SharedDataFlags in KUSER_SHARED_DATA

The KUSER_SHARED_DATA structure defines the layout of a data area that the kernel places at a pre-set address for sharing with user-mode software. Windows Vista introduced a set of ULONG bit fields in union with a SharedDataFlags member at offset 0x02F0. Not only have most subsequent versions added bits but Windows 8 redefined two of them.

Mask Definition Versions
0x00000001
ULONG DbgErrorPortPresent : 1;
6.0 and higher
0x00000002
ULONG DbgElevationEnabled : 1;
6.0 and higher
0x00000004
ULONG DbgVirtEnabled : 1;
6.0 and higher
0x00000008
ULONG DbgInstallerDetectEnabled : 1;
6.0 and higher
0x00000010
ULONG DbgSystemDllRelocated : 1;
6.0 to 6.1
ULONG DbgLkgEnabled : 1;
6.2 and higher
0x00000020
ULONG DbgDynProcessorEnabled : 1;
6.1 and higher
0x00000040
ULONG DbgSEHValidationEnabled : 1;
6.1 only
ULONG DbgConsoleBrokerEnabled : 1;
6.2 and higher
0x00000080
ULONG DbgSecureBootEnabled : 1;
6.2 and higher
0x00000100
ULONG DbgMultiSessionSku : 1;
10.0 and higher
0x00000200
ULONG DbgMultiUsersInSessionSku : 1;
1607 and higher
0x00000400
ULONG DbgStateSeparationEnabled : 1;
1709 and higher
 
ULONG SpareBits : 27;
6.0 to 6.1
ULONG SpareBits : 25;
6.1 only
ULONG SpareBits : 24;
6.2 to 6.3
ULONG SpareBits : 23;
10.0 to 1511
ULONG SpareBits : 22;
1607 to 1703
ULONG SpareBits : 21;
1709 and higher

A comment in the C-language definition of KUSER_SHARED_DATA from NTDDK.H says that there “are for the debugger only” and directs programmers to “Use the bit definitions instead.” These evaluate as:

In the Windows Driver Kit (WDK) for Windows Vista, SystemDllRelocated is defined as a bit field but with no corresponding macro.