Geoff Chappell, Software Analyst
The PROCESSINFO structure has from the beginning had a PIF_flags member that is, of course, interpreted in bits. The reorganisation for version 4.0 that is here thought to have created a W32PROCESS at the start of the PROCESSINFO is also thought to have moved the PIF_flags to the W32PROCESS as the new W32PF_Flags member.
Type information in symbol files for WIN32K.SYS in Windows 7 (only) shows that the bits in the W32PF_Flags are not defined as formal bit fields. Debugger extensions for early Windows versions have text for describing some bits, presumably by reproducing Microsoft’s macro definitions from a C-language header. See that there is demonstrable continuity, not just of what the bits are for but of what Microsoft seems to have named them. Though the move from PIF_flags to W32PF_Flags renumbered the bits, the names mostly just changed their prefix.
I may some day follow up which of these persist to later versions (and whether they are credible for the stated versions).
| Mask | Name | Versions | Remarks |
|---|---|---|---|
| 0x00000001 | PIF_CONSOLEAPPLICATION | 3.51 only | |
| W32PF_CONSOLEAPPLICATION | 4.0 to 5.0 | ||
| 0x00000002 | W32PF_FORCEOFFFEEDBACK | 4.0 to 5.0 | previously 0x00000010 |
| 0x00000004 | W32PF_STARTGLASS | 4.0 to 5.0 | previously 0x00000080 |
| 0x00000008 | W32PF_WOW | 4.0 to 5.0 | previously 0x00004000 |
| 0x00000010 | W32PF_READSCREENACCESSGRANTED | 4.0 to 5.0 | |
| 0x00000020 | W32PF_INITIALIZED | 4.0 to 5.0 | previously 0x00008000 |
| 0x00000002 (3.51); 0x00000040 |
PIF_APPSTARTING | 3.51 only | |
| W32PF_APPSTARTING | 4.0 to 5.0 | ||
| 0x00000004 (3.51); 0x00000080 |
PIF_HAVECOMPATFLAGS | 3.51 only | |
| W32PF_HAVECOMPATFLAGS | 4.0 only | ||
| W32PF_WOW64 | 5.0 | ||
| 0x00000008 (3.51) | PIF_SYSTEMAPP | 3.51 only | |
| 0x00000010 (3.51) | PIF_FORCEOFFFEEDBACK | 3.51 only | next as 0x00000002 |
| 0x00000020 (3.51); 0x00000100 |
PIF_ALLOWFOREGROUNDACTIVATE | 3.51 only | |
| W32PF_ALLOWFOREGROUNDACTIVATE | 4.0 to 5.0 | ||
| 0x00000040 (3.51); 0x00000200 |
PIF_OWNDCCLEANUP | 3.51 only | |
| W32PF_OWNDCCLEANUP | 4.0 to 5.0 | ||
| 0x00000080 (3.51) | PIF_STARTGLASS | 3.51 only | next as 0x00000004 |
| 0x00000100 (3.51); 0x00000400 |
PIF_SHOWSTARTGLASSCALLED | 3.51 only | |
| W32PF_SHOWSTARTGLASSCALLED | 4.0 to 5.0 | ||
| 0x00000200 (3.51); 0x00000800 |
PIF_FORCEBACKGROUNDPRIORITY | 3.51 only | |
| W32PF_FORCEBACKGROUNDPRIORITY | 4.0 to 5.0 | ||
| 0x00000400 (3.51); 0x00001000 |
PIF_TERMINATED | 3.51 only | |
| W32PF_TERMINATED | 4.0 to 5.0 | ||
| 0x00000800 (3.51) | PIF_READSCREENOK | 3.51 only | |
| 0x00001000 (3.51); 0x00002000 |
PIF_CLASSESREGISTERED | 3.51 only | |
| W32PF_CLASSESREGISTERED | 4.0 to 5.0 | ||
| 0x00002000 (3.51); 0x00004000 |
PIF_THREADCONNECTED | 3.51 only | |
| W32PF_THREADCONNECTED | 4.0 to 5.0 | ||
| 0x00008000 | W32PF_PROCESSCONNECTED | 4.0 to 5.0 | |
| 0x00004000 (3.51) | PIF_WOW | 3.51 only | next as 0x00000008 |
| 0x00008000 (3.51) | PIF_INITIALIZED | 3.51 only | next as 0x00000020 |
| 0x00010000 | PIF_WAKEWOWEXEC | 3.51 only | |
| W32PF_WAKEWOWEXEC | 4.0 to 5.0 | ||
| 0x00020000 | PIF_WAITFORINPUTIDLE | 3.51 only | |
| W32PF_WAITFORINPUTIDLE | 4.0 to 5.0 | ||
| 0x00040000 | W32PF_IOWINSTA | 4.0 to 5.0 | |
| 0x00080000 | W32PF_CONSOLEFOREGROUND | 5.0 | |
| 0x00100000 | W32PF_OLELOADED | 5.0 | |
| 0x00200000 | W32PF_SCREENSAVER | 5.0 | |
| 0x04000000 | W32PF_IDLESCREENSAVER | 5.0 |