On 08.01.2016 05:19, Austin English wrote:
As I said in the original patch, http://www.rohitab.com/discuss/topic/40191-ntcreateuserprocess/. Processor Hacker also shows length, http://processhacker.sourceforge.net/doc/ntrtl_8h_source.html, as does a blog on msdn, https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/afdf1b68-1f3e-.... Where are you seeing Size?
To mention a couple of examples:
http://undocumented.ntinternals.net/index.html?page=UserMode%2FStructures%2F... http://doxygen.reactos.org/d3/ddd/structRTL__USER__PROCESS__INFORMATION.html http://www.virtualbox.org/svn/vbox/trunk/include/iprt/nt/nt.h