diff --git a/2.x/trunk/ProcessHacker/appsup.c b/2.x/trunk/ProcessHacker/appsup.c
index 8bbbd9e00..31658b957 100644
--- a/2.x/trunk/ProcessHacker/appsup.c
+++ b/2.x/trunk/ProcessHacker/appsup.c
@@ -318,6 +318,8 @@ NTSTATUS PhGetProcessKnownType(
                 knownProcessType = TaskHostProcessType;
             else if (PhEqualStringRef2(&name, L"\\taskhost.exe", TRUE))
                 knownProcessType = TaskHostProcessType;
+            else if (PhEqualStringRef2(&name, L"\\taskhostex.exe", TRUE))
+                knownProcessType = TaskHostProcessType;
         }
     }
 
diff --git a/2.x/trunk/ProcessHacker/include/phapp.h b/2.x/trunk/ProcessHacker/include/phapp.h
index 7cac40603..2577099ae 100644
--- a/2.x/trunk/ProcessHacker/include/phapp.h
+++ b/2.x/trunk/ProcessHacker/include/phapp.h
@@ -161,7 +161,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
     ServiceHostProcessType, // svchost
     RunDllAsAppProcessType, // rundll32
     ComSurrogateProcessType, // dllhost
-    TaskHostProcessType, // taskeng, taskhost
+    TaskHostProcessType, // taskeng, taskhost, taskhostex
     ExplorerProcessType, // explorer
     MaximumProcessType,
     KnownProcessTypeMask = 0xffff,
diff --git a/2.x/trunk/ProcessHacker/sdk/phapppub.h b/2.x/trunk/ProcessHacker/sdk/phapppub.h
index 0d342697a..4a5d98a18 100644
--- a/2.x/trunk/ProcessHacker/sdk/phapppub.h
+++ b/2.x/trunk/ProcessHacker/sdk/phapppub.h
@@ -356,7 +356,7 @@ typedef enum _PH_KNOWN_PROCESS_TYPE
     ServiceHostProcessType, // svchost
     RunDllAsAppProcessType, // rundll32
     ComSurrogateProcessType, // dllhost
-    TaskHostProcessType, // taskeng, taskhost
+    TaskHostProcessType, // taskeng, taskhost, taskhostex
     ExplorerProcessType, // explorer
     MaximumProcessType,
     KnownProcessTypeMask = 0xffff,
diff --git a/2.x/trunk/phlib/include/ntbasic.h b/2.x/trunk/phlib/include/ntbasic.h
index 37d71a93a..528d02b2b 100644
--- a/2.x/trunk/phlib/include/ntbasic.h
+++ b/2.x/trunk/phlib/include/ntbasic.h
@@ -115,6 +115,31 @@ typedef const UNICODE_STRING *PCUNICODE_STRING;
 
 #define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }
 
+// Balanced tree node
+
+#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
+
+typedef struct _RTL_BALANCED_NODE
+{
+    union
+    {
+        struct _RTL_BALANCED_NODE *Children[2];
+        struct
+        {
+            struct _RTL_BALANCED_NODE *Left;
+            struct _RTL_BALANCED_NODE *Right;
+        };
+    };
+    union
+    {
+        UCHAR Red : 1;
+        UCHAR Balance : 2;
+        ULONG_PTR ParentValue;
+    };
+} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
+
+#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) ((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))
+
 // Portability
 
 typedef struct _SINGLE_LIST_ENTRY32
@@ -231,6 +256,7 @@ typedef enum _SUITE_TYPE
     StorageServer,
     ComputeServer,
     WHServer,
+    PhoneNT,
     MaxSuiteType
 } SUITE_TYPE;
 
diff --git a/2.x/trunk/phlib/include/ntexapi.h b/2.x/trunk/phlib/include/ntexapi.h
index c9dac1428..b97b62c6b 100644
--- a/2.x/trunk/phlib/include/ntexapi.h
+++ b/2.x/trunk/phlib/include/ntexapi.h
@@ -869,6 +869,22 @@ typedef enum _SYSTEM_INFORMATION_CLASS
     SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
     SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
     SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
+    SystemSessionBigPoolInformation, // since WIN8
+    SystemBootGraphicsInformation,
+    SystemScrubPhysicalMemoryInformation,
+    SystemBadPageInformation,
+    SystemProcessorProfileControlArea,
+    SystemCombinePhysicalMemoryInformation,
+    SystemEntropyInterruptTimingCallback,
+    SystemConsoleInformation,
+    SystemPlatformBinaryInformation,
+    SystemThrottleNotificationInformation,
+    SystemHypervisorProcessorCountInformation,
+    SystemDeviceDataInformation,
+    SystemDeviceDataEnumerationInformation,
+    SystemMemoryTopologyInformation,
+    SystemMemoryChannelInformation,
+    SystemBootLogoInformation,
     MaxSystemInfoClass
 } SYSTEM_INFORMATION_CLASS;
 
diff --git a/2.x/trunk/phlib/include/ntioapi.h b/2.x/trunk/phlib/include/ntioapi.h
index 862145ec9..24e26a386 100644
--- a/2.x/trunk/phlib/include/ntioapi.h
+++ b/2.x/trunk/phlib/include/ntioapi.h
@@ -573,6 +573,13 @@ typedef struct _FILE_INTEGRITY_STREAM_INFORMATION
     ULONG Flags;
 } FILE_INTEGRITY_STREAM_INFORMATION, *PFILE_INTEGRITY_STREAM_INFORMATION;
 
+// private
+typedef struct _FILE_VOLUME_NAME_INFORMATION
+{
+    ULONG DeviceNameLength;
+    WCHAR DeviceName[1];
+} FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION;
+
 // NtQueryDirectoryFile types
 
 typedef struct _FILE_DIRECTORY_INFORMATION
@@ -758,7 +765,7 @@ typedef enum _FSINFOCLASS
     FileFsVolumeFlagsInformation,
     FileFsSectorSizeInformation, // since WIN8
     FileFsMaximumInformation
-} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
+} FSINFOCLASS, *PFSINFOCLASS;
 
 // NtQueryVolumeInformation/NtSetVolumeInformation types
 
@@ -1045,7 +1052,7 @@ NtQueryVolumeInformationFile(
     __out PIO_STATUS_BLOCK IoStatusBlock,
     __out_bcount(Length) PVOID FsInformation,
     __in ULONG Length,
-    __in FS_INFORMATION_CLASS FsInformationClass
+    __in FSINFOCLASS FsInformationClass
     );
 
 NTSYSCALLAPI
@@ -1056,7 +1063,7 @@ NtSetVolumeInformationFile(
     __out PIO_STATUS_BLOCK IoStatusBlock,
     __in_bcount(Length) PVOID FsInformation,
     __in ULONG Length,
-    __in FS_INFORMATION_CLASS FsInformationClass
+    __in FSINFOCLASS FsInformationClass
     );
 
 NTSYSCALLAPI
diff --git a/2.x/trunk/phlib/include/ntlpcapi.h b/2.x/trunk/phlib/include/ntlpcapi.h
index ba3f2ec12..fbe1afcc2 100644
--- a/2.x/trunk/phlib/include/ntlpcapi.h
+++ b/2.x/trunk/phlib/include/ntlpcapi.h
@@ -438,8 +438,8 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
     AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION
     AlpcUnregisterCompletionListInformation, // s: VOID
     AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
-    AlpcRegisterCallback, // kernel-mode only // rev
-    AlpcDisableCompletionList, // s: VOID // rev
+    AlpcRegisterCallbackInformation, // kernel-mode only
+    AlpcCompletionListRundownInformation, // s: VOID
     MaxAlpcPortInfoClass
 } ALPC_PORT_INFORMATION_CLASS;
 
diff --git a/2.x/trunk/phlib/include/ntmmapi.h b/2.x/trunk/phlib/include/ntmmapi.h
index 4f2f1a93b..50192d30e 100644
--- a/2.x/trunk/phlib/include/ntmmapi.h
+++ b/2.x/trunk/phlib/include/ntmmapi.h
@@ -201,7 +201,8 @@ typedef struct _SECTION_IMAGE_INFORMATION
             UCHAR ComPlusILOnly : 1;
             UCHAR ImageDynamicallyRelocated : 1;
             UCHAR ImageMappedFlat : 1;
-            UCHAR Reserved : 4;
+            UCHAR BaseBelow4gb : 1;
+            UCHAR Reserved : 3;
         };
     };
     ULONG LoaderFlags;
diff --git a/2.x/trunk/phlib/include/ntpebteb.h b/2.x/trunk/phlib/include/ntpebteb.h
index 46567ff1b..722038f39 100644
--- a/2.x/trunk/phlib/include/ntpebteb.h
+++ b/2.x/trunk/phlib/include/ntpebteb.h
@@ -136,9 +136,11 @@ typedef struct _PEB
         {
             ULONG HeapTracingEnabled : 1;
             ULONG CritSecTracingEnabled : 1;
-            ULONG SpareTracingBits : 30;
+            ULONG LibLoaderTracingEnabled : 1;
+            ULONG SpareTracingBits : 29;
         };
     };
+    ULONGLONG CsrServerReadOnlySharedMemoryBase;
 } PEB, *PPEB;
 
 #define GDI_BATCH_BUFFER_SIZE 310
@@ -294,7 +296,9 @@ typedef struct _TEB
             USHORT DisableUserStackWalk : 1;
             USHORT RtlExceptionAttached : 1;
             USHORT InitialThread : 1;
-            USHORT SpareSameTebBits : 1;
+            USHORT SessionAware : 1;
+            USHORT DisabledStackCheck : 1;
+            USHORT SpareSameTebBits : 3;
         };
     };
 
@@ -304,6 +308,7 @@ typedef struct _TEB
     ULONG LockCount;
     ULONG SpareUlong0;
     PVOID ResourceRetValue;
+    PVOID ReservedForWdf;
 } TEB, *PTEB;
 
 #endif
diff --git a/2.x/trunk/phlib/include/ntpsapi.h b/2.x/trunk/phlib/include/ntpsapi.h
index cff85da32..dd4af7337 100644
--- a/2.x/trunk/phlib/include/ntpsapi.h
+++ b/2.x/trunk/phlib/include/ntpsapi.h
@@ -929,6 +929,7 @@ typedef enum _PS_ATTRIBUTE_NUM
     PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER
     PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES
     PsAttributeMitigationOptions, // in UCHAR
+    PsAttributeSecurityCapabilities,
     PsAttributeMax
 } PS_ATTRIBUTE_NUM;
 
diff --git a/2.x/trunk/phlib/include/ntregapi.h b/2.x/trunk/phlib/include/ntregapi.h
index 3d654031b..682de309f 100644
--- a/2.x/trunk/phlib/include/ntregapi.h
+++ b/2.x/trunk/phlib/include/ntregapi.h
@@ -88,7 +88,7 @@ typedef struct _KEY_VIRTUALIZATION_INFORMATION
     ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\Software for now).
     ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.
     ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.
-    ULONG VirtualStore : 1; // Tells if the key is a part of the virtual sore path. Valid only on the virtual store key handles.
+    ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.
     ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.
     ULONG Reserved : 27;
 } KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;
diff --git a/2.x/trunk/phlib/include/ntrtl.h b/2.x/trunk/phlib/include/ntrtl.h
index 0df50ab60..46d5f348a 100644
--- a/2.x/trunk/phlib/include/ntrtl.h
+++ b/2.x/trunk/phlib/include/ntrtl.h
@@ -547,25 +547,6 @@ RtlIsGenericTableEmpty(
 
 // RB trees
 
-typedef struct _RTL_BALANCED_NODE
-{
-    union
-    {
-        struct _RTL_BALANCED_NODE *Children[2];
-        struct
-        {
-            struct _RTL_BALANCED_NODE *Left;
-            struct _RTL_BALANCED_NODE *Right;
-        };
-    };
-    union
-    {
-        ULONG_PTR Red : 1;
-        ULONG_PTR Balance : 2;
-        ULONG_PTR ParentValue;
-    };
-} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
-
 typedef struct _RTL_RB_TREE
 {
     PRTL_BALANCED_NODE Root;
@@ -1131,9 +1112,9 @@ RtlWakeAllConditionVariable(
 #endif
 
 // begin_rev
-#define RTL_BARRIER_SPIN_ONLY 0x00000001 // never block on event - always spin
-#define RTL_BARRIER_NEVER_SPIN 0x00000002 // always block on event - never spin
-#define RTL_BARRIER_INCREMENT_MAXIMUM_COUNT 0x00010000 // ?
+#define RTL_BARRIER_FLAGS_SPIN_ONLY 0x00000001 // never block on event - always spin
+#define RTL_BARRIER_FLAGS_BLOCK_ONLY 0x00000002 // always block on event - never spin
+#define RTL_BARRIER_FLAGS_NO_DELETE 0x00000004 // use if barrier will never be deleted
 // end_rev
 
 // begin_private
@@ -2334,6 +2315,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS
 
     ULONG EnvironmentSize;
     ULONG EnvironmentVersion;
+    UNICODE_STRING PackageMoniker;
+    PVOID PackageDependencyData;
+    ULONG ProcessGroupId;
 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
 
 #define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001
diff --git a/2.x/trunk/phlib/include/ntwow64.h b/2.x/trunk/phlib/include/ntwow64.h
index e0c26d075..c8e06971c 100644
--- a/2.x/trunk/phlib/include/ntwow64.h
+++ b/2.x/trunk/phlib/include/ntwow64.h
@@ -22,7 +22,9 @@ typedef enum _WOW64_SHARED_INFORMATION
     SharedNtdll32pQueryProcessDebugInformationRemote = 9,
     SharedNtdll32EtwpNotificationThread = 10,
     SharedNtdll32BaseAddress = 11,
-    Wow64SharedPageEntriesCount = 12
+    SharedNtdll32RtlpWnfNotificationThread = 12,
+    SharedNtdll32LdrSystemDllInitBlock = 13,
+    Wow64SharedPageEntriesCount = 14
 } WOW64_SHARED_INFORMATION;
 
 // 32-bit definitions
@@ -42,8 +44,8 @@ typedef struct _RTL_BALANCED_NODE32
     };
     union
     {
-        WOW64_POINTER(ULONG_PTR) Red : 1;
-        WOW64_POINTER(ULONG_PTR) Balance : 2;
+        WOW64_POINTER(UCHAR) Red : 1;
+        WOW64_POINTER(UCHAR) Balance : 2;
         WOW64_POINTER(ULONG_PTR) ParentValue;
     };
 } RTL_BALANCED_NODE32, *PRTL_BALANCED_NODE32;
@@ -216,6 +218,9 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS32
 
     ULONG EnvironmentSize;
     ULONG EnvironmentVersion;
+    UNICODE_STRING32 PackageMoniker;
+    WOW64_POINTER(PVOID) PackageDependencyData;
+    ULONG ProcessGroupId;
 } RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
 
 typedef struct _PEB32
@@ -345,9 +350,11 @@ typedef struct _PEB32
         {
             ULONG HeapTracingEnabled : 1;
             ULONG CritSecTracingEnabled : 1;
-            ULONG SpareTracingBits : 30;
+            ULONG LibLoaderTracingEnabled : 1;
+            ULONG SpareTracingBits : 29;
         };
     };
+    ULONGLONG CsrServerReadOnlySharedMemoryBase;
 } PEB32, *PPEB32;
 
 #define GDI_BATCH_BUFFER_SIZE 310
diff --git a/2.x/trunk/phlib/include/ntzwapi.h b/2.x/trunk/phlib/include/ntzwapi.h
index c2f15654f..4b7ae03a1 100644
--- a/2.x/trunk/phlib/include/ntzwapi.h
+++ b/2.x/trunk/phlib/include/ntzwapi.h
@@ -2655,7 +2655,7 @@ ZwQueryVolumeInformationFile(
     __out PIO_STATUS_BLOCK IoStatusBlock,
     __out_bcount(Length) PVOID FsInformation,
     __in ULONG Length,
-    __in FS_INFORMATION_CLASS FsInformationClass
+    __in FSINFOCLASS FsInformationClass
     );
 
 NTSYSCALLAPI
@@ -3478,7 +3478,7 @@ ZwSetVolumeInformationFile(
     __out PIO_STATUS_BLOCK IoStatusBlock,
     __in_bcount(Length) PVOID FsInformation,
     __in ULONG Length,
-    __in FS_INFORMATION_CLASS FsInformationClass
+    __in FSINFOCLASS FsInformationClass
     );
 
 NTSYSCALLAPI