Shared Kernel User Data
TickCountLowDeprecated: ULONGTickCountMultiplier: ULONGInterruptTime: KSYSTEM_TIMESystemTime: KSYSTEM_TIMETimeZoneBias: KSYSTEM_TIMEImageNumberLow: USHORTImageNumberHigh: USHORTNtSystemRoot: [260]WCHARMaxStackTraceDepth: ULONGCryptoExponent: ULONGTimeZoneId: ULONGLargePageMinimum: ULONGAitSamplingValue: ULONGAppCompatFlag: ULONGRNGSeedVersion: ULONGLONGGlobalValidationRunlevel: ULONGTimeZoneBiasStamp: LONGNtBuildNumber: ULONGNtProductType: NT_PRODUCT_TYPEProductTypeIsValid: BOOLEANReserved0: [1]BOOLEANNativeProcessorArchitecture: USHORTNtMajorVersion: ULONGNtMinorVersion: ULONGProcessorFeatures: [PROCESSOR_FEATURE_MAX]BOOLEANReserved1: ULONGReserved3: ULONGTimeSlip: ULONGAlternativeArchitecture: ALTERNATIVE_ARCHITECTURE_TYPEBootId: ULONGSystemExpirationDate: LARGE_INTEGERSuiteMaskY: ULONGKdDebuggerEnabled: BOOLEANDummyUnion1: extern union {
MitigationPolicies: UCHAR,
Alt: packed struct {
NXSupportPolicy: u2,
SEHValidationPolicy: u2,
CurDirDevicesSkippedForDlls: u2,
Reserved: u2,
},
}CyclesPerYield: USHORTActiveConsoleId: ULONGDismountCount: ULONGComPlusPackage: ULONGLastSystemRITEventTickCount: ULONGNumberOfPhysicalPages: ULONGSafeBootMode: BOOLEANDummyUnion2: extern union {
VirtualizationFlags: UCHAR,
Alt: packed struct {
ArchStartedInEl2: u1,
QcSlIsSupported: u1,
SpareBits: u6,
},
}Reserved12: [2]UCHARDummyUnion3: extern union {
SharedDataFlags: ULONG,
Alt: packed struct {
DbgErrorPortPresent: u1,
DbgElevationEnabled: u1,
DbgVirtEnabled: u1,
DbgInstallerDetectEnabled: u1,
DbgLkgEnabled: u1,
DbgDynProcessorEnabled: u1,
DbgConsoleBrokerEnabled: u1,
DbgSecureBootEnabled: u1,
DbgMultiSessionSku: u1,
DbgMultiUsersInSessionSku: u1,
DbgStateSeparationEnabled: u1,
SpareBits: u21,
},
}DataFlagsPad: [1]ULONGTestRetInstruction: ULONGLONGQpcFrequency: LONGLONGSystemCall: ULONGReserved2: ULONGSystemCallPad: [2]ULONGLONGDummyUnion4: extern union {
TickCount: KSYSTEM_TIME,
TickCountQuad: ULONG64,
Alt: extern struct {
ReservedTickCountOverlay: [3]ULONG,
TickCountPad: [1]ULONG,
},
}Cookie: ULONGCookiePad: [1]ULONGConsoleSessionForegroundProcessId: LONGLONGTimeUpdateLock: ULONGLONGBaselineSystemTimeQpc: ULONGLONGBaselineInterruptTimeQpc: ULONGLONGQpcSystemTimeIncrement: ULONGLONGQpcInterruptTimeIncrement: ULONGLONGQpcSystemTimeIncrementShift: UCHARQpcInterruptTimeIncrementShift: UCHARUnparkedProcessorCount: USHORTEnclaveFeatureMask: [4]ULONGTelemetryCoverageRound: ULONGUserModeGlobalLogger: [16]USHORTImageFileExecutionOptions: ULONGLangGenerationCount: ULONGReserved4: ULONGLONGInterruptTimeBias: ULONGLONGQpcBias: ULONGLONGActiveProcessorCount: ULONGActiveGroupCount: UCHARReserved9: UCHARDummyUnion5: extern union {
QpcData: USHORT,
Alt: extern struct {
QpcBypassEnabled: UCHAR,
QpcShift: UCHAR,
},
}TimeZoneBiasEffectiveStart: LARGE_INTEGERTimeZoneBiasEffectiveEnd: LARGE_INTEGERXState: XSTATE_CONFIGURATIONFeatureConfigurationChangeStamp: KSYSTEM_TIMESpare: ULONGUserPointerAuthMask: ULONG64pub const KUSER_SHARED_DATA = extern struct {
TickCountLowDeprecated: ULONG,
TickCountMultiplier: ULONG,
InterruptTime: KSYSTEM_TIME,
SystemTime: KSYSTEM_TIME,
TimeZoneBias: KSYSTEM_TIME,
ImageNumberLow: USHORT,
ImageNumberHigh: USHORT,
NtSystemRoot: [260]WCHAR,
MaxStackTraceDepth: ULONG,
CryptoExponent: ULONG,
TimeZoneId: ULONG,
LargePageMinimum: ULONG,
AitSamplingValue: ULONG,
AppCompatFlag: ULONG,
RNGSeedVersion: ULONGLONG,
GlobalValidationRunlevel: ULONG,
TimeZoneBiasStamp: LONG,
NtBuildNumber: ULONG,
NtProductType: NT_PRODUCT_TYPE,
ProductTypeIsValid: BOOLEAN,
Reserved0: [1]BOOLEAN,
NativeProcessorArchitecture: USHORT,
NtMajorVersion: ULONG,
NtMinorVersion: ULONG,
ProcessorFeatures: [PROCESSOR_FEATURE_MAX]BOOLEAN,
Reserved1: ULONG,
Reserved3: ULONG,
TimeSlip: ULONG,
AlternativeArchitecture: ALTERNATIVE_ARCHITECTURE_TYPE,
BootId: ULONG,
SystemExpirationDate: LARGE_INTEGER,
SuiteMaskY: ULONG,
KdDebuggerEnabled: BOOLEAN,
DummyUnion1: extern union {
MitigationPolicies: UCHAR,
Alt: packed struct {
NXSupportPolicy: u2,
SEHValidationPolicy: u2,
CurDirDevicesSkippedForDlls: u2,
Reserved: u2,
},
},
CyclesPerYield: USHORT,
ActiveConsoleId: ULONG,
DismountCount: ULONG,
ComPlusPackage: ULONG,
LastSystemRITEventTickCount: ULONG,
NumberOfPhysicalPages: ULONG,
SafeBootMode: BOOLEAN,
DummyUnion2: extern union {
VirtualizationFlags: UCHAR,
Alt: packed struct {
ArchStartedInEl2: u1,
QcSlIsSupported: u1,
SpareBits: u6,
},
},
Reserved12: [2]UCHAR,
DummyUnion3: extern union {
SharedDataFlags: ULONG,
Alt: packed struct {
DbgErrorPortPresent: u1,
DbgElevationEnabled: u1,
DbgVirtEnabled: u1,
DbgInstallerDetectEnabled: u1,
DbgLkgEnabled: u1,
DbgDynProcessorEnabled: u1,
DbgConsoleBrokerEnabled: u1,
DbgSecureBootEnabled: u1,
DbgMultiSessionSku: u1,
DbgMultiUsersInSessionSku: u1,
DbgStateSeparationEnabled: u1,
SpareBits: u21,
},
},
DataFlagsPad: [1]ULONG,
TestRetInstruction: ULONGLONG,
QpcFrequency: LONGLONG,
SystemCall: ULONG,
Reserved2: ULONG,
SystemCallPad: [2]ULONGLONG,
DummyUnion4: extern union {
TickCount: KSYSTEM_TIME,
TickCountQuad: ULONG64,
Alt: extern struct {
ReservedTickCountOverlay: [3]ULONG,
TickCountPad: [1]ULONG,
},
},
Cookie: ULONG,
CookiePad: [1]ULONG,
ConsoleSessionForegroundProcessId: LONGLONG,
TimeUpdateLock: ULONGLONG,
BaselineSystemTimeQpc: ULONGLONG,
BaselineInterruptTimeQpc: ULONGLONG,
QpcSystemTimeIncrement: ULONGLONG,
QpcInterruptTimeIncrement: ULONGLONG,
QpcSystemTimeIncrementShift: UCHAR,
QpcInterruptTimeIncrementShift: UCHAR,
UnparkedProcessorCount: USHORT,
EnclaveFeatureMask: [4]ULONG,
TelemetryCoverageRound: ULONG,
UserModeGlobalLogger: [16]USHORT,
ImageFileExecutionOptions: ULONG,
LangGenerationCount: ULONG,
Reserved4: ULONGLONG,
InterruptTimeBias: ULONGLONG,
QpcBias: ULONGLONG,
ActiveProcessorCount: ULONG,
ActiveGroupCount: UCHAR,
Reserved9: UCHAR,
DummyUnion5: extern union {
QpcData: USHORT,
Alt: extern struct {
QpcBypassEnabled: UCHAR,
QpcShift: UCHAR,
},
},
TimeZoneBiasEffectiveStart: LARGE_INTEGER,
TimeZoneBiasEffectiveEnd: LARGE_INTEGER,
XState: XSTATE_CONFIGURATION,
FeatureConfigurationChangeStamp: KSYSTEM_TIME,
Spare: ULONG,
UserPointerAuthMask: ULONG64,
}