive			0x0451:0x01
0x0289:0x01							uint8_t OwnsProcessAddressSpaceExclusive		0x0459:0x01
0x0289:0x02			uint8_t OwnsProcessAddressSpaceShared			uint8_t OwnsProcessAddressSpaceShared			0x0451:0x02
0x0289:0x02							uint8_t OwnsProcessAddressSpaceShared		0x0459:0x02
0x0289:0x03			uint8_t SuppressSymbolLoad			uint8_t SuppressSymbolLoad			0x0451:0x03
0x0289:0x03							uint8_t SuppressSymbolLoad		0x0459:0x03
0x0289:0x04			uint8_t Prefetching			uint8_t Prefetching			0x0451:0x04
0x0289:0x04							uint8_t Prefetching		0x0459:0x04
0x0289:0x05			uint8_t OwnsDynamicMemoryShared			uint8_t OwnsDynamicMemoryShared			0x0451:0x05
0x0289:0x05							uint8_t OwnsDynamicMemoryShared		0x0459:0x05
0x0289:0x06			uint8_t OwnsChangeControlAreaExclusive			uint8_t OwnsChangeControlAreaExclusive			0x0451:0x06
0x0289:0x06							uint8_t OwnsChangeControlAreaExclusive		0x0459:0x06
0x0289:0x07			uint8_t OwnsChangeControlAreaShared			uint8_t OwnsChangeControlAreaShared			0x0451:0x07
0x0289:0x07							uint8_t OwnsChangeControlAreaShared		0x0459:0x07
0x028A:0x00			uint8_t OwnsPagedPoolWorkingSetExclusive			uint8_t OwnsPagedPoolWorkingSetExclusive			0x0452:0x00
0x028A:0x00							uint8_t OwnsPagedPoolWorkingSetExclusive		0x045A:0x00
0x028A:0x01			uint8_t OwnsPagedPoolWorkingSetShared			uint8_t OwnsPagedPoolWorkingSetShared			0x0452:0x01
0x028A:0x01							uint8_t OwnsPagedPoolWorkingSetShared		0x045A:0x01
0x028A:0x02			uint8_t OwnsSystemPtesWorkingSetExclusive			uint8_t OwnsSystemPtesWorkingSetExclusive			0x0452:0x02
0x028A:0x02							uint8_t OwnsSystemPtesWorkingSetExclusive		0x045A:0x02
0x028A:0x03			uint8_t OwnsSystemPtesWorkingSetShared			uint8_t OwnsSystemPtesWorkingSetShared			0x0452:0x03
0x028A:0x03							uint8_t OwnsSystemPtesWorkingSetShared		0x045A:0x03
0x028A:0x04			uint8_t TrimTrigger			uint8_t TrimTrigger			0x0452:0x04
0x028A:0x04							uint8_t TrimTrigger		0x045A:0x04
0x028A:0x06			uint8_t Spare1			uint8_t Spare1			0x0452:0x06
0x028A:0x06							uint8_t Spare1		0x045A:0x06
0x028B	uint8_t PriorityRegionActive	uint8_t PriorityRegionActive				0x0453
0x028B			uint8_t PriorityRegionActive			0x045B
0x028C	uint8_t CacheManagerActive	uint8_t CacheManagerActive					0x0454
0x028C			uint8_t CacheManagerActive	uint8_t CacheManagerActive			0x045C
0x028C						unsigned long CacheManagerCount	unsigned long CacheManagerCount	0x0468
0x028C					unsigned long IoBoostCount		unsigned long IoBoostCount		0x046C
0x028D	uint8_t DisablePageFaultClustering	uint8_t DisablePageFaultClustering							0x0455
0x028D			uint8_t DisablePageFaultClustering						0x045D
0x028E	uint8_t ActiveFaultCount	uint8_t ActiveFaultCount							0x0456
0x028E			uint8_t ActiveFaultCount						0x045E
0x028F	uint8_t LockOrderState	uint8_t LockOrderState							0x0457
0x028F			uint8_t LockOrderState						0x045F
0x0290	uintptr_t AlpcMessageId	uintptr_t AlpcMessageId							0x0458
0x0290			uintptr_t AlpcMessageId	uintptr_t AlpcMessageId					0x0460
0x0290						unsigned long IoBoostCount		unsigned long IoBoostCount	0x046C
0x0290					uintptr_t IrpListLock			0x0470
0x0294	void * AlpcMessage								0x0460
0x0294	unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet							0x0460
0x0294			void * AlpcMessage						0x0468
0x0294			unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet					0x0468
0x0294							struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList	0x0470
0x0294					void * ReservedForSynchTracking				0x0478
0x0298	struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry							0x0468
0x0298			struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry					0x0470
0x0298					struct _SINGLE_LIST_ENTRY CmCallbackListHead	struct _SINGLE_LIST_ENTRY CmCallbackListHead			0x0480
0x029C							struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY DeboostList	0x0480
0x029C					const struct _GUID * ActivityId				0x0488
0x02A0	unsigned long CacheManagerCount	unsigned long CacheManagerCount							0x0478
0x02A0			unsigned long CacheManagerCount	unsigned long CacheManagerCount					0x0480
0x02A0					void * WnfContext				0x0490
0x02A4	unsigned long IoBoostCount	unsigned long IoBoostCount							0x047C
0x02A4			unsigned long IoBoostCount	unsigned long IoBoostCount					0x0484
0x02A4							uintptr_t BoostListLock	uintptr_t BoostListLock	0x0490
0x02A4					struct _SINGLE_LIST_ENTRY SeLearningModeListHead				0x0498
0x02A8	uintptr_t IrpListLock	uintptr_t IrpListLock							0x0480
0x02A8			uintptr_t IrpListLock	uintptr_t IrpListLock					0x0488
0x02A8							uintptr_t IrpListLock	uintptr_t IrpListLock	0x0498
0x02A8					uint64_t RelativeTimerBias	uint64_t RelativeTimerBias			0x04A0
0x02AC	void * ReservedForSynchTracking	void * ReservedForSynchTracking							0x0488
0x02AC			void * ReservedForSynchTracking	void * ReservedForSynchTracking					0x0490
0x02AC							void * ReservedForSynchTracking		0x04A0
0x02B0	struct _SINGLE_LIST_ENTRY CmCallbackListHead	struct _SINGLE_LIST_ENTRY CmCallbackListHead							0x0490
0x02B0			struct _SINGLE_LIST_ENTRY CmCallbackListHead	struct _SINGLE_LIST_ENTRY CmCallbackListHead					0x0498
0x02B0							struct _SINGLE_LIST_ENTRY CmCallbackListHead		0x04A8
0x02B4			unsigned long KernelStackReference	unsigned long KernelStackReference					0x04A0
0x02B4							const struct _GUID * ActivityId		0x04B0
0x02B8							void * WnfContext		0x04B8
0x02BC							unsigned long KernelStackReference		0x04C0
									union _LARGE_INTEGER CreateTime							0x0598
									union _LARGE_INTEGER ExitTime							0x05A0
									struct _LIST_ENTRY KeyedWaitChain							0x05A0
									void * ChargeOnlySession							0x05B0
									struct _LIST_ENTRY PostBlockList							0x05B8
									void * ForwardLinkShadow							0x05B8
									void * StartAddress							0x05C0
									struct _TERMINATION_PORT * TerminationPort							0x05C8
									struct _ETHREAD * ReaperLink							0x05C8
									void * KeyedWaitValue							0x05C8
0x0338									uint64_t ActiveTimerListLock	union _LARGE_INTEGER CreateTime						0x05D0
0x0340									struct _LIST_ENTRY ActiveTimerListHead	union _LARGE_INTEGER ExitTime						union _LARGE_INTEGER CreateTime		union _LARGE_INTEGER CreateTime			0x05D8
0x0340										struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain										0x05D8
0x0348																union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime		union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	0x05D8
0x0348													union _LARGE_INTEGER ExitTime				union _LARGE_INTEGER CreateTime				0x05E0
0x0348													struct _LIST_ENTRY KeyedWaitChain		struct _LIST_ENTRY KeyedWaitChain						0x05E0
0x0348									struct _CLIENT_ID Cid	void * ChargeOnlySession											0x05E8
0x034C										struct _LIST_ENTRY PostBlockList											0x05F0
0x034C										void * ForwardLinkShadow											0x05F0
0x0350													void * ChargeOnlySession			union _LARGE_INTEGER ExitTime					0x05E0
0x0350																struct _LIST_ENTRY KeyedWaitChain		struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain	struct _LIST_ENTRY KeyedWaitChain	0x05E0
0x0350												void * ForwardLinkShadow		void * ChargeOnlySession	void * ChargeOnlySession						0x05F0
0x0350										void * StartAddress	void * StartAddress										0x05F8
0x0354									struct _KSEMAPHORE KeyedWaitSemaphore			void * StartAddress	struct _LIST_ENTRY PostBlockList								0x05F8
0x0354									struct _KSEMAPHORE AlpcWaitSemaphore				void * ForwardLinkShadow		void * ForwardLinkShadow						0x05F8
0x0354										struct _TERMINATION_PORT * TerminationPort											0x0600
0x0354										struct _ETHREAD * ReaperLink											0x0600
0x0354										void * KeyedWaitValue											0x0600
0x0358												struct _LIST_ENTRY PostBlockList					void * ChargeOnlySession	void * ChargeOnlySession	void * ChargeOnlySession	void * ChargeOnlySession	0x05F0
0x0358														void * StartAddress	void * StartAddress						0x0600
0x0358										uintptr_t ActiveTimerListLock			void * StartAddress			void * ChargeOnlySession					0x0608
0x035C													struct _ETHREAD * ReaperLink			void * ForwardLinkShadow	struct _LIST_ENTRY PostBlockList				0x05F8
0x035C													void * KeyedWaitValue				void * ForwardLinkShadow	void * ForwardLinkShadow	void * ForwardLinkShadow	void * ForwardLinkShadow	0x05F8
0x035C														struct _TERMINATION_PORT * TerminationPort							0x0608
0x035C														struct _ETHREAD * ReaperLink							0x0608
0x035C														void * KeyedWaitValue	void * KeyedWaitValue						0x0608
0x035C										struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead		struct _TERMINATION_PORT * TerminationPort			struct _LIST_ENTRY PostBlockList					0x0610
0x0360																	void * StartAddress	void * StartAddress	void * StartAddress	void * StartAddress	0x0600
0x0360													uintptr_t ActiveTimerListLock			void * StartAddress					0x0610
0x0364												uint64_t ActiveTimerListLock	struct _LIST_ENTRY ActiveTimerListHead			struct _TERMINATION_PORT * TerminationPort					0x0608
0x0364																struct _ETHREAD * ReaperLink					0x0608
0x0364																void * KeyedWaitValue		void * KeyedWaitValue	void * KeyedWaitValue	void * KeyedWaitValue	0x0608
0x0364														struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead						0x0618
0x0364									struct _LIST_ENTRY IrpList	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid										0x0620
0x0368																uintptr_t ActiveTimerListLock					0x0610
0x036C									union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity				struct _CLIENT_ID Cid			struct _LIST_ENTRY ActiveTimerListHead		struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	struct _LIST_ENTRY ActiveTimerListHead	0x0618
0x036C														struct _CLIENT_ID Cid	struct _CLIENT_ID Cid						0x0628
0x036C									uint64_t TopLevelIrp	struct _KSEMAPHORE KeyedWaitSemaphore											0x0630
0x036C										struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore										0x0630
0x0374													struct _KSEMAPHORE KeyedWaitSemaphore			struct _CLIENT_ID Cid		struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	struct _CLIENT_ID Cid	0x0628
0x0374													struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE KeyedWaitSemaphore							0x0638
0x0374														struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore						0x0638
0x037C									struct _DEVICE_OBJECT * DeviceToVerify							struct _KSEMAPHORE KeyedWaitSemaphore					0x0638
0x037C																struct _KSEMAPHORE AlpcWaitSemaphore		struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore	struct _KSEMAPHORE AlpcWaitSemaphore	0x0638
						void * Win32StartAddress											0x0640
						void * LegacyPowerObject											0x0648
0x0380						struct _LIST_ENTRY ThreadListEntry			union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity			0x0650
0x0384					struct _LIST_ENTRY IrpList				struct _LIST_ENTRY IrpList								0x0658
0x0388		union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity									0x0658
0x038C		struct _EX_RUNDOWN_REF RundownProtect		struct _LIST_ENTRY IrpList		struct _LIST_ENTRY IrpList					0x0660
0x038C	struct _EX_PUSH_LOCK ThreadLock	uintptr_t TopLevelIrp							0x0668
0x0390									union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity	union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity		0x0658
0x0390	unsigned long ReadClusterSize	struct _DEVICE_OBJECT * DeviceToVerify								union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity				0x0670
0x0394										struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	struct _LIST_ENTRY IrpList	0x0660
0x0394					uintptr_t TopLevelIrp		uintptr_t TopLevelIrp	struct _LIST_ENTRY IrpList					0x0670
	volatile long MmLockOrdering												0x0674
0x0394		void * Win32StartAddress	void * Win32StartAddress										0x0678
0x0398					struct _DEVICE_OBJECT * DeviceToVerify		struct _DEVICE_OBJECT * DeviceToVerify						0x0678
	unsigned long CrossThreadFlags												0x067C
	unsigned long Terminated												0x067C:0x00
	unsigned long ThreadInserted												0x067C:0x01
	unsigned long HideFromDebugger												0x067C:0x02
	unsigned long ActiveImpersonationInfo												0x067C:0x03
	unsigned long HardErrorsAreDisabled												0x067C:0x04
	unsigned long BreakOnTermination												0x067C:0x05
	unsigned long SkipCreationMsg												0x067C:0x06
	unsigned long SkipTerminationMsg												0x067C:0x07
	unsigned long CopyTokenOnOpen												0x067C:0x08
	unsigned long ThreadIoPriority												0x067C:0x09
	unsigned long ThreadPagePriority												0x067C:0x0C
	unsigned long RundownFail												0x067C:0x0F
	unsigned long UmsForceQueueTermination												0x067C:0x10
	unsigned long ReservedCrossThreadFlags												0x067C:0x11
0x0398		void * LegacyPowerObject											0x0680
0x039C									uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	uintptr_t TopLevelIrp	0x0670
0x039C	unsigned long ActiveExWorker					void * Win32StartAddress	void * Win32StartAddress						0x0680:0x00
	unsigned long MemoryMaker												0x0680:0x01
	unsigned long ClonedThread												0x0680:0x02
	unsigned long KeyedEventInUse												0x0680:0x03
	unsigned long SelfTerminate												0x0680:0x04
	unsigned long SameThreadApcFlags												0x0684
	uint8_t HardFaultBehavior												0x0684:0x00
	volatile uint8_t StartAddressInvalid												0x0684:0x01
	uint8_t EtwCalloutActive												0x0684:0x02
	uint8_t OwnsProcessWorkingSetExclusive												0x0684:0x03
	uint8_t OwnsProcessWorkingSetShared												0x0684:0x04
	uint8_t OwnsSystemCacheWorkingSetExclusive												0x0684:0x05
	uint8_t OwnsSystemCacheWorkingSetShared												0x0684:0x06
	uint8_t OwnsSessionWorkingSetExclusive												0x0684:0x07
	uint8_t OwnsSessionWorkingSetShared												0x0685:0x00
	uint8_t OwnsProcessAddressSpaceExclusive												0x0685:0x01
	uint8_t OwnsProcessAddressSpaceShared												0x0685:0x02
	uint8_t SuppressSymbolLoad												0x0685:0x03
	uint8_t Prefetching												0x0685:0x04
	uint8_t OwnsVadExclusive												0x0685:0x05
	uint8_t OwnsChangeControlAreaExclusive												0x0685:0x06
	uint8_t OwnsChangeControlAreaShared												0x0685:0x07
	uint8_t OwnsPagedPoolWorkingSetExclusive												0x0686:0x00
	uint8_t OwnsPagedPoolWorkingSetShared												0x0686:0x01
	uint8_t OwnsSystemPtesWorkingSetExclusive												0x0686:0x02
	uint8_t OwnsSystemPtesWorkingSetShared												0x0686:0x03
	uint8_t TrimTrigger												0x0686:0x04
	uint8_t Spare2												0x0686:0x06
	uint8_t SystemPagePriorityActive												0x0687:0x00
	uint8_t SystemPagePriority												0x0687:0x01
	uint8_t Spare3												0x0687:0x04
0x039C	uint8_t CacheManagerActive	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry		void * Win32StartAddress			unsigned long TopLevelIrp					0x0688
0x03A0	volatile long CmLockOrdering			void * Win32StartAddress	void * LegacyPowerObject			struct _DEVICE_OBJECT * DeviceToVerify		struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify	struct _DEVICE_OBJECT * DeviceToVerify	0x0678
0x03A0						void * LegacyPowerObject							0x0688
0x03A4	unsigned long SameThreadPassiveFlags			void * LegacyPowerObject					void * Win32StartAddress				0x0680
	uint8_t DisablePageFaultClustering												0x0689
	uint8_t ActiveFaultCount												0x068A
	uint8_t LockOrderState												0x068B
0x03A4						struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry						0x0690
	unsigned long AlpcReceiveAttributeSet												0x0698
0x03A4	void * AlpcMessage	struct _EX_RUNDOWN_REF RundownProtect			struct _LIST_ENTRY ThreadListEntry			void * Win32StartAddress					0x0698
0x03A8								void * LegacyPowerObject		void * LegacyPowerObject	void * LegacyPowerObject	void * LegacyPowerObject	0x0688
0x03A8		struct _EX_PUSH_LOCK ThreadLock											0x06A0
0x03AC	uint64_t AlpcMessageId				struct _EX_RUNDOWN_REF RundownProtect			struct _LIST_ENTRY ThreadListEntry		struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry	struct _LIST_ENTRY ThreadListEntry	0x0690
0x03AC						struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect						0x06A0
0x03AC	struct _LIST_ENTRY AlpcWaitListEntry	unsigned long ReadClusterSize	unsigned long ReadClusterSize										0x06A8
0x03B0					struct _EX_PUSH_LOCK ThreadLock								0x06A8
0x03B0		volatile long MmLockOrdering											0x06AC
0x03B4	long ExitStatus			struct _EX_PUSH_LOCK ThreadLock	unsigned long ReadClusterSize			struct _EX_RUNDOWN_REF RundownProtect		struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	0x06A0
0x03B4		volatile long CmLockOrdering				unsigned long ReadClusterSize							0x06B0
0x03B8					volatile long MmLockOrdering			struct _EX_PUSH_LOCK ThreadLock		struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	struct _EX_PUSH_LOCK ThreadLock	0x06A8
0x03B8		unsigned long CrossThreadFlags		unsigned long Terminated		volatile long MmLockOrdering							0x06B4
0x03B8:0x00		unsigned long Terminated											0x06B4:0x00
0x03B8:0x01		unsigned long ThreadInserted											0x06B4:0x01
0x03B8:0x02		unsigned long HideFromDebugger											0x06B4:0x02
0x03B8:0x03		unsigned long ActiveImpersonationInfo											0x06B4:0x03
0x03B8:0x04		unsigned long HardErrorsAreDisabled											0x06B4:0x04
0x03B8:0x05		unsigned long BreakOnTermination											0x06B4:0x05
0x03B8:0x06		unsigned long SkipCreationMsg											0x06B4:0x06
0x03B8:0x07		unsigned long SkipTerminationMsg											0x06B4:0x07
0x03B8:0x08		unsigned long CopyTokenOnOpen											0x06B4:0x08
0x03B8:0x09		unsigned long ThreadIoPriority											0x06B4:0x09
0x03B8:0x0C		unsigned long ThreadPagePriority											0x06B4:0x0C
0x03B8:0x0F		unsigned long RundownFail											0x06B4:0x0F
0x03B8:0x10		unsigned long UmsForceQueueTermination											0x06B4:0x10
0x03B8:0x11		unsigned long ReservedCrossThreadFlags											0x06B4:0x11
0x03BC				volatile long CmLockOrdering					unsigned long ReadClusterSize	unsigned long ReadClusterSize	unsigned long ReadClusterSize	unsigned long ReadClusterSize	0x06B0
0x03BC	unsigned long CacheManagerCount	unsigned long SameThreadPassiveFlags			volatile long CmLockOrdering			unsigned long ReadClusterSize					0x06B8
0x03BC:0x00		unsigned long ActiveExWorker											0x06B8:0x00
0x03BC:0x01		unsigned long MemoryMaker											0x06B8:0x01
0x03BC:0x02		unsigned long ClonedThread											0x06B8:0x02
0x03BC:0x03		unsigned long KeyedEventInUse											0x06B8:0x03
0x03BC:0x04		unsigned long SelfTerminate											0x06B8:0x04
0x03C0				unsigned long CrossThreadFlags				volatile long MmLockOrdering		volatile long MmLockOrdering	volatile long MmLockOrdering	volatile long MmLockOrdering	0x06B4
0x03C0		unsigned long SameThreadApcFlags			unsigned long Terminated	unsigned long CrossThreadFlags							0x06BC
0x03C0:0x00		uint8_t HardFaultBehavior				unsigned long Terminated							0x06BC:0x00
0x03C0:0x01		volatile uint8_t StartAddressInvalid			unsigned long ThreadInserted								0x06BC:0x01
0x03C0:0x02		uint8_t EtwCalloutActive		uint8_t HardFaultBehavior	unsigned long HideFromDebugger								0x06BC:0x02
0x03C0:0x03		uint8_t OwnsProcessWorkingSetExclusive			unsigned long ActiveImpersonationInfo								0x06BC:0x03
0x03C0:0x04		uint8_t OwnsProcessWorkingSetShared		uint8_t EtwCalloutActive	unsigned long HardErrorsAreDisabled								0x06BC:0x04
0x03C0:0x05		uint8_t OwnsSystemCacheWorkingSetExclusive			unsigned long BreakOnTermination								0x06BC:0x05
0x03C0:0x06		uint8_t OwnsSystemCacheWorkingSetShared			unsigned long SkipCreationMsg								0x06BC:0x06
0x03C0:0x07		uint8_t OwnsSessionWorkingSetExclusive			unsigned long SkipTerminationMsg								0x06BC:0x07
0x03C1:0x00		uint8_t OwnsSessionWorkingSetShared			unsigned long CopyTokenOnOpen								0x06BD:0x00
0x03C1:0x01		uint8_t OwnsProcessAddressSpaceExclusive		uint8_t SystemPagePriority	unsigned long ThreadIoPriority								0x06BD:0x01
0x03C1:0x02		uint8_t OwnsProcessAddressSpaceShared											0x06BD:0x02
0x03C1:0x03		uint8_t SuppressSymbolLoad											0x06BD:0x03
0x03C1:0x04		uint8_t Prefetching			unsigned long ThreadPagePriority								0x06BD:0x04
0x03C1:0x05		uint8_t OwnsVadExclusive											0x06BD:0x05
0x03C1:0x06		uint8_t OwnsChangeControlAreaExclusive											0x06BD:0x06
0x03C1:0x07		uint8_t OwnsChangeControlAreaShared			unsigned long RundownFail								0x06BD:0x07
0x03C2:0x00		uint8_t OwnsPagedPoolWorkingSetExclusive			unsigned long UmsForceQueueTermination								0x06BE:0x00
0x03C2:0x01		uint8_t OwnsPagedPoolWorkingSetShared			unsigned long ReservedCrossThreadFlags								0x06BE:0x01
0x03C2:0x02		uint8_t OwnsSystemPtesWorkingSetExclusive											0x06BE:0x02
0x03C2:0x03		uint8_t OwnsSystemPtesWorkingSetShared											0x06BE:0x03
0x03C2:0x04		uint8_t TrimTrigger											0x06BE:0x04
0x03C2:0x06		uint8_t Spare2											0x06BE:0x06
0x03C3:0x00		uint8_t SystemPagePriorityActive											0x06BF:0x00
0x03C3:0x01		uint8_t SystemPagePriority											0x06BF:0x01
0x03C3:0x04		uint8_t Spare3											0x06BF:0x04
0x03C4					unsigned long SameThreadPassiveFlags			volatile long CmLockOrdering		volatile long CmLockOrdering	volatile long CmLockOrdering	volatile long CmLockOrdering	0x06B8
0x03C4	struct _LIST_ENTRY BoostList	uint8_t CacheManagerActive			unsigned long ActiveExWorker	unsigned long SameThreadPassiveFlags							0x06C0
0x03C4:0x00						unsigned long ActiveExWorker							0x06C0:0x00
0x03C4:0x01					unsigned long MemoryMaker								0x06C0:0x01
0x03C4:0x02					unsigned long ClonedThread								0x06C0:0x02
0x03C4:0x03					unsigned long KeyedEventInUse								0x06C0:0x03
0x03C4:0x04					unsigned long SelfTerminate								0x06C0:0x04
0x03C5		uint8_t DisablePageFaultClustering											0x06C1
0x03C6		uint8_t ActiveFaultCount											0x06C2
0x03C7		uint8_t LockOrderState											0x06C3
0x03C8	unsigned long IoBoostCount			unsigned long SameThreadApcFlags				unsigned long CrossThreadFlags					0x06BC
0x03C8:0x00				uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive			unsigned long Terminated		unsigned long Terminated	unsigned long Terminated	unsigned long Terminated	0x06BC:0x00
0x03C8						unsigned long SameThreadApcFlags							0x06C4
0x03C8:0x00						uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive						0x06C4:0x00
0x03C8		uintptr_t AlpcMessageId	uintptr_t AlpcMessageId										0x06C8
0x03C8:0x01				uint8_t OwnsProcessAddressSpaceShared					unsigned long ThreadInserted	unsigned long ThreadInserted	unsigned long ThreadInserted	unsigned long ThreadInserted	0x06BC:0x01
0x03C8:0x01					uint8_t OwnsProcessAddressSpaceShared			unsigned long ThreadInserted					0x06C4:0x01
0x03C8:0x02									unsigned long HideFromDebugger	unsigned long HideFromDebugger	unsigned long HideFromDebugger	unsigned long HideFromDebugger	0x06BC:0x02
0x03C8:0x02					uint8_t HardFaultBehavior			unsigned long HideFromDebugger					0x06C4:0x02
0x03C8:0x03				volatile uint8_t StartAddressInvalid	volatile uint8_t StartAddressInvalid			unsigned long ActiveImpersonationInfo		unsigned long ActiveImpersonationInfo	unsigned long ActiveImpersonationInfo	unsigned long ActiveImpersonationInfo	0x06BC:0x03
0x03C8:0x03						volatile uint8_t StartAddressInvalid							0x06C4:0x03
0x03C8:0x04					uint8_t EtwCalloutActive			unsigned long HardErrorsAreDisabled		unsigned long HardErrorsAreDisabled	unsigned long HardErrorsAreDisabled	unsigned long HardErrorsAreDisabled	0x06BC:0x04
0x03C8:0x04						uint8_t EtwCalloutActive							0x06C4:0x04
0x03C8:0x05				uint8_t SuppressSymbolLoad					unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	0x06BC:0x05
0x03C8:0x05					uint8_t SuppressSymbolLoad			unsigned long BreakOnTermination					0x06C4:0x05
0x03C8:0x06				uint8_t Prefetching					unsigned long SkipCreationMsg	unsigned long SkipCreationMsg	unsigned long SkipCreationMsg	unsigned long SkipCreationMsg	0x06BC:0x06
0x03C8:0x06					uint8_t Prefetching			unsigned long SkipCreationMsg					0x06C4:0x06
0x03C8:0x07				uint8_t OwnsVadExclusive	uint8_t OwnsVadExclusive			unsigned long SkipTerminationMsg		unsigned long SkipTerminationMsg	unsigned long SkipTerminationMsg	unsigned long SkipTerminationMsg	0x06BC:0x07
0x03C8:0x07						uint8_t OwnsVadExclusive							0x06C4:0x07
0x03C8:0x08				uint8_t SystemPagePriorityActive					unsigned long CopyTokenOnOpen	unsigned long CopyTokenOnOpen	unsigned long CopyTokenOnOpen	unsigned long CopyTokenOnOpen	0x06BD:0x00
0x03C9:0x00					uint8_t SystemPagePriorityActive			unsigned long CopyTokenOnOpen					0x06C5:0x00
0x03C8:0x09									unsigned long ThreadIoPriority	unsigned long ThreadIoPriority	unsigned long ThreadIoPriority	unsigned long ThreadIoPriority	0x06BC:0x09
0x03C9:0x01					uint8_t SystemPagePriority			unsigned long ThreadIoPriority					0x06C5:0x01
0x03C8:0x0C								unsigned long ThreadPagePriority					0x06BC:0x0C
0x03C8:0x0F								unsigned long RundownFail					0x06BC:0x0F
0x03C8:0x10								unsigned long UmsForceQueueTermination					0x06BC:0x10
0x03C8:0x11								unsigned long ReservedCrossThreadFlags	unsigned long IndirectCpuSets				0x06BC:0x11
0x03C8:0x12									unsigned long ReservedCrossThreadFlags				0x06BC:0x12
0x03CC									unsigned long SameThreadPassiveFlags				0x06C0
0x03CC:0x00									unsigned long ActiveExWorker	unsigned long ActiveExWorker	unsigned long ActiveExWorker	unsigned long ActiveExWorker	0x06C0:0x00
0x03CC				uint64_t AlpcMessageId		uint8_t CacheManagerActive	uint8_t CacheManagerActive						0x06C8
0x03CC	struct _LIST_ENTRY DeboostList	void * AlpcMessage			uint8_t CacheManagerActive			unsigned long SameThreadPassiveFlags					0x06D0
0x03CC		unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet					unsigned long ActiveExWorker					0x06D0
0x03CC:0x01								unsigned long MemoryMaker					0x06C0:0x01
0x03CC:0x02								unsigned long ClonedThread			unsigned long StoreLockThread		0x06C0:0x02
0x03CC:0x03								unsigned long KeyedEventInUse			unsigned long ClonedThread		0x06C0:0x03
0x03CC:0x04								unsigned long SelfTerminate			unsigned long KeyedEventInUse		0x06C0:0x04
0x03CC:0x05									unsigned long RespectIoPriority		unsigned long SelfTerminate		0x06C0:0x05
0x03CC:0x06									unsigned long ReservedSameThreadPassiveFlags	unsigned long ReservedSameThreadPassiveFlags	unsigned long RespectIoPriority		0x06C0:0x06
0x03CC:0x07											unsigned long ReservedSameThreadPassiveFlags	unsigned long ReservedSameThreadPassiveFlags	0x06C0:0x07
0x03CD					uint8_t DisablePageFaultClustering								0x06C9
0x03CE					uint8_t ActiveFaultCount								0x06CA
0x03CF					uint8_t LockOrderState								0x06CB
0x03D0								uint8_t OwnsProcessAddressSpaceExclusive	unsigned long SameThreadApcFlags				0x06C4
0x03D0:0x00									uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive	uint8_t OwnsProcessAddressSpaceExclusive	0x06C4:0x00
0x03D0						uintptr_t AlpcMessageId	uintptr_t AlpcMessageId						0x06D0
0x03D0		long ExitStatus	long ExitStatus		unsigned long AlpcMessageId			unsigned long SameThreadApcFlags					0x06D8
0x03D0:0x01								uint8_t OwnsProcessAddressSpaceShared					0x06C4:0x01
0x03D0:0x02								uint8_t HardFaultBehavior					0x06C4:0x02
0x03D0:0x03								volatile uint8_t StartAddressInvalid					0x06C4:0x03
0x03D0:0x04								uint8_t EtwCalloutActive					0x06C4:0x04
0x03D0:0x05								uint8_t SuppressSymbolLoad					0x06C4:0x05
0x03D0:0x06								uint8_t Prefetching					0x06C4:0x06
0x03D0:0x07								uint8_t OwnsVadExclusive					0x06C4:0x07
0x03D1:0x00								uint8_t SystemPagePriorityActive					0x06C5:0x00
0x03D1:0x01								uint8_t SystemPagePriority					0x06C5:0x01
0x03D4									uint8_t CacheManagerActive	uint8_t CacheManagerActive	uint8_t CacheManagerActive	uint8_t CacheManagerActive	0x06C8
0x03D4					unsigned long AlpcReceiveAttributeSet	void * AlpcMessage							0x06D8
0x03D4						unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet						0x06D8
0x03D4		struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry		void * AlpcMessage			uint8_t CacheManagerActive					0x06E0
0x03D5								uint8_t DisablePageFaultClustering					0x06C9
0x03D6								uint8_t ActiveFaultCount					0x06CA
0x03D7								uint8_t LockOrderState					0x06CB
0x03D8									uintptr_t AlpcMessageId	uintptr_t AlpcMessageId	uintptr_t AlpcMessageId	uintptr_t AlpcMessageId	0x06D0
0x03D8					long ExitStatus			unsigned long AlpcMessageId					0x06E0
0x03DC				long ExitStatus	struct _LIST_ENTRY AlpcWaitListEntry			void * AlpcMessage					0x06D8
0x03DC								unsigned long AlpcReceiveAttributeSet		unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet	unsigned long AlpcReceiveAttributeSet	0x06D8
0x03DC						struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry						0x06E8
0x03DC	void * ReservedForSynchTracking	unsigned long CacheManagerCount											0x06F0
0x03E0	uint64_t BoostListLock			struct _LIST_ENTRY AlpcWaitListEntry				long ExitStatus		long ExitStatus	long ExitStatus	long ExitStatus	0x06E0
0x03E0		unsigned long IoBoostCount											0x06F4
0x03E4	uint64_t IrpListLock				unsigned long CacheManagerCount			struct _LIST_ENTRY AlpcWaitListEntry		struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry	struct _LIST_ENTRY AlpcWaitListEntry	0x06E8
0x03E4		struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList			unsigned long CacheManagerCount							0x06F8
0x03E8					unsigned long IoBoostCount								0x06FC
0x03EC	struct _SINGLE_LIST_ENTRY CmCallbackListHead			struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList			unsigned long CacheManagerCount		unsigned long CacheManagerCount	unsigned long CacheManagerCount	unsigned long CacheManagerCount	0x06F8
0x03EC						struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList						0x0700
0x03EC	struct _SINGLE_LIST_ENTRY SeLearningModeListHead	struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY DeboostList										0x0708
0x03F0								unsigned long IoBoostCount					0x06FC
0x03F4	const struct _GUID * ActivityId								struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList	struct _LIST_ENTRY BoostList	0x0700
0x03F4	void * VerifierContext				struct _LIST_ENTRY DeboostList		struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY BoostList					0x0710
0x03F4	unsigned long KernelStackReference	uintptr_t BoostListLock											0x0718
0x03F8		uintptr_t IrpListLock											0x0720
0x03FC									struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY DeboostList	struct _LIST_ENTRY DeboostList	0x0710
0x03FC	void * AdjustedClientToken			uint64_t IrpListLock	uintptr_t BoostListLock		uintptr_t BoostListLock	struct _LIST_ENTRY DeboostList					0x0720
0x03FC		void * ReservedForSynchTracking	void * ReservedForSynchTracking										0x0728
0x0400	unsigned long UserFsBase			void * ReservedForSynchTracking	uintptr_t IrpListLock		uintptr_t IrpListLock						0x0728
0x0400		struct _SINGLE_LIST_ENTRY CmCallbackListHead											0x0730
0x0404									uintptr_t BoostListLock	uintptr_t BoostListLock	uintptr_t BoostListLock	uintptr_t BoostListLock	0x0720
0x0404					void * ReservedForSynchTracking		void * ReservedForSynchTracking	unsigned long BoostListLock					0x0730
0x0404		const struct _GUID * ActivityId											0x0738
0x0408									uintptr_t IrpListLock	uintptr_t IrpListLock	uintptr_t IrpListLock	uintptr_t IrpListLock	0x0728
0x0408	void * PicoContext			const struct _GUID * ActivityId	struct _SINGLE_LIST_ENTRY CmCallbackListHead		struct _SINGLE_LIST_ENTRY CmCallbackListHead	unsigned long IrpListLock					0x0738
0x0408		struct _SINGLE_LIST_ENTRY SeLearningModeListHead											0x0740
0x040C	uint64_t UserGsBase			struct _SINGLE_LIST_ENTRY CmCallbackListHead	const struct _GUID * ActivityId			void * ReservedForSynchTracking		void * ReservedForSynchTracking	void * ReservedForSynchTracking	void * ReservedForSynchTracking	0x0730
0x040C						const struct _GUID * ActivityId	const struct _GUID * ActivityId						0x0740
0x040C		void * VerifierContext											0x0748
0x0410					struct _SINGLE_LIST_ENTRY SeLearningModeListHead			struct _SINGLE_LIST_ENTRY CmCallbackListHead		struct _SINGLE_LIST_ENTRY CmCallbackListHead	struct _SINGLE_LIST_ENTRY CmCallbackListHead	struct _SINGLE_LIST_ENTRY CmCallbackListHead	0x0738
0x0410						struct _SINGLE_LIST_ENTRY SeLearningModeListHead	struct _SINGLE_LIST_ENTRY SeLearningModeListHead						0x0748
0x0410		unsigned long KernelStackReference											0x0750
0x0414				struct _SINGLE_LIST_ENTRY SeLearningModeListHead					const struct _GUID * ActivityId	const struct _GUID * ActivityId	const struct _GUID * ActivityId	const struct _GUID * ActivityId	0x0740
0x0414						void * VerifierContext	void * VerifierContext						0x0750
0x0414		void * AdjustedClientToken			void * VerifierContext			const struct _GUID * ActivityId					0x0758
0x0418									struct _SINGLE_LIST_ENTRY SeLearningModeListHead	struct _SINGLE_LIST_ENTRY SeLearningModeListHead	struct _SINGLE_LIST_ENTRY SeLearningModeListHead	struct _SINGLE_LIST_ENTRY SeLearningModeListHead	0x0748
0x0418					unsigned long KernelStackReference			struct _SINGLE_LIST_ENTRY SeLearningModeListHead					0x0758
0x041C				unsigned long KernelStackReference	void * AdjustedClientToken			void * VerifierContext		void * VerifierContext	void * VerifierContext	void * VerifierContext	0x0750
0x041C			unsigned long UserFsBase	struct _ETHREAD * WorkingOnBehalfClient		void * AdjustedClientToken							0x0760
0x0420					void * WorkingOnBehalfClient			unsigned long KernelStackReference		unsigned long KernelStackReference	unsigned long KernelStackReference	unsigned long KernelStackReference	0x0758
0x0420						void * WorkingOnBehalfClient							0x0768
0x0424									void * AdjustedClientToken	void * AdjustedClientToken	void * AdjustedClientToken	void * AdjustedClientToken	0x0760
0x0424					struct _PS_PROPERTY_SET PropertySet		struct _PS_PROPERTY_SET PropertySet	void * AdjustedClientToken					0x0770
0x0428			uint64_t UserGsBase	unsigned long UserFsBase				void * WorkingOnBehalfClient					0x0768
0x042C			void * PicoContext	uint64_t UserGsBase				struct _PS_PROPERTY_SET PropertySet		struct _PS_PROPERTY_SET PropertySet	struct _PS_PROPERTY_SET PropertySet	struct _PS_PROPERTY_SET PropertySet	0x0770
				void * PicoContext									0x0778
				struct _PROCESS_ENERGY_VALUES * EnergyValues									0x0780
0x0430					struct _THREAD_ENERGY_VALUES * EnergyValues	void * PicoContext							0x0788
0x0434						unsigned long UserFsBase							0x0790
0x0438								void * PicoContext		void * PicoContext	void * PicoContext	void * PicoContext	0x0788
0x0438						uintptr_t UserGsBase							0x0798
0x043C									unsigned long UserFsBase	unsigned long UserFsBase	unsigned long UserFsBase	unsigned long UserFsBase	0x0790
0x043C						struct _THREAD_ENERGY_VALUES * EnergyValues		unsigned long UserFsBase					0x07A0
0x0440									uintptr_t UserGsBase	uintptr_t UserGsBase	uintptr_t UserGsBase	uintptr_t UserGsBase	0x0798
0x0440						volatile unsigned long CmCellReferences		unsigned long UserGsBase					0x07A8
0x0444								struct _THREAD_ENERGY_VALUES * EnergyValues					0x07A0
0x0448								volatile unsigned long CmCellReferences					0x07A8
0x044C								uintptr_t SelectedCpuSets	uintptr_t SelectedCpuSets				0x07B0
0x044C									uintptr_t * SelectedCpuSetsIndirect				0x07B0
0x0450								struct _ESILO * Silo			struct _EJOB * Silo		0x07B8