Flags in the EPROCESS

Version 5.1 of the EPROCESS collected various one-byte booleans into ULONG bit fields that can be accessed together as the Flags. Later versions not only add but reassign:

Mask Definition Versions
0x00000001
ULONG CreateReported : 1;
5.1 and higher
0x00000002
ULONG NoDebugInherit : 1;
5.1 and higher
0x00000004
ULONG ProcessExiting : 1;
5.1 and higher
0x00000008
ULONG ProcessDelete : 1;
5.1 and higher
0x00000010
ULONG Wow64SplitPages : 1;
5.1 to 6.2
ULONG ControlFlowGuardEnabled : 1;
6.3 and higher
0x00000020
ULONG VmDeleted : 1;
5.1 and higher
0x00000040
ULONG OutswapEnabled : 1;
5.1 and higher
0x00000080
ULONG Outswapped : 1;
5.1 and higher
0x00000100
ULONG ForkFailed : 1;
5.1 to 6.3
ULONG FailFastOnCommitFail : 1;
10.0 and higher
0x00000200
ULONG HasPhysicalVad : 1;
5.1 only
ULONG Wow64VaSpace4Gb : 1;
5.2 and higher
0x00000C00
ULONG AddressSpaceInitialized : 2;
5.1 and higher
0x00001000
ULONG SetTimerResolution : 1;
5.1 and higher
0x00002000
ULONG BreakOnTermination : 1;
5.1 and higher
0x00004000
ULONG SessionCreationUnderway : 1;
5.1 to 5.2
ULONG DeprioritizeViews : 1;
6.0 and higher
0x00008000
ULONG WriteWatch : 1;
5.1 and higher
0x00010000
ULONG ProcessInSession : 1;
5.1 and higher
0x00020000
ULONG OverrideAddressSpace : 1;
5.1 and higher
0x00040000
ULONG HasAddressSpace : 1;
5.1 and higher
0x00080000
ULONG LaunchPrefetched : 1;
5.1 and higher
0x00100000
ULONG InjectInpageErrors : 1;
5.1 to 6.1
ULONG Background : 1;
6.2 and higher
 
ULONG Spare : 11;
early 5.1 only
0x00200000
ULONG VmTopDown : 1;
late 5.1 and higher
0x00400000
ULONG Unused3 : 1;
late 5.1 and higher
ULONG ImageNotifyDone : 1;
5.2 and higher
0x00800000
ULONG Unused4 : 1;
late 5.1 and higher
ULONG PdeUpdateNeeded : 1;
5.2 and higher
0x01000000
ULONG VdmAllowed : 1;
late 5.1 and higher
 
ULONG Unused : 5;
late 5.1 only
ULONG Unused : 7;
early 5.2 only
0x02000000
ULONG SmapAllowed : 1;
late 5.2 to 6.0
ULONG CrossSessionCreate : 1;
6.1 to 6.2
ULONG ProcessRundown;
6.3 and higher
0x04000000
ULONG CreateFailed : 1;
late 5.2 only
ULONG ProcessInserted : 1;
6.0 and higher
0x38000000
ULONG DefaultIoPriority : 3;
late 5.2 and higher
 
ULONG SparePsFlags1 : 2;
early 6.0 only
ULONG Unused1 : 1;
late 5.1 only
ULONG Spare1 : 1;
late 5.2 only
0x40000000
ULONG ProcessSelfDelete : 1;
late 6.0 and higher
 
ULONG Unused2 : 1;
late 5.1 only
ULONG Spare2 : 1;
late 5.2 to early 6.0
ULONG SpareProcessFlags : 1;
late 6.0 only
0x80000000
ULONG SetTimerResolutionLink : 1;
6.1 and higher