#ifndef _NTPFAPI_H

/**
 * The PF_PRIVSOURCE_INFO structure contains identity and memory-use information for a private-page source.
 */
typedef struct _PF_PRIVSOURCE_INFO
{
    PFS_PRIVATE_PAGE_SOURCE DbInfo;             // Private-page source identity.
    union
    {
        PVOID EProcess;                         // Legacy name; NOT an EPROCESS address on build 26100.
        ULONG_PTR ProcessId;                    // Process ID, or 0xffffffff for the kernel entry.
    };
    SIZE_T WsPrivatePages;                      // Private pages resident in the source working set.
    SIZE_T TotalPrivatePages;                   // Total private-page count reported for the source.
    ULONG SessionID;                            // Session identifier associated with the source.
    UCHAR ImageName[16];                        // Short source image name in a 16-byte array.
    union
    {
        SIZE_T WsSwapPages;                     // Process working-set swap pages when PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYWSPAGES is selected.
        SIZE_T SessionPagedPoolPages;           // Legacy session paged-pool page count.
        SIZE_T StoreSizePages;                  // Process store size, in pages, when PF_PRIVSOURCE_QUERY_REQUEST_FLAGS_QUERYCOMPRESSEDPAGES is selected.
    };
    SIZE_T WsTotalPages;                        // Total working-set page count for a process or legacy session source.
    ULONG DeepFreezeTimeMs;                     // Process freeze timestamp, in milliseconds, when DeepFrozen is set.
    ULONG ModernApp : 1;                        // Process has the application identity attribute checked by the kernel.
    ULONG DeepFrozen : 1;                       // Process only. If set, DeepFreezeTimeMs contains the time at which the freeze occurred.
    ULONG Foreground : 1;                       // Process is classified as foreground.
    ULONG PerProcessStore : 1;                  // Process has an associated memory store.
    ULONG HasVmContext : 1;                     // Process has a non-NULL VM context.
    ULONG Spare : 27;                           // Reserved field; initialize to zero and do not interpret on output.
} PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO;

#endif
View code on GitHub