#ifndef _NTPSAPI_H
// Process information structures
#if (PHNT_MODE != PHNT_MODE_KERNEL)
typedef struct _PROCESS_WS_WATCH_INFORMATION
{
PVOID FaultingPc;
PVOID FaultingVa;
} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
View code on GitHub
This structure defines a Working Set Watch entry.
NtQueryInformationProcess
with ProcessWorkingSetWatch
(15)PROCESS_WS_WATCH_INFORMATION_EX
The instruction pointer at the moment of the page fault.
The virtual address that triggered the page fault.