Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447

struct _EPROCESS
   +0000 Pcb              : _KPROCESS
   +0078 ProcessLock      : _EX_PUSH_LOCK
   +0080 CreateTime       : _LARGE_INTEGER
   +0088 ExitTime         : _LARGE_INTEGER
   +0090 RundownProtect   : _EX_RUNDOWN_REF
   +0094 UniqueProcessId  : Ptr32 Void
   +0098 ActiveProcessLinks : _LIST_ENTRY
   +00a0 QuotaUsage       : [3] Uint4B
   +00ac QuotaPeak        : [3] Uint4B
   +00b8 CommitCharge     : Uint4B
   +00bc PeakVirtualSize  : Uint4B
   +00c0 VirtualSize      : Uint4B
   +00c4 SessionProcessLinks : _LIST_ENTRY
   +00cc DebugPort        : Ptr32 Void
   +00d0 ExceptionPort    : Ptr32 Void
   +00d4 ObjectTable      : Ptr32 _HANDLE_TAB
   +00d8 Token            : _EX_FAST_REF
   +00dc WorkingSetPage   : Uint4B
   +00e0 AddressCreationLock : _KGUARDED_MUTE
   +0100 HyperSpaceLock   : Uint4B
   +0104 ForkInProgress   : Ptr32 _ETHREAD
   +0108 HardwareTrigger  : Uint4B
   +010c PhysicalVadRoot  : Ptr32 _MM_AVL_TAB
   +0110 CloneRoot        : Ptr32 Void
   +0114 NumberOfPrivatePages : Uint4B
   +0118 NumberOfLockedPages : Uint4B
   +011c Win32Process     : Ptr32 Void
   +0120 Job              : Ptr32 _EJOB
   +0124 SectionObject    : Ptr32 Void
   +0128 SectionBaseAddress : Ptr32 Void
   +012c QuotaBlock       : Ptr32 _EPROCESS_Q
   +0130 WorkingSetWatch  : Ptr32 _PAGEFAULT_
   +0134 Win32WindowStation : Ptr32 Void
   +0138 InheritedFromUniqueProcessId : Ptr32
   +013c LdtInformation   : Ptr32 Void
   +0140 VadFreeHint      : Ptr32 Void
   +0144 VdmObjects       : Ptr32 Void
   +0148 DeviceMap        : Ptr32 Void
   +014c Spare0           : [3] Ptr32 Void
   +0158 PageDirectoryPte : _HARDWARE_PTE
   +0158 Filler           : Uint8B
   +0160 Session          : Ptr32 Void
   +0164 ImageFileName    : [16] UChar
   +0174 JobLinks         : _LIST_ENTRY
   +017c LockedPagesList  : Ptr32 Void
   +0180 ThreadListHead   : _LIST_ENTRY
   +0188 SecurityPort     : Ptr32 Void
   +018c PaeTop           : Ptr32 Void
   +0190 ActiveThreads    : Uint4B
   +0194 GrantedAccess    : Uint4B
   +0198 DefaultHardErrorProcessing : Uint4B
   +019c LastThreadExitStatus : Int4B
   +01a0 Peb              : Ptr32 _PEB
   +01a4 PrefetchTrace    : _EX_FAST_REF
   +01a8 ReadOperationCount : _LARGE_INTEGER
   +01b0 WriteOperationCount : _LARGE_INTEGER
   +01b8 OtherOperationCount : _LARGE_INTEGER
   +01c0 ReadTransferCount : _LARGE_INTEGER
   +01c8 WriteTransferCount : _LARGE_INTEGER
   +01d0 OtherTransferCount : _LARGE_INTEGER
   +01d8 CommitChargeLimit : Uint4B
   +01dc CommitChargePeak : Uint4B
   +01e0 AweInfo          : Ptr32 Void
   +01e4 SeAuditProcessCreationInfo : _SE_AUD
   +01e8 Vm               : _MMSUPPORT
   +0230 MmProcessLinks   : _LIST_ENTRY
   +0238 ModifiedPageCount : Uint4B
   +023c JobStatus        : Uint4B
   +0240 Flags            : Uint4B
   +0240 CreateReported   : Pos 0, 1 Bit
   +0240 NoDebugInherit   : Pos 1, 1 Bit
   +0240 ProcessExiting   : Pos 2, 1 Bit
   +0240 ProcessDelete    : Pos 3, 1 Bit
   +0240 Wow64SplitPages  : Pos 4, 1 Bit
   +0240 VmDeleted        : Pos 5, 1 Bit
   +0240 OutswapEnabled   : Pos 6, 1 Bit
   +0240 Outswapped       : Pos 7, 1 Bit
   +0240 ForkFailed       : Pos 8, 1 Bit
   +0240 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0240 AddressSpaceInitialized : Pos 10, 2
   +0240 SetTimerResolution : Pos 12, 1 Bit
   +0240 BreakOnTermination : Pos 13, 1 Bit
   +0240 SessionCreationUnderway : Pos 14, 1
   +0240 WriteWatch       : Pos 15, 1 Bit
   +0240 ProcessInSession : Pos 16, 1 Bit
   +0240 OverrideAddressSpace : Pos 17, 1 Bit
   +0240 HasAddressSpace  : Pos 18, 1 Bit
   +0240 LaunchPrefetched : Pos 19, 1 Bit
   +0240 InjectInpageErrors : Pos 20, 1 Bit
   +0240 VmTopDown        : Pos 21, 1 Bit
   +0240 ImageNotifyDone  : Pos 22, 1 Bit
   +0240 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0240 VdmAllowed       : Pos 24, 1 Bit
   +0240 SmapAllowed      : Pos 25, 1 Bit
   +0240 CreateFailed     : Pos 26, 1 Bit
   +0240 DefaultIoPriority : Pos 27, 3 Bits
   +0240 Spare1           : Pos 30, 1 Bit
   +0240 Spare2           : Pos 31, 1 Bit
   +0244 ExitStatus       : Int4B
   +0248 NextPageColor    : Uint2B
   +024a SubSystemMinorVersion : UChar
   +024b SubSystemMajorVersion : UChar
   +024a SubSystemVersion : Uint2B
   +024c PriorityClass    : UChar
   +0250 VadRoot          : _MM_AVL_TABLE
   +0270 Cookie           : Uint4B



struct _ETHREAD
   +0000 Tcb              : _KTHREAD
   +01b8 CreateTime       : _LARGE_INTEGER
   +01c0 ExitTime         : _LARGE_INTEGER
   +01c0 LpcReplyChain    : _LIST_ENTRY
   +01c0 KeyedWaitChain   : _LIST_ENTRY
   +01c8 ExitStatus       : Int4B
   +01c8 OfsChain         : Ptr32 Void
   +01cc PostBlockList    : _LIST_ENTRY
   +01d4 TerminationPort  : Ptr32 _TERMINATION_PORT
   +01d4 ReaperLink       : Ptr32 _ETHREAD
   +01d4 KeyedWaitValue   : Ptr32 Void
   +01d8 ActiveTimerListLock : Uint4B
   +01dc ActiveTimerListHead : _LIST_ENTRY
   +01e4 Cid              : _CLIENT_ID
   +01ec LpcReplySemaphore : _KSEMAPHORE
   +01ec KeyedWaitSemaphore : _KSEMAPHORE
   +0200 LpcReplyMessage  : Ptr32 Void
   +0200 LpcWaitingOnPort : Ptr32 Void
   +0204 ImpersonationInfo : Ptr32 _PS_IMPERSONATION_INFORMATION
   +0208 IrpList          : _LIST_ENTRY
   +0210 TopLevelIrp      : Uint4B
   +0214 DeviceToVerify   : Ptr32 _DEVICE_OBJECT
   +0218 ThreadsProcess   : Ptr32 _EPROCESS
   +021c StartAddress     : Ptr32 Void
   +0220 Win32StartAddress : Ptr32 Void
   +0220 LpcReceivedMessageId : Uint4B
   +0224 ThreadListEntry  : _LIST_ENTRY
   +022c RundownProtect   : _EX_RUNDOWN_REF
   +0230 ThreadLock       : _EX_PUSH_LOCK
   +0234 LpcReplyMessageId : Uint4B
   +0238 ReadClusterSize  : Uint4B
   +023c GrantedAccess    : Uint4B
   +0240 CrossThreadFlags : Uint4B
   +0240 Terminated       : Pos 0, 1 Bit
   +0240 DeadThread       : Pos 1, 1 Bit
   +0240 HideFromDebugger : Pos 2, 1 Bit
   +0240 ActiveImpersonationInfo : Pos 3, 1 Bit
   +0240 SystemThread     : Pos 4, 1 Bit
   +0240 HardErrorsAreDisabled : Pos 5, 1 Bit
   +0240 BreakOnTermination : Pos 6, 1 Bit
   +0240 SkipCreationMsg  : Pos 7, 1 Bit
   +0240 SkipTerminationMsg : Pos 8, 1 Bit
   +0244 SameThreadPassiveFlags : Uint4B
   +0244 ActiveExWorker   : Pos 0, 1 Bit
   +0244 ExWorkerCanWaitUser : Pos 1, 1 Bit
   +0244 MemoryMaker      : Pos 2, 1 Bit
   +0244 KeyedEventInUse  : Pos 3, 1 Bit
   +0248 SameThreadApcFlags : Uint4B
   +0248 LpcReceivedMsgIdValid : Pos 0, 1 Bit
   +0248 LpcExitThreadCalled : Pos 1, 1 Bit
   +0248 AddressSpaceOwner : Pos 2, 1 Bit
   +0248 OwnsProcessWorkingSetExclusive : Pos 3, 1 Bit
   +0248 OwnsProcessWorkingSetShared : Pos 4, 1 Bit
   +0248 OwnsSystemWorkingSetExclusive : Pos 5, 1 Bit
   +0248 OwnsSystemWorkingSetShared : Pos 6, 1 Bit
   +0248 OwnsSessionWorkingSetExclusive : Pos 7, 1 Bit
   +0249 OwnsSessionWorkingSetShared : Pos 0, 1 Bit
   +0249 ApcNeeded        : Pos 1, 1 Bit
   +024c ForwardClusterOnly : UChar
   +024d DisablePageFaultClustering : UChar
   +024e ActiveFaultCount : UChar

