SYSTEM_SESSION_PROCESS_INFORMATION

The SYSTEM_SESSION_PROCESS_INFORMATION structure is expected as input to ZwQuerySystemInformation or NtQuerySystemInformation when given the information class SystemSessionProcessInformation (0x35).

Documentation Status

The SYSTEM_SESSION_PROCESS_INFORMATION structure is not documented.

Layout

The SYSTEM_SESSION_PROCESS_INFORMATION is 0x0C or 0x10 bytes in 32-bit and 64-bit Windows, respectively.

Offset Definition
0x00
ULONG SessionId;
0x04
ULONG SizeOfBuf;
0x08
PVOID Buffer;