ExGetPreviousMode

INT64 __fastcall ExGetPreviousMode(){
  return *((unsigned __int8 *)KeGetCurrentThread() + 562);
}