tag:blogger.com,1999:blog-25032870276989792222024-09-27T04:03:04.535-07:00System Programming / Kernel ModeAnonymoushttp://www.blogger.com/profile/11342328233484559083noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-2503287027698979222.post-78726442708720874612011-11-19T14:48:00.001-08:002011-11-19T15:01:42.410-08:00<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: center;">
<span class="Apple-style-span" style="font-size: 24px; font-weight: bold;">Windows System Call Table (NT/2000/XP/2003/Vista/2008/7/8) </span></div>
<div style="text-align: center;">
<span class="Apple-style-span" style="font-size: 24px; font-weight: bold;"><br /></span></div>
<div>
К сожалению таблица системных вызовов что была <a href="http://dev.metasploit.com/users/opcode/syscalls.html">здесь</a> больше недоступна.. Но появилась новая и немного расширенная <a href="http://j00ru.vexillium.org/ntapi/">http://j00ru.vexillium.org/ntapi/</a> .</div>
<div>
<br /></div>
<div>
Источник <a href="http://j00ru.vexillium.org/?p=1010">Здесь</a>. </div>
<div>
<br /></div>
</div>Anonymoushttp://www.blogger.com/profile/11342328233484559083noreply@blogger.com0tag:blogger.com,1999:blog-2503287027698979222.post-61051344063132277242011-09-06T08:30:00.000-07:002011-09-06T08:30:55.766-07:00Windows Vista EROCESS (build 6002)<div dir="ltr" style="text-align: left;" trbidi="on">
Структура EPROCESS на Windows Vista SP2 (сборка 6002)<div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x000 Pcb : _KPROCESS</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x080 ProcessLock : _EX_PUSH_LOCK</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x088 CreateTime : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x090 ExitTime : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x098 RundownProtect : _EX_RUNDOWN_REF</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x09c UniqueProcessId : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0a0 ActiveProcessLinks : _LIST_ENTRY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0a8 QuotaUsage : [3] Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0b4 QuotaPeak : [3] Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0c0 CommitCharge : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0c4 PeakVirtualSize : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0c8 VirtualSize : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0cc SessionProcessLinks : _LIST_ENTRY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d4 DebugPort : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d8 ExceptionPortData : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d8 ExceptionPortValue : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d8 ExceptionPortState : Pos 0, 3 Bits</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0dc ObjectTable : Ptr32 _HANDLE_TABLE</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0e0 Token : _EX_FAST_REF</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0e4 WorkingSetPage : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0e8 AddressCreationLock : _EX_PUSH_LOCK</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0ec RotateInProgress : Ptr32 _ETHREAD</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f0 ForkInProgress : Ptr32 _ETHREAD</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f4 HardwareTrigger : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f8 PhysicalVadRoot : Ptr32 _MM_AVL_TABLE</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0fc CloneRoot : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x100 NumberOfPrivatePages : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x104 NumberOfLockedPages : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x108 Win32Process : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x10c Job : Ptr32 _EJOB</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x110 SectionObject : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x114 SectionBaseAddress : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x118 QuotaBlock : Ptr32 _EPROCESS_QUOTA_BLOCK</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x11c WorkingSetWatch : Ptr32 _PAGEFAULT_HISTORY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x120 Win32WindowStation : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x124 InheritedFromUniqueProcessId : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x128 LdtInformation : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x12c Spare : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x130 VdmObjects : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x134 DeviceMap : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x138 EtwDataSource : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x13c FreeTebHint : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x140 PageDirectoryPte : _HARDWARE_PTE_X86</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x140 Filler : Uint8B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x148 Session : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x14c ImageFileName : [16] UChar</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x15c JobLinks : _LIST_ENTRY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x164 LockedPagesList : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x168 ThreadListHead : _LIST_ENTRY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x170 SecurityPort : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x174 PaeTop : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x178 ActiveThreads : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x17c ImagePathHash : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x180 DefaultHardErrorProcessing : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x184 LastThreadExitStatus : Int4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x188 Peb : Ptr32 _PEB</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x18c PrefetchTrace : _EX_FAST_REF</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x190 ReadOperationCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x198 WriteOperationCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1a0 OtherOperationCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1a8 ReadTransferCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1b0 WriteTransferCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1b8 OtherTransferCount : _LARGE_INTEGER</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1c0 CommitChargeLimit : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1c4 CommitChargePeak : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1c8 AweInfo : Ptr32 Void</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1cc SeAuditProcessCreationInfo:_SE_AUDIT_PROCESS_CREATION_INFO</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1d0 Vm : _MMSUPPORT</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x218 MmProcessLinks : _LIST_ENTRY</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x220 ModifiedPageCount : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 Flags2 : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 JobNotReallyActive : Pos 0, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 AccountingFolded : Pos 1, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 NewProcessReported : Pos 2, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 ExitProcessReported : Pos 3, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 ReportCommitChanges : Pos 4, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 LastReportMemory : Pos 5, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 ReportPhysicalPageChanges : Pos 6, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 HandleTableRundown : Pos 7, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 NeedsHandleRundown : Pos 8, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 RefTraceEnabled : Pos 9, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 NumaAware : Pos 10, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 ProtectedProcess : Pos 11, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 DefaultPagePriority : Pos 12, 3 Bits</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 PrimaryTokenFrozen : Pos 15, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 ProcessVerifierTarget : Pos 16, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 StackRandomizationDisabled : Pos 17, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 AffinityPermanent : Pos 18, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 AffinityUpdateEnable : Pos 19, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x224 CrossSessionCreate : Pos 20, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 Flags : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 CreateReported : Pos 0, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 NoDebugInherit : Pos 1, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ProcessExiting : Pos 2, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ProcessDelete : Pos 3, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 Wow64SplitPages : Pos 4, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 VmDeleted : Pos 5, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 OutswapEnabled : Pos 6, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 Outswapped : Pos 7, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ForkFailed : Pos 8, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 Wow64VaSpace4Gb : Pos 9, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 AddressSpaceInitialized : Pos 10, 2 Bits</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 SetTimerResolution : Pos 12, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 BreakOnTermination : Pos 13, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 DeprioritizeViews : Pos 14, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 WriteWatch : Pos 15, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ProcessInSession : Pos 16, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 OverrideAddressSpace : Pos 17, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 HasAddressSpace : Pos 18, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 LaunchPrefetched : Pos 19, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 InjectInpageErrors : Pos 20, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 VmTopDown : Pos 21, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ImageNotifyDone : Pos 22, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 PdeUpdateNeeded : Pos 23, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 VdmAllowed : Pos 24, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 SmapAllowed : Pos 25, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ProcessInserted : Pos 26, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 DefaultIoPriority : Pos 27, 3 Bits</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 ProcessSelfDelete : Pos 30, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x228 SpareProcessFlags : Pos 31, 1 Bit</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x22c ExitStatus : Int4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x230 Spare7 : Uint2B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x232 SubSystemMinorVersion : UChar</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x233 SubSystemMajorVersion : UChar</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x232 SubSystemVersion : Uint2B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x234 PriorityClass : UChar</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x238 VadRoot : _MM_AVL_TABLE</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x258 Cookie : Uint4B</span></div>
<div>
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x25c AlpcContext : _ALPC_PROCESS_CONTEXT</span></div>
</div>
</div>
Anonymoushttp://www.blogger.com/profile/11342328233484559083noreply@blogger.com0tag:blogger.com,1999:blog-2503287027698979222.post-29944773324781953352011-09-06T04:19:00.000-07:002011-09-06T04:19:35.958-07:00Win 7 EPROCESS (build 7600)<div dir="ltr" style="text-align: left;" trbidi="on">Структура EPROCESS на Windows 7 (сборка 7600)<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;"><br />
</span><br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;"></span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x000 Pcb : _KPROCESS</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x098 ProcessLock : _EX_PUSH_LOCK</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0a0 CreateTime : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0a8 ExitTime : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0b0 RundownProtect : _EX_RUNDOWN_REF</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0b4 UniqueProcessId : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0b8 ActiveProcessLinks : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0c0 ProcessQuotaUsage : [2] Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0c8 ProcessQuotaPeak : [2] Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d0 CommitCharge : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d4 QuotaBlock : Ptr32 _EPROCESS_QUOTA_BLOCK</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0d8 CpuQuotaBlock : Ptr32 _PS_CPU_QUOTA_BLOCK</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0dc PeakVirtualSize : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0e0 VirtualSize : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0e4 SessionProcessLinks : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0ec DebugPort : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f0 ExceptionPortData : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f0 ExceptionPortValue : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f0 ExceptionPortState : Pos 0, 3 Bits</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f4 ObjectTable : Ptr32 _HANDLE_TABLE</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0f8 Token : _EX_FAST_REF</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x0fc WorkingSetPage : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x100 AddressCreationLock : _EX_PUSH_LOCK</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x104 RotateInProgress : Ptr32 _ETHREAD</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x108 ForkInProgress : Ptr32 _ETHREAD</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x10c HardwareTrigger : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x110 PhysicalVadRoot : Ptr32 _MM_AVL_TABLE</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x114 CloneRoot : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x118 NumberOfPrivatePages : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x11c NumberOfLockedPages : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x120 Win32Process : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x124 Job : Ptr32 _EJOB</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x128 SectionObject : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x12c SectionBaseAddress : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x130 Cookie : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x134 Spare8 : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x138 WorkingSetWatch : Ptr32 _PAGEFAULT_HISTORY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x13c Win32WindowStation : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x140 InheritedFromUniqueProcessId : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x144 LdtInformation : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x148 VdmObjects : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x14c ConsoleHostProcess : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x150 DeviceMap : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x154 EtwDataSource : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x158 FreeTebHint : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x160 PageDirectoryPte : _HARDWARE_PTE_X86</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x160 Filler : Uint8B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x168 Session : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x16c ImageFileName : [15] UChar</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x17b PriorityClass : UChar</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x17c JobLinks : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x184 LockedPagesList : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x188 ThreadListHead : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x190 SecurityPort : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x194 PaeTop : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x198 ActiveThreads : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x19c ImagePathHash : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1a0 DefaultHardErrorProcessing : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1a4 LastThreadExitStatus : Int4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1a8 Peb : Ptr32 _PEB</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1ac PrefetchTrace : _EX_FAST_REF</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1b0 ReadOperationCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1b8 WriteOperationCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1c0 OtherOperationCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1c8 ReadTransferCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1d0 WriteTransferCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1d8 OtherTransferCount : _LARGE_INTEGER</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1e0 CommitChargeLimit : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1e4 CommitChargePeak : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1e8 AweInfo : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1ec SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x1f0 Vm : _MMSUPPORT</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x25c MmProcessLinks : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x264 HighestUserAddress : Ptr32 Void</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x268 ModifiedPageCount : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c Flags2 : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c JobNotReallyActive : Pos 0, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c AccountingFolded : Pos 1, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c NewProcessReported : Pos 2, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ExitProcessReported : Pos 3, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ReportCommitChanges : Pos 4, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c LastReportMemory : Pos 5, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ReportPhysicalPageChanges : Pos 6, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c HandleTableRundown : Pos 7, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c NeedsHandleRundown : Pos 8, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c RefTraceEnabled : Pos 9, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c NumaAware : Pos 10, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ProtectedProcess : Pos 11, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c DefaultPagePriority : Pos 12, 3 Bits</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c PrimaryTokenFrozen : Pos 15, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ProcessVerifierTarget : Pos 16, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c StackRandomizationDisabled : Pos 17, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c AffinityPermanent : Pos 18, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c AffinityUpdateEnable : Pos 19, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c PropagateNode : Pos 20, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x26c ExplicitAffinity : Pos 21, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 Flags : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 CreateReported : Pos 0, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 NoDebugInherit : Pos 1, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ProcessExiting : Pos 2, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ProcessDelete : Pos 3, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 Wow64SplitPages : Pos 4, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 VmDeleted : Pos 5, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 OutswapEnabled : Pos 6, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 Outswapped : Pos 7, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ForkFailed : Pos 8, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 Wow64VaSpace4Gb : Pos 9, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 AddressSpaceInitialized : Pos 10, 2 Bits</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 SetTimerResolution : Pos 12, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 BreakOnTermination : Pos 13, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 DeprioritizeViews : Pos 14, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 WriteWatch : Pos 15, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ProcessInSession : Pos 16, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 OverrideAddressSpace : Pos 17, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 HasAddressSpace : Pos 18, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 LaunchPrefetched : Pos 19, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 InjectInpageErrors : Pos 20, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 VmTopDown : Pos 21, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ImageNotifyDone : Pos 22, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 PdeUpdateNeeded : Pos 23, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 VdmAllowed : Pos 24, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 CrossSessionCreate : Pos 25, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ProcessInserted : Pos 26, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 DefaultIoPriority : Pos 27, 3 Bits</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 ProcessSelfDelete : Pos 30, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x270 SetTimerResolutionLink : Pos 31, 1 Bit</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x274 ExitStatus : Int4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x278 VadRoot : _MM_AVL_TABLE</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x298 AlpcContext : _ALPC_PROCESS_CONTEXT</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x2a8 TimerResolutionLink : _LIST_ENTRY</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x2b0 RequestedTimerResolution : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x2b4 ActiveThreadsHighWatermark : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x2b8 SmallestTimerResolution : Uint4B</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">+0x2bc TimerResolutionStackRecord : Ptr32 _PO_DIAG_STACK_RECORD</span><br />
<div><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;"><br />
</span></div><br />
<div><br />
</div></div>Anonymoushttp://www.blogger.com/profile/11342328233484559083noreply@blogger.com0