OutputFlags in PS_CREATE_INFO

In a PS_CREATE_INFO structure on output from NtCreateUserProcess, the State member may be PsCreateSuccess (6). The remainder of the structure is then interpreted as the SuccessState branch of an unnamed union. Within the SuccessState is a set of flags in union with a ULONG named OutputFlags. The flags themselves are a mixture of UCHAR and USHORT bit fields.

Microsoft’s names and types in the following tabulation of these flags are known from a smattering of private symbol files that Microsoft included in packages of public symbol files starting with Windows 8.

UCHAR ProtectedProcess : 1;

UCHAR AddressSpaceOverride : 1;

UCHAR DevOverrideEnabled : 1;

UCHAR ManifestDetected : 1;

UCHAR ProtectedProcessLight : 1;

UCHAR SpareBits1 : 4;

UCHAR SpareBits1 : 3;

UCHAR SpareBits2 : 8;

USHORT SpareBits3 : 16;

No use of the second byte or high word is known in any version.