UINT64 __fastcall RtlGetConsoleSessionForegroundProcessId(){ if( PsIsCurrentThreadInServerSilo() ) return *(_QWORD *)(PsGetCurrentServerSiloGlobals()[141] + 8); else return KUSER_SHARED_DATA.ConsoleSessionForegroundProcessId; }