#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

//static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, FeatureConfigurationChangeStamp)      == 0x720, "KUSER_SHARED_DATA.FeatureConfigurationChangeStamp offset is incorrect");
//static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Spare)                                == 0x72c, "KUSER_SHARED_DATA.Spare offset is incorrect");
//static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, UserPointerAuthMask)                  == 0x730, "KUSER_SHARED_DATA.UserPointerAuthMask offset is incorrect");
//#if !defined(WINDOWS_IGNORE_PACKING_MISMATCH)
//static_assert(sizeof(KUSER_SHARED_DATA)                                             == 0xa80, "KUSER_SHARED_DATA size is incorrect (expected 0xa80)");
//#endif

/**
 * USER_SHARED_DATA pointer to the Windows KUSER_SHARED_DATA structure at its fixed
 * user-mode mapping address (0x7FFE0000).
 *
 * The Windows kernel exposes a read-only data structure, mapped into every user-mode
 * process at the fixed virtual address `0x7FFE0000`. This region contains frequently
 * accessed system information and avoids the overhead of system calls for data that
 * the kernel updates frequently. The mapping is always present and identical across
 * all user processes, it provides a fast and efficient way to retrieve system state.
 */
#define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)0x7ffe0000)

#endif
#endif
View code on GitHub