KUSER_SHARED_DATA structure (ntddk.h)

Artikel
10/03/2022

This topic describes the KUSER_SHARED_DATA structure.

Syntax

typedef struct _KUSER_SHARED_DATA {
  ULONG                         TickCountLowDeprecated;
  ULONG                         TickCountMultiplier;
  KSYSTEM_TIME                  InterruptTime;
  KSYSTEM_TIME                  SystemTime;
  KSYSTEM_TIME                  TimeZoneBias;
  USHORT                        ImageNumberLow;
  USHORT                        ImageNumberHigh;
  WCHAR                         NtSystemRoot[260];
  ULONG                         MaxStackTraceDepth;
  ULONG                         CryptoExponent;
  ULONG                         TimeZoneId;
  ULONG                         LargePageMinimum;
  ULONG                         AitSamplingValue;
  ULONG                         AppCompatFlag;
  ULONGLONG                     RNGSeedVersion;
  ULONG                         GlobalValidationRunlevel;
  LONG                          TimeZoneBiasStamp;
  ULONG                         NtBuildNumber;
  NT_PRODUCT_TYPE               NtProductType;
  BOOLEAN                       ProductTypeIsValid;
  BOOLEAN                       Reserved0[1];
  USHORT                        NativeProcessorArchitecture;
  ULONG                         NtMajorVersion;
  ULONG                         NtMinorVersion;
  BOOLEAN                       ProcessorFeatures[PROCESSOR_FEATURE_MAX];
  ULONG                         Reserved1;
  ULONG                         Reserved3;
  ULONG                         TimeSlip;
  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
  ULONG                         BootId;
  LARGE_INTEGER                 SystemExpirationDate;
  ULONG                         SuiteMask;
  BOOLEAN                       KdDebuggerEnabled;
  union {
    UCHAR MitigationPolicies;
    struct {
      UCHAR NXSupportPolicy : 2;
      UCHAR SEHValidationPolicy : 2;
      UCHAR CurDirDevicesSkippedForDlls : 2;
      UCHAR Reserved : 2;
    };
  };
  USHORT                        CyclesPerYield;
  ULONG                         ActiveConsoleId;
  ULONG                         DismountCount;
  ULONG                         ComPlusPackage;
  ULONG                         LastSystemRITEventTickCount;
  ULONG                         NumberOfPhysicalPages;
  BOOLEAN                       SafeBootMode;
  union {
    UCHAR VirtualizationFlags;
    struct {
      UCHAR ArchStartedInEl2 : 1;
      UCHAR QcSlIsSupported : 1;
    };
  };
  UCHAR                         Reserved12[2];
  union {
    ULONG SharedDataFlags;
    struct {
      ULONG DbgErrorPortPresent : 1;
      ULONG DbgElevationEnabled : 1;
      ULONG DbgVirtEnabled : 1;
      ULONG DbgInstallerDetectEnabled : 1;
      ULONG DbgLkgEnabled : 1;
      ULONG DbgDynProcessorEnabled : 1;
      ULONG DbgConsoleBrokerEnabled : 1;
      ULONG DbgSecureBootEnabled : 1;
      ULONG DbgMultiSessionSku : 1;
      ULONG DbgMultiUsersInSessionSku : 1;
      ULONG DbgStateSeparationEnabled : 1;
      ULONG SpareBits : 21;
    } DUMMYSTRUCTNAME2;
  } DUMMYUNIONNAME2;
  ULONG                         DataFlagsPad[1];
  ULONGLONG                     TestRetInstruction;
  LONGLONG                      QpcFrequency;
  ULONG                         SystemCall;
  ULONG                         Reserved2;
  ULONGLONG                     FullNumberOfPhysicalPages;
  ULONGLONG                     SystemCallPad[1];
  union {
    KSYSTEM_TIME TickCount;
    ULONG64      TickCountQuad;
    struct {
      ULONG ReservedTickCountOverlay[3];
      ULONG TickCountPad[1];
    } DUMMYSTRUCTNAME;
  } DUMMYUNIONNAME3;
  ULONG                         Cookie;
  ULONG                         CookiePad[1];
  LONGLONG                      ConsoleSessionForegroundProcessId;
  ULONGLONG                     TimeUpdateLock;
  ULONGLONG                     BaselineSystemTimeQpc;
  ULONGLONG                     BaselineInterruptTimeQpc;
  ULONGLONG                     QpcSystemTimeIncrement;
  ULONGLONG                     QpcInterruptTimeIncrement;
  UCHAR                         QpcSystemTimeIncrementShift;
  UCHAR                         QpcInterruptTimeIncrementShift;
  USHORT                        UnparkedProcessorCount;
  ULONG                         EnclaveFeatureMask[4];
  ULONG                         TelemetryCoverageRound;
  USHORT                        UserModeGlobalLogger[16];
  ULONG                         ImageFileExecutionOptions;
  ULONG                         LangGenerationCount;
  ULONGLONG                     Reserved4;
  ULONGLONG                     InterruptTimeBias;
  ULONGLONG                     QpcBias;
  ULONG                         ActiveProcessorCount;
  UCHAR                         ActiveGroupCount;
  UCHAR                         Reserved9;
  union {
    USHORT QpcData;
    struct {
      UCHAR QpcBypassEnabled;
      UCHAR QpcReserved;
    };
  };
  LARGE_INTEGER                 TimeZoneBiasEffectiveStart;
  LARGE_INTEGER                 TimeZoneBiasEffectiveEnd;
  XSTATE_CONFIGURATION          XState;
  KSYSTEM_TIME                  FeatureConfigurationChangeStamp;
  ULONG                         Spare;
  ULONG64                       UserPointerAuthMask;
  XSTATE_CONFIGURATION          XStateArm64;
  ULONG                         Reserved10[210];
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;

Members

TickCountLowDeprecated

Current low 32-bit of tick count.

TickCountMultiplier

Tick count multiplier.

InterruptTime

Current 64-bit interrupt time in 100ns units.

SystemTime

Current 64-bit system time in 100ns units.

TimeZoneBias

Current 64-bit time zone bias.

ImageNumberLow

Low image magic number for the host system.

ImageNumberHigh

High image magic number for the host system.

NtSystemRoot[260]

Copy of system root in unicode. This field must be accessed via the RtlGetNtSystemRoot API for an accurate result.

MaxStackTraceDepth

Maximum stack trace depth if tracing enabled.

CryptoExponent

Crypto exponent value.

TimeZoneId

Time zone ID.

LargePageMinimum

Defines the ULONG member LargePageMinimum.

AitSamplingValue

This value controls the AIT sampling rate.

AppCompatFlag

This value controls switchback processing.

RNGSeedVersion

Current kernel root RNG state seed version.

GlobalValidationRunlevel

This value controls assertion failure handling.

TimeZoneBiasStamp

Defines the LONG member TimeZoneBiasStamp.

NtBuildNumber

The shared collective build number undecorated with C or F. GetVersionEx hides the real number.

NtProductType

Product type. This field must be accessed via the RtlGetNtProductType API for an accurate result.

ProductTypeIsValid

Defines the BOOLEAN member ProductTypeIsValid.

Reserved0[1]

Reserved for future use.

NativeProcessorArchitecture

Defines the USHORT member NativeProcessorArchitecture.

NtMajorVersion

The NT major version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

NtMinorVersion

The NT minor version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

ProcessorFeatures[PROCESSOR_FEATURE_MAX]

Processor features.

Reserved1

Reserved for future use.

Reserved3

Reserved for future use.

TimeSlip

Time slippage while in debugger.

AlternativeArchitecture

Alternative system architecture. For example, NEC PC98xx on x86.

BootId

Boot sequence, incremented for each boot attempt by the OS loader.

SystemExpirationDate

If the system is an evaluation unit, the following field contains the date and time that the evaluation unit expires. A value of 0 indicates that there is no expiration. A non-zero value is the UTC absolute time that the system expires.

SuiteMask

Suite support. This field must be accessed via the RtlGetSuiteMask API for an accurate result.

KdDebuggerEnabled

TRUE if a kernel debugger is connected/enabled.

MitigationPolicies

Mitigation policies.

NXSupportPolicy

Defines the UCHAR member NXSupportPolicy.

SEHValidationPolicy

Defines the UCHAR member SEHValidationPolicy.

CurDirDevicesSkippedForDlls

Defines the UCHAR member CurDirDevicesSkippedForDlls.

Reserved

Reserved for future use.

CyclesPerYield

Measured duration of a single processor yield, in cycles. This is used by lock packages to determine how many times to spin waiting for a state change before blocking.

ActiveConsoleId

Current console session Id. Always zero on non-TS systems. This field must be accessed via the RtlGetActiveConsoleId API for an accurate result.

DismountCount

Force-dismounts cause handles to become invalid. Rather than always probe handles, a serial number of dismounts is maintained that clients can use to see if they need to probe handles.

ComPlusPackage

This field indicates the status of the 64-bit COM+ package on the system. It indicates whether the Intermediate Language (IL) COM+ images need to use the 64-bit COM+ runtime or the 32-bit COM+ runtime.

LastSystemRITEventTickCount

Time in tick count for system-wide last user input across all terminal sessions. For MP performance, it is not updated all the time (for example, once a minute per session). It is used for idle detection.

NumberOfPhysicalPages

Number of physical pages in the system. This can dynamically change as physical memory can be added or removed from a running system.

SafeBootMode

True if the system was booted in safe boot mode.

VirtualizationFlags

Virtualization flags.

ArchStartedInEl2

Keep this bitfield in sync with the one in arc.w.

QcSlIsSupported

Keep this bitfield in sync with the one in arc.w.

Reserved12[2]

Reserved for future use.

DUMMYUNIONNAME2

This is a packed bitfield that contains various flags concerning the system state. They must be manipulated using interlocked operations. DbgMultiSessionSku must be accessed via the RtlIsMultiSessionSku API for an accurate result.

DUMMYUNIONNAME2.SharedDataFlags

Defines the ULONG member SharedDataFlags.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2

Defines the DUMMYSTRUCTNAME2 structure.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgErrorPortPresent