SharedDataFlags in KUSER_SHARED

The KUSER_SHARED_DATA structure defines the layout of a data area that the kernel places at a pre-set address for sharing with user-mode software. Windows Vista introduced a set of ULONG bit fields in union with a SharedDataFlags member at offset 0x02F0. Not only have most subsequent versions added bits but Windows 8 redefined two of them.

Mask	Definition	Versions
0x00000001	ULONG DbgErrorPortPresent : 1;	6.0 and higher
0x00000002	ULONG DbgElevationEnabled : 1;	6.0 and higher
0x00000004	ULONG DbgVirtEnabled : 1;	6.0 and higher
0x00000008	ULONG DbgInstallerDetectEnabled : 1;	6.0 and higher
0x00000010	ULONG DbgSystemDllRelocated : 1;	6.0 to 6.1
0x00000010	ULONG DbgLkgEnabled : 1;	6.2 and higher
0x00000020	ULONG DbgDynProcessorEnabled : 1;	6.1 and higher
0x00000040	ULONG DbgSEHValidationEnabled : 1;	6.1 only
0x00000040	ULONG DbgConsoleBrokerEnabled : 1;	6.2 and higher
0x00000080	ULONG DbgSecureBootEnabled : 1;	6.2 and higher
0x00000100	ULONG DbgMultiSessionSku : 1;	10.0 and higher
0x00000200	ULONG DbgMultiUsersInSessionSku : 1;	1607 and higher
0x00000400	ULONG DbgStateSeparationEnabled : 1;	1709 and higher
	ULONG SpareBits : 27;	6.0 to 6.1
	ULONG SpareBits : 25;	6.1 only
	ULONG SpareBits : 24;	6.2 to 6.3
	ULONG SpareBits : 23;	10.0 to 1511
	ULONG SpareBits : 22;	1607 to 1703
	ULONG SpareBits : 21;	1709 and higher

A comment in the C-language definition of KUSER_SHARED_DATA from NTDDK.H says that these “are for the debugger only” and directs programmers to “Use the bit definitions instead.” These evaluate as:

0x00000001 as SHARED_GLOBAL_FLAGS_ERROR_PORT;
0x00000002 as SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED;
0x00000004 as SHARED_GLOBAL_FLAGS_VIRT_ENABLED;
0x00000008 as SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED;
0x00000010 as SHARED_GLOBAL_FLAGS_SPARE (Windows 7 WDK);
0x00000010 as SHARED_GLOBAL_FLAGS_LKG_ENABLED;
0x00000020 as SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED;
0x00000040 as SHARED_GLOBAL_FLAGS_SEH_VALIDATION_ENABLED (Windows 7 WDK);
0x00000040 as SHARED_GLOBAL_FLAGS_CONSOLE_BROKER_ENABLED;
0x00000080 as SHARED_GLOBAL_FLAGS_SECURE_BOOT_ENABLED;
0x00000100 as SHARED_GLOBAL_FLAGS_MULTI_SESSION_SKU;
0x00000200 as SHARED_GLOBAL_FLAGS_MULTIUSERS_IN_SESSION_SKU;
0x00000400 as SHARED_GLOBAL_FLAGS_STATE_SEPARATION_ENABLED.

In the Windows Driver Kit (WDK) for Windows Vista, DbgSystemDllRelocated is defined as a bit field but with no corresponding macro.

SharedDataFlags in KUSER_SHARED_DATA