Note

Access to this page requires authorization. You can try signing in or .

Access to this page requires authorization. You can try .

KUSER_SHARED_DATA structure (ntddk.h)

This topic describes the KUSER_SHARED_DATA structure.

Syntax

typedef struct _KUSER_SHARED_DATA {
 ULONG TickCountLowDeprecated;
 ULONG TickCountMultiplier;
 KSYSTEM_TIME InterruptTime;
 KSYSTEM_TIME SystemTime;
 KSYSTEM_TIME TimeZoneBias;
 USHORT ImageNumberLow;
 USHORT ImageNumberHigh;
 WCHAR NtSystemRoot[260];
 ULONG MaxStackTraceDepth;
 ULONG CryptoExponent;
 ULONG TimeZoneId;
 ULONG LargePageMinimum;
 ULONG AitSamplingValue;
 ULONG AppCompatFlag;
 ULONGLONG RNGSeedVersion;
 ULONG GlobalValidationRunlevel;
 LONG TimeZoneBiasStamp;
 ULONG NtBuildNumber;
 NT_PRODUCT_TYPE NtProductType;
 BOOLEAN ProductTypeIsValid;
 BOOLEAN Reserved0[1];
 USHORT NativeProcessorArchitecture;
 ULONG NtMajorVersion;
 ULONG NtMinorVersion;
 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
 ULONG Reserved1;
 ULONG Reserved3;
 ULONG TimeSlip;
 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
 ULONG BootId;
 LARGE_INTEGER SystemExpirationDate;
 ULONG SuiteMask;
 BOOLEAN KdDebuggerEnabled;
 union {
 UCHAR MitigationPolicies;
 struct {
 UCHAR NXSupportPolicy : 2;
 UCHAR SEHValidationPolicy : 2;
 UCHAR CurDirDevicesSkippedForDlls : 2;
 UCHAR Reserved : 2;
 };
 };
 USHORT CyclesPerYield;
 ULONG ActiveConsoleId;
 ULONG DismountCount;
 ULONG ComPlusPackage;
 ULONG LastSystemRITEventTickCount;
 ULONG NumberOfPhysicalPages;
 BOOLEAN SafeBootMode;
 union {
 UCHAR VirtualizationFlags;
 struct {
 UCHAR ArchStartedInEl2 : 1;
 UCHAR QcSlIsSupported : 1;
 };
 };
 UCHAR Reserved12[2];
 union {
 ULONG SharedDataFlags;
 struct {
 ULONG DbgErrorPortPresent : 1;
 ULONG DbgElevationEnabled : 1;
 ULONG DbgVirtEnabled : 1;
 ULONG DbgInstallerDetectEnabled : 1;
 ULONG DbgLkgEnabled : 1;
 ULONG DbgDynProcessorEnabled : 1;
 ULONG DbgConsoleBrokerEnabled : 1;
 ULONG DbgSecureBootEnabled : 1;
 ULONG DbgMultiSessionSku : 1;
 ULONG DbgMultiUsersInSessionSku : 1;
 ULONG DbgStateSeparationEnabled : 1;
 ULONG SpareBits : 21;
 } DUMMYSTRUCTNAME2;
 } DUMMYUNIONNAME2;
 ULONG DataFlagsPad[1];
 ULONGLONG TestRetInstruction;
 LONGLONG QpcFrequency;
 ULONG SystemCall;
 ULONG Reserved2;
 ULONGLONG FullNumberOfPhysicalPages;
 ULONGLONG SystemCallPad[1];
 union {
 KSYSTEM_TIME TickCount;
 ULONG64 TickCountQuad;
 struct {
 ULONG ReservedTickCountOverlay[3];
 ULONG TickCountPad[1];
 } DUMMYSTRUCTNAME;
 } DUMMYUNIONNAME3;
 ULONG Cookie;
 ULONG CookiePad[1];
 LONGLONG ConsoleSessionForegroundProcessId;
 ULONGLONG TimeUpdateLock;
 ULONGLONG BaselineSystemTimeQpc;
 ULONGLONG BaselineInterruptTimeQpc;
 ULONGLONG QpcSystemTimeIncrement;
 ULONGLONG QpcInterruptTimeIncrement;
 UCHAR QpcSystemTimeIncrementShift;
 UCHAR QpcInterruptTimeIncrementShift;
 USHORT UnparkedProcessorCount;
 ULONG EnclaveFeatureMask[4];
 ULONG TelemetryCoverageRound;
 USHORT UserModeGlobalLogger[16];
 ULONG ImageFileExecutionOptions;
 ULONG LangGenerationCount;
 ULONGLONG Reserved4;
 ULONGLONG InterruptTimeBias;
 ULONGLONG QpcBias;
 ULONG ActiveProcessorCount;
 UCHAR ActiveGroupCount;
 UCHAR Reserved9;
 union {
 USHORT QpcData;
 struct {
 UCHAR QpcBypassEnabled;
 UCHAR QpcReserved;
 };
 };
 LARGE_INTEGER TimeZoneBiasEffectiveStart;
 LARGE_INTEGER TimeZoneBiasEffectiveEnd;
 XSTATE_CONFIGURATION XState;
 KSYSTEM_TIME FeatureConfigurationChangeStamp;
 ULONG Spare;
 ULONG64 UserPointerAuthMask;
 XSTATE_CONFIGURATION XStateArm64;
 ULONG Reserved10[210];
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;

Members

TickCountLowDeprecated

Current low 32-bit of tick count.

TickCountMultiplier

Tick count multiplier.

InterruptTime

Current 64-bit interrupt time in 100ns units.

SystemTime

Current 64-bit system time in 100ns units.

TimeZoneBias

Current 64-bit time zone bias.

ImageNumberLow

Low image magic number for the host system.

ImageNumberHigh

High image magic number for the host system.

NtSystemRoot[260]

Copy of system root in unicode. This field must be accessed via the RtlGetNtSystemRoot API for an accurate result.

MaxStackTraceDepth

Maximum stack trace depth if tracing enabled.

CryptoExponent

Crypto exponent value.

TimeZoneId

Time zone ID.

LargePageMinimum

Defines the ULONG member LargePageMinimum.

AitSamplingValue

This value controls the AIT sampling rate.

AppCompatFlag

This value controls switchback processing.

RNGSeedVersion

Current kernel root RNG state seed version.

GlobalValidationRunlevel

This value controls assertion failure handling.

TimeZoneBiasStamp

Defines the LONG member TimeZoneBiasStamp.

NtBuildNumber

The shared collective build number undecorated with C or F. GetVersionEx hides the real number.

NtProductType

Product type. This field must be accessed via the RtlGetNtProductType API for an accurate result.

ProductTypeIsValid

Defines the BOOLEAN member ProductTypeIsValid.

Reserved0[1]

Reserved for future use.

NativeProcessorArchitecture

Defines the USHORT member NativeProcessorArchitecture.

NtMajorVersion

The NT major version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

NtMinorVersion

The NT minor version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

ProcessorFeatures[PROCESSOR_FEATURE_MAX]

Processor features.

Reserved1

Reserved for future use.

Reserved3

Reserved for future use.

TimeSlip

Time slippage while in debugger.

AlternativeArchitecture

Alternative system architecture. For example, NEC PC98xx on x86.

BootId

Boot sequence, incremented for each boot attempt by the OS loader.

SystemExpirationDate

If the system is an evaluation unit, the following field contains the date and time that the evaluation unit expires. A value of 0 indicates that there is no expiration. A non-zero value is the UTC absolute time that the system expires.

SuiteMask

Suite support. This field must be accessed via the RtlGetSuiteMask API for an accurate result.

KdDebuggerEnabled

TRUE if a kernel debugger is connected/enabled.

MitigationPolicies

Mitigation policies.

NXSupportPolicy

Defines the UCHAR member NXSupportPolicy.

SEHValidationPolicy

Defines the UCHAR member SEHValidationPolicy.

CurDirDevicesSkippedForDlls

Defines the UCHAR member CurDirDevicesSkippedForDlls.

Reserved

Reserved for future use.

CyclesPerYield

Measured duration of a single processor yield, in cycles. This is used by lock packages to determine how many times to spin waiting for a state change before blocking.

ActiveConsoleId

Current console session Id. Always zero on non-TS systems. This field must be accessed via the RtlGetActiveConsoleId API for an accurate result.

DismountCount

Force-dismounts cause handles to become invalid. Rather than always probe handles, a serial number of dismounts is maintained that clients can use to see if they need to probe handles.

ComPlusPackage

This field indicates the status of the 64-bit COM+ package on the system. It indicates whether the Intermediate Language (IL) COM+ images need to use the 64-bit COM+ runtime or the 32-bit COM+ runtime.

LastSystemRITEventTickCount

Time in tick count for system-wide last user input across all terminal sessions. For MP performance, it is not updated all the time (for example, once a minute per session). It is used for idle detection.

NumberOfPhysicalPages

Number of physical pages in the system. This can dynamically change as physical memory can be added or removed from a running system.

SafeBootMode

True if the system was booted in safe boot mode.

VirtualizationFlags

Virtualization flags.

ArchStartedInEl2

Keep this bitfield in sync with the one in arc.w.

QcSlIsSupported

Keep this bitfield in sync with the one in arc.w.

Reserved12[2]

Reserved for future use.

DUMMYUNIONNAME2

This is a packed bitfield that contains various flags concerning the system state. They must be manipulated using interlocked operations. DbgMultiSessionSku must be accessed via the RtlIsMultiSessionSku API for an accurate result.

DUMMYUNIONNAME2.SharedDataFlags

Defines the ULONG member SharedDataFlags.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2

Defines the DUMMYSTRUCTNAME2 structure.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgErrorPortPresent