_KPROCESS

//0x438 bytes (sizeof) struct _KPROCESS { struct _DISPATCHER_HEADER Header; //0x0 struct _LIST_ENTRY ProfileListHead; //0x18 ULONGLONG DirectoryTableBase; //0x28 struct _LIST_ENTRY ThreadListHead; //0x30 ULONG ProcessLock; //0x40 ULONG ProcessTimerDelay; //0x44 ULONGLONG DeepFreezeStartTime; //0x48 struct _KAFFINITY_EX Affinity; //0x50 struct _LIST_ENTRY ReadyListHead; //0x158 struct _SINGLE_LIST_ENTRY SwapListEntry; //0x168 volatile struct _KAFFINITY_EX ActiveProcessors; //0x170 union { struct { ULONG AutoAlignment:1; //0x278 ULONG DisableBoost:1; //0x278 ULONG DisableQuantum:1; //0x278 ULONG DeepFreeze:1; //0x278 ULONG TimerVirtualization:1; //0x278 ULONG CheckStackExtents:1; //0x278 ULONG CacheIsolationEnabled:1; //0x278 ULONG PpmPolicy:4; //0x278 ULONG VaSpaceDeleted:1; //0x278 ULONG MultiGroup:1; //0x278 ULONG ReservedFlags:19; //0x278 }; volatile LONG ProcessFlags; //0x278 }; ULONG ActiveGroupsMask; //0x27c CHAR BasePriority; //0x280 CHAR QuantumReset; //0x281 CHAR Visited; //0x282 union _KEXECUTE_OPTIONS Flags; //0x283 USHORT ThreadSeed[32]; //0x284 USHORT IdealProcessor[32]; //0x2c4 USHORT IdealNode[32]; //0x304 USHORT IdealGlobalNode; //0x344 USHORT Spare1; //0x346 unionvolatile _KSTACK_COUNT StackCount; //0x348 struct _LIST_ENTRY ProcessListEntry; //0x350 ULONGLONG CycleTime; //0x360 ULONGLONG ContextSwitches; //0x368 struct _KSCHEDULING_GROUP* SchedulingGroup; //0x370 ULONG FreezeCount; //0x378 ULONG KernelTime; //0x37c ULONG UserTime; //0x380 ULONG ReadyTime; //0x384 ULONGLONG UserDirectoryTableBase; //0x388 UCHAR AddressPolicy; //0x390 UCHAR Spare2[71]; //0x391 VOID* InstrumentationCallback; //0x3d8 union { ULONGLONG SecureHandle; //0x3e0 struct { ULONGLONG SecureProcess:1; //0x3e0 ULONGLONG Unused:1; //0x3e0 } Flags; //0x3e0 } SecureState; //0x3e0 ULONGLONG KernelWaitTime; //0x3e8 ULONGLONG UserWaitTime; //0x3f0 ULONGLONG LastRebalanceQpc; //0x3f8 VOID* PerProcessorCycleTimes; //0x400 ULONGLONG ExtendedFeatureDisableMask; //0x408 USHORT PrimaryGroup; //0x410 USHORT Spare3[3]; //0x412 VOID* UserCetLogging; //0x418 struct _LIST_ENTRY CpuPartitionList; //0x420 ULONGLONG EndPadding[1]; //0x430 };