process.h

#pragma once
// @todo: requires "kernel.h"; used: KERNEL_USER_TIMES

#pragma pack(push, 8)
#pragma region process_status
using PPS_POST_PROCESS_INIT_ROUTINE = void(NTAPI*)();

using PS_ATTRIBUTE_NUM = enum _PS_ATTRIBUTE_NUM
{
	PsAttributeParentProcess = 0,
	PsAttributeDebugObject = 1,
	PsAttributeToken = 2,
	PsAttributeClientId = 3,
	PsAttributeTebAddress = 4,
	PsAttributeImageName = 5,
	PsAttributeImageInfo = 6,
	PsAttributeMemoryReserve = 7,
	PsAttributePriorityClass = 8,
	PsAttributeErrorMode = 9,
	PsAttributeStdHandleInfo = 10,
	PsAttributeHandleList = 11,
#if Q_NT_VERSION >= Q_NT_WIN7
	PsAttributeGroupAffinity = 12,
	PsAttributePreferredNode = 13,
	PsAttributeIdealProcessor = 14,
	PsAttributeUmsThread = 15,
#if Q_NT_VERSION >= Q_NT_WIN8
	PsAttributeExecuteOptions = 16,
#else
	PsAttributeMitigationOptions = 16,
#endif
#endif
#if Q_NT_VERSION >= Q_NT_WINBLUE
	PsAttributeProtectionLevel = 17,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	PsAttributeSecureProcess = 18,
	PsAttributeJobList = 19,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	PsAttributeChildProcessPolicy = 20,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	PsAttributeAllApplicationPackagesPolicy = 21,
	PsAttributeWin32kFilter = 22,
	PsAttributeSafeOpenPromptOriginClaim = 23,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	PsAttributeBnoIsolation = 24,
	PsAttributeDesktopAppPolicy = 25,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	PsAttributeChpe = 26,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H2
	PsAttributeMitigationAuditOptions = 27,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	PsAttributeMachineType = 28,
	PsAttributeComponentFilter = 29,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	PsAttributeEnableOptionalXStateFeatures = 30,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	PsAttributeSupportedMachines = 31,
	PsAttributeSveVectorLength = 32,
#endif
	PsAttributeMax
};

#define PS_ATTRIBUTE_NUMBER_MASK 0x0000FFFF
#define PS_ATTRIBUTE_THREAD 0x00010000
#define PS_ATTRIBUTE_INPUT 0x00020000
#define PS_ATTRIBUTE_ADDITIVE 0x00040000

_Q_NT_BIT_TEMPLATE struct PS_ATTRIBUTE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::uintptr_t> Attribute; // 0x00
	BitnessType_t<std::size_t> Size; // 0x04 / 0x08
	union
	{
		BitnessType_t<std::uintptr_t> Value;
		BitnessType_t<void*> ValuePtr;
	}; // 0x08 / 0x10
	BitnessType_t<std::size_t*> ReturnLength; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(PS_ATTRIBUTE, 0x10, 0x20);

_Q_NT_BIT_TEMPLATE struct PS_ATTRIBUTE_LIST
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> TotalLength; // 0x0
	PS_ATTRIBUTE<nBitness> Attributes[ANYSIZE_ARRAY]; // 0x4 / 0x8
};

_Q_NT_BIT_TEMPLATE struct PS_MEMORY_RESERVE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> ReserveAddress; // 0x0
	BitnessType_t<std::size_t> ReserveSize; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PS_MEMORY_RESERVE, 0x8, 0x10);

using PS_STD_HANDLE_STATE = enum _PS_STD_HANDLE_STATE
{
	PsNeverDuplicate = 0,
	PsRequestDuplicate = 1,
	PsAlwaysDuplicate = 2,
	PsMaxStdHandleStates = 3
};

struct PS_STD_HANDLE_INFO
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t StdHandleState : 2;
			std::uint32_t PseudoHandleMask : 3;
		};
	}; // 0x0
	std::uint32_t StdHandleSubsystemType; // 0x4
};
static_assert(sizeof(PS_STD_HANDLE_INFO) == 0x8);

using PS_CREATE_STATE = enum _PS_CREATE_STATE : std::int32_t
{
	PsCreateInitialState = 0,
	PsCreateFailOnFileOpen = 1,
	PsCreateFailOnSectionCreate = 2,
	PsCreateFailExeFormat = 3,
	PsCreateFailMachineMismatch = 4,
	PsCreateFailExeName = 5,
	PsCreateSuccess = 6,
	PsCreateMaximumStates = 7
};

_Q_NT_BIT_TEMPLATE struct PS_CREATE_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> Size; // 0x00
	PS_CREATE_STATE State; // 0x04 / 0x08
	union
	{
		struct
		{
			union
			{
				std::uint32_t InitFlags;
				struct
				{
					std::uint8_t WriteOutputOnExit : 1;
					std::uint8_t DetectManifest : 1;
#if Q_NT_VERSION >= Q_NT_WIN8
#if Q_NT_VERSION >= Q_NT_WIN11
					std::uint8_t IFEOSkipRedirects : 1;
#else
					std::uint8_t IFEOSkipDebugger : 1;
#endif
					std::uint8_t IFEODoNotPropagateKeyState : 1;
					std::uint8_t SpareBits1 : 4;
#else
					std::uint8_t SpareBits1 : 6;
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
					std::uint8_t SpareBits2 : 8;
#else
					std::uint8_t IFEOKeyState : 2;
					std::uint8_t SpareBits2 : 6;
#endif
					std::uint16_t ProhibitedImageCharacteristics : 16;
				};
			};
			ACCESS_MASK AdditionalFileAccess;
		} InitState;
		struct
		{
			BitnessType_t<HANDLE> FileHandle;
		} FailSection;
#if Q_NT_VERSION >= Q_NT_WIN8
		struct
		{
			std::uint16_t DllCharacteristics;
		} ExeFormat;
#endif
		struct
		{
			BitnessType_t<HANDLE> IFEOKey;
		} ExeName;
		struct
		{
			union
			{
				std::uint32_t OutputFlags;
				struct
				{
					std::uint8_t ProtectedProcess : 1;
					std::uint8_t AddressSpaceOverride : 1;
					std::uint8_t DevOverrideEnabled : 1;
					std::uint8_t ManifestDetected : 1;
#if Q_NT_VERSION >= Q_NT_WINBLUE
					std::uint8_t ProtectedProcessLight : 1;
					std::uint8_t SpareBits1 : 3;
#else
					std::uint8_t SpareBits1 : 4;
#endif
					std::uint8_t SpareBits2 : 8;
					std::uint16_t SpareBits3 : 16;
				};
			};
			BitnessType_t<HANDLE> FileHandle;
			BitnessType_t<HANDLE> SectionHandle;
			std::uint64_t UserProcessParametersNative;
			std::uint32_t UserProcessParametersWow64;
			std::uint32_t CurrentParameterFlags;
			std::uint64_t PebAddressNative;
			std::uint32_t PebAddressWow64;
			std::uint64_t ManifestAddress;
			std::uint32_t ManifestSize;
		} SuccessState;
	}; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(PS_CREATE_INFO, 0x48, 0x58);

#if Q_NT_VERSION >= Q_NT_WIN7
struct PS_CPU_QUOTA_QUERY_ENTRY
{
	std::uint32_t SessionId; // 0x0
	std::uint32_t Weight; // 0x4
};
static_assert(sizeof(PS_CPU_QUOTA_QUERY_ENTRY) == 0x8);

struct PS_CPU_QUOTA_QUERY_INFORMATION
{
	std::uint32_t SessionCount; // 0x0
	PS_CPU_QUOTA_QUERY_ENTRY SessionInformation[ANYSIZE_ARRAY]; // 0x4
};
#endif

#if Q_NT_VERSION >= Q_NT_WINBLUE
#define PROTECTION_LEVEL_WINTCB_LIGHT		0x00000000
#define PROTECTION_LEVEL_WINDOWS			0x00000001
#define PROTECTION_LEVEL_WINDOWS_LIGHT		0x00000002
#define PROTECTION_LEVEL_ANTIMALWARE_LIGHT	0x00000003
#define PROTECTION_LEVEL_LSA_LIGHT			0x00000004
#define PROTECTION_LEVEL_WINTCB				0x00000005
#define PROTECTION_LEVEL_CODEGEN_LIGHT		0x00000006
#define PROTECTION_LEVEL_AUTHENTICODE		0x00000007
#define PROTECTION_LEVEL_PPL_APP			0x00000008
#define PROTECTION_LEVEL_SAME				0xFFFFFFFF
#define PROTECTION_LEVEL_NONE				0xFFFFFFFE

using PS_PROTECTED_TYPE = enum _PS_PROTECTED_TYPE : std::int32_t
{
	PsProtectedTypeNone = 0,
	PsProtectedTypeProtectedLight = 1,
	PsProtectedTypeProtected = 2,
	PsProtectedTypeMax = 3
};

using PS_PROTECTED_SIGNER = enum _PS_PROTECTED_SIGNER : std::int32_t
{
	PsProtectedSignerNone = 0,
	PsProtectedSignerAuthenticode = 1,
	PsProtectedSignerCodeGen = 2,
	PsProtectedSignerAntimalware = 3,
	PsProtectedSignerLsa = 4,
	PsProtectedSignerWindows = 5,
	PsProtectedSignerWinTcb = 6,
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	PsProtectedSignerWinSystem = 7,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	PsProtectedSignerApp = 8,
#endif
	PsProtectedSignerMax
};

struct PS_PROTECTION
{
	union
	{
		std::uint8_t Level;
		struct
		{
			std::uint8_t Type : 3;
			std::uint8_t Audit : 1;
			std::uint8_t Signer : 4;
		};
	};
};
static_assert(sizeof(PS_PROTECTION) == 0x1);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_TH2
union PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS
{
	std::uint8_t AccessRights;
	struct
	{
		std::uint8_t Trustlet : 1;
		std::uint8_t Ntos : 1;
		std::uint8_t WriteHandle : 1;
		std::uint8_t ReadHandle : 1;
		std::uint8_t Reserved : 4;
	};
};
static_assert(sizeof(PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS) == 0x1);

union PS_TRUSTLET_ATTRIBUTE_TYPE
{
	std::uint32_t AttributeType;
	struct
	{
		std::uint8_t Version;
		std::uint8_t DataCount;
		std::uint8_t SemanticType;
		PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS AccessRights;
	};
};
static_assert(sizeof(PS_TRUSTLET_ATTRIBUTE_TYPE) == 0x4);

struct PS_TRUSTLET_ATTRIBUTE_HEADER
{
	PS_TRUSTLET_ATTRIBUTE_TYPE AttributeType; // 0x0
	struct
	{
		std::uint32_t InstanceNumber : 8;
		std::uint32_t Reserved : 24;
	}; // 0x4
};
static_assert(sizeof(PS_TRUSTLET_ATTRIBUTE_HEADER) == 0x8);

struct PS_TRUSTLET_ATTRIBUTE_DATA
{
	PS_TRUSTLET_ATTRIBUTE_HEADER Header;
	std::uint64_t Data[ANYSIZE_ARRAY];
};

struct PS_TRUSTLET_CREATE_ATTRIBUTES
{
	std::uint64_t TrustletIdentity;
	PS_TRUSTLET_ATTRIBUTE_DATA Attributes[ANYSIZE_ARRAY];
};
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
struct PS_MITIGATION_OPTIONS_MAP
{
	std::uint64_t Map[
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
		3
#else
		2
#endif
	];
};
static_assert(sizeof(PS_MITIGATION_OPTIONS_MAP) == 0x18);

_Q_NT_BIT_TEMPLATE struct PS_BNO_ISOLATION_PARAMETERS
{
private:
	_Q_NT_BIT_TYPE
public:
	UNICODE_STRING<nBitness> IsolationPrefix; // 0x00
	std::uint32_t HandleCount; // 0x08 / 0x10
	BitnessType_t<void**> Handles; // 0x0C / 0x18
	bool IsolationEnabled; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(PS_BNO_ISOLATION_PARAMETERS, 0x14, 0x28);

using PS_MITIGATION_OPTION = enum _PS_MITIGATION_OPTION
{
	PS_MITIGATION_OPTION_NX = 0,
	PS_MITIGATION_OPTION_SEHOP = 1,
	PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES = 2,
	PS_MITIGATION_OPTION_HEAP_TERMINATE = 3,
	PS_MITIGATION_OPTION_BOTTOM_UP_ASLR = 4,
	PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR = 5,
	PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS = 6,
	PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE = 7,
	PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE = 8,
	PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE = 9,
	PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD = 10,
	PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES = 11,
	PS_MITIGATION_OPTION_FONT_DISABLE = 12,
	PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE = 13,
	PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL = 14,
	PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 = 15,
	PS_MITIGATION_OPTION_RETURN_FLOW_GUARD = 16,
	PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY = 17,
	PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD = 18,
	PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT = 19,
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	PS_MITIGATION_OPTION_ROP_STACKPIVOT = 20,
	PS_MITIGATION_OPTION_ROP_CALLER_CHECK = 21,
	PS_MITIGATION_OPTION_ROP_SIMEXEC = 22,
	PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER = 23,
	PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS = 24,
	PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION = 25,
	PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER = 26,
	PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION = 27,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS4
	PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION = 28,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE = 29,
	PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY = 30,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_19H1
	PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS = 31,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
	PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION = 32,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES = 33,
	PS_MITIGATION_OPTION_XTENDED_CONTROL_FLOW_GUARD = 34,
	PS_MITIGATION_OPTION_POINTER_AUTH_USER_IP = 35,
	PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY = 36,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_21H2
	PS_MITIGATION_OPTION_REDIRECTION_TRUST = 37,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_22H2
	PS_MITIGATION_OPTION_RESTRICT_CORE_SHARING = 38,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	PS_MITIGATION_OPTION_FSCTL_SYSTEM_CALL_DISABLE = 39
#endif
};
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS3
using PS_MITIGATION_AUDIT_OPTIONS_MAP = PS_MITIGATION_OPTIONS_MAP;
#endif

// @todo: _PS_SYSTEM_DLL_INIT_BLOCK

#if Q_NT_VERSION >= Q_NT_WIN11_24H2
union PS_PROCESS_CREATION_SVE_VECTOR_LENGTH
{
	std::uint32_t Data;
	struct
	{
		std::uint32_t VectorLength : 24;
		std::uint32_t FlagsReserved : 8;
	};
};
static_assert(sizeof(PS_PROCESS_CREATION_SVE_VECTOR_LENGTH) == 0x4);
#endif
#pragma endregion

#pragma region process_environment_block
struct ACTIVATION_CONTEXT_DATA
{
	std::uint32_t Magic; // 0x00
	std::uint32_t HeaderSize; // 0x04
	std::uint32_t FormatVersion; // 0x08
	std::uint32_t TotalSize; // 0x0C
	std::uint32_t DefaultTocOffset; // 0x10
	std::uint32_t ExtendedTocOffset; // 0x14
	std::uint32_t AssemblyRosterOffset; // 0x18
	std::uint32_t Flags; // 0x1C
};
static_assert(sizeof(ACTIVATION_CONTEXT_DATA) == 0x20);

_Q_NT_BIT_TEMPLATE struct PEB_LDR_DATA
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Length; // 0x00
	std::uint8_t Initialized; // 0x04
	BitnessType_t<void*> SsHandle; // 0x08
	LIST_ENTRY<nBitness> InLoadOrderModuleList; // 0x0C / 0x10
	LIST_ENTRY<nBitness> InMemoryOrderModuleList; // 0x14 / 0x20
	LIST_ENTRY<nBitness> InInitializationOrderModuleList; // 0x1C / 0x30
	BitnessType_t<void*> EntryInProgress; // 0x24 / 0x40
	std::uint8_t ShutdownInProgress; // 0x28 / 0x48
	BitnessType_t<void*> ShutdownThreadId; // 0x2C / 0x50
};
_Q_NT_BIT_ASSERT(PEB_LDR_DATA, 0x30, 0x58);

// @todo: move to "gdi.h"?
_Q_NT_BIT_TEMPLATE using GDI_HANDLE_BUFFER = std::uint32_t[nBitness == 32U ? 34U : 60U];

_Q_NT_BIT_TEMPLATE struct PEB
{
private:
	_Q_NT_BIT_TYPE
public:
	bool InheritedAddressSpace; // 0x0000
	bool ReadImageFileExecOptions; // 0x0001
	bool BeingDebugged; // 0x0002
	union
	{
		std::uint8_t BitField;
		struct
		{
			std::uint8_t ImageUsesLargePages : 1;
			std::uint8_t IsProtectedProcess : 1;
#if Q_NT_VERSION <= Q_NT_WIN8
			std::uint8_t IsLegacyProcess : 1;
#endif
			std::uint8_t IsImageDynamicallyRelocated : 1;
#if Q_NT_VERSION >= Q_NT_VISTA_SP1
			std::uint8_t SkipPatchingUser32Forwarders : 1;
#if Q_NT_VERSION >= Q_NT_WIN8
			std::uint8_t IsPackagedProcess : 1;
			std::uint8_t IsAppContainer : 1;
#if Q_NT_VERSION >= Q_NT_WINBLUE
			std::uint8_t IsProtectedProcessLight : 1;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
			std::uint8_t IsLongPathAwareProcess : 1;
#else
			std::uint8_t SpareBits : 1;
#endif
#else
			std::uint8_t SpareBits : 3;
#endif
#else
			std::uint8_t SpareBits : 4;
#endif
		};
	}; // 0x03
	BitnessType_t<HANDLE> Mutant; // 0x0004 / 0x0008
	BitnessType_t<void*> ImageBaseAddress; // 0x0008 / 0x0010
	BitnessType_t<PEB_LDR_DATA<nBitness>*> Ldr; // 0x000C / 0x0018
	BitnessType_t<RTL_USER_PROCESS_PARAMETERS<nBitness>*> ProcessParameters; // 0x0010 / 0x0020
	BitnessType_t<void*> SubSystemData; // 0x0014 / 0x0028
	BitnessType_t<void*> ProcessHeap; // 0x0018 / 0x0030
	BitnessType_t<RTL_CRITICAL_SECTION<nBitness>*> FastPebLock; // 0x001C / 0x0038
	BitnessType_t<SLIST_HEADER<nBitness>* volatile> AtlThunkSListPtr; // 0x0020 / 0x0040
	BitnessType_t<void*> IFEOKey; // 0x0024 / 0x0048
	union
	{
		std::uint32_t CrossProcessFlags;
		struct
		{
			std::uint32_t ProcessInJob : 1;
			std::uint32_t ProcessInitializing : 1;
#if Q_NT_VERSION >= Q_NT_VISTA_SP1
			std::uint32_t ProcessUsingVEH : 1;
			std::uint32_t ProcessUsingVCH : 1;
#if Q_NT_VERSION >= Q_NT_WIN7
			std::uint32_t ProcessUsingFTH : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
			std::uint32_t ProcessPreviouslyThrottled : 1;
			std::uint32_t ProcessCurrentlyThrottled : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
			std::uint32_t ProcessImagesHotPatched : 1;
			std::uint32_t ReservedBits0 : 24;
#else
			std::uint32_t ReservedBits0 : 25;
#endif
#else
			std::uint32_t ReservedBits0 : 27;
#endif
#else
			std::uint32_t ReservedBits0 : 28;
#endif
#else
			std::uint32_t ReservedBits0 : 30;
#endif
		};
	}; // 0x0028 / 0x0050
	union
	{
		BitnessType_t<void*> KernelCallbackTable;
		BitnessType_t<void*> UserSharedInfoPtr;
	}; // 0x002C / 0x0058
	std::uint32_t SystemReserved; // 0x0030 / 0x0060
#if Q_NT_VERSION >= Q_NT_WIN7
	std::uint32_t AtlThunkSListPtr32; // 0x0034 / 0x0064
	BitnessType_t<void*> ApiSetMap; // 0x0038 / 0x0068
#else
	std::uint32_t SpareUlong; // 0x0034 / 0x0064
	BitnessType_t<void*> FreeList; // 0x0038 / 0x0068
#endif
	std::uint32_t TlsExpansionCounter; // 0x003C / 0x0070
	BitnessType_t<void*> TlsBitmap; // 0x0040 / 0x0078
	std::uint32_t TlsBitmapBits[2]; // 0x0044 / 0x0080
	BitnessType_t<void*> ReadOnlySharedMemoryBase; // 0x004C / 0x0088
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	BitnessType_t<void*> SharedData; // 0x0050 / 0x0090
#else
	BitnessType_t<void*> HotpatchInformation; // 0x0050 / 0x0090
#endif
	BitnessType_t<void**> ReadOnlyStaticServerData; // 0x0054 / 0x0098
	BitnessType_t<void*> AnsiCodePageData; // 0x0058 / 0x00A0
	BitnessType_t<void*> OemCodePageData; // 0x005C / 0x00A8
	BitnessType_t<void*> UnicodeCaseTableData; // 0x0060 / 0x00B0
	std::uint32_t NumberOfProcessors; // 0x0064 / 0x00B8
	std::uint32_t NtGlobalFlag; // 0x0068 / 0x00BC // FLG_*
	LARGE_INTEGER CriticalSectionTimeout; // 0x0070 / 0x00C0
	BitnessType_t<std::size_t> HeapSegmentReserve; // 0x0078 / 0x00C8
	BitnessType_t<std::size_t> HeapSegmentCommit; // 0x007C / 0x00D0
	BitnessType_t<std::size_t> HeapDeCommitTotalFreeThreshold; // 0x0080 / 0x00D8
	BitnessType_t<std::size_t> HeapDeCommitFreeBlockThreshold; // 0x0084 / 0x00E0
	std::uint32_t NumberOfHeaps; // 0x0088 / 0x00E8
	std::uint32_t MaximumNumberOfHeaps; // 0x008C / 0x00EC
	BitnessType_t<void**> ProcessHeaps; // 0x0090 / 0x00F0
	BitnessType_t<void*> GdiSharedHandleTable; // 0x0094 / 0x00F8
	BitnessType_t<void*> ProcessStarterHelper; // 0x0098 / 0x0100
	std::uint32_t GdiDCAttributeList; // 0x009C / 0x108
	BitnessType_t<RTL_CRITICAL_SECTION<nBitness>*> LoaderLock; // 0x00A0 / 0x0110
	std::uint32_t OSMajorVersion; // 0x00A4 / 0x0118
	std::uint32_t OSMinorVersion; // 0x00A8 / 0x011C
	std::uint16_t OSBuildNumber; // 0x00AC / 0x0120
	std::uint16_t OSCSDVersion; // 0x00AE / 0x0122
	std::uint32_t OSPlatformId; // 0x00B0 / 0x0124
	std::uint32_t ImageSubsystem; // 0x00B4 / 0x0128
	std::uint32_t ImageSubsystemMajorVersion; // 0x00B8 / 0x012C
	std::uint32_t ImageSubsystemMinorVersion; // 0x00BC / 0x0130
	BitnessType_t<KAFFINITY> ActiveProcessAffinityMask; // 0x00C0 / 0x0134
	GDI_HANDLE_BUFFER<nBitness> GdiHandleBuffer; // 0x00C4 / 0x0140
	BitnessType_t<PPS_POST_PROCESS_INIT_ROUTINE> PostProcessInitRoutine; // 0x014C / 0x0230
	BitnessType_t<void*> TlsExpansionBitmap; // 0x0150 / 0x0238
	std::uint32_t TlsExpansionBitmapBits[32]; // 0x0154 / 0x0240
	std::uint32_t SessionId; // 0x01D4 / 0x02C0
	ULARGE_INTEGER AppCompatFlags; // 0x01D8 / 0x02C8
	ULARGE_INTEGER AppCompatFlagsUser; // 0x01E0 / 0x02D0
	BitnessType_t<void*> pShimData; // 0x01E8 / 0x02D8
	BitnessType_t<void*> AppCompatInfo; // 0x01EC / 0x02E0
	UNICODE_STRING<nBitness> CSDVersion; // 0x01F0 / 0x02E8
	BitnessType_t<ACTIVATION_CONTEXT_DATA*> ActivationContextData; // 0x01F8 / 0x02F8
	BitnessType_t<struct ASSEMBLY_STORAGE_MAP*> ProcessAssemblyStorageMap; // 0x01FC / 0x0300
	BitnessType_t<ACTIVATION_CONTEXT_DATA*> SystemDefaultActivationContextData; // 0x0200 / 0x0308
	BitnessType_t<struct ASSEMBLY_STORAGE_MAP*> SystemAssemblyStorageMap; // 0x0204 / 0x0310
	BitnessType_t<std::size_t> MinimumStackCommit; // 0x0208 / 0x0318
	// @todo: since XP_SP2/SP3
	BitnessType_t<struct FLS_CALLBACK_INFO*> FlsCallback; // 0x020C / 0x0320
	LIST_ENTRY<nBitness> FlsListHead; // 0x0210
	BitnessType_t<void*> FlsBitmap; // 0x0218
	std::uint32_t SpareUlongs[5]; // 0x021C
#if Q_NT_VERSION >= Q_NT_VISTA
	BitnessType_t<void*> WerRegistrationData; // 0x0230 / 0x0358
	BitnessType_t<void*> WerShipAssertPtr; // 0x0234 / 0x0360
#endif
#if Q_NT_VERSION >= Q_NT_WIN7
	BitnessType_t<void*> Unused; // 0x0238 / 0x0368
	BitnessType_t<void*> pImageHeaderHash; // 0x023C / 0x0370
	std::uint32_t TracingFlags; // 0x0240 / 0x0378
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
	std::uint64_t CsrServerReadOnlySharedMemoryBase; // 0x0248 / 0x0380
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	std::uint32_t TppWorkerpListLock; // 0x0250 / 0x0388
	LIST_ENTRY<nBitness> TppWorkerpList; // 0x0254 / 0x0390
	BitnessType_t<void*> WaitOnAddressHashTable[128]; // 0x025C / 0x03A0
	BitnessType_t<void*> TelemetryCoverageHeader; // 0x045C / 0x07A0
	std::uint32_t CloudFileFlags; // 0x0460 / 0x07A8
	std::uint32_t CloudFileDiagFlags; // 0x0464 / 0x07AC
	std::int8_t PlaceholderCompatibilityMode; // 0x0468 / 0x07B0 // @note: originally "PlaceholderCompatibiltyMode"
	std::int8_t PlaceholderCompatibilityModeReserved[7]; // 0x469 / 0x7B1
	BitnessType_t<struct LEAP_SECOND_DATA*> LeapSecondData; // 0x0470 / 0x07B8
	std::uint32_t LeapSecondFlags; // 0x0474 / 0x07C0
	std::uint32_t NtGlobalFlag2; // 0x0478 / 0x07C4
	std::uint64_t ExtendedFeatureDisableMask; // 0x0480 / 0x07C8
#endif
};
_Q_NT_BIT_ASSERT(PEB, 0x488, 0x7D0);
#pragma endregion

#pragma region process_information
// @note: originally "_PROCESSINFOCLASS"
using PROCESS_INFORMATION_CLASS = enum _PROCESS_INFORMATION_CLASS : std::uint32_t
{
	ProcessBasicInformation = 0,
	ProcessQuotaLimits = 1,
	ProcessIoCounters = 2,
	ProcessVmCounters = 3,
	ProcessTimes = 4,
	ProcessBasePriority = 5,
	ProcessRaisePriority = 6,
	ProcessDebugPort = 7,
	ProcessExceptionPort = 8,
	ProcessAccessToken = 9,
	ProcessLdtInformation = 10,
	ProcessLdtSize = 11,
	ProcessDefaultHardErrorMode = 12,
	ProcessIoPortHandlers = 13,
	ProcessPooledUsageAndLimits = 14,
	ProcessWorkingSetWatch = 15,
	ProcessUserModeIOPL = 16, // requires 'SeTcbPrivilege'
	ProcessEnableAlignmentFaultFixup = 17,
	ProcessPriorityClass = 18,
	ProcessWx86Information = 19, // requires 'SeTcbPrivilege'
	ProcessHandleCount = 20,
	ProcessAffinityMask = 21,
	ProcessPriorityBoost = 22,
	ProcessDeviceMap = 23,
	ProcessSessionInformation = 24,
	ProcessForegroundInformation = 25,
	ProcessWow64Information = 26,
	ProcessImageFileName = 27,
	ProcessLUIDDeviceMapsEnabled = 28,
	ProcessBreakOnTermination = 29,
	ProcessDebugObjectHandle = 30,
	ProcessDebugFlags = 31,
	ProcessHandleTracing = 32,
	ProcessIoPriority = 33,
	ProcessExecuteFlags = 34,
	ProcessResourceManagement = 35,
	ProcessCookie = 36,
	ProcessImageInformation = 37,
#if Q_NT_VERSION >= Q_NT_VISTA
	ProcessCycleTime = 38,
	ProcessPagePriority = 39,
	ProcessInstrumentationCallback = 40,
	ProcessThreadStackAllocation = 41,
	ProcessWorkingSetWatchEx = 42,
	ProcessImageFileNameWin32 = 43,
	ProcessImageFileMapping = 44,
#endif
#if Q_NT_VERSION >= Q_NT_VISTA_SP1
	ProcessAffinityUpdateMode = 45,
	ProcessMemoryAllocationMode = 46,
#endif
#if Q_NT_VERSION >= Q_NT_WIN7
	ProcessGroupInformation = 47,
	ProcessTokenVirtualizationEnabled = 48,
	ProcessConsoleHostProcess = 49,
	ProcessWindowInformation = 50,
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
	ProcessHandleInformation = 51,
	ProcessMitigationPolicy = 52,
	ProcessDynamicFunctionTableInformation = 53,
	ProcessHandleCheckingMode = 54,
	ProcessKeepAliveCount = 55,
	ProcessRevokeFileHandles = 56,
	ProcessWorkingSetControl = 57,
#endif
#if Q_NT_VERSION >= Q_NT_WINBLUE
	ProcessHandleTable = 58,
	ProcessCheckStackExtentsMode = 59,
	ProcessCommandLineInformation = 60,
	ProcessProtectionInformation = 61,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	ProcessMemoryExhaustion = 62,
	ProcessFaultInformation = 63,
	ProcessTelemetryIdInformation = 64,
	ProcessCommitReleaseInformation = 65,
	ProcessDefaultCpuSetsInformation = 66,
	ProcessAllowedCpuSetsInformation = 67,
	ProcessSubsystemProcess = 68,
	ProcessJobMemoryInformation = 69,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	ProcessInPrivate = 70,
	ProcessRaiseUMExceptionOnInvalidHandleClose = 71,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	ProcessIumChallengeResponse = 72,
	ProcessChildProcessInformation = 73,
	ProcessHighGraphicsPriorityInformation = 74, // requires 'SeTcbPrivilege'
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	ProcessSubsystemInformation = 75,
	ProcessEnergyValues = 76,
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	ProcessPowerThrottlingState = 77,
	ProcessReserved3Information = 78,
#else
	ProcessActivityThrottleState = 77,
	ProcessActivityThrottlePolicy = 78,
#endif
	ProcessWin32kSyscallFilterInformation = 79,
	ProcessDisableSystemAllowedCpuSets = 80,
	ProcessWakeInformation = 81,
	ProcessEnergyTrackingState = 82,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	ProcessManageWritesToExecutableMemory = 83,
	ProcessCaptureTrustletLiveDump = 84,
	ProcessTelemetryCoverage = 85,
	ProcessEnclaveInformation = 86,
	ProcessEnableReadWriteVmLogging = 87,
	ProcessUptimeInformation = 88,
	ProcessImageSection = 89,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS4
	ProcessDebugAuthInformation = 90,
	ProcessSystemResourceManagement = 91,
	ProcessSequenceNumber = 92,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	ProcessLoaderDetour = 93,
	ProcessSecurityDomainInformation = 94,
	ProcessCombineSecurityDomainsInformation = 95,
	ProcessEnableLogging = 96,
	ProcessLeapSecondInformation = 97,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_19H1
	ProcessFiberShadowStackAllocation = 98,
	ProcessFreeFiberShadowStackAllocation = 99,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
	ProcessAltSystemCallInformation = 100,
	ProcessDynamicEHContinuationTargets = 101,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	ProcessDynamicEnforcedCetCompatibleRanges = 102,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	ProcessCreateStateChange = 103,
	ProcessApplyStateChange = 104,
	ProcessEnableOptionalXStateFeatures = 105,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	ProcessAltPrefetchParam = 106,
	ProcessAssignCpuPartitions = 107,
	ProcessPriorityClassEx = 108,
	ProcessMembershipInformation = 109,
	ProcessEffectiveIoPriority = 110,
	ProcessEffectivePagePriority = 111,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	ProcessSchedulerSharedData = 112,
	ProcessSlistRollbackInformation = 113,
	ProcessNetworkIoCounters = 114,
	ProcessFindFirstThreadByTebValue = 115,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_25H2
	ProcessEnclaveAddressSpaceRestriction = 116,
	ProcessAvailableCpus = 117,
#endif
	MaxProcessInfoClass
};

_Q_NT_BIT_TEMPLATE struct PROCESS_BASIC_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	NTSTATUS ExitStatus; // 0x00
	BitnessType_t<std::uintptr_t> PebBaseAddress; // 0x04 / 0x08
	BitnessType_t<KAFFINITY> AffinityMask; // 0x08 / 0x10
	KPRIORITY BasePriority; // 0x0C / 0x18
	BitnessType_t<std::uintptr_t> UniqueProcessId; // 0x10 / 0x20
	BitnessType_t<std::uintptr_t> InheritedFromUniqueProcessId; // 0x14 / 0x28
};
_Q_NT_BIT_ASSERT(PROCESS_BASIC_INFORMATION, 0x18, 0x30);

_Q_NT_BIT_TEMPLATE struct PROCESS_EXTENDED_BASIC_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> Size; // 0x00
	PROCESS_BASIC_INFORMATION<nBitness> BasicInfo; // 0x04 / 0x08
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t IsProtectedProcess : 1;
			std::uint32_t IsWow64Process : 1;
#if Q_NT_VERSION >= Q_NT_WIN7
			std::uint32_t IsProcessDeleting : 1;
			std::uint32_t IsCrossSessionCreate : 1;
#if Q_NT_VERSION >= Q_NT_WIN8
			std::uint32_t IsFrozen : 1;
			std::uint32_t IsBackground : 1;
			std::uint32_t IsStronglyNamed : 1;
#if Q_NT_VERSION >= Q_NT_WIN10
			std::uint32_t IsSecureProcess : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
			std::uint32_t IsSubsystemProcess : 1;
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
			std::uint32_t IsTrustedApp : 1;
			std::uint32_t SpareBits : 22;
#else
			std::uint32_t SpareBits : 23;
#endif
#else
			std::uint32_t SpareBits : 24;
#endif
#else
			std::uint32_t SpareBits : 25;
#endif
#else
			std::uint32_t SpareBits : 28;
#endif
#else
			std::uint32_t SpareBits : 30;
#endif
		};
	}; // 0x1C / 0x38
};
_Q_NT_BIT_ASSERT(PROCESS_EXTENDED_BASIC_INFORMATION, 0x20, 0x40);

_Q_NT_BIT_TEMPLATE struct VM_COUNTERS
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> PeakVirtualSize; // 0x00
	BitnessType_t<std::size_t> VirtualSize; // 0x04 / 0x08
	std::uint32_t PageFaultCount; // 0x08 / 0x10
	BitnessType_t<std::size_t> PeakWorkingSetSize; // 0x0C / 0x18
	BitnessType_t<std::size_t> WorkingSetSize; // 0x10 / 0x20
	BitnessType_t<std::size_t> QuotaPeakPagedPoolUsage; // 0x14 / 0x28
	BitnessType_t<std::size_t> QuotaPagedPoolUsage; // 0x18 / 0x30
	BitnessType_t<std::size_t> QuotaPeakNonPagedPoolUsage; // 0x1C / 0x38
	BitnessType_t<std::size_t> QuotaNonPagedPoolUsage; // 0x20 / 0x40
	BitnessType_t<std::size_t> PagefileUsage; // 0x24 / 0x48
	BitnessType_t<std::size_t> PeakPagefileUsage; // 0x28 / 0x50
};
_Q_NT_BIT_ASSERT(VM_COUNTERS, 0x2C, 0x58);

_Q_NT_BIT_TEMPLATE struct VM_COUNTERS_EX : VM_COUNTERS<nBitness>
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> PrivateUsage; // 0x2C / 0x58
};
_Q_NT_BIT_ASSERT(VM_COUNTERS_EX, 0x30, 0x60);

_Q_NT_BIT_TEMPLATE struct PROCESS_EXCEPTION_PORT
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> ExceptionPortHandle; // 0x0
	std::uint32_t StateFlags; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_EXCEPTION_PORT, 0x8, 0x10);

_Q_NT_BIT_TEMPLATE struct PROCESS_ACCESS_TOKEN
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> Token; // 0x0
	BitnessType_t<HANDLE> Thread; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_ACCESS_TOKEN, 0x8, 0x10);

// @todo: move to "loader.h"?
struct LDT_ENTRY
{
	std::uint16_t LimitLow; // 0x0
	std::uint16_t BaseLow; // 0x2
	union
	{
		struct
		{
			std::uint8_t BaseMid;
			std::uint8_t Flags1;
			std::uint8_t Flags2;
			std::uint8_t BaseHi;
		} Bytes;
		struct
		{
			std::uint32_t BaseMid : 8;
			std::uint32_t Type : 5;
			std::uint32_t Dpl : 2;
			std::uint32_t Pres : 1;
			std::uint32_t LimitHi : 4;
			std::uint32_t Sys : 1;
			std::uint32_t Reserved_0 : 1;
			std::uint32_t Default_Big : 1;
			std::uint32_t Granularity : 1;
			std::uint32_t BaseHi : 8;
		} Bits;
	} HighWord; // 0x4
};
static_assert(sizeof(LDT_ENTRY) == 0x8);

struct PROCESS_LDT_INFORMATION // @note: originally "_LDT_INFORMATION"
{
	std::uint32_t Start; // 0x0
	std::uint32_t Length; // 0x4
	LDT_ENTRY LdtEntries[ANYSIZE_ARRAY]; // 0x8
};

_Q_NT_BIT_TEMPLATE struct PROCESS_WS_WATCH_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> FaultingPc; // 0x0
	BitnessType_t<void*> FaultingVa; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_WS_WATCH_INFORMATION, 0x8, 0x10);

_Q_NT_BIT_TEMPLATE struct PROCESS_WS_WATCH_INFORMATION_EX
{
private:
	_Q_NT_BIT_TYPE
public:
	PROCESS_WS_WATCH_INFORMATION<nBitness> BasicInfo; // 0x00
	BitnessType_t<HANDLE> FaultingThreadId; // 0x08 / 0x10
	BitnessType_t<std::uintptr_t> Flags; // 0x0C / 0x18
};
_Q_NT_BIT_ASSERT(PROCESS_WS_WATCH_INFORMATION_EX, 0x10, 0x20);

struct PROCESS_PRIORITY_CLASS
{
	bool Foreground; // 0x0
	std::uint8_t PriorityClass; // 0x1
};
static_assert(sizeof(PROCESS_PRIORITY_CLASS) == 0x2);

// @todo: since WIN7, but listed since VISTA
struct PROCESS_HANDLE_INFORMATION
{
	std::uint32_t HandleCount; // 0x0
	std::uint32_t HandleCountHighWatermark; // 0x4
};
static_assert(sizeof(PROCESS_HANDLE_INFORMATION) == 0x8);

_Q_NT_BIT_TEMPLATE struct PROCESS_DEVICEMAP_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	union
	{
		struct
		{
			BitnessType_t<HANDLE> DirectoryHandle;
		} Set;
		struct
		{
			std::uint32_t DriveMap;
			std::uint8_t DriveType[32];
		} Query;
	};
};
_Q_NT_BIT_ASSERT(PROCESS_DEVICEMAP_INFORMATION, 0x24, 0x28);

_Q_NT_BIT_TEMPLATE struct PROCESS_DEVICEMAP_INFORMATION_EX : PROCESS_DEVICEMAP_INFORMATION<nBitness>
{
	std::uint32_t Flags; // 0x24 / 0x28
};
_Q_NT_BIT_ASSERT(PROCESS_DEVICEMAP_INFORMATION_EX, 0x28, 0x30);

struct PROCESS_SESSION_INFORMATION
{
	std::uint32_t SessionId;
};
static_assert(sizeof(PROCESS_SESSION_INFORMATION) == 0x4);

struct PROCESS_FOREGROUND_BACKGROUND
{
	bool Foreground;
};
static_assert(sizeof(PROCESS_FOREGROUND_BACKGROUND) == 0x1);

#define PROCESS_HANDLE_TRACING_MAX_STACKS 16

_Q_NT_BIT_TEMPLATE struct PROCESS_HANDLE_TRACING_ENTRY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> Handle; // 0x00
	CLIENT_ID<nBitness> ClientId; // 0x04 / 0x08
	std::uint32_t Type; // 0x0C / 0x18
	BitnessType_t<void*> Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS]; // 0x10 / 0x20
};
_Q_NT_BIT_ASSERT(PROCESS_HANDLE_TRACING_ENTRY, 0x50, 0xA0);

_Q_NT_BIT_TEMPLATE struct PROCESS_HANDLE_TRACING_QUERY
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> Handle; // 0x00
	std::uint32_t TotalTraces; // 0x04 / 0x08
	PROCESS_HANDLE_TRACING_ENTRY<nBitness> HandleTrace[ANYSIZE_ARRAY]; // 0x08 / 0x10
};

struct PROCESS_HANDLE_TRACING_ENABLE
{
	std::uint32_t Flags;
};
static_assert(sizeof(PROCESS_HANDLE_TRACING_ENABLE) == 0x4);

struct PROCESS_HANDLE_TRACING_ENABLE_EX : PROCESS_HANDLE_TRACING_ENABLE
{
	std::uint32_t TotalSlots; // 0x4
};
static_assert(sizeof(PROCESS_HANDLE_TRACING_ENABLE_EX) == 0x8);

// @todo: is it should be here?
_Q_NT_BIT_TEMPLATE struct THREAD_TLS_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Flags; // 0x00
	union
	{
		BitnessType_t<void*> NewTlsData;
		BitnessType_t<void*> OldTlsData;
	}; // 0x04 / 0x08
	BitnessType_t<HANDLE> ThreadId; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(THREAD_TLS_INFORMATION, 0xC, 0x18);

using PROCESS_TLS_INFORMATION_TYPE = enum _PROCESS_TLS_INFORMATION_TYPE : std::uint32_t
{
	ProcessTlsReplaceIndex = 0,
	ProcessTlsReplaceVector = 1,
	MaxProcessTlsOperation = 2
};

_Q_NT_BIT_TEMPLATE struct PROCESS_TLS_INFORMATION
{
	std::uint32_t Flags; // 0x00
	std::uint32_t OperationType; // 0x04
	std::uint32_t ThreadDataCount; // 0x08
	union
	{
		std::uint32_t TlsIndex;
		std::uint32_t PreviousCount;
	}; // 0x0C
	THREAD_TLS_INFORMATION<nBitness> ThreadData[ANYSIZE_ARRAY]; // 0x10
};

#if Q_NT_VERSION >= Q_NT_VISTA
struct PROCESS_CYCLE_TIME_INFORMATION
{
	std::uint64_t AccumulatedCycles; // 0x0
	std::uint64_t CurrentCycleCount; // 0x8
};
static_assert(sizeof(PROCESS_CYCLE_TIME_INFORMATION) == 0x10);
#endif

// @todo: since WIN10, but listed since VISTA
_Q_NT_BIT_TEMPLATE struct PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Version; // 0x0
	std::uint32_t Reserved; // 0x4
	BitnessType_t<void*> Callback; // 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, 0xC, 0x10);

_Q_NT_BIT_TEMPLATE struct PROCESS_STACK_ALLOCATION_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> ReserveSize; // 0x00
	BitnessType_t<std::size_t> ZeroBits; // 0x04 / 0x08
	BitnessType_t<void*> StackBase; // 0x08 / 0x10
};
_Q_NT_BIT_ASSERT(PROCESS_STACK_ALLOCATION_INFORMATION, 0xC, 0x18);

#if Q_NT_VERSION >= Q_NT_WIN7
_Q_NT_BIT_TEMPLATE struct PROCESS_STACK_ALLOCATION_INFORMATION_EX
{
	std::uint32_t PreferredNode; // 0x00
	std::uint32_t Reserved0; // 0x04
	std::uint32_t Reserved1; // 0x08
	std::uint32_t Reserved2; // 0x0C
	PROCESS_STACK_ALLOCATION_INFORMATION<nBitness> AllocInfo; // 0x10
};
_Q_NT_BIT_ASSERT(PROCESS_STACK_ALLOCATION_INFORMATION_EX, 0x1C, 0x28);
#endif

#if Q_NT_VERSION >= Q_NT_VISTA_SP1
union PROCESS_AFFINITY_UPDATE_MODE
{
	std::uint32_t Flags;
	struct
	{
		std::uint32_t EnableAutoUpdate : 1;
		std::uint32_t Permanent : 1;
		std::uint32_t Reserved : 30;
	};
};
static_assert(sizeof(PROCESS_AFFINITY_UPDATE_MODE) == 0x4);

union PROCESS_MEMORY_ALLOCATION_MODE
{
	std::uint32_t Flags;
	struct
	{
		std::uint32_t TopDown : 1;
		std::uint32_t Reserved : 31;
	};
};
static_assert(sizeof(PROCESS_MEMORY_ALLOCATION_MODE) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN7
struct PROCESS_WINDOW_INFORMATION
{
	std::uint32_t WindowFlags; // 0x0
	std::uint16_t WindowTitleLength; // 0x4
	wchar_t WindowTitle[ANYSIZE_ARRAY]; // 0x6
};
#endif

#if Q_NT_VERSION >= Q_NT_WIN8
_Q_NT_BIT_TEMPLATE struct PROCESS_HANDLE_TABLE_ENTRY_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> HandleValue; // 0x00
	BitnessType_t<std::size_t> HandleCount; // 0x04 / 0x08
	BitnessType_t<std::size_t> PointerCount; // 0x08 / 0x10
	ACCESS_MASK GrantedAccess; // 0x0C / 0x18
	std::uint32_t ObjectTypeIndex; // 0x10 / 0x1C
	std::uint32_t HandleAttributes; // 0x14 / 0x20
	std::uint32_t Reserved; // 0x18 / 0x24
};
_Q_NT_BIT_ASSERT(PROCESS_HANDLE_TABLE_ENTRY_INFO, 0x1C, 0x28);

_Q_NT_BIT_TEMPLATE struct PROCESS_HANDLE_SNAPSHOT_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> NumberOfHandles; // 0x00
	BitnessType_t<std::uintptr_t> Reserved; // 0x04 / 0x08
	PROCESS_HANDLE_TABLE_ENTRY_INFO<nBitness> Handles[ANYSIZE_ARRAY]; // 0x08 / 0x10
};

struct PROCESS_MITIGATION_ASLR_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnableBottomUpRandomization : 1;
			std::uint32_t EnableForceRelocateImages : 1;
			std::uint32_t EnableHighEntropy : 1;
			std::uint32_t DisallowStrippedImages : 1;
			std::uint32_t ReservedFlags : 28;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_ASLR_POLICY) == 0x4);

struct PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t RaiseExceptionOnInvalidHandleReference : 1;
			std::uint32_t HandleExceptionsPermanentlyEnabled : 1;
			std::uint32_t ReservedFlags : 30;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY) == 0x4);

struct PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t DisallowWin32kSystemCalls : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			std::uint32_t AuditDisallowWin32kSystemCalls : 1;
#if Q_NT_VERSION >= Q_NT_WIN11_23H2
			std::uint32_t DisallowFsctlSystemCalls : 1;
			std::uint32_t AuditDisallowFsctlSystemCalls : 1;
			std::uint32_t ReservedFlags : 28;
#else
			std::uint32_t ReservedFlags : 30;
#endif
#else
			std::uint32_t ReservedFlags : 31;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY) == 0x4);

struct PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t DisableExtensionPoints : 1;
			std::uint32_t ReservedFlags : 31;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY) == 0x4);

#if Q_NT_VERSION >= Q_NT_WINBLUE
struct PROCESS_MITIGATION_DYNAMIC_CODE_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t ProhibitDynamicCode : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
			std::uint32_t AllowThreadOptOut : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
			std::uint32_t AllowRemoteDowngrade : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			std::uint32_t AuditProhibitDynamicCode : 1;
			std::uint32_t ReservedFlags : 28;
#else
			std::uint32_t ReservedFlags : 29;
#endif
#else
			std::uint32_t ReservedFlags : 30;
#endif
#else
			std::uint32_t ReservedFlags : 31;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_DYNAMIC_CODE_POLICY) == 0x4);

struct PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnableControlFlowGuard : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
			std::uint32_t EnableExportSuppression : 1;
			std::uint32_t StrictMode : 1;
#if Q_NT_VERSION >= Q_NT_WIN11
			std::uint32_t EnableXfg : 1;
			std::uint32_t EnableXfgAuditMode : 1;
			std::uint32_t ReservedFlags : 27;
#else
			std::uint32_t ReservedFlags : 29;
#endif
#else
			std::uint32_t ReservedFlags : 31;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY) == 0x4);

struct PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t MicrosoftSignedOnly : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
			std::uint32_t StoreSignedOnly : 1;
			std::uint32_t MitigationOptIn : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			std::uint32_t AuditMicrosoftSignedOnly : 1;
			std::uint32_t AuditStoreSignedOnly : 1;
			std::uint32_t ReservedFlags : 27;
#else
			std::uint32_t ReservedFlags : 29;
#endif
#else
			std::uint32_t ReservedFlags : 31;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10
struct PROCESS_MITIGATION_FONT_DISABLE_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t DisableNonSystemFonts : 1;
			std::uint32_t AuditNonSystemFontLoading : 1;
			std::uint32_t ReservedFlags : 30;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_FONT_DISABLE_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_TH2
struct PROCESS_MITIGATION_IMAGE_LOAD_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t NoRemoteImages : 1;
			std::uint32_t NoLowMandatoryLabelImages : 1;
			std::uint32_t PreferSystem32Images : 1;
			std::uint32_t AuditNoRemoteImages : 1;
			std::uint32_t AuditNoLowMandatoryLabelImages : 1;
			std::uint32_t ReservedFlags : 27;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_IMAGE_LOAD_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS3
struct PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t FilterId : 4;
			std::uint32_t ReservedFlags : 28;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY) == 0x4);

struct PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnableExportAddressFilter : 1;
			std::uint32_t AuditExportAddressFilter : 1;
			std::uint32_t EnableExportAddressFilterPlus : 1;
			std::uint32_t AuditExportAddressFilterPlus : 1;
			std::uint32_t EnableImportAddressFilter : 1;
			std::uint32_t AuditImportAddressFilter : 1;
			std::uint32_t EnableRopStackPivot : 1;
			std::uint32_t AuditRopStackPivot : 1;
			std::uint32_t EnableRopCallerCheck : 1;
			std::uint32_t AuditRopCallerCheck : 1;
			std::uint32_t EnableRopSimExec : 1;
			std::uint32_t AuditRopSimExec : 1;
			std::uint32_t ReservedFlags : 20;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY) == 0x4);

struct PROCESS_MITIGATION_CHILD_PROCESS_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t NoChildProcessCreation : 1;
			std::uint32_t AuditNoChildProcessCreation : 1;
			std::uint32_t AllowSecureProcessCreation : 1;
			std::uint32_t ReservedFlags : 29;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_CHILD_PROCESS_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS5
struct PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t SmtBranchTargetIsolation : 1;
			std::uint32_t IsolateSecurityDomain : 1;
			std::uint32_t DisablePageCombine : 1;
			std::uint32_t SpeculativeStoreBypassDisable : 1;
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
			std::uint32_t RestrictCoreSharing : 1;
			std::uint32_t ReservedFlags : 27;
#else
			std::uint32_t ReservedFlags : 28;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_20H1
struct PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnableUserShadowStack : 1;
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
			std::uint32_t AuditUserShadowStack : 1;
			std::uint32_t SetContextIpValidation : 1;
			std::uint32_t AuditSetContextIpValidation : 1;
			std::uint32_t EnableUserShadowStackStrictMode : 1;
			std::uint32_t BlockNonCetBinaries : 1;
			std::uint32_t BlockNonCetBinariesNonEhcont : 1;
			std::uint32_t AuditBlockNonCetBinaries : 1;
			std::uint32_t CetDynamicApisOutOfProcOnly : 1;
			std::uint32_t SetContextIpValidationRelaxedMode : 1;
			std::uint32_t ReservedFlags : 22;
#else
			std::uint32_t ReservedFlags : 31;
#endif
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN11
struct PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnforceRedirectionTrust : 1;
			std::uint32_t AuditRedirectionTrust : 1;
			std::uint32_t ReservedFlags : 30;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN11_22H2
struct PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnablePointerAuthUserIp : 1;
			std::uint32_t ReservedFlags : 31;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY) == 0x4);

struct PROCESS_MITIGATION_SEHOP_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t EnableSehop : 1;
			std::uint32_t ReservedFlags : 31;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_SEHOP_POLICY) == 0x4);
#endif

#if Q_NT_VERSION == Q_NT_WIN11_23H2
struct PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY
{
	union
	{
		std::uint32_t Flags;
		struct
		{
			std::uint32_t AssemblyManifestRedirectionTrust : 1;
			std::uint32_t ReservedFlags : 31;
		};
	};
};
static_assert(sizeof(PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY) == 0x4);
#endif

using PROCESS_MITIGATION_POLICY = enum _PROCESS_MITIGATION_POLICY : std::uint32_t
{
	ProcessDEPPolicy = 0,
	ProcessASLRPolicy = 1,
	ProcessDynamicCodePolicy = 2,
	ProcessStrictHandleCheckPolicy = 3,
	ProcessSystemCallDisablePolicy = 4,
	ProcessMitigationOptionsMask = 5,
	ProcessExtensionPointDisablePolicy = 6,
#if Q_NT_VERSION >= Q_NT_WINBLUE
	ProcessControlFlowGuardPolicy = 7, // @todo: listed since WIN10_TH1 but structure available since WINBLUE
	ProcessSignaturePolicy = 8,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
	ProcessFontDisablePolicy = 9,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
	ProcessImageLoadPolicy = 10,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	ProcessSystemCallFilterPolicy = 11,
	ProcessPayloadRestrictionPolicy = 12,
	ProcessChildProcessPolicy = 13,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
	ProcessSideChannelIsolationPolicy = 14,
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
	ProcessUserShadowStackPolicy = 15,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
	ProcessRedirectionTrustPolicy = 16,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
	ProcessUserPointerAuthPolicy = 17,
	ProcessSEHOPPolicy = 18,
#endif
#if Q_NT_VERSION == Q_NT_WIN11_23H2
	ProcessActivationContextTrustPolicy = 19,
#endif
	MaxProcessMitigationPolicy
};

struct PROCESS_MITIGATION_POLICY_INFORMATION
{
	PROCESS_MITIGATION_POLICY Policy; // 0x00
	union
	{
		PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;
		PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;
		PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;
#if Q_NT_VERSION >= Q_NT_WIN8
		PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WINBLUE
		PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;
		PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;
		PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10
		PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_TH2
		PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
		PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy;
		PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;
		PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS5
		PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
		PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN11
		PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy;
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_22H2
		PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY UserPointerAuthPolicy;
		PROCESS_MITIGATION_SEHOP_POLICY SEHOPPolicy;
#endif
#if Q_NT_VERSION == Q_NT_WIN11_23H2
		PROCESS_MITIGATION_ACTIVATION_CONTEXT_TRUST_POLICY ActivationContextTrustPolicy;
#endif
	}; // 0x04
};
static_assert(sizeof(PROCESS_MITIGATION_POLICY_INFORMATION) == 0x8);

_Q_NT_BIT_TEMPLATE struct PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<DYNAMIC_FUNCTION_TABLE*> DynamicFunctionTable; // 0x0
	bool Remove; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION, 0x8, 0x10);

struct PROCESS_KEEPALIVE_COUNT_INFORMATION
{
#if Q_NT_VERSION >= Q_NT_WINBLUE
	std::uint32_t WakeCount; // 0x0
	std::uint32_t NoWakeCount; // 0x4
#else
	std::uint32_t Count;
#endif
};
static_assert(sizeof(PROCESS_KEEPALIVE_COUNT_INFORMATION) == 0x8);

_Q_NT_BIT_TEMPLATE struct PROCESS_REVOKE_FILE_HANDLES_INFORMATION
{
	UNICODE_STRING<nBitness> TargetDevicePath;
};
_Q_NT_BIT_ASSERT(PROCESS_REVOKE_FILE_HANDLES_INFORMATION, 0x8, 0x10);

using PROCESS_WORKING_SET_OPERATION = enum _PROCESS_WORKING_SET_OPERATION : std::int32_t
{
	ProcessWorkingSetSwap = 0,
	ProcessWorkingSetEmpty = 1,
	ProcessWorkingSetOperationMax = 2
};

#define PROCESS_WORKING_SET_FLAG_EMPTY_PRIVATE_PAGES	0x01
#define PROCESS_WORKING_SET_FLAG_EMPTY_SHARED_PAGES		0x02
#define PROCESS_WORKING_SET_FLAG_COMPRESS				0x08
#define PROCESS_WORKING_SET_FLAG_STORE					0x10

struct PROCESS_WORKING_SET_CONTROL
{
	std::uint32_t Version; // 0x0
	PROCESS_WORKING_SET_OPERATION Operation; // 0x4
	std::uint32_t Flags; // 0x8 // PROCESS_WORKING_SET_FLAG_*
};
static_assert(sizeof(PROCESS_WORKING_SET_CONTROL) == 0xC);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10
using PROCESS_MEMORY_EXHAUSTION_TYPE = enum _PROCESS_MEMORY_EXHAUSTION_TYPE
{
	PMETypeFailFastOnCommitFailure = 0,
	PMETypeMax = 1
};

_Q_NT_BIT_TEMPLATE struct PROCESS_MEMORY_EXHAUSTION_INFO
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t Version; // 0x0
	std::uint16_t Reserved; // 0x2
	PROCESS_MEMORY_EXHAUSTION_TYPE Type; // 0x4
	BitnessType_t<std::uintptr_t> Value; // 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_MEMORY_EXHAUSTION_INFO, 0xC, 0x10);

struct PROCESS_FAULT_INFORMATION
{
	std::uint32_t FaultFlags; // 0x0
	std::uint32_t AdditionalInfo; // 0x4
};
static_assert(sizeof(PROCESS_FAULT_INFORMATION) == 0x8);

struct PROCESS_TELEMETRY_ID_INFORMATION
{
	std::uint32_t HeaderSize; // 0x00
	std::uint32_t ProcessId; // 0x04
	std::uint64_t ProcessStartKey; // 0x08
	std::uint64_t CreateTime; // 0x10
	std::uint64_t CreateInterruptTime; // 0x18
	std::uint64_t CreateUnbiasedInterruptTime; // 0x20
	std::uint64_t ProcessSequenceNumber; // 0x28
	std::uint64_t SessionCreateTime; // 0x30
	std::uint32_t SessionId; // 0x38
	std::uint32_t BootId; // 0x3C
	std::uint32_t ImageChecksum; // 0x40
	std::uint32_t ImageTimeDateStamp; // 0x44
	std::uint32_t UserSidOffset; // 0x48
	std::uint32_t ImagePathOffset; // 0x4C
	std::uint32_t PackageNameOffset; // 0x50
	std::uint32_t RelativeAppNameOffset; // 0x54
	std::uint32_t CommandLineOffset; // 0x58
};
static_assert(sizeof(PROCESS_TELEMETRY_ID_INFORMATION) == 0x60);

_Q_NT_BIT_TEMPLATE struct PROCESS_COMMIT_RELEASE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t Version; // 0x00
	struct
	{
		std::uint32_t Eligible : 1;
		std::uint32_t ReleaseRepurposedMemResetCommit : 1;
		std::uint32_t ForceReleaseMemResetCommit : 1;
		std::uint32_t Spare : 29;
	}; // 0x04
	BitnessType_t<std::size_t> CommitDebt; // 0x08
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	BitnessType_t<std::size_t> CommittedMemResetSize; // 0x0C / 0x10
	BitnessType_t<std::size_t> RepurposedMemResetSize; // 0x10 / 0x18
#endif
};
static_assert(sizeof(PROCESS_COMMIT_RELEASE_INFORMATION<32U>) == 0x14 && sizeof(PROCESS_COMMIT_RELEASE_INFORMATION<64>) == 0x20);

struct PROCESS_JOB_MEMORY_INFO
{
	std::uint64_t SharedCommitUsage; // 0x00
	std::uint64_t PrivateCommitUsage; // 0x08
	std::uint64_t PeakPrivateCommitUsage; // 0x10
	std::uint64_t PrivateCommitLimit; // 0x18
	std::uint64_t TotalCommitLimit; // 0x20
};
static_assert(sizeof(PROCESS_JOB_MEMORY_INFO) == 0x28);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS1
struct PROCESS_CHILD_PROCESS_INFORMATION
{
	bool ProhibitChildProcesses; // 0x0
	bool AlwaysAllowSecureChildProcess; // 0x1
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	bool AuditProhibitChildProcesses; // 0x2
#endif
};
static_assert(sizeof(PROCESS_CHILD_PROCESS_INFORMATION) == 0x3);

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
using SUBSYSTEM_INFORMATION_TYPE = enum _SUBSYSTEM_INFORMATION_TYPE
{
	SubsystemInformationTypeWin32 = 0,
	SubsystemInformationTypeWSL = 1,
	MaxSubsystemInformationType = 2
};

union ENERGY_STATE_DURATION
{
	std::uint64_t Value;
	struct
	{
		std::uint32_t LastChangeTime;
		std::uint32_t Duration : 31;
		std::uint32_t IsInState : 1;
	};
};
static_assert(sizeof(ENERGY_STATE_DURATION) == 0x8);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10
struct PROCESS_ENERGY_VALUES
{
	std::uint64_t Cycles[2][4]; // 0x00
	std::uint64_t DiskEnergy; // 0x40
	std::uint64_t NetworkTailEnergy; // 0x48
	std::uint64_t MBBTailEnergy; // 0x50
	std::uint64_t NetworkTxRxBytes; // 0x58
	std::uint64_t MBBTxRxBytes; // 0x60
#if Q_NT_VERSION >= Q_NT_WIN10_RS2
	union
	{
		ENERGY_STATE_DURATION Durations[3];
		struct
		{
			ENERGY_STATE_DURATION ForegroundDuration;
			ENERGY_STATE_DURATION DesktopVisibleDuration;
			ENERGY_STATE_DURATION PSMForegroundDuration;
		};
	}; // 0x68
	std::uint32_t CompositionRendered; // 0x80
	std::uint32_t CompositionDirtyGenerated; // 0x84
	std::uint32_t CompositionDirtyPropagated; // 0x88
	std::uint32_t Reserved1; // 0x8C
	std::uint64_t AttributedCycles[2][4]; // 0x90
	std::uint64_t WorkOnBehalfCycles[2][4]; // 0xD0
#else
	union
	{
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
		std::uint16_t WindowInformation;
		struct
		{
			std::uint16_t Foreground : 1;
			std::uint16_t DesktopVisible : 1;
		};
#else
		std::uint32_t WindowInformation;
		struct
		{
			std::uint32_t Foreground : 1;
		};
#endif
	}; // 0x68
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	std::uint16_t CompositorRendered; // 0x6A
	std::uint16_t DirtyGenerated; // 0x6C
	std::uint16_t DirtyPropagated; // 0x6E
	std::int64_t DesktopVisibilityReportTimestamp; // 0x70
	std::uint64_t DesktopVisibleTime; // 0x78
#else
	std::uint32_t PixelArea; // 0x6C
	std::int64_t PixelReportTimestamp; // 0x70
	std::uint64_t PixelTime; // 0x78
#endif
	std::int64_t ForegroundReportTimestamp; // 0x80
	std::uint64_t ForegroundTime; // 0x88
#endif
};
static_assert(sizeof(PROCESS_ENERGY_VALUES) == 0x110);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS2
union TIMELINE_BITMAP
{
	std::uint64_t Value;
	struct
	{
		std::uint32_t EndTime;
		std::uint32_t Bitmap;
	};
};
static_assert(sizeof(TIMELINE_BITMAP) == 0x8);
#endif

struct PROCESS_ENERGY_VALUES_EXTENSION
{
	union
	{
		TIMELINE_BITMAP Timelines[
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			14
#else
			9
#endif
		];
		struct
		{
			TIMELINE_BITMAP CpuTimeline;
			TIMELINE_BITMAP DiskTimeline;
			TIMELINE_BITMAP NetworkTimeline;
			TIMELINE_BITMAP MBBTimeline;
			TIMELINE_BITMAP ForegroundTimeline;
			TIMELINE_BITMAP DesktopVisibleTimeline;
			TIMELINE_BITMAP CompositionRenderedTimeline;
			TIMELINE_BITMAP CompositionDirtyGeneratedTimeline;
			TIMELINE_BITMAP CompositionDirtyPropagatedTimeline;
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
			TIMELINE_BITMAP InputTimeline;
			TIMELINE_BITMAP AudioInTimeline;
			TIMELINE_BITMAP AudioOutTimeline;
			TIMELINE_BITMAP DisplayRequiredTimeline;
			TIMELINE_BITMAP KeyboardInputTimeline;
#endif
		};
	}; // 0x00
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	union
	{
		ENERGY_STATE_DURATION Durations[5];
		struct
		{
			ENERGY_STATE_DURATION InputDuration;
			ENERGY_STATE_DURATION AudioInDuration;
			ENERGY_STATE_DURATION AudioOutDuration;
			ENERGY_STATE_DURATION DisplayRequiredDuration;
			ENERGY_STATE_DURATION PSMBackgroundDuration;
		};
	}; // 0x70
	std::uint32_t KeyboardInput; // 0x98
	std::uint32_t MouseInput; // 0x9C
#endif
};
static_assert(sizeof(PROCESS_ENERGY_VALUES_EXTENSION) == 0xA0);

struct PROCESS_EXTENDED_ENERGY_VALUES
{
	PROCESS_ENERGY_VALUES Base; // 0x0000
	PROCESS_ENERGY_VALUES_EXTENSION Extension; // 0x0110
};
static_assert(sizeof(PROCESS_EXTENDED_ENERGY_VALUES) == 0x1B0);

#if Q_NT_VERSION >= Q_NT_WIN10_RS3
struct POWER_THROTTLING_PROCESS_STATE
{
	std::uint32_t Version; // 0x0
	std::uint32_t ControlMask; // 0x4
	std::uint32_t StateMask; // 0x8
};
static_assert(sizeof(POWER_THROTTLING_PROCESS_STATE) == 0xC);
#else
using PROCESS_ACTIVITY_THROTTLE_STATE = enum _PROCESS_ACTIVITY_THROTTLE_STATE
{
	ProcessActivityThrottleStateSystemManaged = 0,
	ProcessActivityThrottleStateForceOn = 1,
	ProcessActivityThrottleStateForceOff = 2,
	MaxProcessActivityThrottleState = 3
};

using PROCESS_ACTIVITY_THROTTLE_POLICY_OP = enum _PROCESS_ACTIVITY_THROTTLE_POLICY_OP
{
	ProcessActivityThrottlePolicyDisable = 0,
	ProcessActivityThrottlePolicyEnable = 1,
	ProcessActivityThrottlePolicyDefault = 2,
	MaxProcessActivityThrottlePolicy = 3
};

struct PROCESS_ACTIVITY_THROTTLE_POLICY
{
	PROCESS_ACTIVITY_THROTTLE_POLICY_OP Operation; // 0x0
	std::uint32_t PolicyFlags; // 0x4
};
#endif

#ifndef _Q_NT_JOB_WAKE_FILTER
#define _Q_NT_JOB_WAKE_FILTER
struct JOBOBJECT_WAKE_FILTER
{
	std::uint32_t HighEdgeFilter; // 0x0
	std::uint32_t LowEdgeFilter; // 0x4
};
static_assert(sizeof(JOBOBJECT_WAKE_FILTER) == 0x8);
#endif

struct PROCESS_WAKE_INFORMATION
{
	std::uint64_t NotificationChannel; // 0x00
	std::uint32_t WakeCounters[7]; // 0x08
	JOBOBJECT_WAKE_FILTER WakeFilter; // 0x24
};
static_assert(sizeof(PROCESS_WAKE_INFORMATION) == 0x30);

struct PROCESS_ENERGY_TRACKING_STATE
{
	std::uint32_t StateUpdateMask; // 0x00
	std::uint32_t StateDesiredValue; // 0x04
	std::uint32_t StateSequence; // 0x08
	std::uint32_t UpdateTag : 1; // 0x0C
	wchar_t Tag[64]; // 0x10
};
static_assert(sizeof(PROCESS_ENERGY_TRACKING_STATE) == 0x90);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS3
_Q_NT_BIT_TEMPLATE struct MANAGE_WRITES_TO_EXECUTABLE_MEMORY
{
private:
	_Q_NT_BIT_TYPE
public:
	struct
	{
		std::uint32_t Version : 8;
		std::uint32_t ProcessEnableWriteExceptions : 1;
		std::uint32_t ThreadAllowWrites : 1;
		std::uint32_t Spare : 22;
	}; // 0x0
#if Q_NT_VERSION >= Q_NT_WIN10_19H1
	BitnessType_t<void*> KernelWriteToExecutableSignal; // 0x4 / 0x8
#endif
};
_Q_NT_BIT_ASSERT(MANAGE_WRITES_TO_EXECUTABLE_MEMORY, 0x8, 0x10);

// @todo: TELEMETRY_COVERAGE_HEADER, TELEMETRY_COVERAGE_POINT | add inside "telemetry.h"?

union PROCESS_READWRITEVM_LOGGING_INFORMATION
{
	std::uint8_t Flags;
	struct
	{
		std::uint8_t EnableReadVmLogging : 1;
		std::uint8_t EnableWriteVmLogging : 1;
		std::uint8_t Unused : 6;
	};
};
static_assert(sizeof(PROCESS_READWRITEVM_LOGGING_INFORMATION) == 0x1);

struct PROCESS_UPTIME_INFORMATION
{
	std::uint64_t QueryInterruptTime; // 0x00
	std::uint64_t QueryUnbiasedTime; // 0x08
	std::uint64_t EndInterruptTime; // 0x10
	std::uint64_t TimeSinceCreation; // 0x18
	std::uint64_t Uptime; // 0x20
	std::uint64_t SuspendedTime; // 0x28
	struct
	{
		std::uint32_t HangCount : 4;
		std::uint32_t GhostCount : 4;
		std::uint32_t Crashed : 1;
		std::uint32_t Terminated : 1;
	}; // 0x30
};
static_assert(sizeof(PROCESS_UPTIME_INFORMATION) == 0x38);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS4
union PROCESS_SYSTEM_RESOURCE_MANAGEMENT
{
	std::uint32_t Flags;
	struct
	{
		std::uint32_t Foreground : 1;
		std::uint32_t Reserved : 31;
	};
};
static_assert(sizeof(PROCESS_SYSTEM_RESOURCE_MANAGEMENT) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_RS5
struct PROCESS_SECURITY_DOMAIN_INFORMATION
{
	std::uint64_t SecurityDomain;
};
static_assert(sizeof(PROCESS_SECURITY_DOMAIN_INFORMATION) == 0x8);

_Q_NT_BIT_TEMPLATE struct PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<HANDLE> ProcessHandle;
};
static_assert(sizeof(PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION<32U>) == 0x4 && sizeof(PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION<64>) == 0x8);

union PROCESS_LOGGING_INFORMATION
{
	std::uint32_t Flags;
	struct
	{
		std::uint32_t EnableReadVmLogging : 1;
		std::uint32_t EnableWriteVmLogging : 1;
		std::uint32_t EnableProcessSuspendResumeLogging : 1;
		std::uint32_t EnableThreadSuspendResumeLogging : 1;
#if Q_NT_VERSION >= Q_NT_WIN11
		std::uint32_t EnableLocalExecProtectVmLogging : 1;
		std::uint32_t EnableRemoteExecProtectVmLogging : 1;
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
		std::uint32_t EnableImpersonationLogging : 1;
		std::uint32_t Reserved : 25;
#else
		std::uint32_t Reserved : 26;
#endif
#else
		std::uint32_t Reserved : 28;
#endif
	};
};
static_assert(sizeof(PROCESS_LOGGING_INFORMATION) == 0x4);

struct PROCESS_LEAP_SECOND_INFORMATION
{
	std::uint32_t Flags; // 0x0
	std::uint32_t Reserved; // 0x4
};
static_assert(sizeof(PROCESS_LEAP_SECOND_INFORMATION) == 0x8);
#endif

#if Q_NT_VERSION >= Q_NT_WIN10_19H1
_Q_NT_BIT_TEMPLATE struct PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::size_t> ReserveSize; // 0x00
	BitnessType_t<std::size_t> CommitSize; // 0x04 / 0x08
	std::uint32_t PreferredNode; // 0x08 / 0x10
	std::uint32_t Reserved; // 0x0C / 0x14
	BitnessType_t<void*> Ssp; // 0x10 / 0x18
};
static_assert(sizeof(PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION<32U>) == 0x14 && sizeof(PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION<64>) == 0x20);

_Q_NT_BIT_TEMPLATE struct PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> Ssp;
};
static_assert(sizeof(PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION<32U>) == 0x4 && sizeof(PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION<64>) == 0x8);
#endif

// @todo: since 20H1 (WINSDK), but listed since 21H1
#if Q_NT_VERSION >= Q_NT_WIN10_20H1
_Q_NT_BIT_TEMPLATE struct PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<void*> BaseAddress; // 0x00
	BitnessType_t<std::size_t> Size; // 0x04 / 0x08
	std::uint32_t Flags; // 0x08 / 0x10
};
static_assert(sizeof(PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE<32U>) == 0xC && sizeof(PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE<64>) == 0x18);

_Q_NT_BIT_TEMPLATE struct PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t NumberOfRanges; // 0x0
	std::uint16_t Reserved; // 0x2
	std::uint32_t Reserved2; // 0x4
	BitnessType_t<PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE<nBitness>*> Ranges; // 0x8
};
static_assert(sizeof(PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION<32U>) == 0xC && sizeof(PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION<64>) == 0x10);
#endif

#if Q_NT_VERSION >= Q_NT_WIN11_22H2
// @todo: since 22H2, but listed since 20H1
struct PROCESS_SYSCALL_PROVIDER_INFORMATION
{
	GUID ProviderId; // 0x00
	std::uint8_t Level; // 0x10
};
static_assert(sizeof(PROCESS_SYSCALL_PROVIDER_INFORMATION) == 0x14);

_Q_NT_BIT_TEMPLATE struct PROCESS_DYNAMIC_EH_CONTINUATION_TARGET
{
private:
	_Q_NT_BIT_TYPE
public:
	BitnessType_t<std::uintptr_t> TargetAddress; // 0x0
	BitnessType_t<std::uintptr_t> Flags; // 0x4 / 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_DYNAMIC_EH_CONTINUATION_TARGET, 0x8, 0x10);

_Q_NT_BIT_TEMPLATE struct PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint16_t NumberOfTargets; // 0x0
	std::uint16_t Reserved; // 0x2
	std::uint32_t Reserved2; // 0x4
	BitnessType_t<PROCESS_DYNAMIC_EH_CONTINUATION_TARGET<nBitness>*> Targets; // 0x8
};
_Q_NT_BIT_ASSERT(PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION, 0xC, 0x10);
#endif

#if Q_NT_VERSION >= Q_NT_WIN11_22H2
struct PROCESS_PRIORITY_CLASS_EX
{
	union
	{
		std::uint16_t AllFlags;
		struct
		{
			std::uint16_t ForegroundValid : 1;
			std::uint16_t PriorityClassValid : 1;
		};
	}; // 0x0
	std::uint8_t PriorityClass; // 0x2
	bool Foreground; // 0x3
};
static_assert(sizeof(PROCESS_PRIORITY_CLASS_EX) == 0x4);

struct PROCESS_MEMBERSHIP_INFORMATION
{
	std::uint32_t ServerSiloId;
};
static_assert(sizeof(PROCESS_MEMBERSHIP_INFORMATION) == 0x4);
#endif

#if Q_NT_VERSION >= Q_NT_WIN11_24H2
struct PROCESS_NETWORK_COUNTERS
{
	std::uint64_t BytesIn; // 0x0
	std::uint64_t BytesOut; // 0x8
};
static_assert(sizeof(PROCESS_NETWORK_COUNTERS) == 0x10);

_Q_NT_BIT_TEMPLATE struct PROCESS_TEB_VALUE_INFORMATION
{
private:
	_Q_NT_BIT_TYPE
public:
	std::uint32_t ThreadId; // 0x0
	std::uint32_t TebOffset; // 0x4
	BitnessType_t<std::uintptr_t> Value; // 0x8
};
static_assert(sizeof(PROCESS_TEB_VALUE_INFORMATION<32U>) == 0xC && sizeof(PROCESS_TEB_VALUE_INFORMATION<64>) == 0x10);
#endif
#pragma endregion
#pragma pack(pop)