diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys
index 0b5585cd2..628b5e404 100644
Binary files a/trunk/KProcessHacker/i386/kprocesshacker.sys and b/trunk/KProcessHacker/i386/kprocesshacker.sys differ
diff --git a/trunk/KProcessHacker/include/ob.h b/trunk/KProcessHacker/include/ob.h
index e9a9a9b1e..26730415f 100644
--- a/trunk/KProcessHacker/include/ob.h
+++ b/trunk/KProcessHacker/include/ob.h
@@ -23,6 +23,7 @@
 #ifndef _OB_H
 #define _OB_H
 
+#include "types.h"
 #include "ex.h"
 
 #define OBJECT_TO_OBJECT_HEADER(o) \
diff --git a/trunk/KProcessHacker/include/version.h b/trunk/KProcessHacker/include/version.h
index 36cd8cf6e..ebae4926f 100644
--- a/trunk/KProcessHacker/include/version.h
+++ b/trunk/KProcessHacker/include/version.h
@@ -54,6 +54,8 @@ EXT ULONG OffEtClientId;
 EXT ULONG OffEtStartAddress;
 EXT ULONG OffEtWin32StartAddress;
 EXT ULONG OffEpJob;
+EXT ULONG OffEpObjectTable;
+EXT ULONG OffEpRundownProtect;
 EXT ULONG OffOtiGenericMapping;
 
 #endif
diff --git a/trunk/KProcessHacker/ob.c b/trunk/KProcessHacker/ob.c
index 4f666e9cf..b3ca21b58 100644
--- a/trunk/KProcessHacker/ob.c
+++ b/trunk/KProcessHacker/ob.c
@@ -139,7 +139,7 @@ VOID KphObDereferenceProcessHandleTable(
     PEPROCESS Process
     )
 {
-    ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+    ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
 }
 
 NTSTATUS KphObDuplicateObject(
@@ -263,12 +263,12 @@ PHANDLE_TABLE KphObReferenceProcessHandleTable(
 {
     PHANDLE_TABLE handleTable = NULL;
     
-    if (ExAcquireRundownProtection(&((PEPROCESS2)Process)->RundownProtect))
+    if (ExAcquireRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect)))
     {
-        handleTable = ((PEPROCESS2)Process)->ObjectTable;
+        handleTable = *(PHANDLE_TABLE *)KVOFF(Process, OffEpObjectTable);
         
         if (!handleTable)
-            ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+            ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
     }
     
     return handleTable;
diff --git a/trunk/KProcessHacker/version.c b/trunk/KProcessHacker/version.c
index 2ae87e47b..d6e6411bc 100644
--- a/trunk/KProcessHacker/version.c
+++ b/trunk/KProcessHacker/version.c
@@ -44,6 +44,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x224;
         OffEtWin32StartAddress = 0x228;
         OffEpJob = 0x134;
+        OffEpObjectTable = 0xc4;
+        OffEpRundownProtect = 0x80;
         OffOtiGenericMapping = 0x68;
         dprintf("Initialized version-specific data for Windows XP\n");
     }
@@ -57,6 +59,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x1f8;
         OffEtWin32StartAddress = 0x240;
         OffEpJob = 0x10c;
+        OffEpObjectTable = 0xdc;
+        OffEpRundownProtect = 0x98;
         OffOtiGenericMapping = 0x34;
         dprintf("Initialized version-specific data for Windows Vista\n");
     }