#ifndef _NTPSAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The PROCESS_READWRITEVM_LOGGING_INFORMATION structure provides flags to enable logging
 * of read and write operations to a process's virtual memory.
 */
typedef struct _PROCESS_READWRITEVM_LOGGING_INFORMATION
{
    union
    {
        UCHAR Flags;
        struct
        {
            UCHAR EnableReadVmLogging : 1;  // Enable logging of read operations to virtual memory.
            UCHAR EnableWriteVmLogging : 1; // Enable logging of write operations to virtual memory.
            UCHAR Unused : 6;
        };
    };
} PROCESS_READWRITEVM_LOGGING_INFORMATION, *PPROCESS_READWRITEVM_LOGGING_INFORMATION;

#endif
#endif
View code on GitHub