SYSTEM_CONTEXT_SWITCH_INFORMATION

The SYSTEM_CONTEXT_SWITCH_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemContextSwitchInformation (0x24).

Documentation Status

The SYSTEM_CONTEXT_SWITCH_INFORMATION structure is not documented.

Microsoft does publish the practical equivalent of a C-language definition as type information in public symbol files, though not for the kernel, where the structure is prepared, nor even for low-level user-mode DLLs that interpret the structure, but for various higher-level user-mode DLLs such as URLMON.DLL and only then starting with version 6.2.

Two earlier disclosures of type information are known, though not in symbol files but in statically linked libraries: GDISRVL.LIB from the Device Driver Kit (DDK) for Windows NT 3.51; and SHELL32.LIB from the DDK for Windows NT 4.0.

Layout

The SYSTEM_CONTEXT_SWITCH_INFORMATION is 0x30 bytes in both 32-bit and 64-bit Windows, respectively, in version 4.0 and higher. It is originally 0x28 bytes.

Offset Definition Versions
0x00
ULONG ContextSwitches;
3.50 and higher
0x04
ULONG FindAny;
3.50 and higher
0x08
ULONG FindLast;
3.50 and higher
0x0C
ULONG FindIdeal;
4.0 and higher
0x0C (3.51);
0x10
ULONG IdleAny;
3.50 and higher
0x10 (3.51);
0x14
ULONG IdleCurrent;
3.50 and higher
0x14 (3.51);
0x18
ULONG IdleLast;
3.50 and higher
0x1C
ULONG IdleIdeal;
4.0 and higher
0x18 (3.51);
0x20
ULONG PreemptAny;
3.50 and higher
0x1C (3.51);
0x24
ULONG PreemptCurrent;
3.50 and higher
0x20 (3.51);
0x28
ULONG PreemptLast;
3.50 and higher
0x24 (3.51);
0x2C
ULONG SwitchToIdle;
3.50 and higher