Min versionXPXP SP32003/XP642003/XP64 SP12003/XP64 SP22003/XP64 SP22003/XP64 SP2VistaVista SP1Vista SP1Vista SP1777 SP18 Pre RTM8 Pre RTM8.1 Update 18.1 Update 110 Pre RTM10 Pre RTM10 Pre RTM
Max versionXP SP3Vista SP2Vista SP2810 TH2
x86 offset
offset:bitpos
Field Name
0x0000struct _DISPATCHER_HEADER
Header
0x0010struct _LIST_ENTRY
MutantListHead
volatile uint64_t
CycleTime
void *
SListFaultAddress
0x0018void *
InitialStack
volatile unsigned long
HighCycleTime
uint64_t
QuantumTarget
0x001Cvoid *
StackLimit
0x0020void *
Teb
void *
KernelStack
uint64_t
QuantumTarget
void *
InitialStack
0x0024void *
TlsArray
unsigned long
ThreadLock
void * volatile
StackLimit
0x0028void *
KernelStack
unsigned long
ContextSwitches
struct _KAPC_STATE
ApcState
void *
InitialStack
void *
StackBase
0x0028uint8_t[23]
ApcStateFill
0x002Cuint8_t
DebugActive
volatile uint8_t
State
void * volatile
StackLimit
unsigned long
ThreadLock
0x002Duint8_t
State
uint8_t
NpxState
0x002Euint8_t[2]
Alerted
uint8_t
WaitIrql
0x002Fchar
WaitMode
0x0030uint8_t
Iopl
void *
Teb
void *
KernelStack
volatile uint64_t
CycleTime
0x0031uint8_t
NpxState
0x0032char
Saturation
0x0033char
Priority
0x0034struct _KAPC_STATE
ApcState
unsigned long
ThreadLock
0x0038struct _KAPC_STATE
ApcState
union _KWAIT_STATUS_REGISTER
WaitRegister
volatile unsigned long
HighCycleTime
0x0038uint8_t[23]
ApcStateFill
0x0039volatile uint8_t
Running
0x003Auint8_t[2]
Alerted
0x003C:0x00unsigned long
KernelStackResident
void *
ServiceTable
0x003Clong
MiscFlags
0x003C:0x01unsigned long
ReadyTransition
0x003C:0x02unsigned long
ProcessReadyQueue
0x003C:0x03unsigned long
WaitNext
0x003C:0x04unsigned long
SystemAffinityActive
0x003C:0x05unsigned long
Alertable
0x003C:0x06unsigned long
GdiFlushActive
0x003C:0x07unsigned long
UserStackWalkActive
0x003C:0x08unsigned long
ApcInterruptRequest
0x003C:0x09unsigned long
ForceDeferSchedule
0x003C:0x0Aunsigned long
QuantumEndMigrate
0x003C:0x0Bunsigned long
UmsDirectedSwitchEnable
0x003C:0x0Cunsigned long
TimerActive
0x003C:0x0Dunsigned long
Reserved
unsigned long
SystemThread
0x003C:0x0Eunsigned long
Reserved
0x003Fuint8_t
ApcQueueable
0x0040volatile uint8_t
NextProcessor
struct _KAPC_STATE
ApcState
unsigned long
CurrentRunTime
0x0040uint8_t[23]
ApcStateFill
0x0041volatile uint8_t
DeferredProcessor
0x0042uint8_t
AdjustReason
0x0043char
AdjustIncrement
0x0044unsigned long
ApcQueueLock
unsigned long
ExpectedRunTime
0x0048unsigned long
ContextSwitches
void *
KernelStack
0x004Cunsigned long
ContextSwitches
unsigned long
ApcQueueLock
volatile uint8_t
State
struct _XSAVE_FORMAT *
StateSaveArea
0x004Duint8_t
NpxState
0x004Euint8_t
WaitIrql
0x004Fchar
WaitMode
char
Priority
0x0050uint8_t
IdleSwapBlock
long
WaitStatus
volatile uint16_t
NextProcessor
struct _KSCHEDULING_GROUP * volatile
SchedulingGroup
0x0051uint8_t[3]
Spare0
uint8_t
VdmSafe
0x0052uint8_t[2]
Spare0
volatile uint16_t
DeferredProcessor
0x0054long
WaitStatus
struct _KWAIT_BLOCK *
WaitBlockList
struct _KWAIT_BLOCK *
WaitBlockList
unsigned long
ApcQueueLock
union _KWAIT_STATUS_REGISTER
WaitRegister
0x0054struct _KGATE *
GateObject
0x0055volatile uint8_t
Running
0x0056uint8_t[2]
Alerted
0x0057char
Priority
0x0058uint8_t
WaitIrql
uint8_t
Alertable
unsigned long
ContextSwitches
volatile unsigned long
NextProcessor
unsigned long
KernelStackResident
unsigned long
SpareMiscFlag0
unsigned long
AutoBoostActive
0x0058long
MiscFlags
0x0058:0x01unsigned long
ReadyTransition
0x0058:0x02unsigned long
ProcessReadyQueue
unsigned long
WaitNext
0x0058:0x03unsigned long
WaitNext
unsigned long
SystemAffinityActive
0x0058:0x04unsigned long
SystemAffinityActive
unsigned long
Alertable
0x0058:0x05unsigned long
Alertable
unsigned long
UserStackWalkActive
0x0058:0x06unsigned long
CodePatchInProgress
unsigned long
UserStackWalkActive
unsigned long
ApcInterruptRequest
0x0058:0x07unsigned long
UserStackWalkActive
unsigned long
ApcInterruptRequest
unsigned long
QuantumEndMigrate
0x0059char
WaitMode
uint8_t
WaitNext
unsigned long
ApcInterruptRequest
unsigned long
QuantumEndMigrate
unsigned long
UmsDirectedSwitchEnable
0x0058:0x09unsigned long
QuantumEndMigrate
unsigned long
UmsDirectedSwitchEnable
unsigned long
TimerActive
0x0058:0x0Aunsigned long
UmsDirectedSwitchEnable
unsigned long
TimerActive
unsigned long
SystemThread
0x0058:0x0Bunsigned long
TimerActive
unsigned long
SystemThread
unsigned long
ProcessDetachActive
0x0058:0x0Cunsigned long
SystemThread
unsigned long
ProcessDetachActive
unsigned long
CalloutActive
0x0058:0x0Dunsigned long
ProcessDetachActive
unsigned long
CalloutActive
unsigned long
ScbReadyQueue
0x0058:0x0Eunsigned long
CalloutActive
unsigned long
ScbReadyQueue
unsigned long
ApcQueueable
0x0058:0x0Funsigned long
ScbReadyQueue
unsigned long
ApcQueueable
unsigned long
ReservedStackInUse
0x005Auint8_t
WaitNext
uint8_t
WaitReason
unsigned long
ApcQueueable
unsigned long
ReservedStackInUse
unsigned long
UmsPerformingSyscall
0x0058:0x11unsigned long
ReservedStackInUse
unsigned long
UmsPerformingSyscall
unsigned long
TimerSuspended
0x0058:0x12unsigned long
UmsPerformingSyscall
unsigned long
ApcPendingReload
unsigned long
SuspendedWaitMode
0x0058:0x13unsigned long
DisableStackCheck
unsigned long
Reserved
unsigned long
TimerSuspended
unsigned long
SuspendSchedulerApcWait
0x0058:0x14unsigned long
Reserved
unsigned long
SuspendedWaitMode
unsigned long
Reserved
0x0058:0x15unsigned long
Reserved
unsigned long
SuspendSchedulerApcWait
0x0058:0x16unsigned long
Reserved
0x005Buint8_t
WaitReason
char
Priority
0x005Cstruct _KWAIT_BLOCK *
WaitBlockList
uint8_t
EnableStackSwap
volatile uint8_t
State
volatile unsigned long
DeferredProcessor
volatile unsigned long
AutoAlignment
unsigned long
AutoAlignment
0x005Cvolatile long
ThreadFlags
0x005C:0x01volatile unsigned long
DisableBoost
unsigned long
DisableBoost
0x005C:0x02volatile unsigned long
UserAffinitySet
unsigned long
UserAffinitySet
unsigned long
ThreadFlagsSpare0
0x005C:0x03volatile unsigned long
AlertedByThreadId
unsigned long
AlertedByThreadId
0x005C:0x04volatile unsigned long
QuantumDonation
unsigned long
QuantumDonation
0x005C:0x05volatile unsigned long
EnableStackSwap
unsigned long
EnableStackSwap
0x005C:0x06volatile unsigned long
GuiThread
unsigned long
GuiThread
0x005C:0x07volatile unsigned long
DisableQuantum
unsigned long
DisableQuantum
0x005Dvolatile uint8_t
SwapBusy
uint8_t
NpxState
volatile unsigned long
ChargeOnlyGroup
unsigned long
ChargeOnlyGroup
unsigned long
ChargeOnlySchedulingGroup
0x005C:0x09volatile unsigned long
DeferPreemption
unsigned long
DeferPreemption
0x005C:0x0Avolatile unsigned long
QueueDeferPreemption
unsigned long
QueueDeferPreemption
0x005C:0x0Bvolatile unsigned long
ForceDeferSchedule
unsigned long
ForceDeferSchedule
0x005C:0x0Cvolatile unsigned long
ExplicitIdealProcessor
unsigned long
ExplicitIdealProcessor
unsigned long
SharedReadyQueueAffinity
0x005C:0x0Dvolatile unsigned long
FreezeCount
unsigned long
FreezeCount
0x005C:0x0Evolatile unsigned long
EtwStackTraceApcInserted
unsigned long
EtwStackTraceApcInserted
unsigned long
TerminationApcRequest
0x005C:0x0Funsigned long
AutoBoostEntriesExhausted
0x005Euint8_t[2]
Alerted
uint8_t
WaitIrql
unsigned long
EtwStackTraceApcInserted
unsigned long
KernelStackResident
0x005C:0x11unsigned long
EtwStackTraceApcInserted
unsigned long
CommitFailTerminateRequest
0x005C:0x12unsigned long
ThreadFlagsSpare
unsigned long
ProcessStackCountDecremented
0x005C:0x13unsigned long
ThreadFlagsSpare
0x005C:0x16volatile unsigned long
ReservedFlags
unsigned long
ReservedFlags
0x005Fchar
WaitMode
unsigned long
ReservedFlags
unsigned long
EtwStackTraceApcInserted
0x005C:0x19unsigned long
ReservedFlags
0x0060struct _LIST_ENTRY
WaitListEntry
long
WaitStatus
unsigned long
ApcQueueLock
unsigned long
Spare0
volatile uint8_t
Tag
0x0060struct _SINGLE_LIST_ENTRY
SwapListEntry
0x0061uint8_t
SystemHeteroCpuPolicy
0x0062:0x00uint8_t
UserHeteroCpuPolicy
0x0062:0x07uint8_t
ExplicitSystemHeteroCpuPolicy
0x0063uint8_t[1]
Spare0
uint8_t
Spare0
0x0064struct _KWAIT_BLOCK *
WaitBlockList
unsigned long
ContextSwitches
unsigned long
SystemCallNumber
0x0064struct _KGATE *
GateObject
0x0068unsigned long
WaitTime
struct _KQUEUE *
Queue
unsigned long
KernelStackResident
volatile uint8_t
State
void *
FirstArgument
0x0068long
MiscFlags
0x0068:0x01unsigned long
ReadyTransition
0x0068:0x02unsigned long
ProcessReadyQueue
0x0068:0x03unsigned long
WaitNext
0x0068:0x04unsigned long
SystemAffinityActive
0x0068:0x05unsigned long
Alertable
0x0068:0x06unsigned long
GdiFlushActive
0x0068:0x07unsigned long
Reserved
unsigned long
UserStackWalkActive
0x0068:0x08unsigned long
Reserved
char
NpxState
0x006Auint8_t
WaitIrql
0x006Bchar
WaitMode
0x006Cchar
BasePriority
unsigned long
WaitTime
uint8_t
WaitReason
volatile long
WaitStatus
struct _KTRAP_FRAME *
TrapFrame
0x006Duint8_t
DecrementCount
volatile uint8_t
SwapBusy
0x006Echar
PriorityDecrement
uint8_t[2]
Alerted
0x006Fchar
Quantum
0x0070struct _KWAIT_BLOCK[4]
WaitBlock
int16_t
KernelApcDisable
struct _LIST_ENTRY
WaitListEntry
struct _KWAIT_BLOCK *
WaitBlockList
struct _KAPC_STATE
ApcState
0x0070unsigned long
CombinedApcDisable
struct _SINGLE_LIST_ENTRY
SwapListEntry
uint8_t[23]
ApcStateFill
0x0072int16_t
SpecialApcDisable
0x0074void *
Teb
struct _LIST_ENTRY
WaitListEntry
0x0074struct _SINGLE_LIST_ENTRY
SwapListEntry
0x0078struct _KTIMER
Timer
struct _KTIMER
Timer
struct _KQUEUE *
Queue
0x0078uint8_t[40]
TimerFill
0x007Cunsigned long
WaitTime
struct _KQUEUE * volatile
Queue
0x0080int16_t
KernelApcDisable
unsigned long
WaitTime
0x0080unsigned long
CombinedApcDisable
0x0082int16_t
SpecialApcDisable
0x0084void *
Teb
int16_t
KernelApcDisable
0x0084unsigned long
CombinedApcDisable
0x0086int16_t
SpecialApcDisable
0x0087char
Priority
0x0088struct _KTIMER
Timer
void *
Teb
unsigned long
UserIdealProcessor
0x0088uint8_t[40]
TimerFill
0x008Cunsigned long
ContextSwitches
0x0090struct _KTIMER
Timer
volatile uint8_t
State
0x0091char
NpxState
char
Spare12
0x0092uint8_t
WaitIrql
0x0093char
WaitMode
0x0094volatile long
WaitStatus
0x0098struct _KWAIT_BLOCK *
WaitBlockList
0x009Cstruct _LIST_ENTRY
WaitListEntry
0x009Cstruct _SINGLE_LIST_ENTRY
SwapListEntry
0x00A0struct _KWAIT_BLOCK[4]
WaitBlock
long
AutoAlignment
unsigned long
AutoAlignment
0x00A0long
ThreadFlags
0x00A0:0x01long
DisableBoost
unsigned long
DisableBoost
0x00A0:0x02long
ReservedFlags
unsigned long
GuiThread
0x00A0:0x03unsigned long
ReservedFlags
unsigned long
VdmSafe
unsigned long
EtwStackTraceApc1Inserted
0x00A0:0x04unsigned long
ReservedFlags
unsigned long
VdmSafe
0x00A0:0x05unsigned long
ReservedFlags
0x00A4struct _KQUEUE * volatile
Queue
struct _DISPATCHER_HEADER * volatile
Queue
0x00A8struct _KWAIT_BLOCK[4]
WaitBlock
void *
Teb
0x00A8uint8_t[23]
WaitBlockFill0
0x00A8uint8_t[47]
WaitBlockFill1
0x00A8uint8_t[71]
WaitBlockFill2
0x00A8uint8_t[95]
WaitBlockFill3
0x00B0:0x00volatile unsigned long
AutoAlignment
struct _KTIMER
Timer
uint64_t
RelativeTimerBias
0x00B0volatile long
ThreadFlags
0x00B0:0x01volatile unsigned long
DisableBoost
0x00B0:0x02volatile unsigned long
EtwStackTraceApc1Inserted
0x00B0:0x03volatile unsigned long
EtwStackTraceApc2Inserted
0x00B0:0x04volatile unsigned long
CycleChargePending
0x00B0:0x05volatile unsigned long
CalloutActive
0x00B0:0x06volatile unsigned long
ApcQueueable
0x00B0:0x07volatile unsigned long
EnableStackSwap
0x00B0:0x08volatile unsigned long
GuiThread
0x00B0:0x09volatile unsigned long
ReservedFlags
volatile unsigned long
VdmSafe
0x00B0:0x0Avolatile unsigned long
ReservedFlags
0x00B8struct _KWAIT_BLOCK[4]
WaitBlock
volatile unsigned long
AutoAlignment
struct _KTIMER
Timer
0x00B8uint8_t[23]
WaitBlockFill0
volatile long
ThreadFlags
0x00B8uint8_t[47]
WaitBlockFill1
0x00B8uint8_t[71]
WaitBlockFill2
0x00B8uint8_t[95]
WaitBlockFill3
0x00B8:0x01volatile unsigned long
DisableBoost
0x00B8:0x02volatile unsigned long
EtwStackTraceApc1Inserted
0x00B8:0x03volatile unsigned long
EtwStackTraceApc2Inserted
0x00B8:0x04volatile unsigned long
CalloutActive
0x00B8:0x05volatile unsigned long
ApcQueueable
0x00B8:0x06volatile unsigned long
EnableStackSwap
0x00B8:0x07volatile unsigned long
GuiThread
0x00B8:0x08volatile unsigned long
UmsPerformingSyscall
0x00B8:0x09volatile unsigned long
ReservedFlags
volatile unsigned long
VdmSafe
0x00B8:0x0Avolatile unsigned long
ReservedFlags
volatile unsigned long
UmsDispatched
0x00B8:0x0Bvolatile unsigned long
ReservedFlags
0x00BCvoid *
ServiceTable
0x00BFuint8_t
SystemAffinityActive
0x00C0struct _KWAIT_BLOCK[4]
WaitBlock
0x00CFuint8_t
IdealProcessor
0x00D0void *
LegoData
0x00D4unsigned long
KernelApcDisable
0x00D7char
PreviousMode
0x00D8unsigned long
UserAffinity
struct _KWAIT_BLOCK[4]
WaitBlock
0x00D8uint8_t[20]
WaitBlockFill8
0x00D8uint8_t[44]
WaitBlockFill9
0x00D8uint8_t[68]
WaitBlockFill10
0x00D8uint8_t[88]
WaitBlockFill11
0x00DCuint8_t
SystemAffinityActive
0x00DDuint8_t
PowerState
0x00DEuint8_t
NpxIrql
0x00DFuint8_t
InitialNode
0x00E0void *
ServiceTable
struct _KWAIT_BLOCK[4]
WaitBlock
0x00E0uint8_t[20]
WaitBlockFill8
0x00E0uint8_t[44]
WaitBlockFill9
0x00E0uint8_t[68]
WaitBlockFill10
0x00E0uint8_t[88]
WaitBlockFill11
0x00E4struct _KQUEUE *
Queue
0x00E7char
PreviousMode
0x00E8unsigned long
ApcQueueLock
0x00ECstruct _KTHREAD_COUNTERS *
ThreadCounters
0x00EFuint8_t
ResourceIndex
0x00F0struct _KTIMER
Timer
0x00F4struct _KTHREAD_COUNTERS *
ThreadCounters
0x00FFuint8_t
ResourceIndex
0x0100struct _LIST_ENTRY
QueueListEntry
0x0104struct _XSTATE_SAVE *
XStateSave
0x0107uint8_t
LargeStack
0x0108uint8_t
ApcStateIndex
struct _LIST_ENTRY
QueueListEntry
0x0109uint8_t
ApcQueueable
0x010Auint8_t
Preempted
0x010Buint8_t
ProcessReadyQueue
0x010Cuint8_t
KernelStackResident
struct _XSTATE_SAVE *
XStateSave
0x010Dchar
Saturation
0x010Euint8_t
IdealProcessor
0x010Fvolatile uint8_t
NextProcessor
0x0110char
BasePriority
struct _KTRAP_FRAME *
TrapFrame
0x0111uint8_t
Spare4
0x0112char
PriorityDecrement
0x0113char
Quantum
0x0114uint8_t
SystemAffinityActive
void *
CallbackStack
0x0115char
PreviousMode
0x0116uint8_t
ResourceIndex
0x0117uint8_t
DisableBoost
uint8_t
LargeStack
0x0118struct _LIST_ENTRY
QueueListEntry
unsigned long
UserAffinity
void *
ServiceTable
struct _LIST_ENTRY
QueueListEntry
0x011Cstruct _KPROCESS *
Process
uint8_t
ApcStateIndex
void * volatile
Win32Thread
0x011Duint8_t
IdealProcessor
0x011Euint8_t
Preempted
0x011Fuint8_t
ProcessReadyQueue
0x0120unsigned long
SoftAffinity
unsigned long
Affinity
uint8_t
KernelStackResident
struct _KTRAP_FRAME *
TrapFrame
struct _LIST_ENTRY
QueueListEntry
0x0121char
BasePriority
0x0122char
PriorityDecrement
0x0123char
Saturation
0x0124unsigned long
Affinity
void *
ServiceTable
unsigned long
UserAffinity
void *
FirstArgument
void * volatile
Win32Thread
0x0128uint8_t
Preempted
struct _KAPC_STATE *[2]
ApcStatePointer
struct _KPROCESS *
Process
void *
CallbackStack
struct _KTRAP_FRAME *
TrapFrame
0x0128unsigned long
CallbackDepth
0x0129uint8_t
ProcessReadyQueue
0x012Auint8_t
KernelStackResident
0x012Buint8_t
NextProcessor
0x012Cvoid *
CallbackStack
unsigned long
Affinity
volatile unsigned long
Affinity
void *
ServiceTable
void *
FirstArgument
0x0130void *
Win32Thread
struct _KAPC_STATE
SavedApcState
struct _KAPC_STATE *[2]
ApcStatePointer
uint8_t
ApcStateIndex
void *
CallbackStack
unsigned long
WaitTime
0x0130unsigned long
CallbackDepth
0x0131char
BasePriority
0x0132char
PriorityDecrement
0x0133uint8_t
Preempted
0x0134struct _KTRAP_FRAME *
TrapFrame
uint8_t
AdjustReason
uint8_t
ApcStateIndex
int16_t
KernelApcDisable
0x0134unsigned long
CombinedApcDisable
0x0135char
AdjustIncrement
char
BasePriority
0x0136uint8_t
Spare01
char
PriorityDecrement
int16_t
SpecialApcDisable
0x0136:0x00uint8_t
ForegroundBoost
0x0136:0x04uint8_t
UnusualBoost
0x0137char
Saturation
uint8_t
Preempted
0x0138struct _KAPC_STATE *[2]
ApcStatePointer
struct _KAPC_STATE
SavedApcState
unsigned long
SystemCallNumber
uint8_t
AdjustReason
struct _LIST_ENTRY
QueueListEntry
unsigned long
WaitTime
0x0138uint8_t[23]
SavedApcStateFill
0x0139char
AdjustIncrement
0x013Achar
PreviousMode
0x013Bchar
Saturation
0x013Cunsigned long
Spare02
unsigned long
FreezeCount
unsigned long
SystemCallNumber
int16_t
KernelApcDisable
0x013Cunsigned long
CombinedApcDisable
0x013Eint16_t
SpecialApcDisable
0x0140char
PreviousMode
unsigned long
UserAffinity
unsigned long
FreezeCount
volatile unsigned long
NextProcessor
struct _LIST_ENTRY
QueueListEntry
0x0141uint8_t
EnableStackSwap
0x0142uint8_t
LargeStack
0x0143uint8_t
ResourceIndex
0x0144unsigned long
KernelTime
struct _KPROCESS *
Process
volatile struct _GROUP_AFFINITY
UserAffinity
volatile unsigned long
DeferredProcessor
0x0148unsigned long
UserTime
void *
CallbackStack
volatile unsigned long
Affinity
struct _KPROCESS *
Process
volatile unsigned long
NextProcessor
volatile unsigned long
NextProcessor
0x0148:0x00unsigned long
NextProcessorNumber
0x0148:0x1Funsigned long
SharedReadyQueue
0x014Cstruct _KAPC_STATE
SavedApcState
void *
Win32Thread
struct _KAPC_STATE *[2]
ApcStatePointer
volatile struct _GROUP_AFFINITY
UserAffinity
volatile unsigned long
DeferredProcessor
long
QueuePriority
0x014Cuint8_t[6]
UserAffinityFill
0x014Fchar
FreezeCount
0x0150struct _KTRAP_FRAME *
TrapFrame
char
SuspendCount
struct _KPROCESS *
Process
struct _KPROCESS *
Process
0x0151uint8_t
UserIdealProcessor
0x0152uint8_t
CalloutActive
char
PreviousMode
0x0153uint8_t
Iopl
char
BasePriority
0x0154unsigned long
KernelTime
void *
Win32Thread
struct _KAPC_STATE
SavedApcState
volatile struct _GROUP_AFFINITY
Affinity
char
PriorityDecrement
volatile struct _GROUP_AFFINITY
UserAffinity
struct _GROUP_AFFINITY
UserAffinity
0x0154uint8_t[23]
SavedApcStateFill
uint8_t
ForegroundBoost
uint8_t[6]
UserAffinityFill
0x0154:0x04uint8_t
UnusualBoost
0x0155uint8_t
Preempted
0x0156uint8_t
AdjustReason
0x0157char
AdjustIncrement
0x0158unsigned long
UserTime
void *
StackBase
volatile struct _GROUP_AFFINITY
Affinity
0x0158uint8_t[6]
AffinityFill
0x015Achar
PreviousMode
0x015Bchar
BasePriority
0x015Cvoid *
StackBase
struct _KAPC
SuspendApc
char
PriorityDecrement
0x015Cuint8_t[1]
SuspendApcFill0
uint8_t
ForegroundBoost
0x015Cuint8_t[3]
SuspendApcFill1
0x015Cuint8_t[4]
SuspendApcFill2
0x015Cuint8_t[36]
SuspendApcFill3
0x015Cuint8_t[40]
SuspendApcFill4
0x015Cuint8_t[47]
SuspendApcFill5
0x015C:0x04uint8_t
UnusualBoost
0x015Dchar
Quantum
uint8_t
Preempted
0x015Euint8_t
ApcStateIndex
uint8_t
AdjustReason
0x015Fuint8_t
QuantumReset
uint8_t
WaitBlockCount
char
AdjustIncrement
0x0160struct _KAPC
SuspendApc
unsigned long
KernelTime
unsigned long
IdealProcessor
volatile struct _GROUP_AFFINITY
Affinity
struct _GROUP_AFFINITY
Affinity
unsigned long
AffinityVersion
0x0160uint8_t[6]
AffinityFill
0x0164uint8_t
Alertable
unsigned long
UserIdealProcessor
struct _KAPC_STATE *[2]
ApcStatePointer
struct _GROUP_AFFINITY
Affinity
0x0164uint8_t[6]
AffinityFill
0x0165uint8_t
ApcStateIndex
0x0166uint8_t
ApcQueueable
uint8_t
ApcStateIndex
0x0167uint8_t
AutoAlignment
uint8_t
WaitBlockCount
0x0168void *
StackBase
struct _KAPC_STATE *[2]
ApcStatePointer
unsigned long
IdealProcessor
0x016Auint8_t
ApcStateIndex
0x016Bchar
FreezeCount
uint8_t
Spare02
uint8_t
WaitBlockCount
0x016Cstruct _KAPC
SuspendApc
char
SuspendCount
struct _KAPC_STATE
SavedApcState
struct _KAPC_STATE *[2]
ApcStatePointer
unsigned long
IdealProcessor
0x016Cuint8_t[23]
SavedApcStateFill
0x016Duint8_t
UserIdealProcessor
0x016Euint8_t
Spare03
0x016Fuint8_t
Iopl
uint8_t
OtherPlatformFill
0x0170void * volatile
Win32Thread
struct _KAPC_STATE
SavedApcState
unsigned long[1]
Spare15
0x0170uint8_t[23]
SavedApcStateFill
0x0174void *
StackBase
struct _KAPC_STATE
SavedApcState
0x0174uint8_t[23]
SavedApcStateFill
0x0178struct _KAPC
SuspendApc
0x0178uint8_t[1]
SuspendApcFill0
0x0178uint8_t[3]
SuspendApcFill1
0x0178uint8_t[4]
SuspendApcFill2
0x0178uint8_t[36]
SuspendApcFill3
0x0178uint8_t[40]
SuspendApcFill4
0x0178uint8_t[47]
SuspendApcFill5
0x0179char
Spare04
0x017Buint8_t
QuantumReset
0x017Cunsigned long
KernelTime
0x0180void *
TlsArray
0x0183uint8_t
WaitReason
0x0184void *
LegoData
char
SuspendCount
0x0185char
Saturation
0x0186uint16_t
SListFaultCount
0x0187uint8_t
WaitReason
0x0188char
SuspendCount
struct _KAPC
SchedulerApc
0x0188uint8_t[1]
SchedulerApcFill0
0x0188uint8_t[3]
SchedulerApcFill1
0x0188uint8_t[4]
SchedulerApcFill2
0x0188uint8_t[36]
SchedulerApcFill3
0x0188uint8_t[40]
SchedulerApcFill4
0x0188uint8_t[47]
SchedulerApcFill5
0x0189char
Spare1
uint8_t
ResourceIndex
0x018Auint8_t
OtherPlatformFill
0x018Buint8_t
PowerState
uint8_t
QuantumReset
uint8_t
WaitReason
0x018Cunsigned long
UserTime
void * volatile
Win32Thread
unsigned long
KernelTime
char
SuspendCount
0x018Dchar
Saturation
0x018Euint16_t
SListFaultCount
0x0190struct _KSEMAPHORE
SuspendSemaphore
struct _KSEMAPHORE
SuspendSemaphore
void *
StackBase
struct _KAPC
SchedulerApc
0x0190uint8_t[20]
SuspendSemaphorefill
uint8_t[1]
SchedulerApcFill0
0x0190uint8_t[3]
SchedulerApcFill1
0x0190uint8_t[4]
SchedulerApcFill2
0x0190uint8_t[36]
SchedulerApcFill3
0x0190uint8_t[40]
SchedulerApcFill4
0x0190uint8_t[47]
SchedulerApcFill5
0x0191uint8_t
ResourceIndex
0x0193uint8_t
QuantumReset
0x0194struct _KAPC
SuspendApc
unsigned long
KernelTime
0x0194uint8_t[1]
SuspendApcFill0
0x0194uint8_t[3]
SuspendApcFill1
0x0194uint8_t[4]
SuspendApcFill2
0x0194uint8_t[36]
SuspendApcFill3
0x0194uint8_t[40]
SuspendApcFill4
0x0194uint8_t[47]
SuspendApcFill5
0x0195uint8_t
ResourceIndex
0x0197uint8_t
QuantumReset
0x0198unsigned long
KernelTime
0x019Cstruct _KSEMAPHORE
SuspendSemaphore
struct _KPRCB *
WaitPrcb
0x01A0void *
LegoData
0x01A4void *
TlsArray
unsigned long
SListFaultCount
0x01A7uint8_t
PowerState
0x01A8void *
LegoData
struct _LIST_ENTRY
ThreadListEntry
unsigned long
UserTime
0x01ACstruct _LIST_ENTRY
ThreadListEntry
struct _KSEMAPHORE
SuspendSemaphore
struct _KPRCB * volatile
WaitPrcb
0x01ACuint8_t[20]
SuspendSemaphorefill
0x01B0struct _LIST_ENTRY
ThreadListEntry
void *
SListFaultAddress
void *
LegoData
0x01B4uint8_t
LargeStack
struct _KPRCB * volatile
WaitPrcb
0x01B5uint8_t
PowerState
0x01B6uint8_t
NpxIrql
0x01B7uint8_t
Spare5
uint8_t
CallbackNestingLevel
0x01B8char
FreezeCount
uint8_t
AutoAlignment
struct _KPRCB * volatile
WaitPrcb
unsigned long
UserTime
void *
LegoData
0x01B9char
SuspendCount
uint8_t
Iopl
0x01BAuint8_t
IdealProcessor
char
FreezeCount
0x01BBuint8_t
DisableBoost
char
SuspendCount
0x01BCuint8_t[1]
Spare0
void *
LegoData
struct _KEVENT
SuspendEvent
0x01BDuint8_t
UserIdealProcessor
0x01BEvolatile uint8_t
DeferredProcessor
0x01BFuint8_t
AdjustReason
uint8_t
CallbackNestingLevel
0x01C0char
AdjustIncrement
unsigned long
SListFaultCount
unsigned long
UserTime
0x01C1uint8_t[3]
Spare2
0x01C3uint8_t
LargeStack
0x01C4struct _LIST_ENTRY
ThreadListEntry
unsigned long
UserTime
struct _KEVENT
SuspendEvent
0x01C8struct _KSEMAPHORE
SuspendSemaphore
0x01C8uint8_t[20]
SuspendSemaphorefill
0x01CCstruct _LIST_ENTRY
MutantListHead
struct _LIST_ENTRY
ThreadListEntry
0x01D4void *
SListFaultAddress
struct _LIST_ENTRY
MutantListHead
struct _LIST_ENTRY
ThreadListEntry
0x01D8void * volatile
MdlForLockedTeb
0x01DCunsigned long
SListFaultCount
struct _LIST_ENTRY
MutantListHead
0x01E0struct _LIST_ENTRY
ThreadListEntry
0x01E4struct _SINGLE_LIST_ENTRY
LockEntriesFreeList
uint8_t
AbEntrySummary
0x01E5uint8_t
AbWaitEntryCount
0x01E6uint16_t
Spare20
0x01E8struct _LIST_ENTRY
MutantListHead
struct _KLOCK_ENTRY[6]
LockEntries
0x01F0void *
SListFaultAddress
0x01F4struct _KTHREAD_COUNTERS *
ThreadCounters
0x01F8struct _XSTATE_SAVE *
XStateSave
0x0308struct _SINGLE_LIST_ENTRY
PropagateBoostsEntry
0x030Cstruct _SINGLE_LIST_ENTRY
IoSelfBoostsEntry
0x0310uint8_t[16]
PriorityFloorCounts
0x0320unsigned long
PriorityFloorSummary
0x0324volatile long
AbCompletedIoBoostCount
0x0328volatile int16_t
AbReferenceCount
volatile int16_t
KeReferenceCount
0x032Auint8_t
AbFreeEntryCount
uint8_t
AbOrphanedEntrySummary
0x032Buint8_t
AbWaitEntryCount
uint8_t
AbOwnedEntryCount
0x032Cunsigned long
ForegroundLossTime
0x0330struct _LIST_ENTRY
GlobalForegroundListEntry
0x0330struct _SINGLE_LIST_ENTRY
ForegroundDpcStackListEntry
0x0334unsigned long
InGlobalForegroundList
0x0338struct _KSCB *
QueuedScb
0x0340uint64_t
NpxState