_MM_SESSION_SPACE

//0x5000 bytes (sizeof) struct _MM_SESSION_SPACE { volatile LONG ReferenceCount; //0x0 union { ULONG LongFlags; //0x4 struct _MM_SESSION_SPACE_FLAGS Flags; //0x4 } u; //0x4 ULONG SessionId; //0x8 volatile LONG ProcessReferenceToSession; //0xc struct _LIST_ENTRY ProcessList; //0x10 ULONGLONG SessionPageDirectoryIndex; //0x20 volatile ULONGLONG NonPagablePages; //0x28 volatile ULONGLONG CommittedPages; //0x30 VOID* PagedPoolStart; //0x38 VOID* PagedPoolEnd; //0x40 VOID* SessionObject; //0x48 VOID* SessionObjectHandle; //0x50 struct _RTL_AVL_TREE ImageTree; //0x58 ULONG LocaleId; //0x60 ULONG AttachCount; //0x64 struct _KGATE AttachGate; //0x68 struct _LIST_ENTRY WsListEntry; //0x80 struct _MM_PAGED_POOL_INFO PagedPoolInfo; //0x90 struct _MMSESSION Session; //0xa8 ULONGLONG CombineDomain; //0xc8 struct _MMSUPPORT_FULL Vm; //0x100 struct _MMWSL_INSTANCE WorkingSetList; //0x240 struct _MMSUPPORT_AGGREGATION AggregateSessionWs; //0x280 VOID* HeapState; //0x2a0 struct _POOL_DESCRIPTOR PagedPool; //0x2c0 struct _MI_SESSION_DRIVER_UNLOAD DriverUnload; //0x3c0 ULONG TopLevelPteLockBits[32]; //0x3c8 struct _MMPTE PageDirectory; //0x448 struct _EX_PUSH_LOCK SessionVaLock; //0x450 struct _RTL_BITMAP_EX DynamicVaBitMap; //0x458 ULONGLONG DynamicVaHint; //0x468 struct _EX_PUSH_LOCK SessionPteLock; //0x470 LONG PoolBigEntriesInUse; //0x478 volatile LONG PagedPoolPdeCount; //0x47c ULONG DynamicSessionPdeCount; //0x480 struct _MI_SYSTEM_PTE_TYPE SystemPteInfo; //0x488 VOID* PoolTrackTableExpansion; //0x4e8 ULONGLONG PoolTrackTableExpansionSize; //0x4f0 VOID* PoolTrackBigPages; //0x4f8 ULONGLONG PoolTrackBigPagesSize; //0x500 struct _RTL_AVL_TREE PermittedFaultsTree; //0x508 enum _IO_SESSION_STATE IoState; //0x510 ULONG IoStateSequence; //0x514 struct _KEVENT IoNotificationEvent; //0x518 struct _EJOB* ServerSilo; //0x530 ULONGLONG CreateTime; //0x538 UCHAR PoolTags[16384]; //0x1000 };

Used in