Reverse Engineering - Resolving Confusion Over PsGetCurrentProcess, PsGetCurrentProcessId and PsGetProcessId - Using WinDbg to understand dependency between KPCR, KPRCB, K/ETHREAD, K/EPROCESS and KAPC_STATE structures.

This article contains functions and features that are not documented by the original manufacturer. By following advice in this article, you're doing so at your own risk. The methods presented in this article may rely on internal implementation and may not work in the future.

Intro

While doing some casual search I came across a question in an online forum where someone was asking how to decode the following x64 assembly sequence that they saw after disassembling the PsGetCurrentProcess function:

x64[Copy]

nt!PsGetCurrentProcess:
mov     rax, qword ptr gs:[188h]
mov     rax, qword ptr [rax+0B8h]
ret

They were able to pull out some relevant symbols for understanding the sequence above using WinDbg but were confused over the offsets used in the code snipped above.

Let me walk you through what happens there. It actually becomes quite easy once we pull out Microsoft public symbols with WinDbg.

There's a trio of somewhat confusing kernel functions that fall under the same umbrella: PsGetCurrentProcess (or IoGetCurrentProcess, which is really the same function), PsGetCurrentProcessId and PsGetProcessId. So I'll disassemble them all to clarify the meaning of their documentation.
I'll let the reader review their documentation first before continuing on with this article.

WinDbgX

Before we begin doing anything we will need a debugger to disassemble the functions in question. Moreover, we will need a kernel debugger because we're dealing with three kernel functions here.

Technically, you may get away with using a static disassembler (like Ghidra, for instance) and decompile the ntoskrnl.exe binary from the System32 folder. But then you will need to find a way to download symbols for it. On top of that, in my experience, Ghidra is not the best at properly parsing Microsoft symbols. Thus, I personally go with WinDbg for the Windows kernel work.

I've already explained how to set up WinDbgX as a kernel debugger. So make sure to do that. It will also help to install a Virtual Machine as a target OS for kernel debugging. We will use it to break at the corresponding functions and pull up symbols. (The same blog post will explain that as well.)

Then after you attach to the target OS with WinDbgX, break into it (by hitting Alt+Del on the keyboard) and then make sure that symbols are loaded:

WinDbg Command Window[Copy]

0: kd> .reload -f nt

In case you haven't done this already, make sure to configure the symbol server in WinDbgX by going to: File -> Settings -> Debugging settings -> and add srv* into the "Symbol path" field and hit OK.
The new WinDbgX makes this process much simpler than the old WinDbg.

Then disassemble our required functions. I'll go one by one.

x64 Disassembly

As you probably know a compiled C (or C++) code is specific to a CPU architecture. Since Intel/AMD x86-64 architecture is still more popular, let me start from it.

Run the following commands in WinDbgX to see the disassembly of our functions:

WinDbg Command Window[Copy]

0: kd> u nt!PsGetCurrentProcess
nt!PsGetCurrentProcess:
       fffff800`57e3a4b0 65488b042588010000      mov     rax,qword ptr gs:[188h]
       fffff800`57e3a4b9 488b80b8000000          mov     rax,qword ptr [rax+0B8h]
       fffff800`57e3a4c0 c3                      ret

WinDbg Command Window[Copy]

0: kd> u nt!PsGetCurrentProcessId
nt!PsGetCurrentProcessId:
       fffff800`57e05dd0 65488b042588010000      mov     rax,qword ptr gs:[188h]
       fffff800`57e05dd9 488b8078040000          mov     rax,qword ptr [rax+478h]
       fffff800`57e05de0 c3                      ret

WinDbg Command Window[Copy]

0: kd> u nt!PsGetProcessId
nt!PsGetProcessId:
       fffff800`57e6ab30 488b8140040000          mov     rax,qword ptr [rcx+440h]
       fffff800`57e6ab37 c3                      ret

As you can see those functions are pretty simple. Thus, I think we can handle all three at once.

I'm using the module name (i.e. nt), followed by an exclamation mark, in front of a function name to remove any ambiguity in case there are same-named functions somewhere else in other mapped modules. The nt part is also a special module name, which implies ntoskrnl or ntkrnlmp as the actual executable file, in case you will be disassembling those functions elsewhere, like in Ghidra, for instance.
The difference between the ntoskrnl and ntkrnlmp names is mainly a legacy one. During some early days of multi-processor support Microsoft were building two versions of the NT kernel: ntoskrnl with a single-core support (a very old school) and ntkrnlmp having a multi-processor support, and thus the mp part. Now I don't think they care about building for a single CPU, and thus both names are often used interchangeably.

PsGetCurrentProcess

Let's start from nt!PsGetCurrentProcess.

x64[Copy]

    mov     rax,qword ptr gs:[188h]
    mov     rax,qword ptr [rax+0B8h]
    ret

The first instruction uses the gs segment register's base address as a pointer to the internal nt!_KPCR structure. This is true almost everywhere inside the Windows kernel. That is kernel's quick way to retrieve basic details about the CPU core that is currently executing some code.

I believe KPCR stands for "Kernel Processor Control Region". It is a per-processor kernel data structure used by the kernel to store information about the current logical processor. It is largely undocumented and changes often between versions of Windows.

We can dump it using the dt command in WinDbg:

WinDbg Command Window[Copy]

0: kd> dt nt!_KPCR
   +0x000 NtTib            : _NT_TIB
   +0x000 GdtBase          : Ptr64 _KGDTENTRY64
   +0x008 TssBase          : Ptr64 _KTSS64
   +0x010 UserRsp          : Uint8B
   +0x018 Self             : Ptr64 _KPCR
   +0x020 CurrentPrcb      : Ptr64 _KPRCB
   +0x028 LockArray        : Ptr64 _KSPIN_LOCK_QUEUE
   +0x030 Used_Self        : Ptr64 Void
   +0x038 IdtBase          : Ptr64 _KIDTENTRY64
   +0x040 Unused           : [2] Uint8B
   +0x050 Irql             : UChar
   +0x051 SecondLevelCacheAssociativity : UChar
   +0x052 ObsoleteNumber   : UChar
   +0x053 Fill0            : UChar
   +0x054 Unused0          : [3] Uint4B
   +0x060 MajorVersion     : Uint2B
   +0x062 MinorVersion     : Uint2B
   +0x064 StallScaleFactor : Uint4B
   +0x068 Unused1          : [3] Ptr64 Void
   +0x080 KernelReserved   : [15] Uint4B
   +0x0bc SecondLevelCacheSize : Uint4B
   +0x0c0 HalReserved      : [16] Uint4B
   +0x100 Unused2          : Uint4B
   +0x108 KdVersionBlock   : Ptr64 Void
   +0x110 Unused3          : Ptr64 Void
   +0x118 PcrAlign1        : [24] Uint4B
   +0x180 Prcb             : _KPRCB

The offset that we're interested in is 0x188:

x64[Copy]

    
    fffff800`57e3a4b0 65488b042588010000      mov     rax,qword ptr gs:[188h]

But as we can see from the nt!_KPCR struct, we're a bit short. The last member is at the offset 0x180. That is because KPCR is a very old structure, and Microsoft has greatly expanded it by tacking the nt!_KPRCB struct at the end of it.

I believe KPRCB stands for "Kernel Processor Control Block". It doesn't really tell us much, except that it's basically a bigger brother of the KPCR struct.

We can dump it with WinDbg as well:

WinDbg Command Window[Copy]

0: kd> dt nt!_KPRCB
   +0x000 MxCsr            : Uint4B
   +0x004 LegacyNumber     : UChar
   +0x005 ReservedMustBeZero : UChar
   +0x006 InterruptRequest : UChar
   +0x007 IdleHalt         : UChar
   +0x008 CurrentThread    : Ptr64 _KTHREAD
   +0x010 NextThread       : Ptr64 _KTHREAD
   +0x018 IdleThread       : Ptr64 _KTHREAD
   +0x020 NestingLevel     : UChar
   +0x021 ClockOwner       : UChar
   +0x022 PendingTickFlags : UChar
   +0x022 PendingTick      : Pos 0, 1 Bit
   +0x022 PendingBackupTick : Pos 1, 1 Bit
   +0x023 IdleState        : UChar
   +0x024 Number           : Uint4B
   +0x028 RspBase          : Uint8B
   +0x030 PrcbLock         : Uint8B
   +0x038 PriorityState    : Ptr64 Char
   +0x040 CpuType          : Char
   +0x041 CpuID            : Char
   +0x042 CpuStep          : Uint2B
   +0x042 CpuStepping      : UChar
   +0x043 CpuModel         : UChar
   +0x044 MHz              : Uint4B
   +0x048 HalReserved      : [8] Uint8B
   +0x088 MinorVersion     : Uint2B
   +0x08a MajorVersion     : Uint2B
   +0x08c BuildType        : UChar
   +0x08d CpuVendor        : UChar
   +0x08e CoresPerPhysicalProcessor : UChar
   +0x08f LogicalProcessorsPerCore : UChar
   +0x090 TscFrequency     : Uint8B
   +0x098 PrcbPad04        : [5] Uint8B
   +0x0c0 ParentNode       : Ptr64 _KNODE
   +0x0c8 GroupSetMember   : Uint8B
   +0x0d0 Group            : UChar
   +0x0d1 GroupIndex       : UChar
   +0x0d2 PrcbPad05        : [2] UChar
   +0x0d4 InitialApicId    : Uint4B
   +0x0d8 ScbOffset        : Uint4B
   +0x0dc ApicMask         : Uint4B
   +0x0e0 AcpiReserved     : Ptr64 Void
   +0x0e8 CFlushSize       : Uint4B
   +0x0ec PrcbFlags        : _KPRCBFLAG
   +0x0f0 TrappedSecurityDomain : Uint8B
   +0x0f8 BpbState         : UChar
   +0x0f8 BpbCpuIdle       : Pos 0, 1 Bit
   +0x0f8 BpbFlushRsbOnTrap : Pos 1, 1 Bit
   +0x0f8 BpbIbpbOnReturn  : Pos 2, 1 Bit
   +0x0f8 BpbIbpbOnTrap    : Pos 3, 1 Bit
   +0x0f8 BpbIbpbOnRetpolineExit : Pos 4, 1 Bit
   +0x0f8 BpbStateReserved : Pos 5, 3 Bits
   +0x0f9 BpbFeatures      : UChar
   +0x0f9 BpbClearOnIdle   : Pos 0, 1 Bit
   +0x0f9 BpbEnabled       : Pos 1, 1 Bit
   +0x0f9 BpbSmep          : Pos 2, 1 Bit
   +0x0f9 BpbFeaturesReserved : Pos 3, 5 Bits
   +0x0fa BpbCurrentSpecCtrl : UChar
   +0x0fb BpbKernelSpecCtrl : UChar
   +0x0fc BpbNmiSpecCtrl   : UChar
   +0x0fd BpbUserSpecCtrl  : UChar
   +0x0fe PairRegister     : Int2B
   +0x0f0 PrcbPad11        : [2] Uint8B
   +0x100 ProcessorState   : _KPROCESSOR_STATE
   +0x6c0 ExtendedSupervisorState : Ptr64 _XSAVE_AREA_HEADER
   +0x6c8 ProcessorSignature : Uint4B
   +0x6cc ProcessorFlags   : Uint4B
   +0x6d0 BpbRetpolineExitSpecCtrl : UChar
   +0x6d1 BpbTrappedRetpolineExitSpecCtrl : UChar
   +0x6d2 BpbTrappedBpbState : UChar
   +0x6d2 BpbTrappedCpuIdle : Pos 0, 1 Bit
   +0x6d2 BpbTrappedFlushRsbOnTrap : Pos 1, 1 Bit
   +0x6d2 BpbTrappedIbpbOnReturn : Pos 2, 1 Bit
   +0x6d2 BpbTrappedIbpbOnTrap : Pos 3, 1 Bit
   +0x6d2 BpbTrappedIbpbOnRetpolineExit : Pos 4, 1 Bit
   +0x6d2 BpbtrappedBpbStateReserved : Pos 5, 3 Bits
   +0x6d3 BpbRetpolineState : UChar
   +0x6d3 BpbRunningNonRetpolineCode : Pos 0, 1 Bit
   +0x6d3 BpbIndirectCallsSafe : Pos 1, 1 Bit
   +0x6d3 BpbRetpolineEnabled : Pos 2, 1 Bit
   +0x6d3 BpbRetpolineStateReserved : Pos 3, 5 Bits
   +0x6d4 PrcbPad12b       : Uint4B
   +0x6d0 PrcbPad12a       : Uint8B
   +0x6d8 PrcbPad12        : [3] Uint8B
   +0x6f0 LockQueue        : [17] _KSPIN_LOCK_QUEUE
   +0x800 PPLookasideList  : [16] _PP_LOOKASIDE_LIST
   +0x900 PPNxPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x1500 PPNPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x2100 PPPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x2d00 MsrIa32TsxCtrl   : Uint8B
   +0x2d08 DeferredReadyListHead : _SINGLE_LIST_ENTRY
   +0x2d10 MmPageFaultCount : Int4B
   +0x2d14 MmCopyOnWriteCount : Int4B
   +0x2d18 MmTransitionCount : Int4B
   +0x2d1c MmDemandZeroCount : Int4B
   +0x2d20 MmPageReadCount  : Int4B
   +0x2d24 MmPageReadIoCount : Int4B
   +0x2d28 MmDirtyPagesWriteCount : Int4B
   +0x2d2c MmDirtyWriteIoCount : Int4B
   +0x2d30 MmMappedPagesWriteCount : Int4B
   +0x2d34 MmMappedWriteIoCount : Int4B
   +0x2d38 KeSystemCalls    : Uint4B
   +0x2d3c KeContextSwitches : Uint4B
   +0x2d40 PrcbPad40        : Uint4B
   +0x2d44 CcFastReadNoWait : Uint4B
   +0x2d48 CcFastReadWait   : Uint4B
   +0x2d4c CcFastReadNotPossible : Uint4B
   +0x2d50 CcCopyReadNoWait : Uint4B
   +0x2d54 CcCopyReadWait   : Uint4B
   +0x2d58 CcCopyReadNoWaitMiss : Uint4B
   +0x2d5c IoReadOperationCount : Int4B
   +0x2d60 IoWriteOperationCount : Int4B
   +0x2d64 IoOtherOperationCount : Int4B
   +0x2d68 IoReadTransferCount : _LARGE_INTEGER
   +0x2d70 IoWriteTransferCount : _LARGE_INTEGER
   +0x2d78 IoOtherTransferCount : _LARGE_INTEGER
   +0x2d80 PacketBarrier    : Int4B
   +0x2d84 TargetCount      : Int4B
   +0x2d88 IpiFrozen        : Uint4B
   +0x2d8c PrcbPad30        : Uint4B
   +0x2d90 IsrDpcStats      : Ptr64 Void
   +0x2d98 DeviceInterrupts : Uint4B
   +0x2d9c LookasideIrpFloat : Int4B
   +0x2da0 InterruptLastCount : Uint4B
   +0x2da4 InterruptRate    : Uint4B
   +0x2da8 PrcbPad31        : Uint8B
   +0x2db0 PairPrcb         : Ptr64 _KPRCB
   +0x2db8 StaticAffinity   : _KSTATIC_AFFINITY_BLOCK
   +0x3058 PrcbPad35        : [5] Uint8B
   +0x3080 InterruptObjectPool : _SLIST_HEADER
   +0x3090 DpcRuntimeHistoryHashTable : Ptr64 _RTL_HASH_TABLE
   +0x3098 DpcRuntimeHistoryHashTableCleanupDpc : Ptr64 _KDPC
   +0x30a0 CurrentDpcRoutine : Ptr64     void 
   +0x30a8 CurrentDpcRuntimeHistoryCached : Uint8B
   +0x30b0 CurrentDpcStartTime : Uint8B
   +0x30b8 PrcbPad41        : [1] Uint8B
   +0x30c0 DpcData          : [2] _KDPC_DATA
   +0x3110 DpcStack         : Ptr64 Void
   +0x3118 MaximumDpcQueueDepth : Int4B
   +0x311c DpcRequestRate   : Uint4B
   +0x3120 MinimumDpcRate   : Uint4B
   +0x3124 DpcLastCount     : Uint4B
   +0x3128 ThreadDpcEnable  : UChar
   +0x3129 QuantumEnd       : UChar
   +0x312a DpcRoutineActive : UChar
   +0x312b IdleSchedule     : UChar
   +0x312c DpcRequestSummary : Int4B
   +0x312c DpcRequestSlot   : [2] Int2B
   +0x312c NormalDpcState   : Int2B
   +0x312e ThreadDpcState   : Int2B
   +0x312c DpcNormalProcessingActive : Pos 0, 1 Bit
   +0x312c DpcNormalProcessingRequested : Pos 1, 1 Bit
   +0x312c DpcNormalThreadSignal : Pos 2, 1 Bit
   +0x312c DpcNormalTimerExpiration : Pos 3, 1 Bit
   +0x312c DpcNormalDpcPresent : Pos 4, 1 Bit
   +0x312c DpcNormalLocalInterrupt : Pos 5, 1 Bit
   +0x312c DpcNormalSpare   : Pos 6, 10 Bits
   +0x312c DpcThreadActive  : Pos 16, 1 Bit
   +0x312c DpcThreadRequested : Pos 17, 1 Bit
   +0x312c DpcThreadSpare   : Pos 18, 14 Bits
   +0x3130 PrcbPad93        : Uint4B
   +0x3134 LastTick         : Uint4B
   +0x3138 ClockInterrupts  : Uint4B
   +0x313c ReadyScanTick    : Uint4B
   +0x3140 InterruptObject  : [256] Ptr64 Void
   +0x3940 TimerTable       : _KTIMER_TABLE
   +0x7b58 PrcbPad92        : [10] Uint4B
   +0x7b80 DpcGate          : _KGATE
   +0x7b98 PrcbPad52        : Ptr64 Void
   +0x7ba0 CallDpc          : _KDPC
   +0x7be0 ClockKeepAlive   : Int4B
   +0x7be4 PrcbPad60        : [2] UChar
   +0x7be6 NmiActive        : UChar
   +0x7be7 MceActive        : UChar
   +0x7be6 CombinedNmiMceActive : Uint2B
   +0x7be8 DpcWatchdogPeriod : Int4B
   +0x7bec DpcWatchdogCount : Int4B
   +0x7bf0 KeSpinLockOrdering : Int4B
   +0x7bf4 DpcWatchdogProfileCumulativeDpcThreshold : Uint4B
   +0x7bf8 CachedPtes       : Ptr64 Void
   +0x7c00 WaitListHead     : _LIST_ENTRY
   +0x7c10 WaitLock         : Uint8B
   +0x7c18 ReadySummary     : Uint4B
   +0x7c1c AffinitizedSelectionMask : Int4B
   +0x7c20 QueueIndex       : Uint4B
   +0x7c24 PrcbPad75        : [2] Uint4B
   +0x7c2c DpcWatchdogSequenceNumber : Uint4B
   +0x7c30 TimerExpirationDpc : _KDPC
   +0x7c70 ScbQueue         : _RTL_RB_TREE
   +0x7c80 DispatcherReadyListHead : [32] _LIST_ENTRY
   +0x7e80 InterruptCount   : Uint4B
   +0x7e84 KernelTime       : Uint4B
   +0x7e88 UserTime         : Uint4B
   +0x7e8c DpcTime          : Uint4B
   +0x7e90 InterruptTime    : Uint4B
   +0x7e94 AdjustDpcThreshold : Uint4B
   +0x7e98 DebuggerSavedIRQL : UChar
   +0x7e99 GroupSchedulingOverQuota : UChar
   +0x7e9a DeepSleep        : UChar
   +0x7e9b PrcbPad80        : UChar
   +0x7e9c DpcTimeCount     : Uint4B
   +0x7ea0 DpcTimeLimit     : Uint4B
   +0x7ea4 PeriodicCount    : Uint4B
   +0x7ea8 PeriodicBias     : Uint4B
   +0x7eac AvailableTime    : Uint4B
   +0x7eb0 KeExceptionDispatchCount : Uint4B
   +0x7eb4 ReadyThreadCount : Uint4B
   +0x7eb8 ReadyQueueExpectedRunTime : Uint8B
   +0x7ec0 StartCycles      : Uint8B
   +0x7ec8 TaggedCyclesStart : Uint8B
   +0x7ed0 TaggedCycles     : [3] Uint8B
   +0x7ee8 AffinitizedCycles : Uint8B
   +0x7ef0 ImportantCycles  : Uint8B
   +0x7ef8 UnimportantCycles : Uint8B
   +0x7f00 DpcWatchdogProfileSingleDpcThreshold : Uint4B
   +0x7f04 MmSpinLockOrdering : Int4B
   +0x7f08 CachedStack      : Ptr64 Void
   +0x7f10 PageColor        : Uint4B
   +0x7f14 NodeColor        : Uint4B
   +0x7f18 NodeShiftedColor : Uint4B
   +0x7f1c SecondaryColorMask : Uint4B
   +0x7f20 PrcbPad81        : [6] UChar
   +0x7f26 ExceptionStackActive : UChar
   +0x7f27 TbFlushListActive : UChar
   +0x7f28 ExceptionStack   : Ptr64 Void
   +0x7f30 PrcbPad82        : [1] Uint8B
   +0x7f38 CycleTime        : Uint8B
   +0x7f40 Cycles           : [4] [2] Uint8B
   +0x7f80 CcFastMdlReadNoWait : Uint4B
   +0x7f84 CcFastMdlReadWait : Uint4B
   +0x7f88 CcFastMdlReadNotPossible : Uint4B
   +0x7f8c CcMapDataNoWait  : Uint4B
   +0x7f90 CcMapDataWait    : Uint4B
   +0x7f94 CcPinMappedDataCount : Uint4B
   +0x7f98 CcPinReadNoWait  : Uint4B
   +0x7f9c CcPinReadWait    : Uint4B
   +0x7fa0 CcMdlReadNoWait  : Uint4B
   +0x7fa4 CcMdlReadWait    : Uint4B
   +0x7fa8 CcLazyWriteHotSpots : Uint4B
   +0x7fac CcLazyWriteIos   : Uint4B
   +0x7fb0 CcLazyWritePages : Uint4B
   +0x7fb4 CcDataFlushes    : Uint4B
   +0x7fb8 CcDataPages      : Uint4B
   +0x7fbc CcLostDelayedWrites : Uint4B
   +0x7fc0 CcFastReadResourceMiss : Uint4B
   +0x7fc4 CcCopyReadWaitMiss : Uint4B
   +0x7fc8 CcFastMdlReadResourceMiss : Uint4B
   +0x7fcc CcMapDataNoWaitMiss : Uint4B
   +0x7fd0 CcMapDataWaitMiss : Uint4B
   +0x7fd4 CcPinReadNoWaitMiss : Uint4B
   +0x7fd8 CcPinReadWaitMiss : Uint4B
   +0x7fdc CcMdlReadNoWaitMiss : Uint4B
   +0x7fe0 CcMdlReadWaitMiss : Uint4B
   +0x7fe4 CcReadAheadIos   : Uint4B
   +0x7fe8 MmCacheTransitionCount : Int4B
   +0x7fec MmCacheReadCount : Int4B
   +0x7ff0 MmCacheIoCount   : Int4B
   +0x7ff4 PrcbPad91        : Uint4B
   +0x7ff8 MmInternal       : Ptr64 Void
   +0x8000 PowerState       : _PROCESSOR_POWER_STATE
   +0x8200 HyperPte         : Ptr64 Void
   +0x8208 ScbList          : _LIST_ENTRY
   +0x8218 ForceIdleDpc     : _KDPC
   +0x8258 DpcWatchdogDpc   : _KDPC
   +0x8298 DpcWatchdogTimer : _KTIMER
   +0x82d8 Cache            : [5] _CACHE_DESCRIPTOR
   +0x8314 CacheCount       : Uint4B
   +0x8318 CachedCommit     : Uint4B
   +0x831c CachedResidentAvailable : Uint4B
   +0x8320 WheaInfo         : Ptr64 Void
   +0x8328 EtwSupport       : Ptr64 Void
   +0x8330 ExSaPageArray    : Ptr64 Void
   +0x8338 KeAlignmentFixupCount : Uint4B
   +0x833c PrcbPad95        : Uint4B
   +0x8340 HypercallPageList : _SLIST_HEADER
   +0x8350 StatisticsPage   : Ptr64 Uint8B
   +0x8358 GenerationTarget : Uint8B
   +0x8360 PrcbPad85        : [4] Uint8B
   +0x8380 HypercallCachedPages : Ptr64 Void
   +0x8388 VirtualApicAssist : Ptr64 Void
   +0x8390 PackageProcessorSet : _KAFFINITY_EX
   +0x8438 PackageId        : Uint4B
   +0x843c PrcbPad86        : Uint4B
   +0x8440 SharedReadyQueueMask : Uint8B
   +0x8448 SharedReadyQueue : Ptr64 _KSHARED_READY_QUEUE
   +0x8450 SharedQueueScanOwner : Uint4B
   +0x8454 ScanSiblingIndex : Uint4B
   +0x8458 CoreProcessorSet : Uint8B
   +0x8460 ScanSiblingMask  : Uint8B
   +0x8468 LLCMask          : Uint8B
   +0x8470 CacheProcessorMask : [5] Uint8B
   +0x8498 ProcessorProfileControlArea : Ptr64 _PROCESSOR_PROFILE_CONTROL_AREA
   +0x84a0 ProfileEventIndexAddress : Ptr64 Void
   +0x84a8 DpcWatchdogProfile : Ptr64 Ptr64 Void
   +0x84b0 DpcWatchdogProfileCurrentEmptyCapture : Ptr64 Ptr64 Void
   +0x84b8 SchedulerAssist  : Ptr64 Void
   +0x84c0 SynchCounters    : _SYNCH_COUNTERS
   +0x8578 PrcbPad94        : Uint8B
   +0x8580 FsCounters       : _FILESYSTEM_DISK_COUNTERS
   +0x8590 VendorString     : [13] UChar
   +0x859d PrcbPad100       : [3] UChar
   +0x85a0 FeatureBits      : Uint8B
   +0x85a8 UpdateSignature  : _LARGE_INTEGER
   +0x85b0 PteBitCache      : Uint8B
   +0x85b8 PteBitOffset     : Uint4B
   +0x85bc PrcbPad105       : Uint4B
   +0x85c0 Context          : Ptr64 _CONTEXT
   +0x85c8 ContextFlagsInit : Uint4B
   +0x85cc PrcbPad115       : Uint4B
   +0x85d0 ExtendedState    : Ptr64 _XSAVE_AREA
   +0x85d8 IsrStack         : Ptr64 Void
   +0x85e0 EntropyTimingState : _KENTROPY_TIMING_STATE
   +0x8730 PrcbPad110       : Uint8B
   +0x8738 StibpPairingTrace : <anonymous-tag>
   +0x8770 AbSelfIoBoostsList : _SINGLE_LIST_ENTRY
   +0x8778 AbPropagateBoostsList : _SINGLE_LIST_ENTRY
   +0x8780 AbDpc            : _KDPC
   +0x87c0 IoIrpStackProfilerCurrent : _IOP_IRP_STACK_PROFILER
   +0x8814 IoIrpStackProfilerPrevious : _IOP_IRP_STACK_PROFILER
   +0x8868 SecureFault      : _KSECURE_FAULT_INFORMATION
   +0x8878 PrcbPad120       : Uint8B
   +0x8880 LocalSharedReadyQueue : _KSHARED_READY_QUEUE
   +0x8af0 PrcbPad125       : [2] Uint8B
   +0x8b00 TimerExpirationTraceCount : Uint4B
   +0x8b04 PrcbPad127       : Uint4B
   +0x8b08 TimerExpirationTrace : [16] _KTIMER_EXPIRATION_TRACE
   +0x8c08 PrcbPad128       : [7] Uint8B
   +0x8c40 Mailbox          : Ptr64 _REQUEST_MAILBOX
   +0x8c48 PrcbPad130       : [7] Uint8B
   +0x8c80 McheckContext    : [2] _MACHINE_CHECK_CONTEXT
   +0x8d20 PrcbPad134       : [4] Uint8B
   +0x8d40 SelfmapLockHandle : [4] _KLOCK_QUEUE_HANDLE
   +0x8da0 PrcbPad134a      : [4] Uint8B
   +0x8dc0 PrcbPad138       : [128] UChar
   +0x8e40 PrcbPad138a      : [64] UChar
   +0x8e80 KernelDirectoryTableBase : Uint8B
   +0x8e88 RspBaseShadow    : Uint8B
   +0x8e90 UserRspShadow    : Uint8B
   +0x8e98 ShadowFlags      : Uint4B
   +0x8e9c PrcbPad138b      : Uint4B
   +0x8ea0 PrcbPad138c      : Uint8B
   +0x8ea8 PrcbPad138d      : Uint2B
   +0x8eaa VerwSelector     : Uint2B
   +0x8eac DbgMceNestingLevel : Uint4B
   +0x8eb0 DbgMceFlags      : Uint4B
   +0x8eb4 PrcbPad139b      : Uint4B
   +0x8eb8 PrcbPad140       : [505] Uint8B
   +0x9e80 PrcbPad140a      : [8] Uint8B
   +0x9ec0 PrcbPad141       : [504] Uint8B
   +0xae80 PrcbPad141a      : [64] UChar
   +0xaec0 RequestMailbox   : [1] _REQUEST_MAILBOX

As you can see it's a huge structure.

You will be absolutely crazy to rely on the offsets or names of most of the members of this and other structs that I list in this article, because only god and Microsoft kernel folks know the exact meaning of all the stuff that is there. Additionally, the offsets and names of the members may not only change after a Windows update, they will most likely get reshuffled if you sneeze at your computer the wrong way.
So don't even think about hardcoding those offsets anywhere in your production drivers! Use it only for debugging and research.

So having seen the nt!_KPCR and nt!_KPRCB structs, we can now tell that the offset 0x188 in KPCR actually refers to nt!_KPRCB::CurrentThread as 0x180 + 0x8. Then we can tell from the WinDbg output:

WinDbg Command Window[Copy]

   +0x008 CurrentThread    : Ptr64 _KTHREAD

that it's a pointer to the type nt!_KTHREAD, which is another well-known kernel structure that holds the data for an executing thread.

Let's dump it as well in WinDbg:

WinDbg Command Window[Copy]

0: kd> dt nt!_KTHREAD
   +0x000 Header           : _DISPATCHER_HEADER
   +0x018 SListFaultAddress : Ptr64 Void
   +0x020 QuantumTarget    : Uint8B
   +0x028 InitialStack     : Ptr64 Void
   +0x030 StackLimit       : Ptr64 Void
   +0x038 StackBase        : Ptr64 Void
   +0x040 ThreadLock       : Uint8B
   +0x048 CycleTime        : Uint8B
   +0x050 CurrentRunTime   : Uint4B
   +0x054 ExpectedRunTime  : Uint4B
   +0x058 KernelStack      : Ptr64 Void
   +0x060 StateSaveArea    : Ptr64 _XSAVE_FORMAT
   +0x068 SchedulingGroup  : Ptr64 _KSCHEDULING_GROUP
   +0x070 WaitRegister     : _KWAIT_STATUS_REGISTER
   +0x071 Running          : UChar
   +0x072 Alerted          : [2] UChar
   +0x074 AutoBoostActive  : Pos 0, 1 Bit
   +0x074 ReadyTransition  : Pos 1, 1 Bit
   +0x074 WaitNext         : Pos 2, 1 Bit
   +0x074 SystemAffinityActive : Pos 3, 1 Bit
   +0x074 Alertable        : Pos 4, 1 Bit
   +0x074 UserStackWalkActive : Pos 5, 1 Bit
   +0x074 ApcInterruptRequest : Pos 6, 1 Bit
   +0x074 QuantumEndMigrate : Pos 7, 1 Bit
   +0x074 UmsDirectedSwitchEnable : Pos 8, 1 Bit
   +0x074 TimerActive      : Pos 9, 1 Bit
   +0x074 SystemThread     : Pos 10, 1 Bit
   +0x074 ProcessDetachActive : Pos 11, 1 Bit
   +0x074 CalloutActive    : Pos 12, 1 Bit
   +0x074 ScbReadyQueue    : Pos 13, 1 Bit
   +0x074 ApcQueueable     : Pos 14, 1 Bit
   +0x074 ReservedStackInUse : Pos 15, 1 Bit
   +0x074 UmsPerformingSyscall : Pos 16, 1 Bit
   +0x074 TimerSuspended   : Pos 17, 1 Bit
   +0x074 SuspendedWaitMode : Pos 18, 1 Bit
   +0x074 SuspendSchedulerApcWait : Pos 19, 1 Bit
   +0x074 CetUserShadowStack : Pos 20, 1 Bit
   +0x074 BypassProcessFreeze : Pos 21, 1 Bit
   +0x074 Reserved         : Pos 22, 10 Bits
   +0x074 MiscFlags        : Int4B
   +0x078 ThreadFlagsSpare : Pos 0, 2 Bits
   +0x078 AutoAlignment    : Pos 2, 1 Bit
   +0x078 DisableBoost     : Pos 3, 1 Bit
   +0x078 AlertedByThreadId : Pos 4, 1 Bit
   +0x078 QuantumDonation  : Pos 5, 1 Bit
   +0x078 EnableStackSwap  : Pos 6, 1 Bit
   +0x078 GuiThread        : Pos 7, 1 Bit
   +0x078 DisableQuantum   : Pos 8, 1 Bit
   +0x078 ChargeOnlySchedulingGroup : Pos 9, 1 Bit
   +0x078 DeferPreemption  : Pos 10, 1 Bit
   +0x078 QueueDeferPreemption : Pos 11, 1 Bit
   +0x078 ForceDeferSchedule : Pos 12, 1 Bit
   +0x078 SharedReadyQueueAffinity : Pos 13, 1 Bit
   +0x078 FreezeCount      : Pos 14, 1 Bit
   +0x078 TerminationApcRequest : Pos 15, 1 Bit
   +0x078 AutoBoostEntriesExhausted : Pos 16, 1 Bit
   +0x078 KernelStackResident : Pos 17, 1 Bit
   +0x078 TerminateRequestReason : Pos 18, 2 Bits
   +0x078 ProcessStackCountDecremented : Pos 20, 1 Bit
   +0x078 RestrictedGuiThread : Pos 21, 1 Bit
   +0x078 VpBackingThread  : Pos 22, 1 Bit
   +0x078 ThreadFlagsSpare2 : Pos 23, 1 Bit
   +0x078 EtwStackTraceApcInserted : Pos 24, 8 Bits
   +0x078 ThreadFlags      : Int4B
   +0x07c Tag              : UChar
   +0x07d SystemHeteroCpuPolicy : UChar
   +0x07e UserHeteroCpuPolicy : Pos 0, 7 Bits
   +0x07e ExplicitSystemHeteroCpuPolicy : Pos 7, 1 Bit
   +0x07f RunningNonRetpolineCode : Pos 0, 1 Bit
   +0x07f SpecCtrlSpare    : Pos 1, 7 Bits
   +0x07f SpecCtrl         : UChar
   +0x080 SystemCallNumber : Uint4B
   +0x084 ReadyTime        : Uint4B
   +0x088 FirstArgument    : Ptr64 Void
   +0x090 TrapFrame        : Ptr64 _KTRAP_FRAME
   +0x098 ApcState         : _KAPC_STATE
   +0x098 ApcStateFill     : [43] UChar
   +0x0c3 Priority         : Char
   +0x0c4 UserIdealProcessor : Uint4B
   +0x0c8 WaitStatus       : Int8B
   +0x0d0 WaitBlockList    : Ptr64 _KWAIT_BLOCK
   +0x0d8 WaitListEntry    : _LIST_ENTRY
   +0x0d8 SwapListEntry    : _SINGLE_LIST_ENTRY
   +0x0e8 Queue            : Ptr64 _DISPATCHER_HEADER
   +0x0f0 Teb              : Ptr64 Void
   +0x0f8 RelativeTimerBias : Uint8B
   +0x100 Timer            : _KTIMER
   +0x140 WaitBlock        : [4] _KWAIT_BLOCK
   +0x140 WaitBlockFill4   : [20] UChar
   +0x154 ContextSwitches  : Uint4B
   +0x140 WaitBlockFill5   : [68] UChar
   +0x184 State            : UChar
   +0x185 Spare13          : Char
   +0x186 WaitIrql         : UChar
   +0x187 WaitMode         : Char
   +0x140 WaitBlockFill6   : [116] UChar
   +0x1b4 WaitTime         : Uint4B
   +0x140 WaitBlockFill7   : [164] UChar
   +0x1e4 KernelApcDisable : Int2B
   +0x1e6 SpecialApcDisable : Int2B
   +0x1e4 CombinedApcDisable : Uint4B
   +0x140 WaitBlockFill8   : [40] UChar
   +0x168 ThreadCounters   : Ptr64 _KTHREAD_COUNTERS
   +0x140 WaitBlockFill9   : [88] UChar
   +0x198 XStateSave       : Ptr64 _XSTATE_SAVE
   +0x140 WaitBlockFill10  : [136] UChar
   +0x1c8 Win32Thread      : Ptr64 Void
   +0x140 WaitBlockFill11  : [176] UChar
   +0x1f0 Ucb              : Ptr64 _UMS_CONTROL_BLOCK
   +0x1f8 Uch              : Ptr64 _KUMS_CONTEXT_HEADER
   +0x200 ThreadFlags2     : Int4B
   +0x200 BamQosLevel      : Pos 0, 8 Bits
   +0x200 ThreadFlags2Reserved : Pos 8, 24 Bits
   +0x204 Spare21          : Uint4B
   +0x208 QueueListEntry   : _LIST_ENTRY
   +0x218 NextProcessor    : Uint4B
   +0x218 NextProcessorNumber : Pos 0, 31 Bits
   +0x218 SharedReadyQueue : Pos 31, 1 Bit
   +0x21c QueuePriority    : Int4B
   +0x220 Process          : Ptr64 _KPROCESS
   +0x228 UserAffinity     : _GROUP_AFFINITY
   +0x228 UserAffinityFill : [10] UChar
   +0x232 PreviousMode     : Char
   +0x233 BasePriority     : Char
   +0x234 PriorityDecrement : Char
   +0x234 ForegroundBoost  : Pos 0, 4 Bits
   +0x234 UnusualBoost     : Pos 4, 4 Bits
   +0x235 Preempted        : UChar
   +0x236 AdjustReason     : UChar
   +0x237 AdjustIncrement  : Char
   +0x238 AffinityVersion  : Uint8B
   +0x240 Affinity         : _GROUP_AFFINITY
   +0x240 AffinityFill     : [10] UChar
   +0x24a ApcStateIndex    : UChar
   +0x24b WaitBlockCount   : UChar
   +0x24c IdealProcessor   : Uint4B
   +0x250 NpxState         : Uint8B
   +0x258 SavedApcState    : _KAPC_STATE
   +0x258 SavedApcStateFill : [43] UChar
   +0x283 WaitReason       : UChar
   +0x284 SuspendCount     : Char
   +0x285 Saturation       : Char
   +0x286 SListFaultCount  : Uint2B
   +0x288 SchedulerApc     : _KAPC
   +0x288 SchedulerApcFill0 : [1] UChar
   +0x289 ResourceIndex    : UChar
   +0x288 SchedulerApcFill1 : [3] UChar
   +0x28b QuantumReset     : UChar
   +0x288 SchedulerApcFill2 : [4] UChar
   +0x28c KernelTime       : Uint4B
   +0x288 SchedulerApcFill3 : [64] UChar
   +0x2c8 WaitPrcb         : Ptr64 _KPRCB
   +0x288 SchedulerApcFill4 : [72] UChar
   +0x2d0 LegoData         : Ptr64 Void
   +0x288 SchedulerApcFill5 : [83] UChar
   +0x2db CallbackNestingLevel : UChar
   +0x2dc UserTime         : Uint4B
   +0x2e0 SuspendEvent     : _KEVENT
   +0x2f8 ThreadListEntry  : _LIST_ENTRY
   +0x308 MutantListHead   : _LIST_ENTRY
   +0x318 AbEntrySummary   : UChar
   +0x319 AbWaitEntryCount : UChar
   +0x31a AbAllocationRegionCount : UChar
   +0x31b SystemPriority   : Char
   +0x31c SecureThreadCookie : Uint4B
   +0x320 LockEntries      : Ptr64 _KLOCK_ENTRY
   +0x328 PropagateBoostsEntry : _SINGLE_LIST_ENTRY
   +0x330 IoSelfBoostsEntry : _SINGLE_LIST_ENTRY
   +0x338 PriorityFloorCounts : [16] UChar
   +0x348 PriorityFloorCountsReserved : [16] UChar
   +0x358 PriorityFloorSummary : Uint4B
   +0x35c AbCompletedIoBoostCount : Int4B
   +0x360 AbCompletedIoQoSBoostCount : Int4B
   +0x364 KeReferenceCount : Int2B
   +0x366 AbOrphanedEntrySummary : UChar
   +0x367 AbOwnedEntryCount : UChar
   +0x368 ForegroundLossTime : Uint4B
   +0x370 GlobalForegroundListEntry : _LIST_ENTRY
   +0x370 ForegroundDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x378 InGlobalForegroundList : Uint8B
   +0x380 ReadOperationCount : Int8B
   +0x388 WriteOperationCount : Int8B
   +0x390 OtherOperationCount : Int8B
   +0x398 ReadTransferCount : Int8B
   +0x3a0 WriteTransferCount : Int8B
   +0x3a8 OtherTransferCount : Int8B
   +0x3b0 QueuedScb        : Ptr64 _KSCB
   +0x3b8 ThreadTimerDelay : Uint4B
   +0x3bc ThreadFlags3     : Int4B
   +0x3bc ThreadFlags3Reserved : Pos 0, 8 Bits
   +0x3bc PpmPolicy        : Pos 8, 2 Bits
   +0x3bc ThreadFlags3Reserved2 : Pos 10, 22 Bits
   +0x3c0 TracingPrivate   : [1] Uint8B
   +0x3c8 SchedulerAssist  : Ptr64 Void
   +0x3d0 AbWaitObject     : Ptr64 Void
   +0x3d8 ReservedPreviousReadyTimeValue : Uint4B
   +0x3e0 KernelWaitTime   : Uint8B
   +0x3e8 UserWaitTime     : Uint8B
   +0x3f0 GlobalUpdateVpThreadPriorityListEntry : _LIST_ENTRY
   +0x3f0 UpdateVpThreadPriorityDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x3f8 InGlobalUpdateVpThreadPriorityList : Uint8B
   +0x400 SchedulerAssistPriorityFloor : Int4B
   +0x404 Spare28          : Uint4B
   +0x408 EndPadding       : [5] Uint8B

Another whopper and another warning not to rely/hardcode any of the names and offsets in your production driver either.

nt!_KTHREAD is an older version of a larger nt!_ETHREAD kernel struct, that holds it in its nt!_ETHREAD::Tcb member. Both structs contain most of the information about a thread, with nt!_KTHREAD being used primarily by the scheduler.

We can use nt!_KTHREAD to resolve another offset from the second instruction in the nt!PsGetCurrentProcess function:

x64[Copy]

       fffff800`57e3a4b9 488b80b8000000          mov     rax,qword ptr [rax+0B8h]

So as you remember rax holds the pointer to the CurrentThread of type nt!_KTHREAD. But where is the offset 0xB8 in it?

In its place we're seeing the ApcState member of type nt!_KAPC_STATE. We wrote about kernel APCs before. (Check for a refresher here.)

Let's dump it as well:

WinDbg Command Window[Copy]

0: kd> dt nt!_KAPC_STATE
   +0x000 ApcListHead      : [2] _LIST_ENTRY
   +0x020 Process          : Ptr64 _KPROCESS
   +0x028 InProgressFlags  : UChar
   +0x028 KernelApcInProgress : Pos 0, 1 Bit
   +0x028 SpecialApcInProgress : Pos 1, 1 Bit
   +0x029 KernelApcPending : UChar
   +0x02a UserApcPendingAll : UChar
   +0x02a SpecialUserApcPending : Pos 0, 1 Bit
   +0x02a UserApcPending   : Pos 1, 1 Bit

Lastly, we can tell what the 0xB8 offset in the nt!_KTHREAD refers to: 0x98 + 0x20, or nt!_KAPC_STATE::Process, which is a pointer to the type nt!_KPROCESS.

nt!_KPROCESS is very similar to the nt!_KTHREAD struct in that it is used in tandem with the larger nt!_EPROCESS struct that holds it in its first member nt!_EPROCESS::Pcb. Both structs house the information about running processes, including the system one.
This struct may also temporarily preserve information about recently terminated processes.

Thus far, we can now tell what the nt!PsGetCurrentProcess function does. It returns the pointer to the EPROCESS from the nt!_KAPC_STATE::Process for the process that the current thread runs in. Simple, right?

Well, not really, because there lies a gotcha of attaching threads with the KeStackAttachProcess function. So, if someone called that DDI before the nt!PsGetCurrentProcess, it will return the EPROCESS of the attached process, and not the original one that created the thread.

Attaching a thread to another process is outside of the scope of this blog post. (I don't want to make it too long.) But in a nutshell, a kernel driver may attach a thread to another process to switch its virtual address translation to that process. If you remember your basic process isolation, each user-mode process in Windows has its own virtual address space. Thus, by attaching a thread to a process, we let that thread access virtual addresses in that specific process.

PsGetCurrentProcessId

Then let's look at nt!PsGetCurrentProcessId, which is very similar.

x64[Copy]

    mov     rax,qword ptr gs:[188h]
    mov     rax,qword ptr [rax+478h]
    ret

It also takes the pointer to nt!_KPCR::Prcb.CurrentThread of type nt!_KTHREAD and returns the member at the offset 0x478 in it. nt!_KTHREAD is too small for it, thus we need to use its larger cousin nt!_ETHREAD:

WinDbg Command Window[Copy]

0: kd> dt nt!_ETHREAD
   +0x000 Tcb              : _KTHREAD
   +0x430 CreateTime       : _LARGE_INTEGER
   +0x438 ExitTime         : _LARGE_INTEGER
   +0x438 KeyedWaitChain   : _LIST_ENTRY
   +0x448 PostBlockList    : _LIST_ENTRY
   +0x448 ForwardLinkShadow : Ptr64 Void
   +0x450 StartAddress     : Ptr64 Void
   +0x458 TerminationPort  : Ptr64 _TERMINATION_PORT
   +0x458 ReaperLink       : Ptr64 _ETHREAD
   +0x458 KeyedWaitValue   : Ptr64 Void
   +0x460 ActiveTimerListLock : Uint8B
   +0x468 ActiveTimerListHead : _LIST_ENTRY
   +0x478 Cid              : _CLIENT_ID
   +0x488 KeyedWaitSemaphore : _KSEMAPHORE
   +0x488 AlpcWaitSemaphore : _KSEMAPHORE
   +0x4a8 ClientSecurity   : _PS_CLIENT_SECURITY_CONTEXT
   +0x4b0 IrpList          : _LIST_ENTRY
   +0x4c0 TopLevelIrp      : Uint8B
   +0x4c8 DeviceToVerify   : Ptr64 _DEVICE_OBJECT
   +0x4d0 Win32StartAddress : Ptr64 Void
   +0x4d8 ChargeOnlySession : Ptr64 Void
   +0x4e0 LegacyPowerObject : Ptr64 Void
   +0x4e8 ThreadListEntry  : _LIST_ENTRY
   +0x4f8 RundownProtect   : _EX_RUNDOWN_REF
   +0x500 ThreadLock       : _EX_PUSH_LOCK
   +0x508 ReadClusterSize  : Uint4B
   +0x50c MmLockOrdering   : Int4B
   +0x510 CrossThreadFlags : Uint4B
   +0x510 Terminated       : Pos 0, 1 Bit
   +0x510 ThreadInserted   : Pos 1, 1 Bit
   +0x510 HideFromDebugger : Pos 2, 1 Bit
   +0x510 ActiveImpersonationInfo : Pos 3, 1 Bit
   +0x510 HardErrorsAreDisabled : Pos 4, 1 Bit
   +0x510 BreakOnTermination : Pos 5, 1 Bit
   +0x510 SkipCreationMsg  : Pos 6, 1 Bit
   +0x510 SkipTerminationMsg : Pos 7, 1 Bit
   +0x510 CopyTokenOnOpen  : Pos 8, 1 Bit
   +0x510 ThreadIoPriority : Pos 9, 3 Bits
   +0x510 ThreadPagePriority : Pos 12, 3 Bits
   +0x510 RundownFail      : Pos 15, 1 Bit
   +0x510 UmsForceQueueTermination : Pos 16, 1 Bit
   +0x510 IndirectCpuSets  : Pos 17, 1 Bit
   +0x510 DisableDynamicCodeOptOut : Pos 18, 1 Bit
   +0x510 ExplicitCaseSensitivity : Pos 19, 1 Bit
   +0x510 PicoNotifyExit   : Pos 20, 1 Bit
   +0x510 DbgWerUserReportActive : Pos 21, 1 Bit
   +0x510 ForcedSelfTrimActive : Pos 22, 1 Bit
   +0x510 SamplingCoverage : Pos 23, 1 Bit
   +0x510 ReservedCrossThreadFlags : Pos 24, 8 Bits
   +0x514 SameThreadPassiveFlags : Uint4B
   +0x514 ActiveExWorker   : Pos 0, 1 Bit
   +0x514 MemoryMaker      : Pos 1, 1 Bit
   +0x514 StoreLockThread  : Pos 2, 2 Bits
   +0x514 ClonedThread     : Pos 4, 1 Bit
   +0x514 KeyedEventInUse  : Pos 5, 1 Bit
   +0x514 SelfTerminate    : Pos 6, 1 Bit
   +0x514 RespectIoPriority : Pos 7, 1 Bit
   +0x514 ActivePageLists  : Pos 8, 1 Bit
   +0x514 SecureContext    : Pos 9, 1 Bit
   +0x514 ZeroPageThread   : Pos 10, 1 Bit
   +0x514 WorkloadClass    : Pos 11, 1 Bit
   +0x514 ReservedSameThreadPassiveFlags : Pos 12, 20 Bits
   +0x518 SameThreadApcFlags : Uint4B
   +0x518 OwnsProcessAddressSpaceExclusive : Pos 0, 1 Bit
   +0x518 OwnsProcessAddressSpaceShared : Pos 1, 1 Bit
   +0x518 HardFaultBehavior : Pos 2, 1 Bit
   +0x518 StartAddressInvalid : Pos 3, 1 Bit
   +0x518 EtwCalloutActive : Pos 4, 1 Bit
   +0x518 SuppressSymbolLoad : Pos 5, 1 Bit
   +0x518 Prefetching      : Pos 6, 1 Bit
   +0x518 OwnsVadExclusive : Pos 7, 1 Bit
   +0x519 SystemPagePriorityActive : Pos 0, 1 Bit
   +0x519 SystemPagePriority : Pos 1, 3 Bits
   +0x519 AllowUserWritesToExecutableMemory : Pos 4, 1 Bit
   +0x519 AllowKernelWritesToExecutableMemory : Pos 5, 1 Bit
   +0x519 OwnsVadShared    : Pos 6, 1 Bit
   +0x51c CacheManagerActive : UChar
   +0x51d DisablePageFaultClustering : UChar
   +0x51e ActiveFaultCount : UChar
   +0x51f LockOrderState   : UChar
   +0x520 PerformanceCountLowReserved : Uint4B
   +0x524 PerformanceCountHighReserved : Int4B
   +0x528 AlpcMessageId    : Uint8B
   +0x530 AlpcMessage      : Ptr64 Void
   +0x530 AlpcReceiveAttributeSet : Uint4B
   +0x538 AlpcWaitListEntry : _LIST_ENTRY
   +0x548 ExitStatus       : Int4B
   +0x54c CacheManagerCount : Uint4B
   +0x550 IoBoostCount     : Uint4B
   +0x554 IoQoSBoostCount  : Uint4B
   +0x558 IoQoSThrottleCount : Uint4B
   +0x55c KernelStackReference : Uint4B
   +0x560 BoostList        : _LIST_ENTRY
   +0x570 DeboostList      : _LIST_ENTRY
   +0x580 BoostListLock    : Uint8B
   +0x588 IrpListLock      : Uint8B
   +0x590 ReservedForSynchTracking : Ptr64 Void
   +0x598 CmCallbackListHead : _SINGLE_LIST_ENTRY
   +0x5a0 ActivityId       : Ptr64 _GUID
   +0x5a8 SeLearningModeListHead : _SINGLE_LIST_ENTRY
   +0x5b0 VerifierContext  : Ptr64 Void
   +0x5b8 AdjustedClientToken : Ptr64 Void
   +0x5c0 WorkOnBehalfThread : Ptr64 Void
   +0x5c8 PropertySet      : _PS_PROPERTY_SET
   +0x5e0 PicoContext      : Ptr64 Void
   +0x5e8 UserFsBase       : Uint8B
   +0x5f0 UserGsBase       : Uint8B
   +0x5f8 EnergyValues     : Ptr64 _THREAD_ENERGY_VALUES
   +0x600 SelectedCpuSets  : Uint8B
   +0x600 SelectedCpuSetsIndirect : Ptr64 Uint8B
   +0x608 Silo             : Ptr64 _EJOB
   +0x610 ThreadName       : Ptr64 _UNICODE_STRING
   +0x618 SetContextState  : Ptr64 _CONTEXT
   +0x620 LastExpectedRunTime : Uint4B
   +0x624 HeapData         : Uint4B
   +0x628 OwnerEntryListHead : _LIST_ENTRY
   +0x638 DisownedOwnerEntryListLock : Uint8B
   +0x640 DisownedOwnerEntryListHead : _LIST_ENTRY
   +0x650 LockEntries      : [6] _KLOCK_ENTRY
   +0x890 CmDbgInfo        : Ptr64 Void

Now we can tell that the offset 0x478 refers to nt!_ETHREAD::Cid that holds the process ID and the thread ID:

WinDbg Command Window[Copy]

0: kd> dt nt!_CLIENT_ID
   +0x000 UniqueProcess    : Ptr64 Void
   +0x008 UniqueThread     : Ptr64 Void

The nt!PsGetCurrentProcessId returns only the UniqueProcess part, as its name suggests. Which in the user-land is referred to as a process ID, or PID.

In this case it returns the PID of the process that created the current thread, as the implementation doesn't touch the nt!_KTHREAD::ApcState member, and thus doesn't deal with thread attaching in any way.

PsGetProcessId

Finally, the nt!PsGetProcessId function. We pretty much have all the structs handy to understand what it does.

x64[Copy]

    mov     rax,qword ptr [rcx+440h]
    ret

If you read its documentation, it expects a pointer to the EPROCESS as its input parameter. Thus, we can check what is at the offset 0x440 that it returns.

We just need to dump the nt!_EPROCESS struct with WinDbg:

WinDbg Command Window[Copy]

0: kd> dt nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x438 ProcessLock      : _EX_PUSH_LOCK
   +0x440 UniqueProcessId  : Ptr64 Void
   +0x448 ActiveProcessLinks : _LIST_ENTRY
   +0x458 RundownProtect   : _EX_RUNDOWN_REF
   +0x460 Flags2           : Uint4B
   +0x460 JobNotReallyActive : Pos 0, 1 Bit
   +0x460 AccountingFolded : Pos 1, 1 Bit
   +0x460 NewProcessReported : Pos 2, 1 Bit
   +0x460 ExitProcessReported : Pos 3, 1 Bit
   +0x460 ReportCommitChanges : Pos 4, 1 Bit
   +0x460 LastReportMemory : Pos 5, 1 Bit
   +0x460 ForceWakeCharge  : Pos 6, 1 Bit
   +0x460 CrossSessionCreate : Pos 7, 1 Bit
   +0x460 NeedsHandleRundown : Pos 8, 1 Bit
   +0x460 RefTraceEnabled  : Pos 9, 1 Bit
   +0x460 PicoCreated      : Pos 10, 1 Bit
   +0x460 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x460 DefaultPagePriority : Pos 12, 3 Bits
   +0x460 PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x460 ProcessVerifierTarget : Pos 16, 1 Bit
   +0x460 RestrictSetThreadContext : Pos 17, 1 Bit
   +0x460 AffinityPermanent : Pos 18, 1 Bit
   +0x460 AffinityUpdateEnable : Pos 19, 1 Bit
   +0x460 PropagateNode    : Pos 20, 1 Bit
   +0x460 ExplicitAffinity : Pos 21, 1 Bit
   +0x460 ProcessExecutionState : Pos 22, 2 Bits
   +0x460 EnableReadVmLogging : Pos 24, 1 Bit
   +0x460 EnableWriteVmLogging : Pos 25, 1 Bit
   +0x460 FatalAccessTerminationRequested : Pos 26, 1 Bit
   +0x460 DisableSystemAllowedCpuSet : Pos 27, 1 Bit
   +0x460 ProcessStateChangeRequest : Pos 28, 2 Bits
   +0x460 ProcessStateChangeInProgress : Pos 30, 1 Bit
   +0x460 InPrivate        : Pos 31, 1 Bit
   +0x464 Flags            : Uint4B
   +0x464 CreateReported   : Pos 0, 1 Bit
   +0x464 NoDebugInherit   : Pos 1, 1 Bit
   +0x464 ProcessExiting   : Pos 2, 1 Bit
   +0x464 ProcessDelete    : Pos 3, 1 Bit
   +0x464 ManageExecutableMemoryWrites : Pos 4, 1 Bit
   +0x464 VmDeleted        : Pos 5, 1 Bit
   +0x464 OutswapEnabled   : Pos 6, 1 Bit
   +0x464 Outswapped       : Pos 7, 1 Bit
   +0x464 FailFastOnCommitFail : Pos 8, 1 Bit
   +0x464 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x464 AddressSpaceInitialized : Pos 10, 2 Bits
   +0x464 SetTimerResolution : Pos 12, 1 Bit
   +0x464 BreakOnTermination : Pos 13, 1 Bit
   +0x464 DeprioritizeViews : Pos 14, 1 Bit
   +0x464 WriteWatch       : Pos 15, 1 Bit
   +0x464 ProcessInSession : Pos 16, 1 Bit
   +0x464 OverrideAddressSpace : Pos 17, 1 Bit
   +0x464 HasAddressSpace  : Pos 18, 1 Bit
   +0x464 LaunchPrefetched : Pos 19, 1 Bit
   +0x464 Background       : Pos 20, 1 Bit
   +0x464 VmTopDown        : Pos 21, 1 Bit
   +0x464 ImageNotifyDone  : Pos 22, 1 Bit
   +0x464 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x464 VdmAllowed       : Pos 24, 1 Bit
   +0x464 ProcessRundown   : Pos 25, 1 Bit
   +0x464 ProcessInserted  : Pos 26, 1 Bit
   +0x464 DefaultIoPriority : Pos 27, 3 Bits
   +0x464 ProcessSelfDelete : Pos 30, 1 Bit
   +0x464 SetTimerResolutionLink : Pos 31, 1 Bit
   +0x468 CreateTime       : _LARGE_INTEGER
   +0x470 ProcessQuotaUsage : [2] Uint8B
   +0x480 ProcessQuotaPeak : [2] Uint8B
   +0x490 PeakVirtualSize  : Uint8B
   +0x498 VirtualSize      : Uint8B
   +0x4a0 SessionProcessLinks : _LIST_ENTRY
   +0x4b0 ExceptionPortData : Ptr64 Void
   +0x4b0 ExceptionPortValue : Uint8B
   +0x4b0 ExceptionPortState : Pos 0, 3 Bits
   +0x4b8 Token            : _EX_FAST_REF
   +0x4c0 MmReserved       : Uint8B
   +0x4c8 AddressCreationLock : _EX_PUSH_LOCK
   +0x4d0 PageTableCommitmentLock : _EX_PUSH_LOCK
   +0x4d8 RotateInProgress : Ptr64 _ETHREAD
   +0x4e0 ForkInProgress   : Ptr64 _ETHREAD
   +0x4e8 CommitChargeJob  : Ptr64 _EJOB
   +0x4f0 CloneRoot        : _RTL_AVL_TREE
   +0x4f8 NumberOfPrivatePages : Uint8B
   +0x500 NumberOfLockedPages : Uint8B
   +0x508 Win32Process     : Ptr64 Void
   +0x510 Job              : Ptr64 _EJOB
   +0x518 SectionObject    : Ptr64 Void
   +0x520 SectionBaseAddress : Ptr64 Void
   +0x528 Cookie           : Uint4B
   +0x530 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY
   +0x538 Win32WindowStation : Ptr64 Void
   +0x540 InheritedFromUniqueProcessId : Ptr64 Void
   +0x548 OwnerProcessId   : Uint8B
   +0x550 Peb              : Ptr64 _PEB
   +0x558 Session          : Ptr64 _MM_SESSION_SPACE
   +0x560 Spare1           : Ptr64 Void
   +0x568 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK
   +0x570 ObjectTable      : Ptr64 _HANDLE_TABLE
   +0x578 DebugPort        : Ptr64 Void
   +0x580 WoW64Process     : Ptr64 _EWOW64PROCESS
   +0x588 DeviceMap        : Ptr64 Void
   +0x590 EtwDataSource    : Ptr64 Void
   +0x598 PageDirectoryPte : Uint8B
   +0x5a0 ImageFilePointer : Ptr64 _FILE_OBJECT
   +0x5a8 ImageFileName    : [15] UChar
   +0x5b7 PriorityClass    : UChar
   +0x5b8 SecurityPort     : Ptr64 Void
   +0x5c0 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x5c8 JobLinks         : _LIST_ENTRY
   +0x5d8 HighestUserAddress : Ptr64 Void
   +0x5e0 ThreadListHead   : _LIST_ENTRY
   +0x5f0 ActiveThreads    : Uint4B
   +0x5f4 ImagePathHash    : Uint4B
   +0x5f8 DefaultHardErrorProcessing : Uint4B
   +0x5fc LastThreadExitStatus : Int4B
   +0x600 PrefetchTrace    : _EX_FAST_REF
   +0x608 LockedPagesList  : Ptr64 Void
   +0x610 ReadOperationCount : _LARGE_INTEGER
   +0x618 WriteOperationCount : _LARGE_INTEGER
   +0x620 OtherOperationCount : _LARGE_INTEGER
   +0x628 ReadTransferCount : _LARGE_INTEGER
   +0x630 WriteTransferCount : _LARGE_INTEGER
   +0x638 OtherTransferCount : _LARGE_INTEGER
   +0x640 CommitChargeLimit : Uint8B
   +0x648 CommitCharge     : Uint8B
   +0x650 CommitChargePeak : Uint8B
   +0x680 Vm               : _MMSUPPORT_FULL
   +0x7c0 MmProcessLinks   : _LIST_ENTRY
   +0x7d0 ModifiedPageCount : Uint4B
   +0x7d4 ExitStatus       : Int4B
   +0x7d8 VadRoot          : _RTL_AVL_TREE
   +0x7e0 VadHint          : Ptr64 Void
   +0x7e8 VadCount         : Uint8B
   +0x7f0 VadPhysicalPages : Uint8B
   +0x7f8 VadPhysicalPagesLimit : Uint8B
   +0x800 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x820 TimerResolutionLink : _LIST_ENTRY
   +0x830 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
   +0x838 RequestedTimerResolution : Uint4B
   +0x83c SmallestTimerResolution : Uint4B
   +0x840 ExitTime         : _LARGE_INTEGER
   +0x848 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE
   +0x850 InvertedFunctionTableLock : _EX_PUSH_LOCK
   +0x858 ActiveThreadsHighWatermark : Uint4B
   +0x85c LargePrivateVadCount : Uint4B
   +0x860 ThreadListLock   : _EX_PUSH_LOCK
   +0x868 WnfContext       : Ptr64 Void
   +0x870 ServerSilo       : Ptr64 _EJOB
   +0x878 SignatureLevel   : UChar
   +0x879 SectionSignatureLevel : UChar
   +0x87a Protection       : _PS_PROTECTION
   +0x87b HangCount        : Pos 0, 3 Bits
   +0x87b GhostCount       : Pos 3, 3 Bits
   +0x87b PrefilterException : Pos 6, 1 Bit
   +0x87c Flags3           : Uint4B
   +0x87c Minimal          : Pos 0, 1 Bit
   +0x87c ReplacingPageRoot : Pos 1, 1 Bit
   +0x87c Crashed          : Pos 2, 1 Bit
   +0x87c JobVadsAreTracked : Pos 3, 1 Bit
   +0x87c VadTrackingDisabled : Pos 4, 1 Bit
   +0x87c AuxiliaryProcess : Pos 5, 1 Bit
   +0x87c SubsystemProcess : Pos 6, 1 Bit
   +0x87c IndirectCpuSets  : Pos 7, 1 Bit
   +0x87c RelinquishedCommit : Pos 8, 1 Bit
   +0x87c HighGraphicsPriority : Pos 9, 1 Bit
   +0x87c CommitFailLogged : Pos 10, 1 Bit
   +0x87c ReserveFailLogged : Pos 11, 1 Bit
   +0x87c SystemProcess    : Pos 12, 1 Bit
   +0x87c HideImageBaseAddresses : Pos 13, 1 Bit
   +0x87c AddressPolicyFrozen : Pos 14, 1 Bit
   +0x87c ProcessFirstResume : Pos 15, 1 Bit
   +0x87c ForegroundExternal : Pos 16, 1 Bit
   +0x87c ForegroundSystem : Pos 17, 1 Bit
   +0x87c HighMemoryPriority : Pos 18, 1 Bit
   +0x87c EnableProcessSuspendResumeLogging : Pos 19, 1 Bit
   +0x87c EnableThreadSuspendResumeLogging : Pos 20, 1 Bit
   +0x87c SecurityDomainChanged : Pos 21, 1 Bit
   +0x87c SecurityFreezeComplete : Pos 22, 1 Bit
   +0x87c VmProcessorHost  : Pos 23, 1 Bit
   +0x87c VmProcessorHostTransition : Pos 24, 1 Bit
   +0x87c AltSyscall       : Pos 25, 1 Bit
   +0x87c TimerResolutionIgnore : Pos 26, 1 Bit
   +0x87c DisallowUserTerminate : Pos 27, 1 Bit
   +0x880 DeviceAsid       : Int4B
   +0x888 SvmData          : Ptr64 Void
   +0x890 SvmProcessLock   : _EX_PUSH_LOCK
   +0x898 SvmLock          : Uint8B
   +0x8a0 SvmProcessDeviceListHead : _LIST_ENTRY
   +0x8b0 LastFreezeInterruptTime : Uint8B
   +0x8b8 DiskCounters     : Ptr64 _PROCESS_DISK_COUNTERS
   +0x8c0 PicoContext      : Ptr64 Void
   +0x8c8 EnclaveTable     : Ptr64 Void
   +0x8d0 EnclaveNumber    : Uint8B
   +0x8d8 EnclaveLock      : _EX_PUSH_LOCK
   +0x8e0 HighPriorityFaultsAllowed : Uint4B
   +0x8e8 EnergyContext    : Ptr64 _PO_PROCESS_ENERGY_CONTEXT
   +0x8f0 VmContext        : Ptr64 Void
   +0x8f8 SequenceNumber   : Uint8B
   +0x900 CreateInterruptTime : Uint8B
   +0x908 CreateUnbiasedInterruptTime : Uint8B
   +0x910 TotalUnbiasedFrozenTime : Uint8B
   +0x918 LastAppStateUpdateTime : Uint8B
   +0x920 LastAppStateUptime : Pos 0, 61 Bits
   +0x920 LastAppState     : Pos 61, 3 Bits
   +0x928 SharedCommitCharge : Uint8B
   +0x930 SharedCommitLock : _EX_PUSH_LOCK
   +0x938 SharedCommitLinks : _LIST_ENTRY
   +0x948 AllowedCpuSets   : Uint8B
   +0x950 DefaultCpuSets   : Uint8B
   +0x948 AllowedCpuSetsIndirect : Ptr64 Uint8B
   +0x950 DefaultCpuSetsIndirect : Ptr64 Uint8B
   +0x958 DiskIoAttribution : Ptr64 Void
   +0x960 DxgProcess       : Ptr64 Void
   +0x968 Win32KFilterSet  : Uint4B
   +0x970 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES
   +0x978 KTimerSets       : Uint4B
   +0x97c KTimer2Sets      : Uint4B
   +0x980 ThreadTimerSets  : Uint4B
   +0x988 VirtualTimerListLock : Uint8B
   +0x990 VirtualTimerListHead : _LIST_ENTRY
   +0x9a0 WakeChannel      : _WNF_STATE_NAME
   +0x9a0 WakeInfo         : _PS_PROCESS_WAKE_INFORMATION
   +0x9d0 MitigationFlags  : Uint4B
   +0x9d0 MitigationFlagsValues : <anonymous-tag>
   +0x9d4 MitigationFlags2 : Uint4B
   +0x9d4 MitigationFlags2Values : <anonymous-tag>
   +0x9d8 PartitionObject  : Ptr64 Void
   +0x9e0 SecurityDomain   : Uint8B
   +0x9e8 ParentSecurityDomain : Uint8B
   +0x9f0 CoverageSamplerContext : Ptr64 Void
   +0x9f8 MmHotPatchContext : Ptr64 Void
   +0xa00 DynamicEHContinuationTargetsTree : _RTL_AVL_TREE
   +0xa08 DynamicEHContinuationTargetsLock : _EX_PUSH_LOCK
   +0xa10 DynamicEnforcedCetCompatibleRanges : _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES
   +0xa20 DisabledComponentFlags : Uint4B

OK, at the offset 0x440 we can find UniqueProcessId, which is the process ID of the process that created the thread.

That is why the documentation for the nt!PsGetCurrentProcess function tells you to use the following construct to retrieve the process ID of the original process, versus the one that the current thread may be attached to:

C[Copy]

//Get PID of the process that created the current thread:
ULONG_PTR nCreatorPid = PsGetCurrentProcessId();

//Get PID of the process in which context the current thread runs in:
//In most cases this would be the same process that created this thread, but
//if the current thread is attached to another process, this will return the PID of that process instead
ULONG_PTR nOwnerPid = PsGetProcessId(PsGetCurrentProcess());

As an aside, to retrieve the original EPROCESS that created the current thread you can use KeGetCurrentThread and IoThreadToProcess functions that look like this under disassembler:

x64[Copy]

    nt!KeGetCurrentThread: CFG
fffff800`57e3a4d0 65488b042588010000 mov     rax, qword ptr gs:[188h]
fffff800`57e3a4d9 c3                 ret

x64[Copy]

    nt!IoThreadToProcess: CFG
fffff800`57e96ad0 488b8120020000 mov     rax, qword ptr [rcx+220h]
fffff800`57e96ad7 c3             ret

Having read my discourse above you can probably deduce that KeGetCurrentThread returns the pointer to nt!_KPCR::Prcb.CurrentThread at the offset 0x188. And nt!IoThreadToProcess returns the nt!_KTHREAD::Process member at offset 0x220, which is the pointer to nt!_EPROCESS of the original process that created that thread. Thus, you can utilize them as such:

C[Copy]

    //Get pointer to the process that created the current thread:
    //INFO: This will ignore the fact that the current thread could have been attached to another process!
    PEPROCESS OriginalProcess = IoThreadToProcess(PsGetCurrentThread());

This concept does not apply to the user-mode code but it is an essential detail for the kernel programming in Windows. And I hope that I was able to illustrate the difference with the examples above.

Now that we covered that let's look at how the same functions look under the ARM64 compiler.

ARM64 Disassembly

To do the following you will need an ARM64 target OS. (This won't work on an Intel/AMD hardware.) I'm testing it on a Snapdragon laptop.

Run the same commands in the WinDbgX command window after you break into the target OS:

WinDbg Command Window[Copy]

0: kd> u nt!PsGetCurrentProcess
nt!PsGetCurrentProcess:
       fffff800`80cc6480 48c644f9      ldr    x8, [xpr, #0x988]
       fffff800`80cc6484 005940f9      ldr    x0, [x8, #0xB0]
       fffff800`80cc6488 c0035fd6      ret

At the first run WinDbgX gave me a bunch of input with a warning of an "Ambiguous symbol error at 'nt!PsGetCurrentProcess'". That happens because the compiler inlined that small function for efficiency.
In that case just copy the address of one of those functions and use it for the u command instead of nt!PsGetCurrentProcess symbol.

With the following function, Microsoft evidently renamed nt!PsGetCurrentProcessId internally into a more obvious name, nt!PsGetCurrentThreadProcessId. Thus, we're getting:

WinDbg Command Window[Copy]

0: kd> u nt!PsGetCurrentThreadProcessId
nt!PsGetCurrentThreadProcessId:
       fffff800`80cc6490 48c644f9      ldr    x8, [xpr, #0x988]
       fffff800`80cc6494 007542f9      ldr    x0, [x8, #0x4E8]
       fffff800`80cc6498 c0035fd6      ret

And lastly:

WinDbg Command Window[Copy]

0: kd> u nt!PsGetProcessId
nt!PsGetProcessId:
       fffff800`80cc6810 00e040f9      ldr    x0, [x0, #0x1C0]
       fffff800`80cc6814 c0035fd6      ret

The logic here is very similar to what I described for the x64 architecture earlier, except that the address of the nt!_KPCR structure under ARM64 is almost always stored in the x18 register, that WinDbg's disassembler renames into xpr.

x18 is a special register in that its value remains the same, per-CPU core, throughout the kernel. And if it is corrupted, this is a guaranteed way to "triple-fault the CPU", which is not really a thing under ARM, but you get the idea.

Also, as I warned you earlier, you can probably see totally different offsets under a different build of the OS. Let me dump the corresponding structs from my ARM64 laptop just for reference:

WinDbg Command Window[Copy]

0: kd> dt nt!_KPCR
   +0x000 NtTib            : _NT_TIB
   +0x000 TibPad0          : [2] Ptr64 Void
   +0x010 Spare1           : Ptr64 Void
   +0x018 Self             : Ptr64 _KPCR
   +0x020 PcrReserved0     : Ptr64 Void
   +0x028 LockArray        : Ptr64 _KSPIN_LOCK_QUEUE
   +0x030 Used_Self        : Ptr64 Void
   +0x038 CurrentIrql      : UChar
   +0x039 SecondLevelCacheAssociativity : UChar
   +0x03a Pad1             : [2] UChar
   +0x03c MajorVersion     : Uint2B
   +0x03e MinorVersion     : Uint2B
   +0x040 StallScaleFactor : Uint4B
   +0x044 SecondLevelCacheSize : Uint4B
   +0x048 SoftwareInterruptPending : Uint2B
   +0x048 ApcInterrupt     : UChar
   +0x049 DispatchInterrupt : UChar
   +0x04a InterruptPad     : Uint2B
   +0x04c BtiMitigation    : UChar
   +0x04c KvaVbar          : Pos 0, 1 Bit
   +0x04c BtiVbar          : Pos 1, 3 Bits
   +0x04c BtiCswapHvc      : Pos 4, 1 Bit
   +0x04c BtiCswapSmc      : Pos 5, 1 Bit
   +0x04d SsbMitigationFlags : UChar
   +0x04d SsbMitigationFirmware : Pos 0, 1 Bit
   +0x04d SsbMitigationDynamic : Pos 1, 1 Bit
   +0x04d SsbMitigationKernel : Pos 2, 1 Bit
   +0x04d SsbMitigationUser : Pos 3, 1 Bit
   +0x04d SsbMitigationReserved : Pos 4, 4 Bits
   +0x04e BhbMitigation    : UChar
   +0x04f CachePrefetcherMitigationFlags : UChar
   +0x04f CachePrefetcherMitigation : Pos 0, 1 Bit
   +0x04f Pad2             : Pos 1, 7 Bits
   +0x050 PanicStorage     : [6] Uint8B
   +0x080 KdVersionBlock   : Ptr64 Void
   +0x088 HalReserved      : [14] Ptr64 Void
   +0x0f8 KvaUserModeTtbr1 : Ptr64 Void
   +0x100 Idt              : [256] Ptr64 Void
   +0x900 IdtExt           : Ptr64 Ptr64 Void
   +0x908 PcrAlign         : [15] Ptr64 Void
   +0x980 Prcb             : _KPRCB

WinDbg Command Window[Copy]

0: kd> dt nt!_KPRCB
   +0x000 LegacyNumber     : UChar
   +0x001 ReservedMustBeZero : UChar
   +0x002 IdleHalt         : UChar
   +0x008 CurrentThread    : Ptr64 _KTHREAD
   +0x010 NextThread       : Ptr64 _KTHREAD
   +0x018 IdleThread       : Ptr64 _KTHREAD
   +0x020 NestingLevel     : UChar
   +0x021 ClockOwner       : UChar
   +0x022 PendingTickFlags : UChar
   +0x022 PendingTick      : Pos 0, 1 Bit
   +0x022 PendingBackupTick : Pos 1, 1 Bit
   +0x023 IdleState        : UChar
   +0x024 Number           : Uint4B
   +0x028 PrcbLock         : Uint8B
   +0x030 PriorityState    : Ptr64 _KPRIORITY_STATE
   +0x040 ProcessorState   : _KPROCESSOR_STATE
   +0x710 HalReserved      : [10] Uint8B
   +0x760 MinorVersion     : Uint2B
   +0x762 MajorVersion     : Uint2B
   +0x764 BuildType        : UChar
   +0x765 CpuVendor        : UChar
   +0x766 LegacyCoresPerPhysicalProcessor : UChar
   +0x767 LegacyLogicalProcessorsPerCore : UChar
   +0x768 AcpiReserved     : Ptr64 Void
   +0x770 ProcessorModel   : Uint2B
   +0x772 ProcessorRevision : Uint2B
   +0x774 MHz              : Uint4B
   +0x778 CycleCounterFrequency : Uint8B
   +0x780 GroupSetMember   : Uint8B
   +0x788 Group            : UChar
   +0x789 GroupIndex       : UChar
   +0x78a QpcToTscIncrementShift : UChar
   +0x78b PrcbPad3         : [5] UChar
   +0x790 CoresPerPhysicalProcessor : Uint4B
   +0x794 LogicalProcessorsPerCore : Uint4B
   +0x798 QpcToTscIncrement : Uint8B
   +0x7a0 PrcbPad4         : [12] Uint8B
   +0x800 LockQueue        : [17] _KSPIN_LOCK_QUEUE
   +0x910 ProcessorVendorString : [2] UChar
   +0x912 PrcbPad5         : [1] UChar
   +0x914 FeatureBits      : Uint4B
   +0x918 MaxBreakpoints   : Uint4B
   +0x91c MaxWatchpoints   : Uint4B
   +0x920 Context          : Ptr64 _CONTEXT
   +0x928 ContextFlagsInit : Uint4B
   +0x930 ExtendedState    : Ptr64 _XSAVE_AREA
   +0x938 EmulatedAccess   : UChar
   +0x93c EmulatedFaultSyndrome : Uint4B
   +0x940 EmulatedFaultAddress : Uint8B
   +0x948 EmulatedLoadStoreAcquireRelease : Uint8B
   +0x950 EmulatedMisalignedAtomics : Uint8B
   +0x958 EmulatedCoalesceCount : Int4B
   +0x95c TrapFrameLogIndex : Uint4B
   +0x960 TrapFrameLog     : Ptr64 _TRAPFRAME_LOG_ENTRY
   +0x980 PPLookasideList  : [16] _PP_LOOKASIDE_LIST
   +0xa80 PacketBarrier    : Int4B
   +0xa88 DeferredReadyListHead : _SINGLE_LIST_ENTRY
   +0xa90 MmPageFaultCount : Int4B
   +0xa94 MmCopyOnWriteCount : Int4B
   +0xa98 MmTransitionCount : Int4B
   +0xa9c MmDemandZeroCount : Int4B
   +0xaa0 MmPageReadCount  : Int4B
   +0xaa4 MmPageReadIoCount : Int4B
   +0xaa8 MmDirtyPagesWriteCount : Int4B
   +0xaac MmDirtyWriteIoCount : Int4B
   +0xab0 MmMappedPagesWriteCount : Int4B
   +0xab4 MmMappedWriteIoCount : Int4B
   +0xab8 KeSystemCalls    : Uint4B
   +0xabc KeContextSwitches : Uint4B
   +0xac0 CcFastReadNoWait : Uint4B
   +0xac4 CcFastReadWait   : Uint4B
   +0xac8 CcFastReadNotPossible : Uint4B
   +0xacc CcCopyReadNoWait : Uint4B
   +0xad0 CcCopyReadWait   : Uint4B
   +0xad4 CcCopyReadNoWaitMiss : Uint4B
   +0xad8 LookasideIrpFloat : Int4B
   +0xadc IoReadOperationCount : Int4B
   +0xae0 IoWriteOperationCount : Int4B
   +0xae4 IoOtherOperationCount : Int4B
   +0xae8 IoReadTransferCount : _LARGE_INTEGER
   +0xaf0 IoWriteTransferCount : _LARGE_INTEGER
   +0xaf8 IoOtherTransferCount : _LARGE_INTEGER
   +0xb00 Mailbox          : Ptr64 _REQUEST_MAILBOX
   +0xb08 TargetCount      : Int4B
   +0xb0c IpiFrozen        : Uint4B
   +0xb10 RequestSummary   : Uint4B
   +0xb18 DpcData          : [2] _KDPC_DATA
   +0xb78 DpcStack         : Ptr64 Void
   +0xb80 SpBase           : Ptr64 Void
   +0xb88 MaximumDpcQueueDepth : Int4B
   +0xb8c DpcRequestRate   : Uint4B
   +0xb90 MinimumDpcRate   : Uint4B
   +0xb94 DpcLastCount     : Uint4B
   +0xb98 ThreadDpcEnable  : UChar
   +0xb99 QuantumEnd       : UChar
   +0xb9a DpcRoutineActive : UChar
   +0xb9b IdleSchedule     : UChar
   +0xb9c DpcRequestSummary : Int4B
   +0xb9c DpcRequestSlot   : [2] Int2B
   +0xb9c NormalDpcState   : Int2B
   +0xb9e ThreadDpcState   : Int2B
   +0xb9c DpcNormalProcessingActive : Pos 0, 1 Bit
   +0xb9c DpcNormalProcessingRequested : Pos 1, 1 Bit
   +0xb9c DpcNormalThreadSignal : Pos 2, 1 Bit
   +0xb9c DpcNormalTimerExpiration : Pos 3, 1 Bit
   +0xb9c DpcNormalDpcPresent : Pos 4, 1 Bit
   +0xb9c DpcNormalLocalInterrupt : Pos 5, 1 Bit
   +0xb9c DpcNormalPriorityAntiStarvation : Pos 6, 1 Bit
   +0xb9c DpcNormalSwapToDpcDelegate : Pos 7, 1 Bit
   +0xb9c DpcNormalSpare   : Pos 8, 8 Bits
   +0xb9c DpcThreadActive  : Pos 16, 1 Bit
   +0xb9c DpcThreadRequested : Pos 17, 1 Bit
   +0xb9c DpcThreadSpare   : Pos 18, 14 Bits
   +0xba0 LastTick         : Uint4B
   +0xba4 ClockInterrupts  : Uint4B
   +0xba8 ReadyScanTick    : Uint4B
   +0xbac PrcbFlags        : _KPRCBFLAG
   +0xbb0 InterruptLastCount : Uint4B
   +0xbb4 InterruptRate    : Uint4B
   +0xbb8 SingleDpcSoftTimeLimitTicks : Uint4B
   +0xbbc CumulativeDpcSoftTimeLimitTicks : Uint4B
   +0xbc0 SingleDpcSoftTimeoutEventInfo : Ptr64 _KSINGLE_DPC_SOFT_TIMEOUT_EVENT_INFO
   +0xc00 DpcGate          : _KGATE
   +0xc18 MPAffinity       : Uint8B
   +0xc20 CallDpc          : _KDPC
   +0xc60 ClockKeepAlive   : Int4B
   +0xc64 PrcbPad11        : [2] UChar
   +0xc68 DpcWatchdogPeriodTicks : Int4B
   +0xc6c DpcWatchdogCount : Int4B
   +0xc70 DpcWatchdogSequenceNumber : Uint4B
   +0xc74 KeSpinLockOrdering : Int4B
   +0xc78 TrappedSecurityDomain : Uint8B
   +0xc80 WaitListHead     : _LIST_ENTRY
   +0xc90 WaitLock         : Uint8B
   +0xc98 ReadySummary     : Uint4B
   +0xc9c AffinitizedSelectionMask : Int4B
   +0xca0 QueueIndex       : Uint4B
   +0xca4 NormalPriorityQueueIndex : Uint4B
   +0xca8 NormalPriorityReadyScanTick : Uint4B
   +0xcb0 TimerExpirationDpc : _KDPC
   +0xcf0 ScbQueue         : _RTL_RB_TREE
   +0xd00 ScbList          : _LIST_ENTRY
   +0xd10 ActiveScbList    : _LIST_ENTRY
   +0xd80 DispatcherReadyListHead : [32] _LIST_ENTRY
   +0xf80 InterruptCount   : Uint4B
   +0xf84 KernelTime       : Uint4B
   +0xf88 UserTime         : Uint4B
   +0xf8c DpcTime          : Uint4B
   +0xf90 InterruptTime    : Uint4B
   +0xf94 AdjustDpcThreshold : Uint4B
   +0xf98 SkipTick         : UChar
   +0xf99 DebuggerSavedIRQL : UChar
   +0xf9a TbFlushListActive : UChar
   +0xf9b GroupSchedulingOverQuota : UChar
   +0xf9c DpcTimeCount     : Uint4B
   +0xfa0 DpcTimeLimitTicks : Uint4B
   +0xfa4 PeriodicCount    : Uint4B
   +0xfa8 PeriodicBias     : Uint4B
   +0xfac AvailableTime    : Uint4B
   +0xfb0 ScbOffset        : Uint4B
   +0xfb4 KeExceptionDispatchCount : Uint4B
   +0xfb8 SchedulerSubNode : Ptr64 _KSCHEDULER_SUBNODE
   +0xfc0 AffinitizedCycles : Uint8B
   +0xfc8 StartCycles      : Uint8B
   +0xfd0 TaggedCycles     : [4] Uint8B
   +0xff0 CpuCycleScalingFactor : Uint4B
   +0xff4 WorkSubQueueIndex : Uint4B
   +0xff8 EntropyTimingState : _KENTROPY_TIMING_STATE
   +0x1150 CachedStacks     : [2] Ptr64 Void
   +0x1160 PageColor        : Uint4B
   +0x1164 NodeColor        : Uint4B
   +0x1168 PrcbPad18        : [2] Uint4B
   +0x1170 CycleTime        : Uint8B
   +0x1178 Cycles           : [4] [2] Uint8B
   +0x1200 SymCryptEntropyAccumulatorState : _SYMCRYPT_ENTROPY_ACCUMULATOR_STATE
   +0x1380 CcFastMdlReadNoWait : Uint4B
   +0x1384 CcFastMdlReadWait : Uint4B
   +0x1388 CcFastMdlReadNotPossible : Uint4B
   +0x138c CcMapDataNoWait  : Uint4B
   +0x1390 CcMapDataWait    : Uint4B
   +0x1394 CcPinMappedDataCount : Uint4B
   +0x1398 CcPinReadNoWait  : Uint4B
   +0x139c CcPinReadWait    : Uint4B
   +0x13a0 CcMdlReadNoWait  : Uint4B
   +0x13a4 CcMdlReadWait    : Uint4B
   +0x13a8 CcLazyWriteHotSpots : Uint4B
   +0x13ac CcLazyWriteIos   : Uint4B
   +0x13b0 CcLazyWritePages : Uint4B
   +0x13b4 CcDataFlushes    : Uint4B
   +0x13b8 CcDataPages      : Uint4B
   +0x13bc CcLostDelayedWrites : Uint4B
   +0x13c0 CcFastReadResourceMiss : Uint4B
   +0x13c4 CcCopyReadWaitMiss : Uint4B
   +0x13c8 CcFastMdlReadResourceMiss : Uint4B
   +0x13cc CcMapDataNoWaitMiss : Uint4B
   +0x13d0 CcMapDataWaitMiss : Uint4B
   +0x13d4 CcPinReadNoWaitMiss : Uint4B
   +0x13d8 CcPinReadWaitMiss : Uint4B
   +0x13dc CcMdlReadNoWaitMiss : Uint4B
   +0x13e0 CcMdlReadWaitMiss : Uint4B
   +0x13e4 CcReadAheadIos   : Uint4B
   +0x13e8 MmCacheTransitionCount : Int4B
   +0x13ec MmCacheReadCount : Int4B
   +0x13f0 MmCacheIoCount   : Int4B
   +0x1400 PowerState       : _PROCESSOR_POWER_STATE
   +0x1640 ForceIdleDpc     : _KDPC
   +0x1680 DpcRuntimeHistoryHashTable : Ptr64 _RTL_HASH_TABLE
   +0x1688 DpcRuntimeHistoryCleanupTime : Uint8B
   +0x1690 CurrentDpcRoutine : Ptr64     void 
   +0x1698 CurrentDpcRuntimeHistoryCached : Uint8B
   +0x16a0 CurrentDpcStartTime : Uint8B
   +0x16a8 DpcDelegateThread : Ptr64 _KTHREAD
   +0x16b0 DeviceInterrupts : Uint4B
   +0x16b8 IsrDpcStats      : Ptr64 Void
   +0x16c0 KeAlignmentFixupCount : Uint4B
   +0x16c4 CycleAccumulationInitialized : UChar
   +0x16c5 PrcbPad21        : [3] UChar
   +0x16c8 MmSpinLockOrdering : Int8B
   +0x16d0 DpcWatchdogDpc   : _KDPC
   +0x1710 StartCyclesQpc   : Uint8B
   +0x1718 CycleTimeQpc     : Uint8B
   +0x1720 NumberOfSecureFaults : Uint8B
   +0x1728 CompactionMaskInit : Uint8B
   +0x1730 PrcbPad22        : [4] Uint8B
   +0x1750 InterruptObjectPool : _SLIST_HEADER
   +0x1760 PackageProcessorSet : _KAFFINITY_EX
   +0x1868 ProcessorId      : Uint4B
   +0x186c CoreId           : Uint4B
   +0x1870 ModuleId         : Uint4B
   +0x1874 DieId            : Uint4B
   +0x1878 PackageId        : Uint4B
   +0x187c ComplexId        : Uint4B
   +0x1868 TopologyId       : [6] Uint4B
   +0x1880 PrcbPad25        : [80] UChar
   +0x1900 SharedReadyQueueMask : Uint8B
   +0x1908 SharedReadyQueue : Ptr64 _KSHARED_READY_QUEUE
   +0x1910 SharedQueueScanOwner : Uint4B
   +0x1914 ScanSiblingIndex : Uint4B
   +0x1918 CoreControlBlock : Ptr64 _KCORE_CONTROL_BLOCK
   +0x1920 CoreProcessorSet : Uint8B
   +0x1928 ScanSiblingMask  : Uint8B
   +0x1930 LLCMask          : Uint8B
   +0x1938 GroupModuleProcessorSet : Uint8B
   +0x1940 PrcbPad19        : [4] Uint8B
   +0x1960 SmtIsolationThread : Ptr64 _KTHREAD
   +0x1968 Cache            : [6] _CACHE_DESCRIPTOR
   +0x19b0 CacheCount       : UChar
   +0x19b1 PrcbPad20        : UChar
   +0x19b2 SystemWorkKickInProgress : UChar
   +0x19b3 ExceptionStackActive : UChar
   +0x19b4 CachedCommit     : Uint4B
   +0x19b8 CachedResidentAvailable : Uint4B
   +0x19c0 MmFaultCompletionInfo : Ptr64 Void
   +0x19c8 MmInternal       : Ptr64 Void
   +0x19d0 GenerationTarget : Uint8B
   +0x19d8 PrcbPad24        : [1] Uint8B
   +0x19e0 VmInternal       : Ptr64 Void
   +0x19e8 DpcLog           : Ptr64 Void
   +0x19f0 DpcLogIndex      : Uint4B
   +0x19f4 DpcLogBufferSize : Uint4B
   +0x19f8 ExceptionStack   : Ptr64 Void
   +0x1a00 WheaInfo         : Ptr64 Void
   +0x1a08 EtwSupport       : Ptr64 Void
   +0x1a10 HypercallPageList : _SLIST_HEADER
   +0x1a20 HypercallCachedPages : Ptr64 Void
   +0x1a28 VirtualApicAssist : Ptr64 Void
   +0x1a30 VirtualApicAssistPage : _LARGE_INTEGER
   +0x1a38 StatisticsPage   : Ptr64 Uint8B
   +0x1a80 SynchCounters    : _SYNCH_COUNTERS
   +0x1b38 PteBitCache      : Uint8B
   +0x1b40 PteBitOffset     : Uint4B
   +0x1b48 FsCounters       : _FILESYSTEM_DISK_COUNTERS
   +0x1b58 PanicStackBase   : Uint8B
   +0x1b60 IsrStack         : Ptr64 Void
   +0x1b80 TimerTable       : _KTIMER_TABLE
   +0x5d98 PrcbPad13        : [1165] Uint8B
   +0x8200 AbSelfIoBoostsList : _SINGLE_LIST_ENTRY
   +0x8208 AbPropagateBoostsList : _SINGLE_LIST_ENTRY
   +0x8210 AbDpc            : _KDPC
   +0x8250 IoIrpStackProfilerCurrent : _IOP_IRP_STACK_PROFILER
   +0x82a4 IoIrpStackProfilerPrevious : _IOP_IRP_STACK_PROFILER
   +0x8300 LocalSharedReadyQueue : Ptr64 _KSHARED_READY_QUEUE
   +0x8308 TimerExpirationTrace : [16] _KTIMER_EXPIRATION_TRACE
   +0x8408 TimerExpirationTraceCount : Uint4B
   +0x8480 ClockTimerState  : _KCLOCK_TIMER_STATE
   +0x8998 ExSaPageArray    : Ptr64 Void
   +0x89a0 TracepointLog    : Ptr64 _KPRCB_TRACEPOINT_LOG
   +0x89a8 RcuData          : _KE_PRCB_RCU_DATA
   +0x89c8 FreezePowerOff   : Int4B
   +0x89cc DpcWatchdogProfileBufferSize : Uint4B
   +0x89d0 StaticAffinity   : _KSTATIC_AFFINITY_BLOCK
   +0x91f0 DeferredDispatchInterrupts : _KSOFTWARE_INTERRUPT_BATCH
   +0x9400 StaticRescheduleContext : Ptr64 _KI_RESCHEDULE_CONTEXT
   +0x9408 SecureFault      : _KSECURE_FAULT_INFORMATION
   +0x9420 CyclesByThreadType : Ptr64 Uint8B
   +0x9428 ReadyThreadCount : Uint4B
   +0x9430 ReadyQueueExpectedRunTime : Uint8B
   +0x9438 ForceParkDutyCycleData : Ptr64 _KFORCE_PARK_DUTY_CYCLE_DATA
   +0x9440 CpuPartition     : Ptr64 _KCPU_PARTITION
   +0x9448 DpcWatchdogProfileCumulativeDpcThresholdTicks : Uint4B
   +0x944c DpcWatchdogProfileSingleDpcThresholdTicks : Uint4B
   +0x9450 DpcWatchdogProfile : Ptr64 Ptr64 Void
   +0x9458 DpcWatchdogProfileCurrentEmptyCapture : Ptr64 Ptr64 Void
   +0x9460 SchedulerAssist  : Ptr64 Void
   +0x9468 SelfmapLockHandle : [4] _KLOCK_QUEUE_HANDLE
   +0x94c8 CacheProcessorSet : [6] _KAFFINITY_EX
   +0x9af8 ModuleProcessorSet : _KAFFINITY_EX
   +0x9c00 ComplexProcessorSet : _KAFFINITY_EX
   +0x9d08 DieProcessorSet  : _KAFFINITY_EX
   +0x9e10 LocalCoreControlBlock : _KCORE_CONTROL_BLOCK
   +0x9e40 CoreControlBlockIndex : Uint4B
   +0x9e44 PrcbPad26        : Uint4B
   +0x9e48 CoreControlBlockShadow : Ptr64 _KCORE_CONTROL_BLOCK_SHADOW
   +0x9e50 LocalCoreControlBlockShadow : _KCORE_CONTROL_BLOCK_SHADOW
   +0x9e90 NodeRelativeTopologyIndex : [6] Uint4B
   +0x9ea8 KstackFreeDpc    : _KDPC
   +0x9ef0 KstackFreeList   : _SLIST_HEADER
   +0x9f00 IpiFrame         : Ptr64 _KTRAP_FRAME
   +0x9f08 SlistRollbackDpc : _KDPC
   +0x9f48 LocalSearchContexts : [2] Ptr64 _KI_COOPERATIVE_IDLE_SEARCH_CONTEXT
   +0x9f58 SearchContexts   : [2] Ptr64 _KI_COOPERATIVE_IDLE_SEARCH_CONTEXT
   +0x9f68 SearchGenerations : [2] Ptr64 _KI_COOPERATIVE_IDLE_SEARCH_GENERATION
   +0x9f78 PerformanceScoreByClass : [8] Uint2B
   +0x9f88 EfficiencyScoreByClass : [8] Uint2B
   +0x9f98 SmidrEl1Value    : Uint8B
   +0x9fa0 PresentSharedComputeUnits : UChar
   +0x9fa1 PrcbPad27        : [7] UChar
   +0x9fa8 SubNodeSharedComputeUnitSets : [1] Uint8B
   +0x9fb0 SharedComputeUnits : [1] Ptr64 _KI_SHARED_COMPUTE_UNIT_BLOCK
   +0x9fb8 LocalSharedComputeUnits : [1] Ptr64 _KI_SHARED_COMPUTE_UNIT_BLOCK
   +0xa000 RequestMailbox   : [1] _REQUEST_MAILBOX

WinDbg Command Window[Copy]

0: kd> dt nt!_KTHREAD
   +0x000 Header           : _DISPATCHER_HEADER
   +0x018 SListFaultAddress : Ptr64 Void
   +0x020 QuantumTarget    : Uint8B
   +0x028 InitialStack     : Ptr64 Void
   +0x030 StackLimit       : Ptr64 Void
   +0x038 StackBase        : Ptr64 Void
   +0x040 ThreadLock       : Uint8B
   +0x048 CycleTime        : Uint8B
   +0x050 CurrentRunTime   : Uint4B
   +0x054 ExpectedRunTime  : Uint4B
   +0x058 KernelStack      : Ptr64 Void
   +0x060 SchedulingGroup  : Ptr64 _KSCHEDULING_GROUP
   +0x068 WaitRegister     : _KWAIT_STATUS_REGISTER
   +0x069 Alerted          : UChar
   +0x069 KernelModeAlerted : Pos 0, 1 Bit
   +0x069 UserModeAlerted  : Pos 1, 1 Bit
   +0x06a Running          : Uint2B
   +0x06c AutoBoostActive  : Pos 0, 1 Bit
   +0x06c ReadyTransition  : Pos 1, 1 Bit
   +0x06c WaitNext         : Pos 2, 1 Bit
   +0x06c SystemAffinityActive : Pos 3, 1 Bit
   +0x06c Alertable        : Pos 4, 1 Bit
   +0x06c Reserved1        : Pos 5, 1 Bit
   +0x06c ApcInterruptRequest : Pos 6, 1 Bit
   +0x06c QuantumEndMigrate : Pos 7, 1 Bit
   +0x06c SecureThread     : Pos 8, 1 Bit
   +0x06c TimerActive      : Pos 9, 1 Bit
   +0x06c SystemThread     : Pos 10, 1 Bit
   +0x06c ProcessDetachActive : Pos 11, 1 Bit
   +0x06c Reserved2        : Pos 12, 1 Bit
   +0x06c ScbReadyQueue    : Pos 13, 1 Bit
   +0x06c ApcQueueable     : Pos 14, 1 Bit
   +0x06c Reserved3        : Pos 15, 1 Bit
   +0x06c WaitNextClearWobPriorityFloor : Pos 16, 1 Bit
   +0x06c TimerSuspended   : Pos 17, 1 Bit
   +0x06c SuspendedWaitMode : Pos 18, 1 Bit
   +0x06c SuspendSchedulerApcWait : Pos 19, 1 Bit
   +0x06c CetUserShadowStack : Pos 20, 1 Bit
   +0x06c BypassProcessFreeze : Pos 21, 1 Bit
   +0x06c CetKernelShadowStack : Pos 22, 1 Bit
   +0x06c StateSaveAreaDecoupled : Pos 23, 1 Bit
   +0x06c Reserved         : Pos 24, 8 Bits
   +0x06c MiscFlags        : Int4B
   +0x070 UserIdealProcessorFixed : Pos 0, 1 Bit
   +0x070 IsolationWidth   : Pos 1, 1 Bit
   +0x070 AutoAlignment    : Pos 2, 1 Bit
   +0x070 DisableBoost     : Pos 3, 1 Bit
   +0x070 AlertedByThreadId : Pos 4, 1 Bit
   +0x070 QuantumDonation  : Pos 5, 1 Bit
   +0x070 EnableStackSwap  : Pos 6, 1 Bit
   +0x070 GuiThread        : Pos 7, 1 Bit
   +0x070 DisableQuantum   : Pos 8, 1 Bit
   +0x070 ChargeOnlySchedulingGroup : Pos 9, 1 Bit
   +0x070 DeferPreemption  : Pos 10, 1 Bit
   +0x070 QueueDeferPreemption : Pos 11, 1 Bit
   +0x070 ForceDeferSchedule : Pos 12, 1 Bit
   +0x070 SharedReadyQueueAffinity : Pos 13, 1 Bit
   +0x070 FreezeCount      : Pos 14, 1 Bit
   +0x070 TerminationApcRequest : Pos 15, 1 Bit
   +0x070 AutoBoostEntriesExhausted : Pos 16, 1 Bit
   +0x070 KernelStackResident : Pos 17, 1 Bit
   +0x070 TerminateRequestReason : Pos 18, 2 Bits
   +0x070 ProcessStackCountDecremented : Pos 20, 1 Bit
   +0x070 RestrictedGuiThread : Pos 21, 1 Bit
   +0x070 VpBackingThread  : Pos 22, 1 Bit
   +0x070 EtwStackTraceCrimsonApcDisabled : Pos 23, 1 Bit
   +0x070 EtwStackTraceApcInserted : Pos 24, 8 Bits
   +0x070 ThreadFlags      : Int4B
   +0x074 Tag              : UChar
   +0x075 CalloutActive    : Pos 0, 1 Bit
   +0x075 ReservedStackInUse : Pos 1, 1 Bit
   +0x075 UserStackWalkActive : Pos 2, 1 Bit
   +0x075 SameThreadTransientFlagsReserved : Pos 3, 5 Bits
   +0x075 SameThreadTransientFlags : Char
   +0x076 Spare0           : UChar
   +0x078 SystemCallNumber : Uint4B
   +0x07c ReadyTime        : Uint4B
   +0x080 FirstArgument    : Ptr64 Void
   +0x088 TrapFrame        : Ptr64 _KTRAP_FRAME
   +0x090 ApcState         : _KAPC_STATE
   +0x090 ApcStateFill     : [43] UChar
   +0x0bb Priority         : Char
   +0x0bc UserIdealProcessor : Uint4B
   +0x0c0 WaitStatus       : Int8B
   +0x0c8 WaitBlockList    : Ptr64 _KWAIT_BLOCK
   +0x0d0 WaitListEntry    : _LIST_ENTRY
   +0x0d0 SwapListEntry    : _SINGLE_LIST_ENTRY
   +0x0e0 Queue            : Ptr64 _DISPATCHER_HEADER
   +0x0e8 Teb              : Ptr64 Void
   +0x0f0 RelativeTimerBias : Uint8B
   +0x0f8 Timer            : _KTIMER
   +0x138 WaitBlock        : [4] _KWAIT_BLOCK
   +0x138 WaitBlockFill4   : [20] UChar
   +0x14c ContextSwitches  : Uint4B
   +0x138 WaitBlockFill5   : [68] UChar
   +0x17c State            : UChar
   +0x17d Spare13          : Char
   +0x17e WaitIrql         : UChar
   +0x17f WaitMode         : Char
   +0x138 WaitBlockFill6   : [116] UChar
   +0x1ac WaitTime         : Uint4B
   +0x138 WaitBlockFill7   : [164] UChar
   +0x1dc KernelApcDisable : Int2B
   +0x1de SpecialApcDisable : Int2B
   +0x1dc CombinedApcDisable : Uint4B
   +0x138 WaitBlockFill8   : [40] UChar
   +0x160 ThreadCounters   : Ptr64 _KTHREAD_COUNTERS
   +0x138 WaitBlockFill9   : [88] UChar
   +0x190 XStateSave       : Ptr64 _XSTATE_SAVE
   +0x138 WaitBlockFill10  : [136] UChar
   +0x1c0 Win32Thread      : Ptr64 Void
   +0x138 WaitBlockFill11  : [176] UChar
   +0x1e8 EmulationControlBlock : Ptr64 _KEMUL_CONTROL_BLOCK
   +0x1f0 LastXStateSaveDebugInfo : Uint8B
   +0x1f8 ThreadFlags2     : Int4B
   +0x1f8 DisableKasan     : Pos 0, 1 Bit
   +0x1f8 AbContextSwitchState : Pos 1, 1 Bit
   +0x1f8 AbReleasePending : Pos 2, 1 Bit
   +0x1f8 ChargeOnlySchedulingGroupOverridden : Pos 3, 1 Bit
   +0x1f8 ThreadFlags2Reserved : Pos 4, 28 Bits
   +0x1fc BamQosLevel      : UChar
   +0x1fd HardwareFeedbackClass : UChar
   +0x1fe PriorityDecrement : Int2B
   +0x1fe ForegroundBoost  : Pos 0, 4 Bits
   +0x1fe UnusualBoost     : Pos 4, 8 Bits
   +0x200 QueueListEntry   : _LIST_ENTRY
   +0x210 SwitchFrame      : _KSWITCH_FRAME
   +0x230 VfpState         : Ptr64 _KARM64_VFP_STATE
   +0x238 NextProcessor    : Uint4B
   +0x238 NextProcessorNumber : Pos 0, 31 Bits
   +0x238 SharedReadyQueue : Pos 31, 1 Bit
   +0x23c QueuePriority    : Int4B
   +0x240 Process          : Ptr64 _KPROCESS
   +0x248 UserAffinity     : Ptr64 _KAFFINITY_EX
   +0x250 UserAffinityPrimaryGroup : Uint2B
   +0x252 PreviousMode     : Char
   +0x253 BasePriority     : Char
   +0x254 SharedComputeUnitsUsed : UChar
   +0x255 Preempted        : UChar
   +0x256 AdjustReason     : UChar
   +0x257 AdjustIncrement  : Char
   +0x258 AffinityVersion  : Uint8B
   +0x260 Affinity         : Ptr64 _KAFFINITY_EX
   +0x268 AffinityPrimaryGroup : Uint2B
   +0x26a ApcStateIndex    : UChar
   +0x26b WaitBlockCount   : UChar
   +0x26c IdealProcessor   : Uint4B
   +0x270 NpxState         : Uint8B
   +0x278 SavedApcState    : _KAPC_STATE
   +0x278 SavedApcStateFill : [43] UChar
   +0x2a3 WaitReason       : UChar
   +0x2a4 SuspendCount     : Char
   +0x2a5 Saturation       : Char
   +0x2a6 SListFaultCount  : Uint2B
   +0x2a8 SchedulerApc     : _KAPC
   +0x2a8 SchedulerApcFill1 : [3] UChar
   +0x2ab QuantumReset     : UChar
   +0x2a8 SchedulerApcFill2 : [4] UChar
   +0x2ac KernelTime       : Uint4B
   +0x2a8 SchedulerApcFill3 : [64] UChar
   +0x2e8 WaitPrcb         : Ptr64 _KPRCB
   +0x2a8 SchedulerApcFill4 : [72] UChar
   +0x2f0 LegoData         : Ptr64 Void
   +0x2a8 SchedulerApcFill5 : [83] UChar
   +0x2fb CallbackNestingLevel : UChar
   +0x2fc UserTime         : Uint4B
   +0x300 SuspendEvent     : _KEVENT
   +0x318 ThreadListEntry  : _LIST_ENTRY
   +0x328 MutantListHead   : _LIST_ENTRY
   +0x338 AbWaitEntryCount : UChar
   +0x339 AbOwnedEntryCount : UChar
   +0x338 AbEntryCountValue : Uint2B
   +0x33a FreezeFlags      : UChar
   +0x33a FreezeCount2     : Pos 0, 1 Bit
   +0x33a FreezeNormal     : Pos 1, 1 Bit
   +0x33a FreezeDeep       : Pos 2, 1 Bit
   +0x33b WobPriority      : Char
   +0x33c SecureThreadCookie : Uint4B
   +0x340 SchedulerSharedSystemSlot : Ptr64 Void
   +0x348 PropagateBoostsEntry : _SINGLE_LIST_ENTRY
   +0x350 IoSelfBoostsEntry : _SINGLE_LIST_ENTRY
   +0x358 PriorityFloorCounts : [32] UChar
   +0x378 PriorityFloorSummary : Uint4B
   +0x37c AbCompletedIoBoostCount : Int4B
   +0x380 AbCompletedIoQoSBoostCount : Int4B
   +0x384 KeReferenceCount : Int2B
   +0x386 DecayBoost       : Char
   +0x387 Spare6           : UChar
   +0x388 ForegroundLossTime : Uint4B
   +0x390 GlobalForegroundListEntry : _LIST_ENTRY
   +0x390 ForegroundDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x398 InGlobalForegroundList : Uint8B
   +0x3a0 ReadOperationCount : Int8B
   +0x3a8 WriteOperationCount : Int8B
   +0x3b0 OtherOperationCount : Int8B
   +0x3b8 ReadTransferCount : Int8B
   +0x3c0 WriteTransferCount : Int8B
   +0x3c8 OtherTransferCount : Int8B
   +0x3d0 QueuedScb        : Ptr64 _KSCB
   +0x3d8 ThreadTimerDelay : Uint4B
   +0x3dc Spare26          : Uint2B
   +0x3de PpmPolicy        : UChar
   +0x3df CpuSetWorkloadClass : UChar
   +0x3e0 TracingPrivate   : [1] Uint8B
   +0x3e8 SchedulerAssist  : Ptr64 Void
   +0x3f0 AbWaitObject     : Ptr64 Void
   +0x3f8 ReservedPreviousReadyTimeValue : Uint4B
   +0x400 KernelWaitTime   : Uint8B
   +0x408 UserWaitTime     : Uint8B
   +0x410 GlobalUpdateVpThreadPriorityListEntry : _LIST_ENTRY
   +0x410 UpdateVpThreadPriorityDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x418 InGlobalUpdateVpThreadPriorityList : Uint8B
   +0x420 SchedulerAssistPriorityFloor : Int4B
   +0x424 RealtimePriorityFloor : Int4B
   +0x428 StateSaveAreaSveVectorOffset : Uint4B
   +0x42c StateSaveAreaSvePredicateOffset : Uint4B
   +0x430 SchedulerAssistYieldCounter : Uint4B
   +0x434 SchedulerAssistYieldBoostCount : Uint4B
   +0x438 SchedulerAssistLastYieldBoostTime : Int8B
   +0x440 WpsFeedback      : Ptr64 _KTHREAD_WPS_FEEDBACK
   +0x448 Spare37          : Uint8B
   +0x450 SmeSvcr          : Uint8B
   +0x458 StateSaveAreaSmeZaOffset : Uint4B
   +0x45c StateSaveAreaSmeTpidr2Offset : Uint4B
   +0x460 StateSaveAreaSmeZtOffset : Uint4B
   +0x464 ScuUsageTrackerOffset : Uint2B
   +0x466 Spare33          : Uint2B
   +0x468 Spare29          : Uint4B
   +0x46c ModeHistory      : Uint4B
   +0x470 SystemAffinityTokenListHead : _SINGLE_LIST_ENTRY
   +0x478 StateSaveArea    : Ptr64 _XSAVE_FORMAT
   +0x480 ResourceIndex    : UChar
   +0x481 CoreIsolationReasons : UChar
   +0x482 BamQosLevelFromAssistPage : UChar
   +0x483 SecureCallCoreIsolationCount : UChar
   +0x484 SchedulerSharedOffset : Uint4B
   +0x488 SchedulerSharedSwappablePage : Ptr64 _KSWAPPABLE_PAGE
   +0x490 AutoBoostThreadState : Ptr64 Void
   +0x498 Spare32          : Ptr64 Void
   +0x490 KernelAbEntries  : Ptr64 _KLOCK_ENTRIES
   +0x498 UserAbEntries    : Ptr64 _KLOCK_ENTRIES

WinDbg Command Window[Copy]

0: kd> dt nt!_KAPC_STATE
   +0x000 ApcListHead      : [2] _LIST_ENTRY
   +0x020 Process          : Ptr64 _KPROCESS
   +0x028 InProgressFlags  : UChar
   +0x028 KernelApcInProgress : Pos 0, 1 Bit
   +0x028 SpecialApcInProgress : Pos 1, 1 Bit
   +0x029 KernelApcPending : UChar
   +0x02a UserApcPendingAll : UChar
   +0x02a SpecialUserApcPending : Pos 0, 1 Bit
   +0x02a UserApcPending   : Pos 1, 1 Bit

WinDbg Command Window[Copy]

0: kd> dt nt!_ETHREAD
   +0x000 Tcb              : _KTHREAD
   +0x4a0 CreateTime       : _LARGE_INTEGER
   +0x4a8 ExitTime         : _LARGE_INTEGER
   +0x4a8 KeyedWaitChain   : _LIST_ENTRY
   +0x4b8 PostBlockList    : _LIST_ENTRY
   +0x4b8 ForwardLinkShadow : Ptr64 Void
   +0x4c0 StartAddress     : Ptr64 Void
   +0x4c8 TerminationPort  : Ptr64 _TERMINATION_PORT
   +0x4c8 ReaperLink       : Ptr64 _ETHREAD
   +0x4c8 KeyedWaitValue   : Ptr64 Void
   +0x4d0 ActiveTimerListLock : Uint8B
   +0x4d8 ActiveTimerListHead : _LIST_ENTRY
   +0x4e8 Cid              : _CLIENT_ID
   +0x4f8 KeyedWaitSemaphore : _KSEMAPHORE
   +0x4f8 AlpcWaitSemaphore : _KSEMAPHORE
   +0x518 ClientSecurity   : _PS_CLIENT_SECURITY_CONTEXT
   +0x520 IrpList          : _LIST_ENTRY
   +0x530 TopLevelIrp      : Uint8B
   +0x538 DeviceToVerify   : Ptr64 _DEVICE_OBJECT
   +0x540 Win32StartAddress : Ptr64 Void
   +0x548 ChargeOnlySession : Ptr64 Void
   +0x550 LegacyPowerObject : Ptr64 Void
   +0x558 ThreadListEntry  : _LIST_ENTRY
   +0x568 RundownProtect   : _EX_RUNDOWN_REF
   +0x570 ThreadLock       : _EX_PUSH_LOCK
   +0x578 ReadClusterSize  : Uint4B
   +0x57c MmLockOrdering   : Uint4B
   +0x580 CrossThreadFlags : Uint4B
   +0x580 Terminated       : Pos 0, 1 Bit
   +0x580 ThreadInserted   : Pos 1, 1 Bit
   +0x580 HideFromDebugger : Pos 2, 1 Bit
   +0x580 ActiveImpersonationInfo : Pos 3, 1 Bit
   +0x580 HardErrorsAreDisabled : Pos 4, 1 Bit
   +0x580 BreakOnTermination : Pos 5, 1 Bit
   +0x580 SkipCreationMsg  : Pos 6, 1 Bit
   +0x580 SkipTerminationMsg : Pos 7, 1 Bit
   +0x580 CopyTokenOnOpen  : Pos 8, 1 Bit
   +0x580 ThreadIoPriority : Pos 9, 3 Bits
   +0x580 ThreadPagePriority : Pos 12, 3 Bits
   +0x580 RundownFail      : Pos 15, 1 Bit
   +0x580 UmsForceQueueTermination : Pos 16, 1 Bit
   +0x580 IndirectCpuSets  : Pos 17, 1 Bit
   +0x580 DisableDynamicCodeOptOut : Pos 18, 1 Bit
   +0x580 ExplicitCaseSensitivity : Pos 19, 1 Bit
   +0x580 PicoNotifyExit   : Pos 20, 1 Bit
   +0x580 DbgWerUserReportActive : Pos 21, 1 Bit
   +0x580 ForcedSelfTrimActive : Pos 22, 1 Bit
   +0x580 SamplingCoverage : Pos 23, 1 Bit
   +0x580 ImpersonationSchedulingGroup : Pos 24, 1 Bit
   +0x580 Prefetching      : Pos 25, 1 Bit
   +0x580 ReservedCrossThreadFlags : Pos 26, 6 Bits
   +0x584 SameThreadPassiveFlags : Uint4B
   +0x584 ActiveExWorker   : Pos 0, 1 Bit
   +0x584 MemoryMaker      : Pos 1, 1 Bit
   +0x584 StoreLockThread  : Pos 2, 2 Bits
   +0x584 ClonedThread     : Pos 4, 1 Bit
   +0x584 KeyedEventInUse  : Pos 5, 1 Bit
   +0x584 SelfTerminate    : Pos 6, 1 Bit
   +0x584 RespectIoPriority : Pos 7, 1 Bit
   +0x584 ActivePageLists  : Pos 8, 1 Bit
   +0x584 SecureContext    : Pos 9, 1 Bit
   +0x584 ZeroPageThread   : Pos 10, 1 Bit
   +0x584 GenerateDumpOnBadHandleAccess : Pos 11, 1 Bit
   +0x584 PeriodicTrimmerThread : Pos 12, 1 Bit
   +0x584 ReservedSameThreadPassiveFlags : Pos 13, 19 Bits
   +0x588 SameThreadApcFlags : Uint4B
   +0x588 OwnsProcessAddressSpaceExclusive : Pos 0, 1 Bit
   +0x588 OwnsProcessAddressSpaceShared : Pos 1, 1 Bit
   +0x588 HardFaultBehavior : Pos 2, 1 Bit
   +0x588 StartAddressInvalid : Pos 3, 1 Bit
   +0x588 EtwCalloutActive : Pos 4, 1 Bit
   +0x588 SuppressSymbolLoad : Pos 5, 1 Bit
   +0x588 SpareBit         : Pos 6, 1 Bit
   +0x588 OwnsVadExclusive : Pos 7, 1 Bit
   +0x589 SystemPagePriorityActive : Pos 0, 1 Bit
   +0x589 SystemPagePriority : Pos 1, 3 Bits
   +0x589 AllowUserWritesToExecutableMemory : Pos 4, 1 Bit
   +0x589 AllowKernelWritesToExecutableMemory : Pos 5, 1 Bit
   +0x589 OwnsVadShared    : Pos 6, 1 Bit
   +0x589 PasidMsrValid    : Pos 7, 1 Bit
   +0x58a SlabReplenishInProgress : Pos 0, 1 Bit
   +0x58c CacheManagerActive : UChar
   +0x58d DisablePageFaultClustering : UChar
   +0x58e ActiveFaultCount : UChar
   +0x58f LockOrderState   : UChar
   +0x590 SharedPsModuleLockAcquires : Uint4B
   +0x594 MmReserved       : Uint4B
   +0x598 AlpcMessageId    : Uint8B
   +0x5a0 AlpcMessage      : Ptr64 Void
   +0x5a0 AlpcReceiveAttributeSet : Uint4B
   +0x5a8 AlpcWaitListEntry : _LIST_ENTRY
   +0x5b8 ExitStatus       : Int4B
   +0x5bc CacheManagerCount : Uint4B
   +0x5c0 IoBoostCount     : Uint4B
   +0x5c4 IoQoSBoostCount  : Uint4B
   +0x5c8 IoQoSThrottleCount : Uint4B
   +0x5cc KernelStackReference : Uint4B
   +0x5d0 BoostList        : _LIST_ENTRY
   +0x5e0 DeboostList      : _LIST_ENTRY
   +0x5f0 BoostListLock    : Uint8B
   +0x5f8 IrpListLock      : Uint8B
   +0x600 ReservedForSynchTracking : Ptr64 Void
   +0x608 CmCallbackListHead : _SINGLE_LIST_ENTRY
   +0x610 ActivityId       : Ptr64 _GUID
   +0x618 SeLearningModeListHead : _SINGLE_LIST_ENTRY
   +0x620 VerifierContext  : Ptr64 Void
   +0x628 AdjustedClientToken : Ptr64 Void
   +0x630 WorkOnBehalfThread : Ptr64 Void
   +0x638 PropertySet      : _PS_PROPERTY_SET
   +0x650 PicoContext      : Ptr64 Void
   +0x658 UserRoBase       : Uint8B
   +0x660 UserRwBase       : Uint8B
   +0x668 EnergyValues     : Ptr64 _THREAD_ENERGY_VALUES
   +0x670 SelectedCpuSets  : Uint8B
   +0x670 SelectedCpuSetsIndirect : Ptr64 Uint8B
   +0x678 Silo             : Ptr64 _EJOB
   +0x680 ThreadName       : Ptr64 _UNICODE_STRING
   +0x688 SparePointer     : Ptr64 Void
   +0x690 SparePointer2    : Ptr64 Void
   +0x698 OwnerEntryListHead : _LIST_ENTRY
   +0x6a8 DisownedOwnerEntryListLock : Uint8B
   +0x6b0 DisownedOwnerEntryListHead : _LIST_ENTRY
   +0x6c0 SchedulerSharedDataObject : Ptr64 Void
   +0x6c8 CmThreadInfo     : Ptr64 Void
   +0x6d0 FlsData          : Ptr64 Void
   +0x6d8 LastExpectedRunTime : Uint4B
   +0x6dc LastSoftParkElectionRunTime : Uint4B
   +0x6e0 LastSoftParkElectionGeneration : Uint8B
   +0x6e8 LastSoftParkElectionGroupAffinity : _GROUP_AFFINITY
   +0x6f8 UserIsolationDomain : Uint8B
   +0x700 UpdateTebApc     : _KAPC
   +0x700 UpdateTebApcFill1 : [3] UChar
   +0x703 Win32kPriorityFloor : Char
   +0x700 UpdateTebApcFill2 : [4] UChar
   +0x704 LastSoftParkElectionQos : UChar
   +0x705 LastSoftParkElectionWorkloadType : UChar
   +0x706 LastSoftParkElectionRunningType : UChar
   +0x707 MmSlabIdentity   : UChar
   +0x700 UpdateTebApcFill3 : [64] UChar
   +0x740 RngState         : _RTL_THREAD_RNG_STATE
   +0x700 UpdateTebApcFill4 : [72] UChar
   +0x748 UsedByRngState   : Ptr64 Void
   +0x700 UpdateTebApcFill5 : [83] UChar
   +0x753 UpdateTebSpareByte2 : UChar
   +0x754 HeapData         : Uint4B
   +0x758 Win32kThreadLock : Uint8B
   +0x760 ThreadIndex      : Ptr64 Void
   +0x768 MmFaultClusterContext : Ptr64 Void
   +0x770 ProcessFastRef   : _EX_FAST_REF

WinDbg Command Window[Copy]

0: kd> dt nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x1b8 ProcessLock      : _EX_PUSH_LOCK
   +0x1c0 UniqueProcessId  : Ptr64 Void
   +0x1c8 ActiveProcessLinks : _LIST_ENTRY
   +0x1d8 RundownProtect   : _EX_RUNDOWN_REF
   +0x1e0 Flags2           : Uint4B
   +0x1e0 JobNotReallyActive : Pos 0, 1 Bit
   +0x1e0 AccountingFolded : Pos 1, 1 Bit
   +0x1e0 NewProcessReported : Pos 2, 1 Bit
   +0x1e0 ExitProcessReported : Pos 3, 1 Bit
   +0x1e0 ReportCommitChanges : Pos 4, 1 Bit
   +0x1e0 LastReportMemory : Pos 5, 1 Bit
   +0x1e0 ForceWakeCharge  : Pos 6, 1 Bit
   +0x1e0 CrossSessionCreate : Pos 7, 1 Bit
   +0x1e0 NeedsHandleRundown : Pos 8, 1 Bit
   +0x1e0 RefTraceEnabled  : Pos 9, 1 Bit
   +0x1e0 PicoCreated      : Pos 10, 1 Bit
   +0x1e0 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x1e0 DefaultPagePriority : Pos 12, 3 Bits
   +0x1e0 PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x1e0 ProcessVerifierTarget : Pos 16, 1 Bit
   +0x1e0 RestrictSetThreadContext : Pos 17, 1 Bit
   +0x1e0 AffinityPermanent : Pos 18, 1 Bit
   +0x1e0 AffinityUpdateEnable : Pos 19, 1 Bit
   +0x1e0 PropagateNode    : Pos 20, 1 Bit
   +0x1e0 ExplicitAffinity : Pos 21, 1 Bit
   +0x1e0 Flags2Available1 : Pos 22, 2 Bits
   +0x1e0 EnableReadVmLogging : Pos 24, 1 Bit
   +0x1e0 EnableWriteVmLogging : Pos 25, 1 Bit
   +0x1e0 FatalAccessTerminationRequested : Pos 26, 1 Bit
   +0x1e0 DisableSystemAllowedCpuSet : Pos 27, 1 Bit
   +0x1e0 Flags2Available2 : Pos 28, 3 Bits
   +0x1e0 InPrivate        : Pos 31, 1 Bit
   +0x1e4 Flags            : Uint4B
   +0x1e4 CreateReported   : Pos 0, 1 Bit
   +0x1e4 NoDebugInherit   : Pos 1, 1 Bit
   +0x1e4 ProcessExiting   : Pos 2, 1 Bit
   +0x1e4 ProcessDelete    : Pos 3, 1 Bit
   +0x1e4 ManageExecutableMemoryWrites : Pos 4, 1 Bit
   +0x1e4 VmDeleted        : Pos 5, 1 Bit
   +0x1e4 OutswapEnabled   : Pos 6, 1 Bit
   +0x1e4 Outswapped       : Pos 7, 1 Bit
   +0x1e4 FailFastOnCommitFail : Pos 8, 1 Bit
   +0x1e4 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x1e4 AddressSpaceInitialized : Pos 10, 2 Bits
   +0x1e4 SetTimerResolution : Pos 12, 1 Bit
   +0x1e4 BreakOnTermination : Pos 13, 1 Bit
   +0x1e4 DeprioritizeViews : Pos 14, 1 Bit
   +0x1e4 WriteWatch       : Pos 15, 1 Bit
   +0x1e4 ProcessInSession : Pos 16, 1 Bit
   +0x1e4 OverrideAddressSpace : Pos 17, 1 Bit
   +0x1e4 HasAddressSpace  : Pos 18, 1 Bit
   +0x1e4 LaunchPrefetched : Pos 19, 1 Bit
   +0x1e4 Reserved         : Pos 20, 1 Bit
   +0x1e4 VmTopDown        : Pos 21, 1 Bit
   +0x1e4 ImageNotifyDone  : Pos 22, 1 Bit
   +0x1e4 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x1e4 VdmAllowed       : Pos 24, 1 Bit
   +0x1e4 ProcessRundown   : Pos 25, 1 Bit
   +0x1e4 ProcessInserted  : Pos 26, 1 Bit
   +0x1e4 DefaultIoPriority : Pos 27, 3 Bits
   +0x1e4 ProcessSelfDelete : Pos 30, 1 Bit
   +0x1e4 SetTimerResolutionLink : Pos 31, 1 Bit
   +0x1e8 CreateTime       : _LARGE_INTEGER
   +0x1f0 ProcessQuotaUsage : [2] Uint8B
   +0x200 ProcessQuotaPeak : [2] Uint8B
   +0x210 PeakVirtualSize  : Uint8B
   +0x218 VirtualSize      : Uint8B
   +0x220 SessionProcessLinks : _LIST_ENTRY
   +0x230 ExceptionPortData : Ptr64 Void
   +0x230 ExceptionPortValue : Uint8B
   +0x230 ExceptionPortState : Pos 0, 3 Bits
   +0x238 Token            : _EX_FAST_REF
   +0x240 MmReserved       : Uint8B
   +0x248 AddressCreationLock : _EX_PUSH_LOCK
   +0x250 PageTableCommitmentLock : _EX_PUSH_LOCK
   +0x258 RotateInProgress : Ptr64 _ETHREAD
   +0x260 ForkInProgress   : Ptr64 _ETHREAD
   +0x268 CommitChargeJob  : Ptr64 _EJOB
   +0x270 CloneRoot        : _RTL_AVL_TREE
   +0x278 NumberOfPrivatePages : Uint8B
   +0x280 MmReserved2      : Uint8B
   +0x288 Win32Process     : Ptr64 Void
   +0x290 Job              : Ptr64 _EJOB
   +0x298 SectionObject    : Ptr64 Void
   +0x2a0 SectionBaseAddress : Ptr64 Void
   +0x2a8 Cookie           : Uint4B
   +0x2b0 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY
   +0x2b8 Win32WindowStation : Ptr64 Void
   +0x2c0 InheritedFromUniqueProcessId : Ptr64 Void
   +0x2c8 OwnerProcessId   : Uint8B
   +0x2d0 Peb              : Ptr64 _PEB
   +0x2d8 Session          : Ptr64 _PSP_SESSION_SPACE
   +0x2e0 Spare1           : Ptr64 Void
   +0x2e8 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK
   +0x2f0 ObjectTable      : Ptr64 _HANDLE_TABLE
   +0x2f8 DebugPort        : Ptr64 Void
   +0x300 WoW64Process     : Ptr64 _EWOW64PROCESS
   +0x308 DeviceMap        : _EX_FAST_REF
   +0x310 EtwDataSource    : Ptr64 Void
   +0x318 PageDirectoryPte : Uint8B
   +0x320 ImageFilePointer : Ptr64 _FILE_OBJECT
   +0x328 ImageFileName    : [15] UChar
   +0x337 PriorityClass    : UChar
   +0x338 SecurityPort     : Ptr64 Void
   +0x340 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x348 JobLinks         : _LIST_ENTRY
   +0x358 HighestUserAddress : Ptr64 Void
   +0x360 ThreadListHead   : _LIST_ENTRY
   +0x370 ActiveThreads    : Uint4B
   +0x374 ImagePathHash    : Uint4B
   +0x378 DefaultHardErrorProcessing : Uint4B
   +0x37c LastThreadExitStatus : Int4B
   +0x380 PrefetchTrace    : _EX_FAST_REF
   +0x388 LockedPagesList  : Ptr64 Void
   +0x390 ReadOperationCount : _LARGE_INTEGER
   +0x398 WriteOperationCount : _LARGE_INTEGER
   +0x3a0 OtherOperationCount : _LARGE_INTEGER
   +0x3a8 ReadTransferCount : _LARGE_INTEGER
   +0x3b0 WriteTransferCount : _LARGE_INTEGER
   +0x3b8 OtherTransferCount : _LARGE_INTEGER
   +0x3c0 CommitChargeLimit : Uint8B
   +0x3c8 CommitCharge     : Uint8B
   +0x3d0 CommitChargePeak : Uint8B
   +0x400 Vm               : _MMSUPPORT_FULL
   +0x600 MmProcessLinks   : _LIST_ENTRY
   +0x610 ModifiedPageCount : Uint4B
   +0x614 ExitStatus       : Int4B
   +0x618 VadRoot          : _RTL_AVL_TREE
   +0x620 VadHint          : Ptr64 Void
   +0x628 VadCount         : Uint8B
   +0x630 VadPhysicalPages : Uint8B
   +0x638 VadPhysicalPagesLimit : Uint8B
   +0x640 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x660 TimerResolutionLink : _LIST_ENTRY
   +0x670 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
   +0x678 RequestedTimerResolution : Uint4B
   +0x67c SmallestTimerResolution : Uint4B
   +0x680 ExitTime         : _LARGE_INTEGER
   +0x688 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE_USER_MODE
   +0x690 InvertedFunctionTableLock : _EX_PUSH_LOCK
   +0x698 ActiveThreadsHighWatermark : Uint4B
   +0x69c LargePrivateVadCount : Uint4B
   +0x6a0 ThreadListLock   : _EX_PUSH_LOCK
   +0x6a8 WnfContext       : Ptr64 Void
   +0x6b0 ServerSilo       : Ptr64 _EJOB
   +0x6b8 SignatureLevel   : UChar
   +0x6b9 SectionSignatureLevel : UChar
   +0x6ba Protection       : _PS_PROTECTION
   +0x6bb HangCount        : Pos 0, 3 Bits
   +0x6bb GhostCount       : Pos 3, 3 Bits
   +0x6bb PrefilterException : Pos 6, 1 Bit
   +0x6bc Flags3           : Uint4B
   +0x6bc Minimal          : Pos 0, 1 Bit
   +0x6bc ReplacingPageRoot : Pos 1, 1 Bit
   +0x6bc Crashed          : Pos 2, 1 Bit
   +0x6bc JobVadsAreTracked : Pos 3, 1 Bit
   +0x6bc VadTrackingDisabled : Pos 4, 1 Bit
   +0x6bc AuxiliaryProcess : Pos 5, 1 Bit
   +0x6bc SubsystemProcess : Pos 6, 1 Bit
   +0x6bc IndirectCpuSets  : Pos 7, 1 Bit
   +0x6bc RelinquishedCommit : Pos 8, 1 Bit
   +0x6bc HighGraphicsPriority : Pos 9, 1 Bit
   +0x6bc CommitFailLogged : Pos 10, 1 Bit
   +0x6bc ReserveFailLogged : Pos 11, 1 Bit
   +0x6bc SystemProcess    : Pos 12, 1 Bit
   +0x6bc AllImagesAtBasePristineBase : Pos 13, 1 Bit
   +0x6bc AddressPolicyFrozen : Pos 14, 1 Bit
   +0x6bc ProcessFirstResume : Pos 15, 1 Bit
   +0x6bc ForegroundExternal : Pos 16, 1 Bit
   +0x6bc ForegroundSystem : Pos 17, 1 Bit
   +0x6bc HighMemoryPriority : Pos 18, 1 Bit
   +0x6bc EnableProcessSuspendResumeLogging : Pos 19, 1 Bit
   +0x6bc EnableThreadSuspendResumeLogging : Pos 20, 1 Bit
   +0x6bc SecurityDomainChanged : Pos 21, 1 Bit
   +0x6bc SecurityFreezeComplete : Pos 22, 1 Bit
   +0x6bc VmProcessorHost  : Pos 23, 1 Bit
   +0x6bc VmProcessorHostTransition : Pos 24, 1 Bit
   +0x6bc AltSyscall       : Pos 25, 1 Bit
   +0x6bc TimerResolutionIgnore : Pos 26, 1 Bit
   +0x6bc DisallowUserTerminate : Pos 27, 1 Bit
   +0x6bc EnableProcessRemoteExecProtectVmLogging : Pos 28, 1 Bit
   +0x6bc EnableProcessLocalExecProtectVmLogging : Pos 29, 1 Bit
   +0x6bc MemoryCompressionProcess : Pos 30, 1 Bit
   +0x6bc EnableProcessImpersonationLogging : Pos 31, 1 Bit
   +0x6c0 DeviceAsid       : Int4B
   +0x6c8 SvmData          : Ptr64 Void
   +0x6d0 SvmProcessLock   : _EX_PUSH_LOCK
   +0x6d8 SvmLock          : Uint8B
   +0x6e0 SvmProcessDeviceListHead : _LIST_ENTRY
   +0x6f0 LastFreezeInterruptTime : Uint8B
   +0x6f8 DiskCounters     : Ptr64 _PROCESS_DISK_COUNTERS
   +0x700 PicoContext      : Ptr64 Void
   +0x708 EnclaveTable     : Ptr64 Void
   +0x710 EnclaveNumber    : Uint8B
   +0x718 EnclaveLock      : _EX_PUSH_LOCK
   +0x720 HighPriorityFaultsAllowed : Uint4B
   +0x728 EnergyContext    : Ptr64 _PO_PROCESS_ENERGY_CONTEXT
   +0x730 VmContext        : Ptr64 Void
   +0x738 SequenceNumber   : Uint8B
   +0x740 CreateInterruptTime : Uint8B
   +0x748 CreateUnbiasedInterruptTime : Uint8B
   +0x750 TotalUnbiasedFrozenTime : Uint8B
   +0x758 LastAppStateUpdateTime : Uint8B
   +0x760 LastAppStateUptime : Pos 0, 61 Bits
   +0x760 LastAppState     : Pos 61, 3 Bits
   +0x768 SharedCommitCharge : Uint8B
   +0x770 SharedCommitLock : _EX_PUSH_LOCK
   +0x778 SharedCommitLinks : _LIST_ENTRY
   +0x788 AllowedCpuSets   : Uint8B
   +0x790 DefaultCpuSets   : Uint8B
   +0x788 AllowedCpuSetsIndirect : Ptr64 Uint8B
   +0x790 DefaultCpuSetsIndirect : Ptr64 Uint8B
   +0x798 DiskIoAttribution : Ptr64 Void
   +0x7a0 DxgProcess       : Ptr64 Void
   +0x7a8 Win32KFilterSet  : Uint4B
   +0x7ac Machine          : Uint2B
   +0x7ae MmSlabIdentity   : UChar
   +0x7af VirtualTimersPaused : UChar
   +0x7b0 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES
   +0x7b8 KTimerSets       : Uint4B
   +0x7bc KTimer2Sets      : Uint4B
   +0x7c0 ThreadTimerSets  : Uint4B
   +0x7c8 VirtualTimerListLock : Uint8B
   +0x7d0 VirtualTimerListHead : _LIST_ENTRY
   +0x7e0 WakeInfo         : _PS_PROCESS_WAKE_INFORMATION
   +0x810 MitigationFlags  : Uint4B
   +0x810 MitigationFlagsValues : <unnamed-tag>
   +0x814 MitigationFlags2 : Uint4B
   +0x814 MitigationFlags2Values : <unnamed-tag>
   +0x818 PartitionObject  : Ptr64 Void
   +0x820 SecurityDomain   : Uint8B
   +0x828 ParentSecurityDomain : Uint8B
   +0x830 CoverageSamplerContext : Ptr64 Void
   +0x838 MmHotPatchContext : Ptr64 Void
   +0x840 DynamicEHContinuationTargetsTree : _RTL_AVL_TREE
   +0x848 DynamicEHContinuationTargetsLock : _EX_PUSH_LOCK
   +0x850 PointerAuthUserIpKey : [2] Uint8B
   +0x860 DynamicEnforcedCetCompatibleRanges : _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES
   +0x870 DisabledComponentFlags : Uint4B
   +0x874 PageCombineSequence : Int4B
   +0x878 PathRedirectionHashes : Ptr64 Uint4B
   +0x880 SyscallProviderReserved : [4] Ptr64 Void
   +0x8a0 MitigationFlags3 : Uint4B
   +0x8a0 MitigationFlags3Values : <unnamed-tag>
   +0x8a4 Flags4           : Uint4B
   +0x8a4 ThreadWasActive  : Pos 0, 1 Bit
   +0x8a4 MinimalTerminate : Pos 1, 1 Bit
   +0x8a4 ImageExpansionDisable : Pos 2, 1 Bit
   +0x8a4 SessionFirstProcess : Pos 3, 1 Bit
   +0x8a8 SyscallUsage     : Uint4B
   +0x8a8 SyscallUsageValues : <unnamed-tag>
   +0x8ac SupervisorDeviceAsid : Int4B
   +0x8b0 SupervisorSvmData : Ptr64 Void
   +0x8b8 NetworkCounters  : Ptr64 _PROCESS_NETWORK_COUNTERS
   +0x8c0 Execution        : _PROCESS_EXECUTION
   +0x8c8 ThreadIndexTable : Ptr64 Void
   +0x8d0 JobCpuPartitionObject : Ptr64 Void
   +0x8d8 FreezeWorkLinks  : _LIST_ENTRY
   +0x8e8 PpmPolicyLock    : _EX_PUSH_LOCK
   +0x8f0 BamPpmPolicy     : Uint4B
   +0x8f4 ProcessPowerThrottlingState : _EPROCESS_POWER_THROTTLING_STATE
   +0x900 ProcessQosCallbackListEntry : _SINGLE_LIST_ENTRY

So having these structures we can understand what each function does under the ARM64 compiler.

Spoiler: they do the same thing.

nt!PsGetCurrentProcess function under ARM64 reads the nt!_KPCR::Prcb.CurrentThread at the offset 0x988, which is 0x980 + 0x8. That gives it a pointer to the current thread of type nt!_KTHREAD. It then returns its nt!_KTHREAD::ApcState.Process, or the pointer to nt!_KPROCESS, which is the process that currently "owns" the thread by being its original creator, or if the thread was attached to it.

Likewise, the PsGetCurrentThreadProcessId also gets the pointer to the current thread from nt!_KPCR::Prcb.CurrentThread at the offset 0x988, and then returns its nt!_KTHREAD::Cid.UniqueProcess at the offset 0x4E8. This returns a PID of the process that created the current thread.

And finally, PsGetProcessId function takes on the input one argument of type EPROCESS and then uses it to return nt!_EPROCESS::UniqueProcessId at the offset 0x1C0, that returns a PID of the process that created that thread.

For more detailed navigation among all these offsets, please refer to my description above for the x64 architecture. The principle is the same, it's just that the offset values are different.

Conclusion

I don't want to sound like a broken record, but often times peeking into implementation of a function may be a much better way to understand its workings then reading into its documentation. Although doing both may not hurt either.

Stay tuned and I may reverse engineer more kernel DDIs.

Blog Post

Reverse Engineering - Resolving Confusion Over PsGetCurrentProcess, PsGetCurrentProcessId and PsGetProcessId

Using WinDbg to understand dependency between KPCR, KPRCB, K/ETHREAD, K/EPROCESS and KAPC_STATE structures.

Intro

WinDbgX

x64 Disassembly

PsGetCurrentProcess

PsGetCurrentProcessId

PsGetProcessId

ARM64 Disassembly

Conclusion

Social Media

Contact

Related Articles