Geoff Chappell, Software Analyst
With the EPROCESS having all its Flags and Flags2 bits fully in use, Windows 8.1 started a third set:
Mask | Definition | Versions |
---|---|---|
0x00000001 |
ULONG Minimal : 1; |
6.3 and higher |
0x00000002 |
ULONG ReplacingPageRoot : 1; |
10.0 and higher |
0x00000004 |
ULONG DisableNonSystemFonts : 1; |
10.0 and higher |
0x00000008 |
ULONG AuditNonSystemFontLoading : 1; |
10.0 and higher |
0x00000010 |
ULONG Crashed : 1; |
10.0 and higher |
0x00000020 |
ULONG JobVadsAreTracked : 1; |
10.0 and higher |
0x00000040 |
ULONG VadTrackingDisabled : 1; |
10.0 and higher |
0x00000080 |
ULONG AuxiliaryProcess : 1; |
10.0 and higher |
0x00000100 |
ULONG SubsystemProcess : 1; |
10.0 and higher |
0x00000200 |
ULONG IndirectCpuSets : 1; |
10.0 and higher |
0x00000400 |
ULONG InPrivate : 1; |
10.0 and higher |