Min version8 Pre RTM8 Pre RTM8.1 Update 110 TH2
Max version810
x86 offset
offset:bitpos
Field Name
0x0000uint8_t
InheritedAddressSpace
0x0001uint8_t
ReadImageFileExecOptions
0x0002uint8_t
BeingDebugged
0x0003uint8_t
BitField
0x0003:0x00uint8_t
ImageUsesLargePages
0x0003:0x01uint8_t
IsProtectedProcess
0x0003:0x02uint8_t
IsLegacyProcess
uint8_t
IsImageDynamicallyRelocated
0x0003:0x03uint8_t
IsImageDynamicallyRelocated
uint8_t
SkipPatchingUser32Forwarders
0x0003:0x04uint8_t
SkipPatchingUser32Forwarders
uint8_t
IsPackagedProcess
0x0003:0x05uint8_t
SpareBits
uint8_t
IsPackagedProcess
uint8_t
IsAppContainer
0x0003:0x06uint8_t
IsAppContainer
uint8_t
IsProtectedProcessLight
0x0003:0x07uint8_t
SpareBits
0x0004unsigned long
Mutant
0x0008unsigned long
ImageBaseAddress
0x000Cunsigned long
Ldr
0x0010unsigned long
ProcessParameters
0x0014unsigned long
SubSystemData
0x0018unsigned long
ProcessHeap
0x001Cunsigned long
FastPebLock
0x0020unsigned long
AtlThunkSListPtr
0x0024unsigned long
IFEOKey
0x0028unsigned long
CrossProcessFlags
0x0028:0x00unsigned long
ProcessInJob
0x0028:0x01unsigned long
ProcessInitializing
0x0028:0x02unsigned long
ProcessUsingVEH
0x0028:0x03unsigned long
ProcessUsingVCH
0x0028:0x04unsigned long
ProcessUsingFTH
0x0028:0x05unsigned long
ReservedBits0
0x002Cunsigned long
KernelCallbackTable
0x002Cunsigned long
UserSharedInfoPtr
0x0030unsigned long[1]
SystemReserved
0x0034unsigned long
AtlThunkSListPtr32
0x0038unsigned long
ApiSetMap
0x003Cunsigned long
TlsExpansionCounter
0x0040unsigned long
TlsBitmap
0x0044unsigned long[2]
TlsBitmapBits
0x004Cunsigned long
ReadOnlySharedMemoryBase
0x0050unsigned long
HotpatchInformation
unsigned long
SparePvoid0
0x0054unsigned long
ReadOnlyStaticServerData
0x0058unsigned long
AnsiCodePageData
0x005Cunsigned long
OemCodePageData
0x0060unsigned long
UnicodeCaseTableData
0x0064unsigned long
NumberOfProcessors
0x0068unsigned long
NtGlobalFlag
0x0070union _LARGE_INTEGER
CriticalSectionTimeout
0x0078unsigned long
HeapSegmentReserve
0x007Cunsigned long
HeapSegmentCommit
0x0080unsigned long
HeapDeCommitTotalFreeThreshold
0x0084unsigned long
HeapDeCommitFreeBlockThreshold
0x0088unsigned long
NumberOfHeaps
0x008Cunsigned long
MaximumNumberOfHeaps
0x0090unsigned long
ProcessHeaps
0x0094unsigned long
GdiSharedHandleTable
0x0098unsigned long
ProcessStarterHelper
0x009Cunsigned long
GdiDCAttributeList
0x00A0unsigned long
LoaderLock
0x00A4unsigned long
OSMajorVersion
0x00A8unsigned long
OSMinorVersion
0x00ACuint16_t
OSBuildNumber
0x00AEuint16_t
OSCSDVersion
0x00B0unsigned long
OSPlatformId
0x00B4unsigned long
ImageSubsystem
0x00B8unsigned long
ImageSubsystemMajorVersion
0x00BCunsigned long
ImageSubsystemMinorVersion
0x00C0unsigned long
ActiveProcessAffinityMask
0x00C4unsigned long[34]
GdiHandleBuffer
0x014Cunsigned long
PostProcessInitRoutine
0x0150unsigned long
TlsExpansionBitmap
0x0154unsigned long[32]
TlsExpansionBitmapBits
0x01D4unsigned long
SessionId
0x01D8union _ULARGE_INTEGER
AppCompatFlags
0x01E0union _ULARGE_INTEGER
AppCompatFlagsUser
0x01E8unsigned long
pShimData
0x01ECunsigned long
AppCompatInfo
0x01F0struct _STRING32
CSDVersion
0x01F8unsigned long
ActivationContextData
0x01FCunsigned long
ProcessAssemblyStorageMap
0x0200unsigned long
SystemDefaultActivationContextData
0x0204unsigned long
SystemAssemblyStorageMap
0x0208unsigned long
MinimumStackCommit
0x020Cunsigned long
FlsCallback
0x0210struct LIST_ENTRY32
FlsListHead
0x0218unsigned long
FlsBitmap
0x021Cunsigned long[4]
FlsBitmapBits
0x022Cunsigned long
FlsHighIndex
0x0230unsigned long
WerRegistrationData
0x0234unsigned long
WerShipAssertPtr
0x0238unsigned long
pUnused
0x023Cunsigned long
pImageHeaderHash
0x0240unsigned long
TracingFlags
0x0240:0x00unsigned long
HeapTracingEnabled
0x0240:0x01unsigned long
CritSecTracingEnabled
0x0240:0x02unsigned long
LibLoaderTracingEnabled
0x0240:0x03unsigned long
SpareTracingBits
0x0248uint64_t
CsrServerReadOnlySharedMemoryBase
0x0250unsigned long
TppWorkerpListLock
0x0254struct LIST_ENTRY32
TppWorkerpList
0x025Cunsigned long[128]
WaitOnAddressHashTable