Live inspector for the KUSER_SHARED_DATA struct at 0x7FFE0000 — a read-only kernel page exposed to all user-mode processes containing system-wide state.
Fields are grouped by purpose:
- Time — System/interrupt time, tick counts, timezone bias
- System Info — OS version, build, product type, boot config
- Processor — Core counts, RAM, features (SSE, AVX, etc.)
- Debug & Security — Debugger state, mitigations, SharedDataFlags
- QPC — Performance counter frequency and bypass config
- XState — XSAVE feature masks and sizes
Note that this tool was developed targeting Win11 25h2 and the struct is laid out as such, however it should still retain backwards compatibility for several major windows versions.