KEXECUTE_OPTIONS

The KEXECUTE_OPTIONS structure (formally _KEXECUTE_OPTIONS, and actually a union in most versions) was introduced simultaneously for version 5.1 in Windows XP SP2 and version 5.2 in Windows Server 2003 SP1. It is here thought to have no purpose outside the KPROCESS. Indeed, it started as nothing but a simple structure of UCHAR bit fields:

typedef struct _KEXECUTE_OPTIONS {      // late 5.2 to 6.0
    /*  bit fields, see below  */
} KEXECUTE_OPTIONS;

Within the KPROCESS, the KEXECUTE_OPTIONS were originally a member named Flags in union with a UCHAR named ExecuteOptions. Then Windows 7 wrapped the structure of bit fields and its integral overlay (now made volatile) into a union, and Windows 8 added another integral overlay (but without volatile):

typedef union _KEXECUTE_OPTIONS {       // 6.1 and higher
    struct {
        /*  bit fields, see below  */
    };
    UCHAR volatile ExecuteOptions;
    UCHAR ExceptionOptionsNV;           // 6.2 and higher
} KEXECUTE_OPTIONS;

Either way, the bit fields themselves remain the same except that one was added for Windows Vista SP1:

UCHAR ExecuteDisable : 1;

UCHAR ExecuteEnable : 1;

UCHAR DisableThunkEmulation : 1;

UCHAR Permanent : 1;

UCHAR ExecuteDispatchEnable : 1;

UCHAR ImageDispatchEnable : 1;

UCHAR DisableExceptionChainValidation : 1;

UCHAR Spare : 2;

UCHAR Spare : 1;