Skip to content

Instantly share code, notes, and snippets.

@HACKE-RC
Created May 31, 2022 13:44
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save HACKE-RC/c60db55e3331aef8125e20a24a9dc26c to your computer and use it in GitHub Desktop.
Save HACKE-RC/c60db55e3331aef8125e20a24a9dc26c to your computer and use it in GitHub Desktop.
The Windows KPROCESS structure.
struct _KPROCESS {
struct _DISPATCHER_HEADER Header;
struct _LIST_ENTRY ProfileListHead;
unsigned int DirectoryTableBase;
unsigned long Asid;
struct _LIST_ENTRY ThreadListHead;
unsigned long ProcessLock;
unsigned long Spare0;
unsigned int DeepFreezeStartTime;
struct _KAFFINITY_EX Affinity;
struct _LIST_ENTRY ReadyListHead;
struct _SINGLE_LIST_ENTRY SwapListEntry;
struct _KAFFINITY_EX ActiveProcessors;
long AutoAlignment : 1;
long DisableBoost : 1;
long DisableQuantum : 1;
unsigned long DeepFreeze : 1;
unsigned long TimerVirtualization : 1;
unsigned long CheckStackExtents : 1;
unsigned long SpareFlags0 : 2;
unsigned long ActiveGroupsMask : 20;
long ReservedFlags : 4;
long ProcessFlags;
char BasePriority;
char QuantumReset;
unsigned int Visited;
union _KEXECUTE_OPTIONS Flags;
unsigned long ThreadSeed[20];
unsigned int IdealNode[20];
unsigned int IdealGlobalNode;
union _KSTACK_COUNT StackCount;
struct _LIST_ENTRY ProcessListEntry;
unsigned int CycleTime;
unsigned int ContextSwitches;
struct _KSCHEDULING_GROUP *SchedulingGroup;
unsigned long FreezeCount;
unsigned long KernelTime;
unsigned long UserTime;
void *InstrumentationCallback;
};
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment