Windows Vista RTM x64 (Windows NT 6.0)
Enums
Structs
enum _ALTERNATIVE_ARCHITECTURE_TYPE
Referred from:
typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE {// 3 elements, 0x4 bytes
StandardDesign = 0 /*0x0*/,
NEC98x86 = 1 /*0x1*/,
EndAlternatives = 2 /*0x2*/
} ALTERNATIVE_ARCHITECTURE_TYPE, *PALTERNATIVE_ARCHITECTURE_TYPE;
enum _ARBITER_ACTION
typedef enum _ARBITER_ACTION {// 10 elements, 0x4 bytes
ArbiterActionTestAllocation = 0 /*0x0*/,
ArbiterActionRetestAllocation = 1 /*0x1*/,
ArbiterActionCommitAllocation = 2 /*0x2*/,
ArbiterActionRollbackAllocation = 3 /*0x3*/,
ArbiterActionQueryAllocatedResources = 4 /*0x4*/,
ArbiterActionWriteReservedResources = 5 /*0x5*/,
ArbiterActionQueryConflict = 6 /*0x6*/,
ArbiterActionQueryArbitrate = 7 /*0x7*/,
ArbiterActionAddReserved = 8 /*0x8*/,
ArbiterActionBootAllocation = 9 /*0x9*/
} ARBITER_ACTION, *PARBITER_ACTION;
enum _ARBITER_REQUEST_SOURCE
Referred from:
typedef enum _ARBITER_REQUEST_SOURCE {// 6 elements, 0x4 bytes
ArbiterRequestUndefined = -1 /*0xFF*/,
ArbiterRequestLegacyReported = 0 /*0x0*/,
ArbiterRequestHalReported = 1 /*0x1*/,
ArbiterRequestLegacyAssigned = 2 /*0x2*/,
ArbiterRequestPnpDetected = 3 /*0x3*/,
ArbiterRequestPnpEnumerated = 4 /*0x4*/
} ARBITER_REQUEST_SOURCE, *PARBITER_REQUEST_SOURCE;
enum _ARBITER_RESULT
Referred from:
typedef enum _ARBITER_RESULT {// 4 elements, 0x4 bytes
ArbiterResultUndefined = -1 /*0xFF*/,
ArbiterResultSuccess = 0 /*0x0*/,
ArbiterResultExternalConflict = 1 /*0x1*/,
ArbiterResultNullRequest = 2 /*0x2*/
} ARBITER_RESULT, *PARBITER_RESULT;
enum _BUS_QUERY_ID_TYPE
Referred from:
typedef enum _BUS_QUERY_ID_TYPE {// 5 elements, 0x4 bytes
BusQueryDeviceID = 0 /*0x0*/,
BusQueryHardwareIDs = 1 /*0x1*/,
BusQueryCompatibleIDs = 2 /*0x2*/,
BusQueryInstanceID = 3 /*0x3*/,
BusQueryDeviceSerialNumber = 4 /*0x4*/
} BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
enum _CONFIGURATION_CLASS
Referred from:
typedef enum _CONFIGURATION_CLASS {// 8 elements, 0x4 bytes
SystemClass = 0 /*0x0*/,
ProcessorClass = 1 /*0x1*/,
CacheClass = 2 /*0x2*/,
AdapterClass = 3 /*0x3*/,
ControllerClass = 4 /*0x4*/,
PeripheralClass = 5 /*0x5*/,
MemoryClass = 6 /*0x6*/,
MaximumClass = 7 /*0x7*/
} CONFIGURATION_CLASS, *PCONFIGURATION_CLASS;
enum _CONFIGURATION_TYPE
Referred from:
typedef enum _CONFIGURATION_TYPE {// 42 elements, 0x4 bytes
ArcSystem = 0 /*0x0*/,
CentralProcessor = 1 /*0x1*/,
FloatingPointProcessor = 2 /*0x2*/,
PrimaryIcache = 3 /*0x3*/,
PrimaryDcache = 4 /*0x4*/,
SecondaryIcache = 5 /*0x5*/,
SecondaryDcache = 6 /*0x6*/,
SecondaryCache = 7 /*0x7*/,
EisaAdapter = 8 /*0x8*/,
TcAdapter = 9 /*0x9*/,
ScsiAdapter = 10 /*0xA*/,
DtiAdapter = 11 /*0xB*/,
MultiFunctionAdapter = 12 /*0xC*/,
DiskController = 13 /*0xD*/,
TapeController = 14 /*0xE*/,
CdromController = 15 /*0xF*/,
WormController = 16 /*0x10*/,
SerialController = 17 /*0x11*/,
NetworkController = 18 /*0x12*/,
DisplayController = 19 /*0x13*/,
ParallelController = 20 /*0x14*/,
PointerController = 21 /*0x15*/,
KeyboardController = 22 /*0x16*/,
AudioController = 23 /*0x17*/,
OtherController = 24 /*0x18*/,
DiskPeripheral = 25 /*0x19*/,
FloppyDiskPeripheral = 26 /*0x1A*/,
TapePeripheral = 27 /*0x1B*/,
ModemPeripheral = 28 /*0x1C*/,
MonitorPeripheral = 29 /*0x1D*/,
PrinterPeripheral = 30 /*0x1E*/,
PointerPeripheral = 31 /*0x1F*/,
KeyboardPeripheral = 32 /*0x20*/,
TerminalPeripheral = 33 /*0x21*/,
OtherPeripheral = 34 /*0x22*/,
LinePeripheral = 35 /*0x23*/,
NetworkPeripheral = 36 /*0x24*/,
SystemMemory = 37 /*0x25*/,
DockingInformation = 38 /*0x26*/,
RealModeIrqRoutingTable = 39 /*0x27*/,
RealModePCIEnumeration = 40 /*0x28*/,
MaximumType = 41 /*0x29*/
} CONFIGURATION_TYPE, *PCONFIGURATION_TYPE;
enum _DEVICE_POWER_STATE
Referred from:
typedef enum _DEVICE_POWER_STATE {// 6 elements, 0x4 bytes
PowerDeviceUnspecified = 0 /*0x0*/,
PowerDeviceD0 = 1 /*0x1*/,
PowerDeviceD1 = 2 /*0x2*/,
PowerDeviceD2 = 3 /*0x3*/,
PowerDeviceD3 = 4 /*0x4*/,
PowerDeviceMaximum = 5 /*0x5*/
} DEVICE_POWER_STATE, *PDEVICE_POWER_STATE;
enum _DEVICE_RELATION_TYPE
Referred from:
typedef enum _DEVICE_RELATION_TYPE {// 6 elements, 0x4 bytes
BusRelations = 0 /*0x0*/,
EjectionRelations = 1 /*0x1*/,
PowerRelations = 2 /*0x2*/,
RemovalRelations = 3 /*0x3*/,
TargetDeviceRelation = 4 /*0x4*/,
SingleBusRelations = 5 /*0x5*/
} DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
enum _DEVICE_TEXT_TYPE
Referred from:
typedef enum _DEVICE_TEXT_TYPE {// 2 elements, 0x4 bytes
DeviceTextDescription = 0 /*0x0*/,
DeviceTextLocationInformation = 1 /*0x1*/
} DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
enum _DEVICE_USAGE_NOTIFICATION_TYPE
Referred from:
typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {// 4 elements, 0x4 bytes
DeviceUsageTypeUndefined = 0 /*0x0*/,
DeviceUsageTypePaging = 1 /*0x1*/,
DeviceUsageTypeHibernation = 2 /*0x2*/,
DeviceUsageTypeDumpFile = 3 /*0x3*/
} DEVICE_USAGE_NOTIFICATION_TYPE, *PDEVICE_USAGE_NOTIFICATION_TYPE;
enum _DPFLTR_TYPE
typedef enum _DPFLTR_TYPE {// 137 elements, 0x4 bytes
DPFLTR_SYSTEM_ID = 0 /*0x0*/,
DPFLTR_SMSS_ID = 1 /*0x1*/,
DPFLTR_SETUP_ID = 2 /*0x2*/,
DPFLTR_NTFS_ID = 3 /*0x3*/,
DPFLTR_FSTUB_ID = 4 /*0x4*/,
DPFLTR_CRASHDUMP_ID = 5 /*0x5*/,
DPFLTR_CDAUDIO_ID = 6 /*0x6*/,
DPFLTR_CDROM_ID = 7 /*0x7*/,
DPFLTR_CLASSPNP_ID = 8 /*0x8*/,
DPFLTR_DISK_ID = 9 /*0x9*/,
DPFLTR_REDBOOK_ID = 10 /*0xA*/,
DPFLTR_STORPROP_ID = 11 /*0xB*/,
DPFLTR_SCSIPORT_ID = 12 /*0xC*/,
DPFLTR_SCSIMINIPORT_ID = 13 /*0xD*/,
DPFLTR_CONFIG_ID = 14 /*0xE*/,
DPFLTR_I8042PRT_ID = 15 /*0xF*/,
DPFLTR_SERMOUSE_ID = 16 /*0x10*/,
DPFLTR_LSERMOUS_ID = 17 /*0x11*/,
DPFLTR_KBDHID_ID = 18 /*0x12*/,
DPFLTR_MOUHID_ID = 19 /*0x13*/,
DPFLTR_KBDCLASS_ID = 20 /*0x14*/,
DPFLTR_MOUCLASS_ID = 21 /*0x15*/,
DPFLTR_TWOTRACK_ID = 22 /*0x16*/,
DPFLTR_WMILIB_ID = 23 /*0x17*/,
DPFLTR_ACPI_ID = 24 /*0x18*/,
DPFLTR_AMLI_ID = 25 /*0x19*/,
DPFLTR_HALIA64_ID = 26 /*0x1A*/,
DPFLTR_VIDEO_ID = 27 /*0x1B*/,
DPFLTR_SVCHOST_ID = 28 /*0x1C*/,
DPFLTR_VIDEOPRT_ID = 29 /*0x1D*/,
DPFLTR_TCPIP_ID = 30 /*0x1E*/,
DPFLTR_DMSYNTH_ID = 31 /*0x1F*/,
DPFLTR_NTOSPNP_ID = 32 /*0x20*/,
DPFLTR_FASTFAT_ID = 33 /*0x21*/,
DPFLTR_SAMSS_ID = 34 /*0x22*/,
DPFLTR_PNPMGR_ID = 35 /*0x23*/,
DPFLTR_NETAPI_ID = 36 /*0x24*/,
DPFLTR_SCSERVER_ID = 37 /*0x25*/,
DPFLTR_SCCLIENT_ID = 38 /*0x26*/,
DPFLTR_SERIAL_ID = 39 /*0x27*/,
DPFLTR_SERENUM_ID = 40 /*0x28*/,
DPFLTR_UHCD_ID = 41 /*0x29*/,
DPFLTR_RPCPROXY_ID = 42 /*0x2A*/,
DPFLTR_AUTOCHK_ID = 43 /*0x2B*/,
DPFLTR_DCOMSS_ID = 44 /*0x2C*/,
DPFLTR_UNIMODEM_ID = 45 /*0x2D*/,
DPFLTR_SIS_ID = 46 /*0x2E*/,
DPFLTR_FLTMGR_ID = 47 /*0x2F*/,
DPFLTR_WMICORE_ID = 48 /*0x30*/,
DPFLTR_BURNENG_ID = 49 /*0x31*/,
DPFLTR_IMAPI_ID = 50 /*0x32*/,
DPFLTR_SXS_ID = 51 /*0x33*/,
DPFLTR_FUSION_ID = 52 /*0x34*/,
DPFLTR_IDLETASK_ID = 53 /*0x35*/,
DPFLTR_SOFTPCI_ID = 54 /*0x36*/,
DPFLTR_TAPE_ID = 55 /*0x37*/,
DPFLTR_MCHGR_ID = 56 /*0x38*/,
DPFLTR_IDEP_ID = 57 /*0x39*/,
DPFLTR_PCIIDE_ID = 58 /*0x3A*/,
DPFLTR_FLOPPY_ID = 59 /*0x3B*/,
DPFLTR_FDC_ID = 60 /*0x3C*/,
DPFLTR_TERMSRV_ID = 61 /*0x3D*/,
DPFLTR_W32TIME_ID = 62 /*0x3E*/,
DPFLTR_PREFETCHER_ID = 63 /*0x3F*/,
DPFLTR_RSFILTER_ID = 64 /*0x40*/,
DPFLTR_FCPORT_ID = 65 /*0x41*/,
DPFLTR_PCI_ID = 66 /*0x42*/,
DPFLTR_DMIO_ID = 67 /*0x43*/,
DPFLTR_DMCONFIG_ID = 68 /*0x44*/,
DPFLTR_DMADMIN_ID = 69 /*0x45*/,
DPFLTR_WSOCKTRANSPORT_ID = 70 /*0x46*/,
DPFLTR_VSS_ID = 71 /*0x47*/,
DPFLTR_PNPMEM_ID = 72 /*0x48*/,
DPFLTR_PROCESSOR_ID = 73 /*0x49*/,
DPFLTR_DMSERVER_ID = 74 /*0x4A*/,
DPFLTR_SR_ID = 75 /*0x4B*/,
DPFLTR_INFINIBAND_ID = 76 /*0x4C*/,
DPFLTR_IHVDRIVER_ID = 77 /*0x4D*/,
DPFLTR_IHVVIDEO_ID = 78 /*0x4E*/,
DPFLTR_IHVAUDIO_ID = 79 /*0x4F*/,
DPFLTR_IHVNETWORK_ID = 80 /*0x50*/,
DPFLTR_IHVSTREAMING_ID = 81 /*0x51*/,
DPFLTR_IHVBUS_ID = 82 /*0x52*/,
DPFLTR_HPS_ID = 83 /*0x53*/,
DPFLTR_RTLTHREADPOOL_ID = 84 /*0x54*/,
DPFLTR_LDR_ID = 85 /*0x55*/,
DPFLTR_TCPIP6_ID = 86 /*0x56*/,
DPFLTR_ISAPNP_ID = 87 /*0x57*/,
DPFLTR_SHPC_ID = 88 /*0x58*/,
DPFLTR_STORPORT_ID = 89 /*0x59*/,
DPFLTR_STORMINIPORT_ID = 90 /*0x5A*/,
DPFLTR_PRINTSPOOLER_ID = 91 /*0x5B*/,
DPFLTR_VSSDYNDISK_ID = 92 /*0x5C*/,
DPFLTR_VERIFIER_ID = 93 /*0x5D*/,
DPFLTR_VDS_ID = 94 /*0x5E*/,
DPFLTR_VDSBAS_ID = 95 /*0x5F*/,
DPFLTR_VDSDYN_ID = 96 /*0x60*/,
DPFLTR_VDSDYNDR_ID = 97 /*0x61*/,
DPFLTR_VDSLDR_ID = 98 /*0x62*/,
DPFLTR_VDSUTIL_ID = 99 /*0x63*/,
DPFLTR_DFRGIFC_ID = 100 /*0x64*/,
DPFLTR_DEFAULT_ID = 101 /*0x65*/,
DPFLTR_MM_ID = 102 /*0x66*/,
DPFLTR_DFSC_ID = 103 /*0x67*/,
DPFLTR_WOW64_ID = 104 /*0x68*/,
DPFLTR_ALPC_ID = 105 /*0x69*/,
DPFLTR_WDI_ID = 106 /*0x6A*/,
DPFLTR_PERFLIB_ID = 107 /*0x6B*/,
DPFLTR_KTM_ID = 108 /*0x6C*/,
DPFLTR_IOSTRESS_ID = 109 /*0x6D*/,
DPFLTR_HEAP_ID = 110 /*0x6E*/,
DPFLTR_WHEA_ID = 111 /*0x6F*/,
DPFLTR_USERGDI_ID = 112 /*0x70*/,
DPFLTR_MMCSS_ID = 113 /*0x71*/,
DPFLTR_TPM_ID = 114 /*0x72*/,
DPFLTR_THREADORDER_ID = 115 /*0x73*/,
DPFLTR_ENVIRON_ID = 116 /*0x74*/,
DPFLTR_EMS_ID = 117 /*0x75*/,
DPFLTR_WDT_ID = 118 /*0x76*/,
DPFLTR_FVEVOL_ID = 119 /*0x77*/,
DPFLTR_NDIS_ID = 120 /*0x78*/,
DPFLTR_NVCTRACE_ID = 121 /*0x79*/,
DPFLTR_LUAFV_ID = 122 /*0x7A*/,
DPFLTR_APPCOMPAT_ID = 123 /*0x7B*/,
DPFLTR_USBSTOR_ID = 124 /*0x7C*/,
DPFLTR_SBP2PORT_ID = 125 /*0x7D*/,
DPFLTR_COVERAGE_ID = 126 /*0x7E*/,
DPFLTR_CACHEMGR_ID = 127 /*0x7F*/,
DPFLTR_MOUNTMGR_ID = 128 /*0x80*/,
DPFLTR_CFR_ID = 129 /*0x81*/,
DPFLTR_TXF_ID = 130 /*0x82*/,
DPFLTR_KSECDD_ID = 131 /*0x83*/,
DPFLTR_FLTREGRESS_ID = 132 /*0x84*/,
DPFLTR_MPIO_ID = 133 /*0x85*/,
DPFLTR_MSDSM_ID = 134 /*0x86*/,
DPFLTR_UDFS_ID = 135 /*0x87*/,
DPFLTR_ENDOFTABLE_ID = 136 /*0x88*/
} DPFLTR_TYPE, *PDPFLTR_TYPE;
enum _ETW_BUFFER_STATE
Referred from:
typedef enum _ETW_BUFFER_STATE {// 5 elements, 0x4 bytes
EtwBufferStateFree = 0 /*0x0*/,
EtwBufferStateGeneralLogging = 1 /*0x1*/,
EtwBufferStateCSwitch = 2 /*0x2*/,
EtwBufferStateFlush = 3 /*0x3*/,
EtwBufferStateMaximum = 4 /*0x4*/
} ETW_BUFFER_STATE, *PETW_BUFFER_STATE;
enum _ETW_GUID_TYPE
typedef enum _ETW_GUID_TYPE {// 3 elements, 0x4 bytes
EtwTraceGuidType = 0 /*0x0*/,
EtwNotificationGuidType = 1 /*0x1*/,
EtwGuidTypeMax = 2 /*0x2*/
} ETW_GUID_TYPE, *PETW_GUID_TYPE;
enum _ETW_PROVIDER_STATE
Referred from:
typedef enum _ETW_PROVIDER_STATE {// 4 elements, 0x4 bytes
EtwProviderStateFree = 0 /*0x0*/,
EtwProviderStateTransition = 1 /*0x1*/,
EtwProviderStateActive = 2 /*0x2*/,
EtwProviderStateMax = 3 /*0x3*/
} ETW_PROVIDER_STATE, *PETW_PROVIDER_STATE;
enum _ETW_RT_EVENT_LOSS
Referred from:
typedef enum _ETW_RT_EVENT_LOSS {// 5 elements, 0x4 bytes
EtwRtEventNoLoss = 0 /*0x0*/,
EtwRtEventLost = 1 /*0x1*/,
EtwRtBufferLost = 2 /*0x2*/,
EtwRtBackupLost = 3 /*0x3*/,
EtwRtEventLossMax = 4 /*0x4*/
} ETW_RT_EVENT_LOSS, *PETW_RT_EVENT_LOSS;
enum _EVENT_TYPE
typedef enum _EVENT_TYPE {// 2 elements, 0x4 bytes
NotificationEvent = 0 /*0x0*/,
SynchronizationEvent = 1 /*0x1*/
} EVENT_TYPE, *PEVENT_TYPE;
enum _EXCEPTION_DISPOSITION
typedef enum _EXCEPTION_DISPOSITION {// 4 elements, 0x4 bytes
ExceptionContinueExecution = 0 /*0x0*/,
ExceptionContinueSearch = 1 /*0x1*/,
ExceptionNestedException = 2 /*0x2*/,
ExceptionCollidedUnwind = 3 /*0x3*/
} EXCEPTION_DISPOSITION, *PEXCEPTION_DISPOSITION;
Referred from:
typedef enum _FILE_INFORMATION_CLASS {// 50 elements, 0x4 bytes
FileDirectoryInformation = 1 /*0x1*/,
FileFullDirectoryInformation = 2 /*0x2*/,
FileBothDirectoryInformation = 3 /*0x3*/,
FileBasicInformation = 4 /*0x4*/,
FileStandardInformation = 5 /*0x5*/,
FileInternalInformation = 6 /*0x6*/,
FileEaInformation = 7 /*0x7*/,
FileAccessInformation = 8 /*0x8*/,
FileNameInformation = 9 /*0x9*/,
FileRenameInformation = 10 /*0xA*/,
FileLinkInformation = 11 /*0xB*/,
FileNamesInformation = 12 /*0xC*/,
FileDispositionInformation = 13 /*0xD*/,
FilePositionInformation = 14 /*0xE*/,
FileFullEaInformation = 15 /*0xF*/,
FileModeInformation = 16 /*0x10*/,
FileAlignmentInformation = 17 /*0x11*/,
FileAllInformation = 18 /*0x12*/,
FileAllocationInformation = 19 /*0x13*/,
FileEndOfFileInformation = 20 /*0x14*/,
FileAlternateNameInformation = 21 /*0x15*/,
FileStreamInformation = 22 /*0x16*/,
FilePipeInformation = 23 /*0x17*/,
FilePipeLocalInformation = 24 /*0x18*/,
FilePipeRemoteInformation = 25 /*0x19*/,
FileMailslotQueryInformation = 26 /*0x1A*/,
FileMailslotSetInformation = 27 /*0x1B*/,
FileCompressionInformation = 28 /*0x1C*/,
FileObjectIdInformation = 29 /*0x1D*/,
FileCompletionInformation = 30 /*0x1E*/,
FileMoveClusterInformation = 31 /*0x1F*/,
FileQuotaInformation = 32 /*0x20*/,
FileReparsePointInformation = 33 /*0x21*/,
FileNetworkOpenInformation = 34 /*0x22*/,
FileAttributeTagInformation = 35 /*0x23*/,
FileTrackingInformation = 36 /*0x24*/,
FileIdBothDirectoryInformation = 37 /*0x25*/,
FileIdFullDirectoryInformation = 38 /*0x26*/,
FileValidDataLengthInformation = 39 /*0x27*/,
FileShortNameInformation = 40 /*0x28*/,
FileIoCompletionNotificationInformation = 41 /*0x29*/,
FileIoStatusBlockRangeInformation = 42 /*0x2A*/,
FileIoPriorityHintInformation = 43 /*0x2B*/,
FileSfioReserveInformation = 44 /*0x2C*/,
FileSfioVolumeInformation = 45 /*0x2D*/,
FileHardLinkInformation = 46 /*0x2E*/,
FileProcessIdsUsingFileInformation = 47 /*0x2F*/,
FileNormalizedNameInformation = 48 /*0x30*/,
FileNetworkPhysicalNameInformation = 49 /*0x31*/,
FileMaximumInformation = 50 /*0x32*/
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
enum _FSINFOCLASS
Referred from:
typedef enum _FSINFOCLASS {// 11 elements, 0x4 bytes
FileFsVolumeInformation = 1 /*0x1*/,
FileFsLabelInformation = 2 /*0x2*/,
FileFsSizeInformation = 3 /*0x3*/,
FileFsDeviceInformation = 4 /*0x4*/,
FileFsAttributeInformation = 5 /*0x5*/,
FileFsControlInformation = 6 /*0x6*/,
FileFsFullSizeInformation = 7 /*0x7*/,
FileFsObjectIdInformation = 8 /*0x8*/,
FileFsDriverPathInformation = 9 /*0x9*/,
FileFsVolumeFlagsInformation = 10 /*0xA*/,
FileFsMaximumInformation = 11 /*0xB*/
} FSINFOCLASS, *PFSINFOCLASS;
enum _FS_FILTER_SECTION_SYNC_TYPE
typedef enum _FS_FILTER_SECTION_SYNC_TYPE {// 2 elements, 0x4 bytes
SyncTypeOther = 0 /*0x0*/,
SyncTypeCreateSection = 1 /*0x1*/
} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {// 2 elements, 0x4 bytes
NotifyTypeCreate = 0 /*0x0*/,
NotifyTypeRetired = 1 /*0x1*/
} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
enum _HEAP_FAILURE_TYPE
typedef enum _HEAP_FAILURE_TYPE {// 14 elements, 0x4 bytes
heap_failure_internal = 0 /*0x0*/,
heap_failure_unknown = 1 /*0x1*/,
heap_failure_generic = 2 /*0x2*/,
heap_failure_entry_corruption = 3 /*0x3*/,
heap_failure_multiple_entries_corruption = 4 /*0x4*/,
heap_failure_virtual_block_corruption = 5 /*0x5*/,
heap_failure_buffer_overrun = 6 /*0x6*/,
heap_failure_buffer_underrun = 7 /*0x7*/,
heap_failure_block_not_busy = 8 /*0x8*/,
heap_failure_invalid_argument = 9 /*0x9*/,
heap_failure_usage_after_free = 10 /*0xA*/,
heap_failure_cross_heap_operation = 11 /*0xB*/,
heap_failure_freelists_corruption = 12 /*0xC*/,
heap_failure_listentry_corruption = 13 /*0xD*/
} HEAP_FAILURE_TYPE, *PHEAP_FAILURE_TYPE;
enum _HSTORAGE_TYPE
Referred from:
typedef enum _HSTORAGE_TYPE {// 3 elements, 0x4 bytes
Stable = 0 /*0x0*/,
Volatile = 1 /*0x1*/,
InvalidStorage = 2 /*0x2*/
} HSTORAGE_TYPE, *PHSTORAGE_TYPE;
enum _INTERFACE_TYPE
Referred from:
typedef enum _INTERFACE_TYPE {// 18 elements, 0x4 bytes
InterfaceTypeUndefined = -1 /*0xFF*/,
Internal = 0 /*0x0*/,
Isa = 1 /*0x1*/,
Eisa = 2 /*0x2*/,
MicroChannel = 3 /*0x3*/,
TurboChannel = 4 /*0x4*/,
PCIBus = 5 /*0x5*/,
VMEBus = 6 /*0x6*/,
NuBus = 7 /*0x7*/,
PCMCIABus = 8 /*0x8*/,
CBus = 9 /*0x9*/,
MPIBus = 10 /*0xA*/,
MPSABus = 11 /*0xB*/,
ProcessorInternal = 12 /*0xC*/,
InternalPowerBus = 13 /*0xD*/,
PNPISABus = 14 /*0xE*/,
PNPBus = 15 /*0xF*/,
MaximumInterfaceType = 16 /*0x10*/
} INTERFACE_TYPE, *PINTERFACE_TYPE;
enum _INTERLOCKED_RESULT
typedef enum _INTERLOCKED_RESULT {// 3 elements, 0x4 bytes
ResultNegative = 1 /*0x1*/,
ResultZero = 0 /*0x0*/,
ResultPositive = 2 /*0x2*/
} INTERLOCKED_RESULT, *PINTERLOCKED_RESULT;
enum _IO_ALLOCATION_ACTION
typedef enum _IO_ALLOCATION_ACTION {// 3 elements, 0x4 bytes
KeepObject = 1 /*0x1*/,
DeallocateObject = 2 /*0x2*/,
DeallocateObjectKeepRegisters = 3 /*0x3*/
} IO_ALLOCATION_ACTION, *PIO_ALLOCATION_ACTION;
enum _IO_PAGING_PRIORITY
typedef enum _IO_PAGING_PRIORITY {// 5 elements, 0x4 bytes
IoPagingPriorityInvalid = 0 /*0x0*/,
IoPagingPriorityNormal = 1 /*0x1*/,
IoPagingPriorityHigh = 2 /*0x2*/,
IoPagingPriorityReserved1 = 3 /*0x3*/,
IoPagingPriorityReserved2 = 4 /*0x4*/
} IO_PAGING_PRIORITY, *PIO_PAGING_PRIORITY;
enum _IO_PRIORITY_HINT
Referred from:
typedef enum _IO_PRIORITY_HINT {// 6 elements, 0x4 bytes
IoPriorityVeryLow = 0 /*0x0*/,
IoPriorityLow = 1 /*0x1*/,
IoPriorityNormal = 2 /*0x2*/,
IoPriorityHigh = 3 /*0x3*/,
IoPriorityCritical = 4 /*0x4*/,
MaxIoPriorityTypes = 5 /*0x5*/
} IO_PRIORITY_HINT, *PIO_PRIORITY_HINT;
enum _IRQ_DEVICE_POLICY
Referred from:
typedef enum _IRQ_DEVICE_POLICY {// 6 elements, 0x4 bytes
IrqPolicyMachineDefault = 0 /*0x0*/,
IrqPolicyAllCloseProcessors = 1 /*0x1*/,
IrqPolicyOneCloseProcessor = 2 /*0x2*/,
IrqPolicyAllProcessorsInMachine = 3 /*0x3*/,
IrqPolicySpecifiedProcessors = 4 /*0x4*/,
IrqPolicySpreadMessagesAcrossAllProcessors = 5 /*0x5*/
} IRQ_DEVICE_POLICY, *PIRQ_DEVICE_POLICY;
enum _IRQ_PRIORITY
Referred from:
typedef enum _IRQ_PRIORITY {// 4 elements, 0x4 bytes
IrqPriorityUndefined = 0 /*0x0*/,
IrqPriorityLow = 1 /*0x1*/,
IrqPriorityNormal = 2 /*0x2*/,
IrqPriorityHigh = 3 /*0x3*/
} IRQ_PRIORITY, *PIRQ_PRIORITY;
enum _KENLISTMENT_STATE
Referred from:
typedef enum _KENLISTMENT_STATE {// 21 elements, 0x4 bytes
KEnlistmentUninitialized = 0 /*0x0*/,
KEnlistmentActive = 256 /*0x100*/,
KEnlistmentPreparing = 257 /*0x101*/,
KEnlistmentPrepared = 258 /*0x102*/,
KEnlistmentInDoubt = 259 /*0x103*/,
KEnlistmentCommitted = 260 /*0x104*/,
KEnlistmentCommittedNotify = 261 /*0x105*/,
KEnlistmentCommitRequested = 262 /*0x106*/,
KEnlistmentAborted = 263 /*0x107*/,
KEnlistmentDelegated = 264 /*0x108*/,
KEnlistmentDelegatedDisconnected = 265 /*0x109*/,
KEnlistmentPrePreparing = 266 /*0x10A*/,
KEnlistmentForgotten = 267 /*0x10B*/,
KEnlistmentRecovering = 268 /*0x10C*/,
KEnlistmentSavepointing = 269 /*0x10D*/,
KEnlistmentAborting = 270 /*0x10E*/,
KEnlistmentReadOnly = 271 /*0x10F*/,
KEnlistmentOutcomeUnavailable = 272 /*0x110*/,
KEnlistmentOffline = 273 /*0x111*/,
KEnlistmentPrePrepared = 274 /*0x112*/,
KEnlistmentInitialized = 275 /*0x113*/
} KENLISTMENT_STATE, *PKENLISTMENT_STATE;
enum _KINTERRUPT_MODE
Referred from:
typedef enum _KINTERRUPT_MODE {// 2 elements, 0x4 bytes
LevelSensitive = 0 /*0x0*/,
Latched = 1 /*0x1*/
} KINTERRUPT_MODE, *PKINTERRUPT_MODE;
enum _KINTERRUPT_POLARITY
Referred from:
typedef enum _KINTERRUPT_POLARITY {// 3 elements, 0x4 bytes
InterruptPolarityUnknown = 0 /*0x0*/,
InterruptActiveHigh = 1 /*0x1*/,
InterruptActiveLow = 2 /*0x2*/
} KINTERRUPT_POLARITY, *PKINTERRUPT_POLARITY;
enum _KOBJECTS
typedef enum _KOBJECTS {// 26 elements, 0x4 bytes
EventNotificationObject = 0 /*0x0*/,
EventSynchronizationObject = 1 /*0x1*/,
MutantObject = 2 /*0x2*/,
ProcessObject = 3 /*0x3*/,
QueueObject = 4 /*0x4*/,
SemaphoreObject = 5 /*0x5*/,
ThreadObject = 6 /*0x6*/,
GateObject = 7 /*0x7*/,
TimerNotificationObject = 8 /*0x8*/,
TimerSynchronizationObject = 9 /*0x9*/,
Spare2Object = 10 /*0xA*/,
Spare3Object = 11 /*0xB*/,
Spare4Object = 12 /*0xC*/,
Spare5Object = 13 /*0xD*/,
Spare6Object = 14 /*0xE*/,
Spare7Object = 15 /*0xF*/,
Spare8Object = 16 /*0x10*/,
Spare9Object = 17 /*0x11*/,
ApcObject = 18 /*0x12*/,
DpcObject = 19 /*0x13*/,
DeviceQueueObject = 20 /*0x14*/,
EventPairObject = 21 /*0x15*/,
InterruptObject = 22 /*0x16*/,
ProfileObject = 23 /*0x17*/,
ThreadedDpcObject = 24 /*0x18*/,
MaximumKernelObject = 25 /*0x19*/
} KOBJECTS, *PKOBJECTS;
enum _KRESOURCEMANAGER_STATE
Referred from:
typedef enum _KRESOURCEMANAGER_STATE {// 3 elements, 0x4 bytes
KResourceManagerUninitialized = 0 /*0x0*/,
KResourceManagerOffline = 1 /*0x1*/,
KResourceManagerOnline = 2 /*0x2*/
} KRESOURCEMANAGER_STATE, *PKRESOURCEMANAGER_STATE;
enum _KTHREAD_STATE
typedef enum _KTHREAD_STATE {// 9 elements, 0x4 bytes
Initialized = 0 /*0x0*/,
Ready = 1 /*0x1*/,
Running = 2 /*0x2*/,
Standby = 3 /*0x3*/,
Terminated = 4 /*0x4*/,
Waiting = 5 /*0x5*/,
Transition = 6 /*0x6*/,
DeferredReady = 7 /*0x7*/,
GateWait = 8 /*0x8*/
} KTHREAD_STATE, *PKTHREAD_STATE;
enum _KTM_STATE
Referred from:
typedef enum _KTM_STATE {// 6 elements, 0x4 bytes
KKtmUninitialized = 0 /*0x0*/,
KKtmInitialized = 1 /*0x1*/,
KKtmRecovering = 2 /*0x2*/,
KKtmOnline = 3 /*0x3*/,
KKtmRecoveryFailed = 4 /*0x4*/,
KKtmOffline = 5 /*0x5*/
} KTM_STATE, *PKTM_STATE;
enum _KTRANSACTION_OUTCOME
Referred from:
typedef enum _KTRANSACTION_OUTCOME {// 5 elements, 0x4 bytes
KTxOutcomeUninitialized = 0 /*0x0*/,
KTxOutcomeUndetermined = 1 /*0x1*/,
KTxOutcomeCommitted = 2 /*0x2*/,
KTxOutcomeAborted = 3 /*0x3*/,
KTxOutcomeUnavailable = 4 /*0x4*/
} KTRANSACTION_OUTCOME, *PKTRANSACTION_OUTCOME;
enum _KTRANSACTION_STATE
Referred from:
typedef enum _KTRANSACTION_STATE {// 13 elements, 0x4 bytes
KTransactionUninitialized = 0 /*0x0*/,
KTransactionActive = 1 /*0x1*/,
KTransactionPreparing = 2 /*0x2*/,
KTransactionPrepared = 3 /*0x3*/,
KTransactionInDoubt = 4 /*0x4*/,
KTransactionCommitted = 5 /*0x5*/,
KTransactionAborted = 6 /*0x6*/,
KTransactionDelegated = 7 /*0x7*/,
KTransactionPrePreparing = 8 /*0x8*/,
KTransactionForgotten = 9 /*0x9*/,
KTransactionRecovering = 10 /*0xA*/,
KTransactionSavepointing = 11 /*0xB*/,
KTransactionPrePrepared = 12 /*0xC*/
} KTRANSACTION_STATE, *PKTRANSACTION_STATE;
enum _KWAIT_REASON
typedef enum _KWAIT_REASON {// 38 elements, 0x4 bytes
Executive = 0 /*0x0*/,
FreePage = 1 /*0x1*/,
PageIn = 2 /*0x2*/,
PoolAllocation = 3 /*0x3*/,
DelayExecution = 4 /*0x4*/,
Suspended = 5 /*0x5*/,
UserRequest = 6 /*0x6*/,
WrExecutive = 7 /*0x7*/,
WrFreePage = 8 /*0x8*/,
WrPageIn = 9 /*0x9*/,
WrPoolAllocation = 10 /*0xA*/,
WrDelayExecution = 11 /*0xB*/,
WrSuspended = 12 /*0xC*/,
WrUserRequest = 13 /*0xD*/,
WrEventPair = 14 /*0xE*/,
WrQueue = 15 /*0xF*/,
WrLpcReceive = 16 /*0x10*/,
WrLpcReply = 17 /*0x11*/,
WrVirtualMemory = 18 /*0x12*/,
WrPageOut = 19 /*0x13*/,
WrRendezvous = 20 /*0x14*/,
Spare2 = 21 /*0x15*/,
Spare3 = 22 /*0x16*/,
Spare4 = 23 /*0x17*/,
Spare5 = 24 /*0x18*/,
WrCalloutStack = 25 /*0x19*/,
WrKernel = 26 /*0x1A*/,
WrResource = 27 /*0x1B*/,
WrPushLock = 28 /*0x1C*/,
WrMutex = 29 /*0x1D*/,
WrQuantumEnd = 30 /*0x1E*/,
WrDispatchInt = 31 /*0x1F*/,
WrPreempted = 32 /*0x20*/,
WrYieldExecution = 33 /*0x21*/,
WrFastMutex = 34 /*0x22*/,
WrGuardedMutex = 35 /*0x23*/,
WrRundown = 36 /*0x24*/,
MaximumWaitReason = 37 /*0x25*/
} KWAIT_REASON, *PKWAIT_REASON;
enum _LSA_FOREST_TRUST_RECORD_TYPE
typedef enum _LSA_FOREST_TRUST_RECORD_TYPE {// 4 elements, 0x4 bytes
ForestTrustTopLevelName = 0 /*0x0*/,
ForestTrustTopLevelNameEx = 1 /*0x1*/,
ForestTrustDomainInfo = 2 /*0x2*/,
ForestTrustRecordTypeLast = 2 /*0x2*/
} LSA_FOREST_TRUST_RECORD_TYPE, *PLSA_FOREST_TRUST_RECORD_TYPE;
enum _MEMORY_CACHING_TYPE
typedef enum _MEMORY_CACHING_TYPE {// 7 elements, 0x4 bytes
MmNonCached = 0 /*0x0*/,
MmCached = 1 /*0x1*/,
MmWriteCombined = 2 /*0x2*/,
MmHardwareCoherentCached = 3 /*0x3*/,
MmNonCachedUnordered = 4 /*0x4*/,
MmUSWCCached = 5 /*0x5*/,
MmMaximumCacheType = 6 /*0x6*/
} MEMORY_CACHING_TYPE, *PMEMORY_CACHING_TYPE;
enum _MEMORY_CACHING_TYPE_ORIG
typedef enum _MEMORY_CACHING_TYPE_ORIG {// 1 elements, 0x4 bytes
MmFrameBufferCached = 2 /*0x2*/
} MEMORY_CACHING_TYPE_ORIG, *PMEMORY_CACHING_TYPE_ORIG;
enum _MI_PFN_CACHE_ATTRIBUTE
typedef enum _MI_PFN_CACHE_ATTRIBUTE {// 4 elements, 0x4 bytes
MiNonCached = 0 /*0x0*/,
MiCached = 1 /*0x1*/,
MiWriteCombined = 2 /*0x2*/,
MiNotMapped = 3 /*0x3*/
} MI_PFN_CACHE_ATTRIBUTE, *PMI_PFN_CACHE_ATTRIBUTE;
enum _MI_SYSTEM_VA_TYPE
typedef enum _MI_SYSTEM_VA_TYPE {// 13 elements, 0x4 bytes
MiVaUnused = 0 /*0x0*/,
MiVaSessionSpace = 1 /*0x1*/,
MiVaProcessSpace = 2 /*0x2*/,
MiVaBootLoaded = 3 /*0x3*/,
MiVaPfnDatabase = 4 /*0x4*/,
MiVaNonPagedPool = 5 /*0x5*/,
MiVaPagedPool = 6 /*0x6*/,
MiVaSpecialPool = 7 /*0x7*/,
MiVaSystemCache = 8 /*0x8*/,
MiVaSystemPtes = 9 /*0x9*/,
MiVaHal = 10 /*0xA*/,
MiVaSessionGlobalSpace = 11 /*0xB*/,
MiVaMaximumType = 12 /*0xC*/
} MI_SYSTEM_VA_TYPE, *PMI_SYSTEM_VA_TYPE;
enum _MI_VAD_TYPE
typedef enum _MI_VAD_TYPE {// 8 elements, 0x4 bytes
VadNone = 0 /*0x0*/,
VadDevicePhysicalMemory = 1 /*0x1*/,
VadImageMap = 2 /*0x2*/,
VadAwe = 3 /*0x3*/,
VadWriteWatch = 4 /*0x4*/,
VadLargePages = 5 /*0x5*/,
VadRotatePhysical = 6 /*0x6*/,
VadLargePageSection = 7 /*0x7*/
} MI_VAD_TYPE, *PMI_VAD_TYPE;
enum _MMLISTS
Referred from:
typedef enum _MMLISTS {// 8 elements, 0x4 bytes
ZeroedPageList = 0 /*0x0*/,
FreePageList = 1 /*0x1*/,
StandbyPageList = 2 /*0x2*/,
ModifiedPageList = 3 /*0x3*/,
ModifiedNoWritePageList = 4 /*0x4*/,
BadPageList = 5 /*0x5*/,
ActiveAndValid = 6 /*0x6*/,
TransitionPage = 7 /*0x7*/
} MMLISTS, *PMMLISTS;
enum _MM_PAGE_ACCESS_TYPE
Referred from:
typedef enum _MM_PAGE_ACCESS_TYPE {// 4 elements, 0x4 bytes
MmPteAccessType = 0 /*0x0*/,
MmCcReadAheadType = 1 /*0x1*/,
MmPfnRepurposeType = 2 /*0x2*/,
MmMaximumPageAccessType = 3 /*0x3*/
} MM_PAGE_ACCESS_TYPE, *PMM_PAGE_ACCESS_TYPE;
enum _MM_POOL_FAILURE_REASONS
typedef enum _MM_POOL_FAILURE_REASONS {// 12 elements, 0x4 bytes
MmNonPagedNoPtes = 0 /*0x0*/,
MmPriorityTooLow = 1 /*0x1*/,
MmNonPagedNoPagesAvailable = 2 /*0x2*/,
MmPagedNoPtes = 3 /*0x3*/,
MmSessionPagedNoPtes = 4 /*0x4*/,
MmPagedNoPagesAvailable = 5 /*0x5*/,
MmSessionPagedNoPagesAvailable = 6 /*0x6*/,
MmPagedNoCommit = 7 /*0x7*/,
MmSessionPagedNoCommit = 8 /*0x8*/,
MmNonPagedNoResidentAvailable = 9 /*0x9*/,
MmNonPagedNoCommit = 10 /*0xA*/,
MmMaximumFailureReason = 11 /*0xB*/
} MM_POOL_FAILURE_REASONS, *PMM_POOL_FAILURE_REASONS;
enum _MM_POOL_PRIORITIES
typedef enum _MM_POOL_PRIORITIES {// 4 elements, 0x4 bytes
MmHighPriority = 0 /*0x0*/,
MmNormalPriority = 1 /*0x1*/,
MmLowPriority = 2 /*0x2*/,
MmMaximumPoolPriority = 3 /*0x3*/
} MM_POOL_PRIORITIES, *PMM_POOL_PRIORITIES;
enum _MM_POOL_TYPES
typedef enum _MM_POOL_TYPES {// 4 elements, 0x4 bytes
MmNonPagedPool = 0 /*0x0*/,
MmPagedPool = 1 /*0x1*/,
MmSessionPagedPool = 2 /*0x2*/,
MmMaximumPoolType = 3 /*0x3*/
} MM_POOL_TYPES, *PMM_POOL_TYPES;
enum _MM_PREEMPTIVE_TRIMS
typedef enum _MM_PREEMPTIVE_TRIMS {// 5 elements, 0x4 bytes
MmPreemptForNonPaged = 0 /*0x0*/,
MmPreemptForPaged = 1 /*0x1*/,
MmPreemptForNonPagedPriority = 2 /*0x2*/,
MmPreemptForPagedPriority = 3 /*0x3*/,
MmMaximumPreempt = 4 /*0x4*/
} MM_PREEMPTIVE_TRIMS, *PMM_PREEMPTIVE_TRIMS;
enum _MODE
typedef enum _MODE {// 3 elements, 0x4 bytes
KernelMode = 0 /*0x0*/,
UserMode = 1 /*0x1*/,
MaximumMode = 2 /*0x2*/
} MODE, *PMODE;
enum _NT_PRODUCT_TYPE
Referred from:
typedef enum _NT_PRODUCT_TYPE {// 3 elements, 0x4 bytes
NtProductWinNt = 1 /*0x1*/,
NtProductLanManNt = 2 /*0x2*/,
NtProductServer = 3 /*0x3*/
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
enum _OB_OPEN_REASON
typedef enum _OB_OPEN_REASON {// 5 elements, 0x4 bytes
ObCreateHandle = 0 /*0x0*/,
ObOpenHandle = 1 /*0x1*/,
ObDuplicateHandle = 2 /*0x2*/,
ObInheritHandle = 3 /*0x3*/,
ObMaxOpenReason = 4 /*0x4*/
} OB_OPEN_REASON, *POB_OPEN_REASON;
enum _PCI_EXPRESS_DEVICE_TYPE
Referred from:
typedef enum _PCI_EXPRESS_DEVICE_TYPE {// 9 elements, 0x4 bytes
PciExpressEndpoint = 0 /*0x0*/,
PciExpressLegacyEndpoint = 1 /*0x1*/,
PciExpressRootPort = 4 /*0x4*/,
PciExpressUpstreamSwitchPort = 5 /*0x5*/,
PciExpressDownstreamSwitchPort = 6 /*0x6*/,
PciExpressToPciXBridge = 7 /*0x7*/,
PciXToExpressBridge = 8 /*0x8*/,
PciExpressRootComplexIntegratedEndpoint = 9 /*0x9*/,
PciExpressRootComplexEventCollector = 10 /*0xA*/
} PCI_EXPRESS_DEVICE_TYPE, *PPCI_EXPRESS_DEVICE_TYPE;
enum _PCI_HOTPLUG_SLOT_INTERRUPT
typedef enum _PCI_HOTPLUG_SLOT_INTERRUPT {// 5 elements, 0x4 bytes
SlotInterruptPresenceDetect = 0 /*0x0*/,
SlotInterruptLatchChange = 1 /*0x1*/,
SlotInterruptAttentionButton = 2 /*0x2*/,
SlotInterruptPowerFault = 3 /*0x3*/,
SlotInterruptMaximum = 7 /*0x7*/
} PCI_HOTPLUG_SLOT_INTERRUPT, *PPCI_HOTPLUG_SLOT_INTERRUPT;
enum _PF_FILE_ACCESS_TYPE
typedef enum _PF_FILE_ACCESS_TYPE {// 3 elements, 0x4 bytes
PfFileAccessTypeRead = 0 /*0x0*/,
PfFileAccessTypeWrite = 1 /*0x1*/,
PfFileAccessTypeMax = 2 /*0x2*/
} PF_FILE_ACCESS_TYPE, *PPF_FILE_ACCESS_TYPE;
enum _PLUGPLAY_EVENT_CATEGORY
Referred from:
typedef enum _PLUGPLAY_EVENT_CATEGORY {// 12 elements, 0x4 bytes
HardwareProfileChangeEvent = 0 /*0x0*/,
TargetDeviceChangeEvent = 1 /*0x1*/,
DeviceClassChangeEvent = 2 /*0x2*/,
CustomDeviceEvent = 3 /*0x3*/,
DeviceInstallEvent = 4 /*0x4*/,
DeviceArrivalEvent = 5 /*0x5*/,
PowerEvent = 6 /*0x6*/,
VetoEvent = 7 /*0x7*/,
BlockedDriverEvent = 8 /*0x8*/,
InvalidIDEvent = 9 /*0x9*/,
PowerSettingChange = 10 /*0xA*/,
MaxPlugEventCategory = 11 /*0xB*/
} PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY;
enum _PNP_DEVNODE_STATE
Referred from:
typedef enum _PNP_DEVNODE_STATE {// 22 elements, 0x4 bytes
DeviceNodeUnspecified = 768 /*0x300*/,
DeviceNodeUninitialized = 769 /*0x301*/,
DeviceNodeInitialized = 770 /*0x302*/,
DeviceNodeDriversAdded = 771 /*0x303*/,
DeviceNodeResourcesAssigned = 772 /*0x304*/,
DeviceNodeStartPending = 773 /*0x305*/,
DeviceNodeStartCompletion = 774 /*0x306*/,
DeviceNodeStartPostWork = 775 /*0x307*/,
DeviceNodeStarted = 776 /*0x308*/,
DeviceNodeQueryStopped = 777 /*0x309*/,
DeviceNodeStopped = 778 /*0x30A*/,
DeviceNodeRestartCompletion = 779 /*0x30B*/,
DeviceNodeEnumeratePending = 780 /*0x30C*/,
DeviceNodeEnumerateCompletion = 781 /*0x30D*/,
DeviceNodeAwaitingQueuedDeletion = 782 /*0x30E*/,
DeviceNodeAwaitingQueuedRemoval = 783 /*0x30F*/,
DeviceNodeQueryRemoved = 784 /*0x310*/,
DeviceNodeRemovePendingCloses = 785 /*0x311*/,
DeviceNodeRemoved = 786 /*0x312*/,
DeviceNodeDeletePendingCloses = 787 /*0x313*/,
DeviceNodeDeleted = 788 /*0x314*/,
MaxDeviceNodeState = 789 /*0x315*/
} PNP_DEVNODE_STATE, *PPNP_DEVNODE_STATE;
enum _PNP_VETO_TYPE
Referred from:
typedef enum _PNP_VETO_TYPE {// 13 elements, 0x4 bytes
PNP_VetoTypeUnknown = 0 /*0x0*/,
PNP_VetoLegacyDevice = 1 /*0x1*/,
PNP_VetoPendingClose = 2 /*0x2*/,
PNP_VetoWindowsApp = 3 /*0x3*/,
PNP_VetoWindowsService = 4 /*0x4*/,
PNP_VetoOutstandingOpen = 5 /*0x5*/,
PNP_VetoDevice = 6 /*0x6*/,
PNP_VetoDriver = 7 /*0x7*/,
PNP_VetoIllegalDeviceRequest = 8 /*0x8*/,
PNP_VetoInsufficientPower = 9 /*0x9*/,
PNP_VetoNonDisableable = 10 /*0xA*/,
PNP_VetoLegacyDriver = 11 /*0xB*/,
PNP_VetoInsufficientRights = 12 /*0xC*/
} PNP_VETO_TYPE, *PPNP_VETO_TYPE;
enum _POLICY_AUDIT_EVENT_TYPE
typedef enum _POLICY_AUDIT_EVENT_TYPE {// 9 elements, 0x4 bytes
AuditCategorySystem = 0 /*0x0*/,
AuditCategoryLogon = 1 /*0x1*/,
AuditCategoryObjectAccess = 2 /*0x2*/,
AuditCategoryPrivilegeUse = 3 /*0x3*/,
AuditCategoryDetailedTracking = 4 /*0x4*/,
AuditCategoryPolicyChange = 5 /*0x5*/,
AuditCategoryAccountManagement = 6 /*0x6*/,
AuditCategoryDirectoryServiceAccess = 7 /*0x7*/,
AuditCategoryAccountLogon = 8 /*0x8*/
} POLICY_AUDIT_EVENT_TYPE, *PPOLICY_AUDIT_EVENT_TYPE;
enum _POOL_TYPE
Referred from:
typedef enum _POOL_TYPE {// 15 elements, 0x4 bytes
NonPagedPool = 0 /*0x0*/,
PagedPool = 1 /*0x1*/,
NonPagedPoolMustSucceed = 2 /*0x2*/,
DontUseThisType = 3 /*0x3*/,
NonPagedPoolCacheAligned = 4 /*0x4*/,
PagedPoolCacheAligned = 5 /*0x5*/,
NonPagedPoolCacheAlignedMustS = 6 /*0x6*/,
MaxPoolType = 7 /*0x7*/,
NonPagedPoolSession = 32 /*0x20*/,
PagedPoolSession = 33 /*0x21*/,
NonPagedPoolMustSucceedSession = 34 /*0x22*/,
DontUseThisTypeSession = 35 /*0x23*/,
NonPagedPoolCacheAlignedSession = 36 /*0x24*/,
PagedPoolCacheAlignedSession = 37 /*0x25*/,
NonPagedPoolCacheAlignedMustSSession = 38 /*0x26*/
} POOL_TYPE, *PPOOL_TYPE;
enum _POP_POLICY_DEVICE_TYPE
Referred from:
typedef enum _POP_POLICY_DEVICE_TYPE {// 9 elements, 0x4 bytes
PolicyDeviceSystemButton = 0 /*0x0*/,
PolicyDeviceThermalZone = 1 /*0x1*/,
PolicyDeviceBattery = 2 /*0x2*/,
PolicyDeviceMemory = 3 /*0x3*/,
PolicyInitiatePowerActionAPI = 4 /*0x4*/,
PolicySetPowerStateAPI = 5 /*0x5*/,
PolicyImmediateDozeS4 = 6 /*0x6*/,
PolicySystemIdle = 7 /*0x7*/,
PolicyDeviceMax = 8 /*0x8*/
} POP_POLICY_DEVICE_TYPE, *PPOP_POLICY_DEVICE_TYPE;
enum _POWER_ACTION
Referred from:
typedef enum _POWER_ACTION {// 8 elements, 0x4 bytes
PowerActionNone = 0 /*0x0*/,
PowerActionReserved = 1 /*0x1*/,
PowerActionSleep = 2 /*0x2*/,
PowerActionHibernate = 3 /*0x3*/,
PowerActionShutdown = 4 /*0x4*/,
PowerActionShutdownReset = 5 /*0x5*/,
PowerActionShutdownOff = 6 /*0x6*/,
PowerActionWarmEject = 7 /*0x7*/
} POWER_ACTION, *PPOWER_ACTION;
enum _POWER_STATE_TYPE
Referred from:
typedef enum _POWER_STATE_TYPE {// 2 elements, 0x4 bytes
SystemPowerState = 0 /*0x0*/,
DevicePowerState = 1 /*0x1*/
} POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
enum _PP_NPAGED_LOOKASIDE_NUMBER
typedef enum _PP_NPAGED_LOOKASIDE_NUMBER {// 9 elements, 0x4 bytes
LookasideSmallIrpList = 0 /*0x0*/,
LookasideLargeIrpList = 1 /*0x1*/,
LookasideMdlList = 2 /*0x2*/,
LookasideCreateInfoList = 3 /*0x3*/,
LookasideNameBufferList = 4 /*0x4*/,
LookasideTwilightList = 5 /*0x5*/,
LookasideCompletionList = 6 /*0x6*/,
LookasideScratchBufferList = 7 /*0x7*/,
LookasideMaximumList = 8 /*0x8*/
} PP_NPAGED_LOOKASIDE_NUMBER, *PPP_NPAGED_LOOKASIDE_NUMBER;
enum _PROCESSOR_CACHE_TYPE
Referred from:
typedef enum _PROCESSOR_CACHE_TYPE {// 4 elements, 0x4 bytes
CacheUnified = 0 /*0x0*/,
CacheInstruction = 1 /*0x1*/,
CacheData = 2 /*0x2*/,
CacheTrace = 3 /*0x3*/
} PROCESSOR_CACHE_TYPE, *PPROCESSOR_CACHE_TYPE;
enum _PROFILE_STATUS
Referred from:
typedef enum _PROFILE_STATUS {// 5 elements, 0x4 bytes
DOCK_NOTDOCKDEVICE = 0 /*0x0*/,
DOCK_QUIESCENT = 1 /*0x1*/,
DOCK_ARRIVING = 2 /*0x2*/,
DOCK_DEPARTING = 3 /*0x3*/,
DOCK_EJECTIRP_COMPLETED = 4 /*0x4*/
} PROFILE_STATUS, *PPROFILE_STATUS;
enum _PROXY_CLASS
Referred from:
typedef enum _PROXY_CLASS {// 4 elements, 0x4 bytes
ProxyFull = 0 /*0x0*/,
ProxyService = 1 /*0x1*/,
ProxyTree = 2 /*0x2*/,
ProxyDirectory = 3 /*0x3*/
} PROXY_CLASS, *PPROXY_CLASS;
enum _PS_ATTRIBUTE_NUM
typedef enum _PS_ATTRIBUTE_NUM {// 13 elements, 0x4 bytes
PsAttributeParentProcess = 0 /*0x0*/,
PsAttributeDebugObject = 1 /*0x1*/,
PsAttributeToken = 2 /*0x2*/,
PsAttributeClientId = 3 /*0x3*/,
PsAttributeTebAddress = 4 /*0x4*/,
PsAttributeImageName = 5 /*0x5*/,
PsAttributeImageInfo = 6 /*0x6*/,
PsAttributeMemoryReserve = 7 /*0x7*/,
PsAttributePriorityClass = 8 /*0x8*/,
PsAttributeErrorMode = 9 /*0x9*/,
PsAttributeStdHandleInfo = 10 /*0xA*/,
PsAttributeHandleList = 11 /*0xB*/,
PsAttributeMax = 12 /*0xC*/
} PS_ATTRIBUTE_NUM, *PPS_ATTRIBUTE_NUM;
enum _PS_CREATE_STATE
typedef enum _PS_CREATE_STATE {// 8 elements, 0x4 bytes
PsCreateInitialState = 0 /*0x0*/,
PsCreateFailOnFileOpen = 1 /*0x1*/,
PsCreateFailOnSectionCreate = 2 /*0x2*/,
PsCreateFailExeFormat = 3 /*0x3*/,
PsCreateFailMachineMismatch = 4 /*0x4*/,
PsCreateFailExeName = 5 /*0x5*/,
PsCreateSuccess = 6 /*0x6*/,
PsCreateMaximumStates = 7 /*0x7*/
} PS_CREATE_STATE, *PPS_CREATE_STATE;
enum _PS_IFEO_KEY_STATE
typedef enum _PS_IFEO_KEY_STATE {// 4 elements, 0x4 bytes
PsReadIFEOAllValues = 0 /*0x0*/,
PsSkipIFEODebugger = 1 /*0x1*/,
PsSkipAllIFEO = 2 /*0x2*/,
PsMaxIFEOKeyStates = 3 /*0x3*/
} PS_IFEO_KEY_STATE, *PPS_IFEO_KEY_STATE;
enum _PS_RESOURCE_TYPE
typedef enum _PS_RESOURCE_TYPE {// 6 elements, 0x4 bytes
PsResourceNonPagedPool = 0 /*0x0*/,
PsResourcePagedPool = 1 /*0x1*/,
PsResourcePageFile = 2 /*0x2*/,
PsResourceWorkingSet = 3 /*0x3*/,
PsResourceCpuRate = 4 /*0x4*/,
PsResourceMax = 5 /*0x5*/
} PS_RESOURCE_TYPE, *PPS_RESOURCE_TYPE;
enum _PS_STD_HANDLE_STATE
typedef enum _PS_STD_HANDLE_STATE {// 4 elements, 0x4 bytes
PsNeverDuplicate = 0 /*0x0*/,
PsRequestDuplicate = 1 /*0x1*/,
PsAlwaysDuplicate = 2 /*0x2*/,
PsMaxStdHandleStates = 3 /*0x3*/
} PS_STD_HANDLE_STATE, *PPS_STD_HANDLE_STATE;
enum _REG_NOTIFY_CLASS
typedef enum _REG_NOTIFY_CLASS {// 53 elements, 0x4 bytes
RegNtDeleteKey = 0 /*0x0*/,
RegNtPreDeleteKey = 0 /*0x0*/,
RegNtSetValueKey = 1 /*0x1*/,
RegNtPreSetValueKey = 1 /*0x1*/,
RegNtDeleteValueKey = 2 /*0x2*/,
RegNtPreDeleteValueKey = 2 /*0x2*/,
RegNtSetInformationKey = 3 /*0x3*/,
RegNtPreSetInformationKey = 3 /*0x3*/,
RegNtRenameKey = 4 /*0x4*/,
RegNtPreRenameKey = 4 /*0x4*/,
RegNtEnumerateKey = 5 /*0x5*/,
RegNtPreEnumerateKey = 5 /*0x5*/,
RegNtEnumerateValueKey = 6 /*0x6*/,
RegNtPreEnumerateValueKey = 6 /*0x6*/,
RegNtQueryKey = 7 /*0x7*/,
RegNtPreQueryKey = 7 /*0x7*/,
RegNtQueryValueKey = 8 /*0x8*/,
RegNtPreQueryValueKey = 8 /*0x8*/,
RegNtQueryMultipleValueKey = 9 /*0x9*/,
RegNtPreQueryMultipleValueKey = 9 /*0x9*/,
RegNtPreCreateKey = 10 /*0xA*/,
RegNtPostCreateKey = 11 /*0xB*/,
RegNtPreOpenKey = 12 /*0xC*/,
RegNtPostOpenKey = 13 /*0xD*/,
RegNtKeyHandleClose = 14 /*0xE*/,
RegNtPreKeyHandleClose = 14 /*0xE*/,
RegNtPostDeleteKey = 15 /*0xF*/,
RegNtPostSetValueKey = 16 /*0x10*/,
RegNtPostDeleteValueKey = 17 /*0x11*/,
RegNtPostSetInformationKey = 18 /*0x12*/,
RegNtPostRenameKey = 19 /*0x13*/,
RegNtPostEnumerateKey = 20 /*0x14*/,
RegNtPostEnumerateValueKey = 21 /*0x15*/,
RegNtPostQueryKey = 22 /*0x16*/,
RegNtPostQueryValueKey = 23 /*0x17*/,
RegNtPostQueryMultipleValueKey = 24 /*0x18*/,
RegNtPostKeyHandleClose = 25 /*0x19*/,
RegNtPreCreateKeyEx = 26 /*0x1A*/,
RegNtPostCreateKeyEx = 27 /*0x1B*/,
RegNtPreOpenKeyEx = 28 /*0x1C*/,
RegNtPostOpenKeyEx = 29 /*0x1D*/,
RegNtPreFlushKey = 30 /*0x1E*/,
RegNtPostFlushKey = 31 /*0x1F*/,
RegNtPreLoadKey = 32 /*0x20*/,
RegNtPostLoadKey = 33 /*0x21*/,
RegNtPreUnLoadKey = 34 /*0x22*/,
RegNtPostUnLoadKey = 35 /*0x23*/,
RegNtPreQueryKeySecurity = 36 /*0x24*/,
RegNtPostQueryKeySecurity = 37 /*0x25*/,
RegNtPreSetKeySecurity = 38 /*0x26*/,
RegNtPostSetKeySecurity = 39 /*0x27*/,
RegNtCallbackObjectContextCleanup = 40 /*0x28*/,
MaxRegNtNotifyClass = 41 /*0x29*/
} REG_NOTIFY_CLASS, *PREG_NOTIFY_CLASS;
enum _RTL_GENERIC_COMPARE_RESULTS
typedef enum _RTL_GENERIC_COMPARE_RESULTS {// 3 elements, 0x4 bytes
GenericLessThan = 0 /*0x0*/,
GenericGreaterThan = 1 /*0x1*/,
GenericEqual = 2 /*0x2*/
} RTL_GENERIC_COMPARE_RESULTS, *PRTL_GENERIC_COMPARE_RESULTS;
enum _ReplacesCorHdrNumericDefines
typedef enum _ReplacesCorHdrNumericDefines {// 23 elements, 0x4 bytes
COMIMAGE_FLAGS_ILONLY = 1 /*0x1*/,
COMIMAGE_FLAGS_32BITREQUIRED = 2 /*0x2*/,
COMIMAGE_FLAGS_IL_LIBRARY = 4 /*0x4*/,
COMIMAGE_FLAGS_STRONGNAMESIGNED = 8 /*0x8*/,
COMIMAGE_FLAGS_TRACKDEBUGDATA = 65536 /*0x10000*/,
COR_VERSION_MAJOR_V2 = 2 /*0x2*/,
COR_VERSION_MAJOR = 2 /*0x2*/,
COR_VERSION_MINOR = 0 /*0x0*/,
COR_DELETED_NAME_LENGTH = 8 /*0x8*/,
COR_VTABLEGAP_NAME_LENGTH = 8 /*0x8*/,
NATIVE_TYPE_MAX_CB = 1 /*0x1*/,
COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE = 255 /*0xFF*/,
IMAGE_COR_MIH_METHODRVA = 1 /*0x1*/,
IMAGE_COR_MIH_EHRVA = 2 /*0x2*/,
IMAGE_COR_MIH_BASICBLOCK = 8 /*0x8*/,
COR_VTABLE_32BIT = 1 /*0x1*/,
COR_VTABLE_64BIT = 2 /*0x2*/,
COR_VTABLE_FROM_UNMANAGED = 4 /*0x4*/,
COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN = 8 /*0x8*/,
COR_VTABLE_CALL_MOST_DERIVED = 16 /*0x10*/,
IMAGE_COR_EATJ_THUNK_SIZE = 32 /*0x20*/,
MAX_CLASS_NAME = 1024 /*0x400*/,
MAX_PACKAGE_NAME = 1024 /*0x400*/
} ReplacesCorHdrNumericDefines, *PReplacesCorHdrNumericDefines;
enum _SECURITY_IMPERSONATION_LEVEL
Referred from:
typedef enum _SECURITY_IMPERSONATION_LEVEL {// 4 elements, 0x4 bytes
SecurityAnonymous = 0 /*0x0*/,
SecurityIdentification = 1 /*0x1*/,
SecurityImpersonation = 2 /*0x2*/,
SecurityDelegation = 3 /*0x3*/
} SECURITY_IMPERSONATION_LEVEL, *PSECURITY_IMPERSONATION_LEVEL;
enum _SECURITY_OPERATION_CODE
typedef enum _SECURITY_OPERATION_CODE {// 4 elements, 0x4 bytes
SetSecurityDescriptor = 0 /*0x0*/,
QuerySecurityDescriptor = 1 /*0x1*/,
DeleteSecurityDescriptor = 2 /*0x2*/,
AssignSecurityDescriptor = 3 /*0x3*/
} SECURITY_OPERATION_CODE, *PSECURITY_OPERATION_CODE;
enum _SYSTEM_POWER_CONDITION
typedef enum _SYSTEM_POWER_CONDITION {// 4 elements, 0x4 bytes
PoAc = 0 /*0x0*/,
PoDc = 1 /*0x1*/,
PoHot = 2 /*0x2*/,
PoConditionMaximum = 3 /*0x3*/
} SYSTEM_POWER_CONDITION, *PSYSTEM_POWER_CONDITION;
enum _SYSTEM_POWER_STATE
Referred from:
typedef enum _SYSTEM_POWER_STATE {// 8 elements, 0x4 bytes
PowerSystemUnspecified = 0 /*0x0*/,
PowerSystemWorking = 1 /*0x1*/,
PowerSystemSleeping1 = 2 /*0x2*/,
PowerSystemSleeping2 = 3 /*0x3*/,
PowerSystemSleeping3 = 4 /*0x4*/,
PowerSystemHibernate = 5 /*0x5*/,
PowerSystemShutdown = 6 /*0x6*/,
PowerSystemMaximum = 7 /*0x7*/
} SYSTEM_POWER_STATE, *PSYSTEM_POWER_STATE;
enum _TOKEN_TYPE
Referred from:
typedef enum _TOKEN_TYPE {// 2 elements, 0x4 bytes
TokenPrimary = 1 /*0x1*/,
TokenImpersonation = 2 /*0x2*/
} TOKEN_TYPE, *PTOKEN_TYPE;
enum _TYPE_OF_MEMORY
Referred from:
typedef enum _TYPE_OF_MEMORY {// 29 elements, 0x4 bytes
LoaderExceptionBlock = 0 /*0x0*/,
LoaderSystemBlock = 1 /*0x1*/,
LoaderFree = 2 /*0x2*/,
LoaderBad = 3 /*0x3*/,
LoaderLoadedProgram = 4 /*0x4*/,
LoaderFirmwareTemporary = 5 /*0x5*/,
LoaderFirmwarePermanent = 6 /*0x6*/,
LoaderOsloaderHeap = 7 /*0x7*/,
LoaderOsloaderStack = 8 /*0x8*/,
LoaderSystemCode = 9 /*0x9*/,
LoaderHalCode = 10 /*0xA*/,
LoaderBootDriver = 11 /*0xB*/,
LoaderConsoleInDriver = 12 /*0xC*/,
LoaderConsoleOutDriver = 13 /*0xD*/,
LoaderStartupDpcStack = 14 /*0xE*/,
LoaderStartupKernelStack = 15 /*0xF*/,
LoaderStartupPanicStack = 16 /*0x10*/,
LoaderStartupPcrPage = 17 /*0x11*/,
LoaderStartupPdrPage = 18 /*0x12*/,
LoaderRegistryData = 19 /*0x13*/,
LoaderMemoryData = 20 /*0x14*/,
LoaderNlsData = 21 /*0x15*/,
LoaderSpecialMemory = 22 /*0x16*/,
LoaderBBTMemory = 23 /*0x17*/,
LoaderReserve = 24 /*0x18*/,
LoaderXIPRom = 25 /*0x19*/,
LoaderHALCachedMemory = 26 /*0x1A*/,
LoaderLargePageFiller = 27 /*0x1B*/,
LoaderMaximum = 28 /*0x1C*/
} TYPE_OF_MEMORY, *PTYPE_OF_MEMORY;
enum _UoWActionType
Referred from:
typedef enum _UoWActionType {// 15 elements, 0x4 bytes
UoWAddThisKey = 0 /*0x0*/,
UoWAddChildKey = 1 /*0x1*/,
UoWDeleteThisKey = 2 /*0x2*/,
UoWDeleteChildKey = 3 /*0x3*/,
UoWSetValueNew = 4 /*0x4*/,
UoWSetValueExisting = 5 /*0x5*/,
UoWDeleteValue = 6 /*0x6*/,
UoWSetKeyUserFlags = 7 /*0x7*/,
UoWSetLastWriteTime = 8 /*0x8*/,
UoWSetSecurityDescriptor = 9 /*0x9*/,
UoWRenameSubKey = 10 /*0xA*/,
UoWRenameOldSubKey = 11 /*0xB*/,
UoWRenameNewSubKey = 12 /*0xC*/,
UoWIsolation = 13 /*0xD*/,
UoWInvalid = 14 /*0xE*/
} UoWActionType, *PUoWActionType;
enum _VI_CNT_INDEX_TYPE
typedef enum _VI_CNT_INDEX_TYPE {// 26 elements, 0x4 bytes
VF_CNT_IRPS_TOTAL_COUNT = 0 /*0x0*/,
VF_CNT_IRPS_NOT_A_TARGET = 1 /*0x1*/,
VF_CNT_IRPS_KMODE = 2 /*0x2*/,
VF_CNT_IRPS_SKIP_FLAGS = 3 /*0x3*/,
VF_CNT_IRPS_ALREADY_HOOKED = 4 /*0x4*/,
VF_CNT_IRPS_WILL_ATTEMPT_CANCEL = 5 /*0x5*/,
VF_CNT_IRPS_WILL_NOT_CANCEL = 6 /*0x6*/,
VF_CNT_REAL_RACE_FOR_COMPLETION = 7 /*0x7*/,
VF_CNT_IRPS_COMPLETED_BY_DRIVER = 8 /*0x8*/,
VF_CNT_IRPS_COMPLETED_BY_CANCEL = 9 /*0x9*/,
VF_CNT_IRPS_NO_CANCEL_ROUTINE = 10 /*0xA*/,
VF_CNT_IRPS_CANCEL_RETURNED_TRUE = 11 /*0xB*/,
VF_CNT_IRPS_CANCEL_RETURNED_FALSE = 12 /*0xC*/,
VF_CNT_IRP_CANCEL_ROUTINE_NO_CHECK = 13 /*0xD*/,
VF_CNT_IRP_CANCEL_ROUTINE_NEVER = 14 /*0xE*/,
VF_CNT_IRP_CANCEL_ROUTINE_SOMETIMES = 15 /*0xF*/,
VF_CNT_EXTRA_ALLOCS = 16 /*0x10*/,
VF_CNT_EXTRA_FREES = 17 /*0x11*/,
VF_CNT_CALLS_TO_TIMER_DPC = 18 /*0x12*/,
VF_CNT_CALLS_TO_CANCEL_WORKER = 19 /*0x13*/,
VF_CNT_FREE_FROM_CANCEL_ROUTINE = 20 /*0x14*/,
VF_CNT_FREE_FROM_COMPLETION_ROUTINE = 21 /*0x15*/,
VF_CNT_ISSUES_LOGGED = 22 /*0x16*/,
VF_CNT_CANCEL_AND_COMPLETE_DIFFERENT_THREADS = 23 /*0x17*/,
VF_CNT_IRPS_TOO_MANY_UNDER_WATCH = 24 /*0x18*/,
VF_CNT_MAX_INDEX = 25 /*0x19*/
} VI_CNT_INDEX_TYPE, *PVI_CNT_INDEX_TYPE;
enum _VI_DEADLOCK_RESOURCE_TYPE
Referred from:
typedef enum _VI_DEADLOCK_RESOURCE_TYPE {// 7 elements, 0x4 bytes
VfDeadlockUnknown = 0 /*0x0*/,
VfDeadlockMutex = 1 /*0x1*/,
VfDeadlockMutexAbandoned = 2 /*0x2*/,
VfDeadlockFastMutex = 3 /*0x3*/,
VfDeadlockFastMutexUnsafe = 4 /*0x4*/,
VfDeadlockSpinLock = 5 /*0x5*/,
VfDeadlockTypeMaximum = 6 /*0x6*/
} VI_DEADLOCK_RESOURCE_TYPE, *PVI_DEADLOCK_RESOURCE_TYPE;
enum _WAIT_TYPE
typedef enum _WAIT_TYPE {// 2 elements, 0x4 bytes
WaitAll = 0 /*0x0*/,
WaitAny = 1 /*0x1*/
} WAIT_TYPE, *PWAIT_TYPE;
enum _WHEA_ERROR_SEVERITY
Referred from:
typedef enum _WHEA_ERROR_SEVERITY {// 4 elements, 0x4 bytes
WheaErrSevRecoverable = 0 /*0x0*/,
WheaErrSevFatal = 1 /*0x1*/,
WheaErrSevCorrected = 2 /*0x2*/,
WheaErrSevNone = 3 /*0x3*/
} WHEA_ERROR_SEVERITY, *PWHEA_ERROR_SEVERITY;
enum _WHEA_ERROR_SOURCE_TYPE
Referred from:
typedef enum _WHEA_ERROR_SOURCE_TYPE {// 7 elements, 0x4 bytes
WheaErrSrcTypeMCE = 0 /*0x0*/,
WheaErrSrcTypeCMC = 1 /*0x1*/,
WheaErrSrcTypeCPE = 2 /*0x2*/,
WheaErrSrcTypeNMI = 3 /*0x3*/,
WheaErrSrcTypePCIe = 4 /*0x4*/,
WheaErrSrcTypeOther = 5 /*0x5*/,
WheaErrSrcTypeMax = 6 /*0x6*/
} WHEA_ERROR_SOURCE_TYPE, *PWHEA_ERROR_SOURCE_TYPE;
Referred from:
typedef enum _WHEA_ERROR_STATUS_FORMAT {// 8 elements, 0x4 bytes
WheaErrorStatusFormatIPFSalRecord = 0 /*0x0*/,
WheaErrorStatusFormatIA32MCA = 1 /*0x1*/,
WheaErrorStatusFormatEM64TMCA = 2 /*0x2*/,
WheaErrorStatusFormatAMD64MCA = 3 /*0x3*/,
WheaErrorStatusFormatPCIExpress = 4 /*0x4*/,
WheaErrorStatusFormatNMIPort = 5 /*0x5*/,
WheaErrorStatusFormatOther = 6 /*0x6*/,
WheaErrorStatusFormatMax = 7 /*0x7*/
} WHEA_ERROR_STATUS_FORMAT, *PWHEA_ERROR_STATUS_FORMAT;
enum _WHEA_ERROR_TYPE
Referred from:
typedef enum _WHEA_ERROR_TYPE {// 6 elements, 0x4 bytes
WheaErrTypeProcessor = 0 /*0x0*/,
WheaErrTypeMemory = 1 /*0x1*/,
WheaErrTypePCIExpress = 2 /*0x2*/,
WheaErrTypeNMI = 3 /*0x3*/,
WheaErrTypePCIXBus = 4 /*0x4*/,
WheaErrTypePCIXDevice = 5 /*0x5*/
} WHEA_ERROR_TYPE, *PWHEA_ERROR_TYPE;
typedef enum _WOW64_SHARED_INFORMATION {// 13 elements, 0x4 bytes
SharedNtdll32LdrInitializeThunk = 0 /*0x0*/,
SharedNtdll32KiUserExceptionDispatcher = 1 /*0x1*/,
SharedNtdll32KiUserApcDispatcher = 2 /*0x2*/,
SharedNtdll32KiUserCallbackDispatcher = 3 /*0x3*/,
SharedNtdll32LdrHotPatchRoutine = 4 /*0x4*/,
SharedNtdll32ExpInterlockedPopEntrySListFault = 5 /*0x5*/,
SharedNtdll32ExpInterlockedPopEntrySListResume = 6 /*0x6*/,
SharedNtdll32ExpInterlockedPopEntrySListEnd = 7 /*0x7*/,
SharedNtdll32RtlUserThreadStart = 8 /*0x8*/,
SharedNtdll32pQueryProcessDebugInformationRemote = 9 /*0x9*/,
SharedNtdll32EtwpNotificationThread = 10 /*0xA*/,
SharedNtdll32BaseAddress = 11 /*0xB*/,
Wow64SharedPageEntriesCount = 12 /*0xC*/
} WOW64_SHARED_INFORMATION, *PWOW64_SHARED_INFORMATION;
enum ___20100701102B1C00428CCE753AA77AFA2_RecordType
Referred from:
typedef enum ___20100701102B1C00428CCE753AA77AFA2_RecordType {// 2 elements, 0x4 bytes
KTMOH_CommitTransaction_Result = 1 /*0x1*/,
KTMOH_RollbackTransaction_Result = 2 /*0x2*/
} __20100701102B1C00428CCE753AA77AFA2_RecordType, *P__20100701102B1C00428CCE753AA77AFA2_RecordType;
struct _ACCESS_STATE
Referred from:
typedef struct _ACCESS_STATE { // 16 elements, 0xA0 bytes (sizeof)
/*0x000*/ struct _LUID OperationID; // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT8 SecurityEvaluated;
/*0x009*/ UINT8 GenerateAudit;
/*0x00A*/ UINT8 GenerateOnClose;
/*0x00B*/ UINT8 PrivilegesAllocated;
/*0x00C*/ ULONG32 Flags;
/*0x010*/ ULONG32 RemainingDesiredAccess;
/*0x014*/ ULONG32 PreviouslyGrantedAccess;
/*0x018*/ ULONG32 OriginalDesiredAccess;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ struct _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; // 4 elements, 0x20 bytes (sizeof)
/*0x040*/ VOID* SecurityDescriptor;
/*0x048*/ VOID* AuxData;
union { // 2 elements, 0x2C bytes (sizeof)
/*0x050*/ struct _INITIAL_PRIVILEGE_SET InitialPrivilegeSet; // 3 elements, 0x2C bytes (sizeof)
/*0x050*/ struct _PRIVILEGE_SET PrivilegeSet; // 3 elements, 0x14 bytes (sizeof)
} Privileges;
/*0x07C*/ UINT8 AuditPrivileges;
/*0x07D*/ UINT8 _PADDING1_[0x3];
/*0x080*/ struct _UNICODE_STRING ObjectName; // 3 elements, 0x10 bytes (sizeof)
/*0x090*/ struct _UNICODE_STRING ObjectTypeName; // 3 elements, 0x10 bytes (sizeof)
} ACCESS_STATE, *PACCESS_STATE;
struct _ACL
Referred from:
typedef struct _ACL { // 5 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT8 AclRevision;
/*0x001*/ UINT8 Sbz1;
/*0x002*/ UINT16 AclSize;
/*0x004*/ UINT16 AceCount;
/*0x006*/ UINT16 Sbz2;
} ACL, *PACL;
struct _ACTIVATION_CONTEXT
Referred from:
typedef struct _ACTIVATION_CONTEXT { // 0 elements, 0x0 bytes (sizeof)
} ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT;
struct _ACTIVATION_CONTEXT_DATA
Referred from:
typedef struct _ACTIVATION_CONTEXT_DATA { // 0 elements, 0x0 bytes (sizeof)
} ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA;
struct _ACTIVATION_CONTEXT_STACK
Referred from:
typedef struct _ACTIVATION_CONTEXT_STACK { // 5 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame;
/*0x008*/ struct _LIST_ENTRY FrameListCache; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ ULONG32 Flags;
/*0x01C*/ ULONG32 NextCookieSequenceNumber;
/*0x020*/ ULONG32 StackId;
/*0x024*/ UINT8 _PADDING0_[0x4];
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
struct _ADAPTER_OBJECT
Referred from:
typedef struct _ADAPTER_OBJECT { // 0 elements, 0x0 bytes (sizeof)
} ADAPTER_OBJECT, *PADAPTER_OBJECT;
struct _ALPC_PROCESS_CONTEXT
Referred from:
typedef struct _ALPC_PROCESS_CONTEXT {// 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _EX_PUSH_LOCK Lock; // 7 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _LIST_ENTRY ViewListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ UINT64 PagedPoolQuotaCache;
} ALPC_PROCESS_CONTEXT, *PALPC_PROCESS_CONTEXT;
struct _ALPHA_LOADER_BLOCK
Referred from:
typedef struct _ALPHA_LOADER_BLOCK { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 PlaceHolder;
} ALPHA_LOADER_BLOCK, *PALPHA_LOADER_BLOCK;
struct _AMD64_DBGKD_CONTROL_SET
Referred from:
typedef struct _AMD64_DBGKD_CONTROL_SET { // 4 elements, 0x1C bytes (sizeof)
/*0x000*/ ULONG32 TraceFlag;
/*0x004*/ UINT64 Dr7;
/*0x00C*/ UINT64 CurrentSymbolStart;
/*0x014*/ UINT64 CurrentSymbolEnd;
} AMD64_DBGKD_CONTROL_SET, *PAMD64_DBGKD_CONTROL_SET;
struct _ARBITER_ADD_RESERVED_PARAMETERS
Referred from:
typedef struct _ARBITER_ADD_RESERVED_PARAMETERS { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _DEVICE_OBJECT* ReserveDevice;
} ARBITER_ADD_RESERVED_PARAMETERS, *PARBITER_ADD_RESERVED_PARAMETERS;
struct _ARBITER_ALLOCATION_STATE
Referred from:
typedef struct _ARBITER_ALLOCATION_STATE { // 12 elements, 0x50 bytes (sizeof)
/*0x000*/ UINT64 Start;
/*0x008*/ UINT64 End;
/*0x010*/ UINT64 CurrentMinimum;
/*0x018*/ UINT64 CurrentMaximum;
/*0x020*/ struct _ARBITER_LIST_ENTRY* Entry;
/*0x028*/ struct _ARBITER_ALTERNATIVE* CurrentAlternative;
/*0x030*/ ULONG32 AlternativeCount;
/*0x034*/ UINT8 _PADDING0_[0x4];
/*0x038*/ struct _ARBITER_ALTERNATIVE* Alternatives;
/*0x040*/ UINT16 Flags;
/*0x042*/ UINT8 RangeAttributes;
/*0x043*/ UINT8 RangeAvailableAttributes;
/*0x044*/ UINT8 _PADDING1_[0x4];
/*0x048*/ UINT64 WorkSpace;
} ARBITER_ALLOCATION_STATE, *PARBITER_ALLOCATION_STATE;
struct _ARBITER_ALTERNATIVE
Referred from:
typedef struct _ARBITER_ALTERNATIVE { // 8 elements, 0x40 bytes (sizeof)
/*0x000*/ UINT64 Minimum;
/*0x008*/ UINT64 Maximum;
/*0x010*/ UINT64 Length;
/*0x018*/ UINT64 Alignment;
/*0x020*/ LONG32 Priority;
/*0x024*/ ULONG32 Flags;
/*0x028*/ struct _IO_RESOURCE_DESCRIPTOR* Descriptor;
/*0x030*/ ULONG32 Reserved[3];
/*0x03C*/ UINT8 _PADDING0_[0x4];
} ARBITER_ALTERNATIVE, *PARBITER_ALTERNATIVE;
struct _ARBITER_BOOT_ALLOCATION_PARAMETERS
Referred from:
typedef struct _ARBITER_BOOT_ALLOCATION_PARAMETERS { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY* ArbitrationList;
} ARBITER_BOOT_ALLOCATION_PARAMETERS, *PARBITER_BOOT_ALLOCATION_PARAMETERS;
struct _ARBITER_CONFLICT_INFO
Referred from:
typedef struct _ARBITER_CONFLICT_INFO { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _DEVICE_OBJECT* OwningObject;
/*0x008*/ UINT64 Start;
/*0x010*/ UINT64 End;
} ARBITER_CONFLICT_INFO, *PARBITER_CONFLICT_INFO;
struct _ARBITER_INSTANCE
typedef struct _ARBITER_INSTANCE { // 42 elements, 0x690 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KEVENT* MutexEvent;
/*0x010*/ UINT16* Name;
/*0x018*/ UINT16* OrderingName;
/*0x020*/ INT32 ResourceType;
/*0x024*/ UINT8 _PADDING1_[0x4];
/*0x028*/ struct _RTL_RANGE_LIST* Allocation;
/*0x030*/ struct _RTL_RANGE_LIST* PossibleAllocation;
/*0x038*/ struct _ARBITER_ORDERING_LIST OrderingList; // 3 elements, 0x10 bytes (sizeof)
/*0x048*/ struct _ARBITER_ORDERING_LIST ReservedList; // 3 elements, 0x10 bytes (sizeof)
/*0x058*/ LONG32 ReferenceCount;
/*0x05C*/ UINT8 _PADDING2_[0x4];
/*0x060*/ struct _ARBITER_INTERFACE* Interface;
/*0x068*/ ULONG32 AllocationStackMaxSize;
/*0x06C*/ UINT8 _PADDING3_[0x4];
/*0x070*/ struct _ARBITER_ALLOCATION_STATE* AllocationStack;
/*0x078*/ PVOID UnpackRequirement;
/*0x080*/ PVOID PackResource;
/*0x088*/ PVOID UnpackResource;
/*0x090*/ PVOID ScoreRequirement;
/*0x098*/ PVOID TestAllocation;
/*0x0A0*/ PVOID RetestAllocation;
/*0x0A8*/ PVOID CommitAllocation;
/*0x0B0*/ PVOID RollbackAllocation;
/*0x0B8*/ PVOID BootAllocation;
/*0x0C0*/ PVOID QueryArbitrate;
/*0x0C8*/ PVOID QueryConflict;
/*0x0D0*/ PVOID AddReserved;
/*0x0D8*/ PVOID StartArbiter;
/*0x0E0*/ PVOID PreprocessEntry;
/*0x0E8*/ PVOID AllocateEntry;
/*0x0F0*/ PVOID GetNextAllocationRange;
/*0x0F8*/ PVOID FindSuitableRange;
/*0x100*/ PVOID AddAllocation;
/*0x108*/ PVOID BacktrackAllocation;
/*0x110*/ PVOID OverrideConflict;
/*0x118*/ PVOID InitializeRangeList;
/*0x120*/ UINT8 TransactionInProgress;
/*0x121*/ UINT8 _PADDING4_[0x7];
/*0x128*/ VOID* Extension;
/*0x130*/ struct _DEVICE_OBJECT* BusDeviceObject;
/*0x138*/ VOID* ConflictCallbackContext;
/*0x140*/ PVOID ConflictCallback;
/*0x148*/ WCHAR PdoDescriptionString[336];
/*0x3E8*/ CHAR PdoSymbolicNameString[672];
/*0x688*/ WCHAR PdoAddressString[1];
/*0x68A*/ UINT8 _PADDING5_[0x6];
} ARBITER_INSTANCE, *PARBITER_INSTANCE;
struct _ARBITER_INTERFACE
Referred from:
typedef struct _ARBITER_INTERFACE { // 7 elements, 0x30 bytes (sizeof)
/*0x000*/ UINT16 Size;
/*0x002*/ UINT16 Version;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* Context;
/*0x010*/ PVOID InterfaceReference;
/*0x018*/ PVOID InterfaceDereference;
/*0x020*/ PVOID ArbiterHandler;
/*0x028*/ ULONG32 Flags;
/*0x02C*/ UINT8 _PADDING1_[0x4];
} ARBITER_INTERFACE, *PARBITER_INTERFACE;
struct _ARBITER_LIST_ENTRY
Referred from:
typedef struct _ARBITER_LIST_ENTRY { // 13 elements, 0x60 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 AlternativeCount;
/*0x014*/ UINT8 _PADDING0_[0x4];
/*0x018*/ struct _IO_RESOURCE_DESCRIPTOR* Alternatives;
/*0x020*/ struct _DEVICE_OBJECT* PhysicalDeviceObject;
/*0x028*/ enum _ARBITER_REQUEST_SOURCE RequestSource;
/*0x02C*/ ULONG32 Flags;
/*0x030*/ INT64 WorkSpace;
/*0x038*/ enum _INTERFACE_TYPE InterfaceType;
/*0x03C*/ ULONG32 SlotNumber;
/*0x040*/ ULONG32 BusNumber;
/*0x044*/ UINT8 _PADDING1_[0x4];
/*0x048*/ struct _CM_PARTIAL_RESOURCE_DESCRIPTOR* Assignment;
/*0x050*/ struct _IO_RESOURCE_DESCRIPTOR* SelectedAlternative;
/*0x058*/ enum _ARBITER_RESULT Result;
/*0x05C*/ UINT8 _PADDING2_[0x4];
} ARBITER_LIST_ENTRY, *PARBITER_LIST_ENTRY;
struct _ARBITER_ORDERING
Referred from:
typedef struct _ARBITER_ORDERING { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Start;
/*0x008*/ UINT64 End;
} ARBITER_ORDERING, *PARBITER_ORDERING;
struct _ARBITER_ORDERING_LIST
Referred from:
typedef struct _ARBITER_ORDERING_LIST { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Count;
/*0x002*/ UINT16 Maximum;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _ARBITER_ORDERING* Orderings;
} ARBITER_ORDERING_LIST, *PARBITER_ORDERING_LIST;
struct _ARBITER_PARAMETERS
typedef struct _ARBITER_PARAMETERS { // 1 elements, 0x20 bytes (sizeof)
union { // 7 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _ARBITER_TEST_ALLOCATION_PARAMETERS TestAllocation; // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _ARBITER_RETEST_ALLOCATION_PARAMETERS RetestAllocation; // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _ARBITER_BOOT_ALLOCATION_PARAMETERS BootAllocation; // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS QueryAllocatedResources; // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _ARBITER_QUERY_CONFLICT_PARAMETERS QueryConflict; // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _ARBITER_QUERY_ARBITRATE_PARAMETERS QueryArbitrate; // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _ARBITER_ADD_RESERVED_PARAMETERS AddReserved; // 1 elements, 0x8 bytes (sizeof)
} Parameters;
} ARBITER_PARAMETERS, *PARBITER_PARAMETERS;
struct _ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS
Referred from:
typedef struct _ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _CM_PARTIAL_RESOURCE_LIST** AllocatedResources;
} ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS, *PARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS;
struct _ARBITER_QUERY_ARBITRATE_PARAMETERS
Referred from:
typedef struct _ARBITER_QUERY_ARBITRATE_PARAMETERS { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY* ArbitrationList;
} ARBITER_QUERY_ARBITRATE_PARAMETERS, *PARBITER_QUERY_ARBITRATE_PARAMETERS;
struct _ARBITER_QUERY_CONFLICT_PARAMETERS
Referred from:
typedef struct _ARBITER_QUERY_CONFLICT_PARAMETERS { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _DEVICE_OBJECT* PhysicalDeviceObject;
/*0x008*/ struct _IO_RESOURCE_DESCRIPTOR* ConflictingResource;
/*0x010*/ ULONG32* ConflictCount;
/*0x018*/ struct _ARBITER_CONFLICT_INFO** Conflicts;
} ARBITER_QUERY_CONFLICT_PARAMETERS, *PARBITER_QUERY_CONFLICT_PARAMETERS;
struct _ARBITER_RETEST_ALLOCATION_PARAMETERS
Referred from:
typedef struct _ARBITER_RETEST_ALLOCATION_PARAMETERS { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY* ArbitrationList;
/*0x008*/ ULONG32 AllocateFromCount;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _CM_PARTIAL_RESOURCE_DESCRIPTOR* AllocateFrom;
} ARBITER_RETEST_ALLOCATION_PARAMETERS, *PARBITER_RETEST_ALLOCATION_PARAMETERS;
struct _ARBITER_TEST_ALLOCATION_PARAMETERS
Referred from:
typedef struct _ARBITER_TEST_ALLOCATION_PARAMETERS { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY* ArbitrationList;
/*0x008*/ ULONG32 AllocateFromCount;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _CM_PARTIAL_RESOURCE_DESCRIPTOR* AllocateFrom;
} ARBITER_TEST_ALLOCATION_PARAMETERS, *PARBITER_TEST_ALLOCATION_PARAMETERS;
Referred from:
typedef struct _ARC_DISK_INFORMATION { // 1 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY DiskSignatures; // 2 elements, 0x10 bytes (sizeof)
} ARC_DISK_INFORMATION, *PARC_DISK_INFORMATION;
struct _ARM_DBGKD_CONTROL_SET
Referred from:
typedef struct _ARM_DBGKD_CONTROL_SET { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 Continue;
/*0x004*/ ULONG32 CurrentSymbolStart;
/*0x008*/ ULONG32 CurrentSymbolEnd;
} ARM_DBGKD_CONTROL_SET, *PARM_DBGKD_CONTROL_SET;
struct _ASSEMBLY_STORAGE_MAP
Referred from:
typedef struct _ASSEMBLY_STORAGE_MAP { // 0 elements, 0x0 bytes (sizeof)
} ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP;
struct _BATTERY_REPORTING_SCALE
Referred from:
typedef struct _BATTERY_REPORTING_SCALE { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Granularity;
/*0x004*/ ULONG32 Capacity;
} BATTERY_REPORTING_SCALE, *PBATTERY_REPORTING_SCALE;
struct _BITMAP_RANGE
Referred from:
typedef struct _BITMAP_RANGE { // 6 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Links; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ INT64 BasePage;
/*0x018*/ ULONG32 FirstDirtyPage;
/*0x01C*/ ULONG32 LastDirtyPage;
/*0x020*/ ULONG32 DirtyPages;
/*0x024*/ UINT8 _PADDING0_[0x4];
/*0x028*/ ULONG32* Bitmap;
} BITMAP_RANGE, *PBITMAP_RANGE;
struct _BUS_EXTENSION_LIST
typedef struct _BUS_EXTENSION_LIST { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Next;
/*0x008*/ struct _PI_BUS_EXTENSION* BusExtension;
} BUS_EXTENSION_LIST, *PBUS_EXTENSION_LIST;
struct _CACHED_CHILD_LIST
Referred from:
typedef struct _CACHED_CHILD_LIST { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT64 ValueList;
/*0x008*/ struct _CM_KEY_CONTROL_BLOCK* RealKcb;
};
} CACHED_CHILD_LIST, *PCACHED_CHILD_LIST;
struct _CACHED_KSTACK_LIST
Referred from:
typedef struct _CACHED_KSTACK_LIST { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ union _SLIST_HEADER SListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x010*/ LONG32 MinimumFree;
/*0x014*/ ULONG32 Misses;
/*0x018*/ ULONG32 MissesLast;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} CACHED_KSTACK_LIST, *PCACHED_KSTACK_LIST;
struct _CACHE_DESCRIPTOR
Referred from:
typedef struct _CACHE_DESCRIPTOR { // 5 elements, 0xC bytes (sizeof)
/*0x000*/ UINT8 Level;
/*0x001*/ UINT8 Associativity;
/*0x002*/ UINT16 LineSize;
/*0x004*/ ULONG32 Size;
/*0x008*/ enum _PROCESSOR_CACHE_TYPE Type;
} CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR;
struct _CACHE_MANAGER_CALLBACKS
Referred from:
typedef struct _CACHE_MANAGER_CALLBACKS { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ PVOID AcquireForLazyWrite;
/*0x008*/ PVOID ReleaseFromLazyWrite;
/*0x010*/ PVOID AcquireForReadAhead;
/*0x018*/ PVOID ReleaseFromReadAhead;
} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
struct _CACHE_UNINITIALIZE_EVENT
Referred from:
typedef struct _CACHE_UNINITIALIZE_EVENT { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _CACHE_UNINITIALIZE_EVENT* Next;
/*0x008*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
struct _CALL_HASH_ENTRY
typedef struct _CALL_HASH_ENTRY { // 4 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* CallersAddress;
/*0x018*/ VOID* CallersCaller;
/*0x020*/ ULONG32 CallCount;
/*0x024*/ UINT8 _PADDING0_[0x4];
} CALL_HASH_ENTRY, *PCALL_HASH_ENTRY;
typedef struct _CALL_PERFORMANCE_DATA { // 2 elements, 0x408 bytes (sizeof)
/*0x000*/ UINT64 SpinLock;
/*0x008*/ struct _LIST_ENTRY HashTable[64];
} CALL_PERFORMANCE_DATA, *PCALL_PERFORMANCE_DATA;
struct _CELL_DATA
Referred from:
typedef struct _CELL_DATA { // 1 elements, 0x50 bytes (sizeof)
union { // 7 elements, 0x50 bytes (sizeof)
/*0x000*/ struct _CM_KEY_NODE KeyNode; // 22 elements, 0x50 bytes (sizeof)
/*0x000*/ struct _CM_KEY_VALUE KeyValue; // 8 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _CM_KEY_SECURITY KeySecurity; // 7 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _CM_KEY_INDEX KeyIndex; // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _CM_BIG_DATA ValueData; // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 KeyList[1];
/*0x000*/ WCHAR KeyString[1];
} u;
} CELL_DATA, *PCELL_DATA;
struct _CHILD_LIST
Referred from:
typedef struct _CHILD_LIST { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ ULONG32 List;
} CHILD_LIST, *PCHILD_LIST;
struct _CLIENT_ID
Referred from:
typedef struct _CLIENT_ID { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* UniqueProcess;
/*0x008*/ VOID* UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
struct _CLIENT_ID32
Referred from:
typedef struct _CLIENT_ID32 { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 UniqueProcess;
/*0x004*/ ULONG32 UniqueThread;
} CLIENT_ID32, *PCLIENT_ID32;
struct _CLIENT_ID64
Referred from:
typedef struct _CLIENT_ID64 { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 UniqueProcess;
/*0x008*/ UINT64 UniqueThread;
} CLIENT_ID64, *PCLIENT_ID64;
struct _CMHIVE
Referred from:
typedef struct _CMHIVE { // 44 elements, 0xB38 bytes (sizeof)
/*0x000*/ struct _HHIVE Hive; // 29 elements, 0x590 bytes (sizeof)
/*0x590*/ VOID* FileHandles[6];
/*0x5C0*/ struct _LIST_ENTRY NotifyList; // 2 elements, 0x10 bytes (sizeof)
/*0x5D0*/ struct _LIST_ENTRY HiveList; // 2 elements, 0x10 bytes (sizeof)
/*0x5E0*/ struct _FAST_MUTEX* HiveLock;
/*0x5E8*/ struct _FAST_MUTEX* ViewLock;
/*0x5F0*/ struct _FAST_MUTEX* WriterLock;
/*0x5F8*/ struct _EX_PUSH_LOCK FlusherLock; // 7 elements, 0x8 bytes (sizeof)
/*0x600*/ struct _EX_PUSH_LOCK SecurityLock; // 7 elements, 0x8 bytes (sizeof)
/*0x608*/ struct _LIST_ENTRY MappedViewList; // 2 elements, 0x10 bytes (sizeof)
/*0x618*/ struct _LIST_ENTRY PinnedViewList; // 2 elements, 0x10 bytes (sizeof)
/*0x628*/ struct _LIST_ENTRY FlushedViewList; // 2 elements, 0x10 bytes (sizeof)
/*0x638*/ UINT16 MappedViewCount;
/*0x63A*/ UINT16 PinnedViewCount;
/*0x63C*/ ULONG32 UseCount;
/*0x640*/ ULONG32 ViewsPerHive;
/*0x644*/ UINT8 _PADDING0_[0x4];
/*0x648*/ struct _FILE_OBJECT* FileObject;
/*0x650*/ ULONG32 LastShrinkHiveSize;
/*0x654*/ UINT8 _PADDING1_[0x4];
/*0x658*/ union _LARGE_INTEGER ActualFileSize; // 4 elements, 0x8 bytes (sizeof)
/*0x660*/ struct _UNICODE_STRING FileFullPath; // 3 elements, 0x10 bytes (sizeof)
/*0x670*/ struct _UNICODE_STRING FileUserName; // 3 elements, 0x10 bytes (sizeof)
/*0x680*/ struct _UNICODE_STRING HiveRootPath; // 3 elements, 0x10 bytes (sizeof)
/*0x690*/ ULONG32 SecurityCount;
/*0x694*/ ULONG32 SecurityCacheSize;
/*0x698*/ LONG32 SecurityHitHint;
/*0x69C*/ UINT8 _PADDING2_[0x4];
/*0x6A0*/ struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache;
/*0x6A8*/ struct _LIST_ENTRY SecurityHash[64];
/*0xAA8*/ ULONG32 UnloadEventCount;
/*0xAAC*/ UINT8 _PADDING3_[0x4];
/*0xAB0*/ struct _KEVENT** UnloadEventArray;
/*0xAB8*/ struct _CM_KEY_CONTROL_BLOCK* RootKcb;
/*0xAC0*/ UINT8 Frozen;
/*0xAC1*/ UINT8 _PADDING4_[0x7];
/*0xAC8*/ struct _CM_WORKITEM* UnloadWorkItem;
/*0xAD0*/ UINT8 GrowOnlyMode;
/*0xAD1*/ UINT8 _PADDING5_[0x3];
/*0xAD4*/ ULONG32 GrowOffset;
/*0xAD8*/ struct _LIST_ENTRY KcbConvertListHead; // 2 elements, 0x10 bytes (sizeof)
/*0xAE8*/ struct _LIST_ENTRY KnodeConvertListHead; // 2 elements, 0x10 bytes (sizeof)
/*0xAF8*/ struct _CM_CELL_REMAP_BLOCK* CellRemapArray;
/*0xB00*/ ULONG32 Flags;
/*0xB04*/ UINT8 _PADDING6_[0x4];
/*0xB08*/ struct _LIST_ENTRY TrustClassEntry; // 2 elements, 0x10 bytes (sizeof)
/*0xB18*/ ULONG32 FlushCount;
/*0xB1C*/ UINT8 _PADDING7_[0x4];
/*0xB20*/ struct _CM_RM* CmRm;
/*0xB28*/ ULONG32 CmRmInitFailPoint;
/*0xB2C*/ LONG32 CmRmInitFailStatus;
/*0xB30*/ struct _KTHREAD* CreatorOwner;
} CMHIVE, *PCMHIVE;
struct _CMP_OFFSET_ARRAY
typedef struct _CMP_OFFSET_ARRAY {// 3 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 FileOffset;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* DataBuffer;
/*0x010*/ ULONG32 DataLength;
/*0x014*/ UINT8 _PADDING1_[0x4];
} CMP_OFFSET_ARRAY, *PCMP_OFFSET_ARRAY;
struct _CM_BIG_DATA
Referred from:
typedef struct _CM_BIG_DATA { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT16 Signature;
/*0x002*/ UINT16 Count;
/*0x004*/ ULONG32 List;
} CM_BIG_DATA, *PCM_BIG_DATA;
struct _CM_CACHED_VALUE_INDEX
typedef struct _CM_CACHED_VALUE_INDEX { // 2 elements, 0x58 bytes (sizeof)
/*0x000*/ ULONG32 CellIndex;
/*0x004*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x50 bytes (sizeof)
/*0x008*/ struct _CELL_DATA CellData; // 1 elements, 0x50 bytes (sizeof)
/*0x008*/ UINT64 List[1];
} Data;
} CM_CACHED_VALUE_INDEX, *PCM_CACHED_VALUE_INDEX;
struct _CM_CELL_REMAP_BLOCK
Referred from:
typedef struct _CM_CELL_REMAP_BLOCK { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 OldCell;
/*0x004*/ ULONG32 NewCell;
} CM_CELL_REMAP_BLOCK, *PCM_CELL_REMAP_BLOCK;
struct _CM_FULL_RESOURCE_DESCRIPTOR
Referred from:
typedef struct _CM_FULL_RESOURCE_DESCRIPTOR { // 3 elements, 0x24 bytes (sizeof)
/*0x000*/ enum _INTERFACE_TYPE InterfaceType;
/*0x004*/ ULONG32 BusNumber;
/*0x008*/ struct _CM_PARTIAL_RESOURCE_LIST PartialResourceList; // 4 elements, 0x1C bytes (sizeof)
} CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
struct _CM_INDEX_HINT_BLOCK
Referred from:
typedef struct _CM_INDEX_HINT_BLOCK { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ ULONG32 HashKey[1];
} CM_INDEX_HINT_BLOCK, *PCM_INDEX_HINT_BLOCK;
struct _CM_INTENT_LOCK
Referred from:
typedef struct _CM_INTENT_LOCK { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 OwnerCount;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _CM_KCB_UOW** OwnerTable;
} CM_INTENT_LOCK, *PCM_INTENT_LOCK;
struct _CM_KCB_UOW
Referred from:
typedef struct _CM_KCB_UOW { // 20 elements, 0x60 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY TransactionListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _CM_INTENT_LOCK* KCBLock;
/*0x018*/ struct _CM_INTENT_LOCK* KeyLock;
/*0x020*/ struct _LIST_ENTRY KCBListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
/*0x038*/ struct _CM_TRANS* Transaction;
/*0x040*/ ULONG32 UoWState;
/*0x044*/ enum _UoWActionType ActionType;
/*0x048*/ enum _HSTORAGE_TYPE StorageType;
/*0x04C*/ UINT8 _PADDING0_[0x4];
union { // 8 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _CM_KEY_CONTROL_BLOCK* ChildKCB;
/*0x050*/ ULONG32 VolatileKeyCell;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ ULONG32 OldValueCell;
/*0x054*/ ULONG32 NewValueCell;
/*0x058*/ UINT8 _PADDING1_[0x8];
};
/*0x050*/ ULONG32 UserFlags;
/*0x050*/ union _LARGE_INTEGER LastWriteTime; // 4 elements, 0x8 bytes (sizeof)
/*0x050*/ ULONG32 TxSecurityCell;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _CM_KEY_CONTROL_BLOCK* OldChildKCB;
/*0x058*/ struct _CM_KEY_CONTROL_BLOCK* NewChildKCB;
};
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _CM_KEY_CONTROL_BLOCK* OtherChildKCB;
/*0x058*/ ULONG32 ThisVolatileKeyCell;
/*0x05C*/ UINT8 _PADDING2_[0x4];
};
};
} CM_KCB_UOW, *PCM_KCB_UOW;
struct _CM_KEY_BODY
Referred from:
typedef struct _CM_KEY_BODY { // 10 elements, 0x60 bytes (sizeof)
/*0x000*/ ULONG32 Type;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
/*0x010*/ struct _CM_NOTIFY_BLOCK* NotifyBlock;
/*0x018*/ VOID* ProcessID;
/*0x020*/ struct _LIST_ENTRY KeyBodyList; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ ULONG32 Flags;
/*0x034*/ UINT8 _PADDING1_[0x4];
/*0x038*/ VOID* KtmTrans;
/*0x040*/ struct _GUID* KtmUow;
/*0x048*/ struct _EX_PUSH_LOCK KeyBodyLock; // 7 elements, 0x8 bytes (sizeof)
/*0x050*/ struct _LIST_ENTRY ContextListHead; // 2 elements, 0x10 bytes (sizeof)
} CM_KEY_BODY, *PCM_KEY_BODY;
struct _CM_KEY_CONTROL_BLOCK
Referred from:
typedef struct _CM_KEY_CONTROL_BLOCK { // 38 elements, 0x100 bytes (sizeof)
/*0x000*/ ULONG32 RefCount;
struct { // 5 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 ExtFlags : 8; // 0 BitPosition
/*0x004*/ ULONG32 PrivateAlloc : 1; // 8 BitPosition
/*0x004*/ ULONG32 Delete : 1; // 9 BitPosition
/*0x004*/ ULONG32 DelayedCloseIndex : 12; // 10 BitPosition
/*0x004*/ ULONG32 TotalLevels : 10; // 22 BitPosition
};
union { // 2 elements, 0x20 bytes (sizeof)
/*0x008*/ struct _CM_KEY_HASH KeyHash; // 4 elements, 0x20 bytes (sizeof)
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 ConvKey;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _CM_KEY_HASH* NextHash;
/*0x018*/ struct _HHIVE* KeyHive;
/*0x020*/ ULONG32 KeyCell;
/*0x024*/ UINT8 _PADDING1_[0x4];
};
};
/*0x028*/ struct _CM_KEY_CONTROL_BLOCK* ParentKcb;
/*0x030*/ struct _CM_NAME_CONTROL_BLOCK* NameBlock;
/*0x038*/ struct _CM_KEY_SECURITY_CACHE* CachedSecurity;
/*0x040*/ struct _CACHED_CHILD_LIST ValueCache; // 3 elements, 0x10 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
/*0x050*/ struct _CM_INDEX_HINT_BLOCK* IndexHint;
/*0x050*/ ULONG32 HashKey;
/*0x050*/ ULONG32 SubKeyCount;
};
union { // 2 elements, 0x10 bytes (sizeof)
/*0x058*/ struct _LIST_ENTRY KeyBodyListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x058*/ struct _LIST_ENTRY FreeListEntry; // 2 elements, 0x10 bytes (sizeof)
};
/*0x068*/ struct _CM_KEY_BODY* KeyBodyArray[4];
/*0x088*/ VOID* DelayCloseEntry;
/*0x090*/ union _LARGE_INTEGER KcbLastWriteTime; // 4 elements, 0x8 bytes (sizeof)
/*0x098*/ UINT16 KcbMaxNameLen;
/*0x09A*/ UINT16 KcbMaxValueNameLen;
/*0x09C*/ ULONG32 KcbMaxValueDataLen;
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x0A0*/ ULONG32 KcbUserFlags : 4; // 0 BitPosition
/*0x0A0*/ ULONG32 KcbVirtControlFlags : 4; // 4 BitPosition
/*0x0A0*/ ULONG32 KcbDebug : 8; // 8 BitPosition
/*0x0A0*/ ULONG32 Flags : 16; // 16 BitPosition
};
/*0x0A8*/ CHAR* RealKeyName;
/*0x0B0*/ struct _LIST_ENTRY KCBUoWListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x0C0*/ struct _CM_TRANS* TransKCBOwner;
/*0x0C8*/ struct _CM_INTENT_LOCK KCBLock; // 2 elements, 0x10 bytes (sizeof)
/*0x0D8*/ struct _CM_INTENT_LOCK KeyLock; // 2 elements, 0x10 bytes (sizeof)
/*0x0E8*/ struct _CHILD_LIST TransValueCache; // 2 elements, 0x8 bytes (sizeof)
/*0x0F0*/ struct _CM_TRANS* TransValueListOwner;
/*0x0F8*/ struct _UNICODE_STRING* FullKCBName;
} CM_KEY_CONTROL_BLOCK, *PCM_KEY_CONTROL_BLOCK;
struct _CM_KEY_HASH
Referred from:
typedef struct _CM_KEY_HASH { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 ConvKey;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _CM_KEY_HASH* NextHash;
/*0x010*/ struct _HHIVE* KeyHive;
/*0x018*/ ULONG32 KeyCell;
/*0x01C*/ UINT8 _PADDING1_[0x4];
} CM_KEY_HASH, *PCM_KEY_HASH;
struct _CM_KEY_INDEX
Referred from:
typedef struct _CM_KEY_INDEX { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT16 Signature;
/*0x002*/ UINT16 Count;
/*0x004*/ ULONG32 List[1];
} CM_KEY_INDEX, *PCM_KEY_INDEX;
struct _CM_KEY_NODE
Referred from:
typedef struct _CM_KEY_NODE { // 22 elements, 0x50 bytes (sizeof)
/*0x000*/ UINT16 Signature;
/*0x002*/ UINT16 Flags;
/*0x004*/ union _LARGE_INTEGER LastWriteTime; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Spare;
/*0x010*/ ULONG32 Parent;
/*0x014*/ ULONG32 SubKeyCounts[2];
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x01C*/ ULONG32 SubKeyLists[2];
/*0x024*/ struct _CHILD_LIST ValueList; // 2 elements, 0x8 bytes (sizeof)
};
/*0x01C*/ struct _CM_KEY_REFERENCE ChildHiveReference; // 2 elements, 0x10 bytes (sizeof)
};
/*0x02C*/ ULONG32 Security;
/*0x030*/ ULONG32 Class;
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x034*/ ULONG32 MaxNameLen : 16; // 0 BitPosition
/*0x034*/ ULONG32 UserFlags : 4; // 16 BitPosition
/*0x034*/ ULONG32 VirtControlFlags : 4; // 20 BitPosition
/*0x034*/ ULONG32 Debug : 8; // 24 BitPosition
};
/*0x038*/ ULONG32 MaxClassLen;
/*0x03C*/ ULONG32 MaxValueNameLen;
/*0x040*/ ULONG32 MaxValueDataLen;
/*0x044*/ ULONG32 WorkVar;
/*0x048*/ UINT16 NameLength;
/*0x04A*/ UINT16 ClassLength;
/*0x04C*/ WCHAR Name[1];
/*0x04E*/ UINT8 _PADDING0_[0x2];
} CM_KEY_NODE, *PCM_KEY_NODE;
struct _CM_KEY_REFERENCE
Referred from:
typedef struct _CM_KEY_REFERENCE {// 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 KeyCell;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _HHIVE* KeyHive;
} CM_KEY_REFERENCE, *PCM_KEY_REFERENCE;
struct _CM_KEY_SECURITY
Referred from:
typedef struct _CM_KEY_SECURITY { // 7 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT16 Signature;
/*0x002*/ UINT16 Reserved;
/*0x004*/ ULONG32 Flink;
/*0x008*/ ULONG32 Blink;
/*0x00C*/ ULONG32 ReferenceCount;
/*0x010*/ ULONG32 DescriptorLength;
/*0x014*/ struct _SECURITY_DESCRIPTOR_RELATIVE Descriptor; // 7 elements, 0x14 bytes (sizeof)
} CM_KEY_SECURITY, *PCM_KEY_SECURITY;
struct _CM_KEY_SECURITY_CACHE
Referred from:
typedef struct _CM_KEY_SECURITY_CACHE { // 6 elements, 0x38 bytes (sizeof)
/*0x000*/ ULONG32 Cell;
/*0x004*/ ULONG32 ConvKey;
/*0x008*/ struct _LIST_ENTRY List; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ ULONG32 DescriptorLength;
/*0x01C*/ ULONG32 RealRefCount;
/*0x020*/ struct _SECURITY_DESCRIPTOR_RELATIVE Descriptor; // 7 elements, 0x14 bytes (sizeof)
/*0x034*/ UINT8 _PADDING0_[0x4];
} CM_KEY_SECURITY_CACHE, *PCM_KEY_SECURITY_CACHE;
struct _CM_KEY_SECURITY_CACHE_ENTRY
Referred from:
typedef struct _CM_KEY_SECURITY_CACHE_ENTRY { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Cell;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _CM_KEY_SECURITY_CACHE* CachedSecurity;
} CM_KEY_SECURITY_CACHE_ENTRY, *PCM_KEY_SECURITY_CACHE_ENTRY;
struct _CM_KEY_VALUE
Referred from:
typedef struct _CM_KEY_VALUE { // 8 elements, 0x18 bytes (sizeof)
/*0x000*/ UINT16 Signature;
/*0x002*/ UINT16 NameLength;
/*0x004*/ ULONG32 DataLength;
/*0x008*/ ULONG32 Data;
/*0x00C*/ ULONG32 Type;
/*0x010*/ UINT16 Flags;
/*0x012*/ UINT16 Spare;
/*0x014*/ WCHAR Name[1];
/*0x016*/ UINT8 _PADDING0_[0x2];
} CM_KEY_VALUE, *PCM_KEY_VALUE;
struct _CM_NAME_CONTROL_BLOCK
Referred from:
typedef struct _CM_NAME_CONTROL_BLOCK { // 7 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT8 Compressed;
/*0x001*/ UINT8 _PADDING0_[0x1];
/*0x002*/ UINT16 RefCount;
/*0x004*/ UINT8 _PADDING1_[0x4];
union { // 2 elements, 0x18 bytes (sizeof)
/*0x008*/ struct _CM_NAME_HASH NameHash; // 4 elements, 0x18 bytes (sizeof)
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 ConvKey;
/*0x00C*/ UINT8 _PADDING2_[0x4];
/*0x010*/ struct _CM_KEY_HASH* NextHash;
/*0x018*/ UINT16 NameLength;
/*0x01A*/ WCHAR Name[1];
/*0x01C*/ UINT8 _PADDING3_[0x4];
};
};
} CM_NAME_CONTROL_BLOCK, *PCM_NAME_CONTROL_BLOCK;
struct _CM_NAME_HASH
Referred from:
typedef struct _CM_NAME_HASH { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 ConvKey;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _CM_NAME_HASH* NextHash;
/*0x010*/ UINT16 NameLength;
/*0x012*/ WCHAR Name[1];
/*0x014*/ UINT8 _PADDING1_[0x4];
} CM_NAME_HASH, *PCM_NAME_HASH;
struct _CM_NOTIFY_BLOCK
Referred from:
typedef struct _CM_NOTIFY_BLOCK { // 8 elements, 0x58 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY HiveList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY PostList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
/*0x028*/ struct _CM_KEY_BODY* KeyBody;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x030*/ ULONG32 Filter : 30; // 0 BitPosition
/*0x030*/ ULONG32 WatchTree : 1; // 30 BitPosition
/*0x030*/ ULONG32 NotifyPending : 1; // 31 BitPosition
};
/*0x038*/ struct _SECURITY_SUBJECT_CONTEXT SubjectContext; // 4 elements, 0x20 bytes (sizeof)
} CM_NOTIFY_BLOCK, *PCM_NOTIFY_BLOCK;
struct _CM_PARTIAL_RESOURCE_DESCRIPTOR
Referred from:
typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { // 4 elements, 0x14 bytes (sizeof)
/*0x000*/ UINT8 Type;
/*0x001*/ UINT8 ShareDisposition;
/*0x002*/ UINT16 Flags;
union { // 12 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length;
} Generic;
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length;
} Port;
struct { // 3 elements, 0x10 bytes (sizeof)
/*0x004*/ ULONG32 Level;
/*0x008*/ ULONG32 Vector;
/*0x00C*/ UINT64 Affinity;
} Interrupt;
struct { // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 4 elements, 0x10 bytes (sizeof)
/*0x004*/ UINT16 Reserved;
/*0x006*/ UINT16 MessageCount;
/*0x008*/ ULONG32 Vector;
/*0x00C*/ UINT64 Affinity;
} Raw;
struct { // 3 elements, 0x10 bytes (sizeof)
/*0x004*/ ULONG32 Level;
/*0x008*/ ULONG32 Vector;
/*0x00C*/ UINT64 Affinity;
} Translated;
};
} MessageInterrupt;
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length;
} Memory;
struct { // 3 elements, 0xC bytes (sizeof)
/*0x004*/ ULONG32 Channel;
/*0x008*/ ULONG32 Port;
/*0x00C*/ ULONG32 Reserved1;
} Dma;
struct { // 1 elements, 0xC bytes (sizeof)
/*0x004*/ ULONG32 Data[3];
} DevicePrivate;
struct { // 3 elements, 0xC bytes (sizeof)
/*0x004*/ ULONG32 Start;
/*0x008*/ ULONG32 Length;
/*0x00C*/ ULONG32 Reserved;
} BusNumber;
struct { // 3 elements, 0xC bytes (sizeof)
/*0x004*/ ULONG32 DataSize;
/*0x008*/ ULONG32 Reserved1;
/*0x00C*/ ULONG32 Reserved2;
} DeviceSpecificData;
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length40;
} Memory40;
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length48;
} Memory48;
struct { // 2 elements, 0xC bytes (sizeof)
/*0x004*/ union _LARGE_INTEGER Start; // 4 elements, 0x8 bytes (sizeof)
/*0x00C*/ ULONG32 Length64;
} Memory64;
} u;
} CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
struct _CM_PARTIAL_RESOURCE_LIST
Referred from:
typedef struct _CM_PARTIAL_RESOURCE_LIST { // 4 elements, 0x1C bytes (sizeof)
/*0x000*/ UINT16 Version;
/*0x002*/ UINT16 Revision;
/*0x004*/ ULONG32 Count;
/*0x008*/ struct _CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
} CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
struct _CM_RESOURCE_LIST
Referred from:
typedef struct _CM_RESOURCE_LIST { // 2 elements, 0x28 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ struct _CM_FULL_RESOURCE_DESCRIPTOR List[1];
} CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
struct _CM_RM
Referred from:
typedef struct _CM_RM { // 17 elements, 0x88 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY RmListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY TransactionListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ VOID* TmHandle;
/*0x028*/ VOID* Tm;
/*0x030*/ VOID* RmHandle;
/*0x038*/ VOID* KtmRm;
/*0x040*/ ULONG32 RefCount;
/*0x044*/ ULONG32 ContainerNum;
/*0x048*/ UINT64 ContainerSize;
/*0x050*/ struct _CMHIVE* CmHive;
/*0x058*/ VOID* LogFileObject;
/*0x060*/ VOID* MarshallingContext;
/*0x068*/ ULONG32 RmFlags;
/*0x06C*/ LONG32 LogStartStatus1;
/*0x070*/ LONG32 LogStartStatus2;
/*0x074*/ UINT8 _PADDING0_[0x4];
/*0x078*/ UINT64 BaseLsn;
/*0x080*/ struct _ERESOURCE* RmLock;
} CM_RM, *PCM_RM;
struct _CM_TRANS
Referred from:
typedef struct _CM_TRANS { // 12 elements, 0xB0 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY TransactionListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY KCBUoWListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY LazyCommitListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ VOID* KtmTrans;
/*0x038*/ struct _CM_RM* CmRm;
/*0x040*/ struct _KENLISTMENT* KtmEnlistmentObject;
/*0x048*/ VOID* KtmEnlistmentHandle;
/*0x050*/ struct _GUID KtmUow; // 4 elements, 0x10 bytes (sizeof)
/*0x060*/ UINT64 StartLsn;
/*0x068*/ ULONG32 TransState;
/*0x06C*/ ULONG32 HiveCount;
/*0x070*/ struct _CMHIVE* HiveArray[8];
} CM_TRANS, *PCM_TRANS;
struct _CM_VIEW_OF_FILE
Referred from:
typedef struct _CM_VIEW_OF_FILE { // 9 elements, 0x58 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY MappedViewLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY PinnedViewLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY FlushedViewLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _CMHIVE* CmHive;
/*0x038*/ VOID* Bcb;
/*0x040*/ VOID* ViewAddress;
/*0x048*/ ULONG32 FileOffset;
/*0x04C*/ ULONG32 Size;
/*0x050*/ ULONG32 UseCount;
/*0x054*/ UINT8 _PADDING0_[0x4];
} CM_VIEW_OF_FILE, *PCM_VIEW_OF_FILE;
struct _CM_WORKITEM
Referred from:
typedef struct _CM_WORKITEM { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ PVOID WorkerRoutine;
/*0x018*/ VOID* Parameter;
} CM_WORKITEM, *PCM_WORKITEM;
struct _COMPRESSED_DATA_INFO
typedef struct _COMPRESSED_DATA_INFO { // 7 elements, 0xC bytes (sizeof)
/*0x000*/ UINT16 CompressionFormatAndEngine;
/*0x002*/ UINT8 CompressionUnitShift;
/*0x003*/ UINT8 ChunkShift;
/*0x004*/ UINT8 ClusterShift;
/*0x005*/ UINT8 Reserved;
/*0x006*/ UINT16 NumberOfChunks;
/*0x008*/ ULONG32 CompressedChunkSizes[1];
} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
struct _CONFIGURATION_COMPONENT
Referred from:
typedef struct _CONFIGURATION_COMPONENT { // 10 elements, 0x28 bytes (sizeof)
/*0x000*/ enum _CONFIGURATION_CLASS Class;
/*0x004*/ enum _CONFIGURATION_TYPE Type;
/*0x008*/ struct _DEVICE_FLAGS Flags; // 7 elements, 0x4 bytes (sizeof)
/*0x00C*/ UINT16 Version;
/*0x00E*/ UINT16 Revision;
/*0x010*/ ULONG32 Key;
/*0x014*/ ULONG32 AffinityMask;
/*0x018*/ ULONG32 ConfigurationDataLength;
/*0x01C*/ ULONG32 IdentifierLength;
/*0x020*/ CHAR* Identifier;
} CONFIGURATION_COMPONENT, *PCONFIGURATION_COMPONENT;
struct _CONFIGURATION_COMPONENT_DATA
Referred from:
typedef struct _CONFIGURATION_COMPONENT_DATA { // 5 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _CONFIGURATION_COMPONENT_DATA* Parent;
/*0x008*/ struct _CONFIGURATION_COMPONENT_DATA* Child;
/*0x010*/ struct _CONFIGURATION_COMPONENT_DATA* Sibling;
/*0x018*/ struct _CONFIGURATION_COMPONENT ComponentEntry; // 10 elements, 0x28 bytes (sizeof)
/*0x040*/ VOID* ConfigurationData;
} CONFIGURATION_COMPONENT_DATA, *PCONFIGURATION_COMPONENT_DATA;
struct _CONTEXT
Referred from:
typedef struct _CONTEXT { // 64 elements, 0x4D0 bytes (sizeof)
/*0x000*/ UINT64 P1Home;
/*0x008*/ UINT64 P2Home;
/*0x010*/ UINT64 P3Home;
/*0x018*/ UINT64 P4Home;
/*0x020*/ UINT64 P5Home;
/*0x028*/ UINT64 P6Home;
/*0x030*/ ULONG32 ContextFlags;
/*0x034*/ ULONG32 MxCsr;
/*0x038*/ UINT16 SegCs;
/*0x03A*/ UINT16 SegDs;
/*0x03C*/ UINT16 SegEs;
/*0x03E*/ UINT16 SegFs;
/*0x040*/ UINT16 SegGs;
/*0x042*/ UINT16 SegSs;
/*0x044*/ ULONG32 EFlags;
/*0x048*/ UINT64 Dr0;
/*0x050*/ UINT64 Dr1;
/*0x058*/ UINT64 Dr2;
/*0x060*/ UINT64 Dr3;
/*0x068*/ UINT64 Dr6;
/*0x070*/ UINT64 Dr7;
/*0x078*/ UINT64 Rax;
/*0x080*/ UINT64 Rcx;
/*0x088*/ UINT64 Rdx;
/*0x090*/ UINT64 Rbx;
/*0x098*/ UINT64 Rsp;
/*0x0A0*/ UINT64 Rbp;
/*0x0A8*/ UINT64 Rsi;
/*0x0B0*/ UINT64 Rdi;
/*0x0B8*/ UINT64 R8;
/*0x0C0*/ UINT64 R9;
/*0x0C8*/ UINT64 R10;
/*0x0D0*/ UINT64 R11;
/*0x0D8*/ UINT64 R12;
/*0x0E0*/ UINT64 R13;
/*0x0E8*/ UINT64 R14;
/*0x0F0*/ UINT64 R15;
/*0x0F8*/ UINT64 Rip;
union { // 2 elements, 0x200 bytes (sizeof)
/*0x100*/ struct _XMM_SAVE_AREA32 FltSave; // 16 elements, 0x200 bytes (sizeof)
struct { // 18 elements, 0x200 bytes (sizeof)
/*0x100*/ struct _M128A Header[2];
/*0x120*/ struct _M128A Legacy[8];
/*0x1A0*/ struct _M128A Xmm0; // 2 elements, 0x10 bytes (sizeof)
/*0x1B0*/ struct _M128A Xmm1; // 2 elements, 0x10 bytes (sizeof)
/*0x1C0*/ struct _M128A Xmm2; // 2 elements, 0x10 bytes (sizeof)
/*0x1D0*/ struct _M128A Xmm3; // 2 elements, 0x10 bytes (sizeof)
/*0x1E0*/ struct _M128A Xmm4; // 2 elements, 0x10 bytes (sizeof)
/*0x1F0*/ struct _M128A Xmm5; // 2 elements, 0x10 bytes (sizeof)
/*0x200*/ struct _M128A Xmm6; // 2 elements, 0x10 bytes (sizeof)
/*0x210*/ struct _M128A Xmm7; // 2 elements, 0x10 bytes (sizeof)
/*0x220*/ struct _M128A Xmm8; // 2 elements, 0x10 bytes (sizeof)
/*0x230*/ struct _M128A Xmm9; // 2 elements, 0x10 bytes (sizeof)
/*0x240*/ struct _M128A Xmm10; // 2 elements, 0x10 bytes (sizeof)
/*0x250*/ struct _M128A Xmm11; // 2 elements, 0x10 bytes (sizeof)
/*0x260*/ struct _M128A Xmm12; // 2 elements, 0x10 bytes (sizeof)
/*0x270*/ struct _M128A Xmm13; // 2 elements, 0x10 bytes (sizeof)
/*0x280*/ struct _M128A Xmm14; // 2 elements, 0x10 bytes (sizeof)
/*0x290*/ struct _M128A Xmm15; // 2 elements, 0x10 bytes (sizeof)
/*0x2A0*/ UINT8 _PADDING0_[0x60];
};
};
/*0x300*/ struct _M128A VectorRegister[26];
/*0x4A0*/ UINT64 VectorControl;
/*0x4A8*/ UINT64 DebugControl;
/*0x4B0*/ UINT64 LastBranchToRip;
/*0x4B8*/ UINT64 LastBranchFromRip;
/*0x4C0*/ UINT64 LastExceptionToRip;
/*0x4C8*/ UINT64 LastExceptionFromRip;
} CONTEXT, *PCONTEXT;
struct _CONTEXT32_UPDATE
typedef struct _CONTEXT32_UPDATE { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 NumberEntries;
} CONTEXT32_UPDATE, *PCONTEXT32_UPDATE;
struct _CONTROL_AREA
Referred from:
typedef struct _CONTROL_AREA { // 14 elements, 0x60 bytes (sizeof)
/*0x000*/ struct _SEGMENT* Segment;
/*0x008*/ struct _LIST_ENTRY DereferenceList; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ ULONG32 NumberOfSectionReferences;
/*0x01C*/ ULONG32 NumberOfPfnReferences;
/*0x020*/ ULONG32 NumberOfMappedViews;
/*0x024*/ ULONG32 NumberOfUserReferences;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x028*/ ULONG32 LongFlags;
/*0x028*/ struct _MMSECTION_FLAGS Flags; // 27 elements, 0x4 bytes (sizeof)
} u;
union { // 1 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x02C*/ UINT16 ModifiedWriteCount;
/*0x02E*/ UINT16 FlushInProgressCount;
} e2;
} u1;
/*0x030*/ struct _EX_FAST_REF FilePointer; // 3 elements, 0x8 bytes (sizeof)
/*0x038*/ LONG32 ControlAreaLock;
/*0x03C*/ ULONG32 StartingFrame;
/*0x040*/ struct _MI_SECTION_CREATION_EVENT* WaitingForDeletion;
union { // 1 elements, 0x10 bytes (sizeof)
struct { // 9 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x048*/ ULONG32 NumberOfSystemCacheViews;
/*0x048*/ ULONG32 ImageRelocationStartBit;
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x04C*/ LONG32 WritableUserReferences;
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x04C*/ ULONG32 ImageRelocationSizeIn64k : 16; // 0 BitPosition
/*0x04C*/ ULONG32 Unused : 14; // 16 BitPosition
/*0x04C*/ ULONG32 BitMap64 : 1; // 30 BitPosition
/*0x04C*/ ULONG32 ImageActive : 1; // 31 BitPosition
};
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x050*/ struct _MM_SUBSECTION_AVL_TABLE* SubsectionRoot;
/*0x050*/ struct _MI_IMAGE_SECURITY_REFERENCE* SeImageStub;
};
} e2;
} u2;
/*0x058*/ INT64 LockedPages;
} CONTROL_AREA, *PCONTROL_AREA;
struct _CURDIR
Referred from:
typedef struct _CURDIR { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _UNICODE_STRING DosPath; // 3 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* Handle;
} CURDIR, *PCURDIR;
struct _DBGKD_ANY_CONTROL_SET
Referred from:
typedef struct _DBGKD_ANY_CONTROL_SET { // 5 elements, 0x1C bytes (sizeof)
union { // 5 elements, 0x1C bytes (sizeof)
/*0x000*/ struct _X86_DBGKD_CONTROL_SET X86ControlSet; // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 AlphaControlSet;
/*0x000*/ struct _IA64_DBGKD_CONTROL_SET IA64ControlSet; // 3 elements, 0x14 bytes (sizeof)
/*0x000*/ struct _AMD64_DBGKD_CONTROL_SET Amd64ControlSet; // 4 elements, 0x1C bytes (sizeof)
/*0x000*/ struct _ARM_DBGKD_CONTROL_SET ArmControlSet; // 3 elements, 0xC bytes (sizeof)
};
} DBGKD_ANY_CONTROL_SET, *PDBGKD_ANY_CONTROL_SET;
struct _DBGKD_BREAKPOINTEX
Referred from:
typedef struct _DBGKD_BREAKPOINTEX { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 BreakPointCount;
/*0x004*/ LONG32 ContinueStatus;
} DBGKD_BREAKPOINTEX, *PDBGKD_BREAKPOINTEX;
struct _DBGKD_CONTINUE
Referred from:
typedef struct _DBGKD_CONTINUE { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ LONG32 ContinueStatus;
} DBGKD_CONTINUE, *PDBGKD_CONTINUE;
struct _DBGKD_CONTINUE2
Referred from:
typedef struct _DBGKD_CONTINUE2 { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ LONG32 ContinueStatus;
union { // 2 elements, 0x1C bytes (sizeof)
/*0x004*/ struct _AMD64_DBGKD_CONTROL_SET ControlSet; // 4 elements, 0x1C bytes (sizeof)
/*0x004*/ struct _DBGKD_ANY_CONTROL_SET AnyControlSet; // 5 elements, 0x1C bytes (sizeof)
};
} DBGKD_CONTINUE2, *PDBGKD_CONTINUE2;
struct _DBGKD_FILL_MEMORY
Referred from:
typedef struct _DBGKD_FILL_MEMORY { // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Address;
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT16 Flags;
/*0x00E*/ UINT16 PatternLength;
} DBGKD_FILL_MEMORY, *PDBGKD_FILL_MEMORY;
struct _DBGKD_GET_CONTEXT
Referred from:
typedef struct _DBGKD_GET_CONTEXT { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Unused;
} DBGKD_GET_CONTEXT, *PDBGKD_GET_CONTEXT;
struct _DBGKD_GET_INTERNAL_BREAKPOINT32
Referred from:
typedef struct _DBGKD_GET_INTERNAL_BREAKPOINT32 { // 7 elements, 0x1C bytes (sizeof)
/*0x000*/ ULONG32 BreakpointAddress;
/*0x004*/ ULONG32 Flags;
/*0x008*/ ULONG32 Calls;
/*0x00C*/ ULONG32 MaxCallsPerPeriod;
/*0x010*/ ULONG32 MinInstructions;
/*0x014*/ ULONG32 MaxInstructions;
/*0x018*/ ULONG32 TotalInstructions;
} DBGKD_GET_INTERNAL_BREAKPOINT32, *PDBGKD_GET_INTERNAL_BREAKPOINT32;
struct _DBGKD_GET_INTERNAL_BREAKPOINT64
Referred from:
typedef struct _DBGKD_GET_INTERNAL_BREAKPOINT64 { // 7 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 BreakpointAddress;
/*0x008*/ ULONG32 Flags;
/*0x00C*/ ULONG32 Calls;
/*0x010*/ ULONG32 MaxCallsPerPeriod;
/*0x014*/ ULONG32 MinInstructions;
/*0x018*/ ULONG32 MaxInstructions;
/*0x01C*/ ULONG32 TotalInstructions;
} DBGKD_GET_INTERNAL_BREAKPOINT64, *PDBGKD_GET_INTERNAL_BREAKPOINT64;
struct _DBGKD_GET_SET_BUS_DATA
Referred from:
typedef struct _DBGKD_GET_SET_BUS_DATA { // 5 elements, 0x14 bytes (sizeof)
/*0x000*/ ULONG32 BusDataType;
/*0x004*/ ULONG32 BusNumber;
/*0x008*/ ULONG32 SlotNumber;
/*0x00C*/ ULONG32 Offset;
/*0x010*/ ULONG32 Length;
} DBGKD_GET_SET_BUS_DATA, *PDBGKD_GET_SET_BUS_DATA;
struct _DBGKD_GET_VERSION32
Referred from:
typedef struct _DBGKD_GET_VERSION32 { // 14 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT16 MajorVersion;
/*0x002*/ UINT16 MinorVersion;
/*0x004*/ UINT16 ProtocolVersion;
/*0x006*/ UINT16 Flags;
/*0x008*/ ULONG32 KernBase;
/*0x00C*/ ULONG32 PsLoadedModuleList;
/*0x010*/ UINT16 MachineType;
/*0x012*/ UINT16 ThCallbackStack;
/*0x014*/ UINT16 NextCallback;
/*0x016*/ UINT16 FramePointer;
/*0x018*/ ULONG32 KiCallUserMode;
/*0x01C*/ ULONG32 KeUserCallbackDispatcher;
/*0x020*/ ULONG32 BreakpointWithStatus;
/*0x024*/ ULONG32 DebuggerDataList;
} DBGKD_GET_VERSION32, *PDBGKD_GET_VERSION32;
struct _DBGKD_GET_VERSION64
Referred from:
typedef struct _DBGKD_GET_VERSION64 {// 14 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT16 MajorVersion;
/*0x002*/ UINT16 MinorVersion;
/*0x004*/ UINT8 ProtocolVersion;
/*0x005*/ UINT8 KdSecondaryVersion;
/*0x006*/ UINT16 Flags;
/*0x008*/ UINT16 MachineType;
/*0x00A*/ UINT8 MaxPacketType;
/*0x00B*/ UINT8 MaxStateChange;
/*0x00C*/ UINT8 MaxManipulate;
/*0x00D*/ UINT8 Simulation;
/*0x00E*/ UINT16 Unused[1];
/*0x010*/ UINT64 KernBase;
/*0x018*/ UINT64 PsLoadedModuleList;
/*0x020*/ UINT64 DebuggerDataList;
} DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;
struct _DBGKD_LOAD_SYMBOLS32
typedef struct _DBGKD_LOAD_SYMBOLS32 { // 6 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 PathNameLength;
/*0x004*/ ULONG32 BaseOfDll;
/*0x008*/ ULONG32 ProcessId;
/*0x00C*/ ULONG32 CheckSum;
/*0x010*/ ULONG32 SizeOfImage;
/*0x014*/ UINT8 UnloadSymbols;
/*0x015*/ UINT8 _PADDING0_[0x3];
} DBGKD_LOAD_SYMBOLS32, *PDBGKD_LOAD_SYMBOLS32;
struct _DBGKD_LOAD_SYMBOLS64
typedef struct _DBGKD_LOAD_SYMBOLS64 { // 6 elements, 0x28 bytes (sizeof)
/*0x000*/ ULONG32 PathNameLength;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 BaseOfDll;
/*0x010*/ UINT64 ProcessId;
/*0x018*/ ULONG32 CheckSum;
/*0x01C*/ ULONG32 SizeOfImage;
/*0x020*/ UINT8 UnloadSymbols;
/*0x021*/ UINT8 _PADDING1_[0x7];
} DBGKD_LOAD_SYMBOLS64, *PDBGKD_LOAD_SYMBOLS64;
struct _DBGKD_MANIPULATE_STATE32
typedef struct _DBGKD_MANIPULATE_STATE32 { // 5 elements, 0x34 bytes (sizeof)
/*0x000*/ ULONG32 ApiNumber;
/*0x004*/ UINT16 ProcessorLevel;
/*0x006*/ UINT16 Processor;
/*0x008*/ LONG32 ReturnStatus;
union { // 20 elements, 0x28 bytes (sizeof)
/*0x00C*/ struct _DBGKD_READ_MEMORY32 ReadMemory; // 3 elements, 0xC bytes (sizeof)
/*0x00C*/ struct _DBGKD_WRITE_MEMORY32 WriteMemory; // 3 elements, 0xC bytes (sizeof)
/*0x00C*/ struct _DBGKD_READ_MEMORY64 ReadMemory64; // 3 elements, 0x10 bytes (sizeof)
/*0x00C*/ struct _DBGKD_WRITE_MEMORY64 WriteMemory64; // 3 elements, 0x10 bytes (sizeof)
/*0x00C*/ struct _DBGKD_GET_CONTEXT GetContext; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_SET_CONTEXT SetContext; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_WRITE_BREAKPOINT32 WriteBreakPoint; // 2 elements, 0x8 bytes (sizeof)
/*0x00C*/ struct _DBGKD_RESTORE_BREAKPOINT RestoreBreakPoint; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_CONTINUE Continue; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_CONTINUE2 Continue2; // 3 elements, 0x20 bytes (sizeof)
/*0x00C*/ struct _DBGKD_READ_WRITE_IO32 ReadWriteIo; // 3 elements, 0xC bytes (sizeof)
/*0x00C*/ struct _DBGKD_READ_WRITE_IO_EXTENDED32 ReadWriteIoExtended; // 6 elements, 0x18 bytes (sizeof)
/*0x00C*/ struct _DBGKD_QUERY_SPECIAL_CALLS QuerySpecialCalls; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_SET_SPECIAL_CALL32 SetSpecialCall; // 1 elements, 0x4 bytes (sizeof)
/*0x00C*/ struct _DBGKD_SET_INTERNAL_BREAKPOINT32 SetInternalBreakpoint; // 2 elements, 0x8 bytes (sizeof)
/*0x00C*/ struct _DBGKD_GET_INTERNAL_BREAKPOINT32 GetInternalBreakpoint; // 7 elements, 0x1C bytes (sizeof)
/*0x00C*/ struct _DBGKD_GET_VERSION32 GetVersion32; // 14 elements, 0x28 bytes (sizeof)
/*0x00C*/ struct _DBGKD_BREAKPOINTEX BreakPointEx; // 2 elements, 0x8 bytes (sizeof)
/*0x00C*/ struct _DBGKD_READ_WRITE_MSR ReadWriteMsr; // 3 elements, 0xC bytes (sizeof)
/*0x00C*/ struct _DBGKD_SEARCH_MEMORY SearchMemory; // 4 elements, 0x18 bytes (sizeof)
} u;
} DBGKD_MANIPULATE_STATE32, *PDBGKD_MANIPULATE_STATE32;
struct _DBGKD_MANIPULATE_STATE64
typedef struct _DBGKD_MANIPULATE_STATE64 { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ ULONG32 ApiNumber;
/*0x004*/ UINT16 ProcessorLevel;
/*0x006*/ UINT16 Processor;
/*0x008*/ LONG32 ReturnStatus;
/*0x00C*/ UINT8 _PADDING0_[0x4];
union { // 22 elements, 0x28 bytes (sizeof)
/*0x010*/ struct _DBGKD_READ_MEMORY64 ReadMemory; // 3 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_WRITE_MEMORY64 WriteMemory; // 3 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_GET_CONTEXT GetContext; // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ struct _DBGKD_SET_CONTEXT SetContext; // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ struct _DBGKD_WRITE_BREAKPOINT64 WriteBreakPoint; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_RESTORE_BREAKPOINT RestoreBreakPoint; // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ struct _DBGKD_CONTINUE Continue; // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ struct _DBGKD_CONTINUE2 Continue2; // 3 elements, 0x20 bytes (sizeof)
/*0x010*/ struct _DBGKD_READ_WRITE_IO64 ReadWriteIo; // 3 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_READ_WRITE_IO_EXTENDED64 ReadWriteIoExtended; // 6 elements, 0x20 bytes (sizeof)
/*0x010*/ struct _DBGKD_QUERY_SPECIAL_CALLS QuerySpecialCalls; // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ struct _DBGKD_SET_SPECIAL_CALL64 SetSpecialCall; // 1 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _DBGKD_SET_INTERNAL_BREAKPOINT64 SetInternalBreakpoint; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_GET_INTERNAL_BREAKPOINT64 GetInternalBreakpoint; // 7 elements, 0x20 bytes (sizeof)
/*0x010*/ struct _DBGKD_GET_VERSION64 GetVersion64; // 14 elements, 0x28 bytes (sizeof)
/*0x010*/ struct _DBGKD_BREAKPOINTEX BreakPointEx; // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _DBGKD_READ_WRITE_MSR ReadWriteMsr; // 3 elements, 0xC bytes (sizeof)
/*0x010*/ struct _DBGKD_SEARCH_MEMORY SearchMemory; // 4 elements, 0x18 bytes (sizeof)
/*0x010*/ struct _DBGKD_GET_SET_BUS_DATA GetSetBusData; // 5 elements, 0x14 bytes (sizeof)
/*0x010*/ struct _DBGKD_FILL_MEMORY FillMemory; // 4 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DBGKD_QUERY_MEMORY QueryMemory; // 4 elements, 0x18 bytes (sizeof)
/*0x010*/ struct _DBGKD_SWITCH_PARTITION SwitchPartition; // 1 elements, 0x4 bytes (sizeof)
} u;
} DBGKD_MANIPULATE_STATE64, *PDBGKD_MANIPULATE_STATE64;
struct _DBGKD_QUERY_MEMORY
Referred from:
typedef struct _DBGKD_QUERY_MEMORY { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ UINT64 Address;
/*0x008*/ UINT64 Reserved;
/*0x010*/ ULONG32 AddressSpace;
/*0x014*/ ULONG32 Flags;
} DBGKD_QUERY_MEMORY, *PDBGKD_QUERY_MEMORY;
struct _DBGKD_QUERY_SPECIAL_CALLS
Referred from:
typedef struct _DBGKD_QUERY_SPECIAL_CALLS { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 NumberOfSpecialCalls;
} DBGKD_QUERY_SPECIAL_CALLS, *PDBGKD_QUERY_SPECIAL_CALLS;
struct _DBGKD_READ_MEMORY32
Referred from:
typedef struct _DBGKD_READ_MEMORY32 { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 TargetBaseAddress;
/*0x004*/ ULONG32 TransferCount;
/*0x008*/ ULONG32 ActualBytesRead;
} DBGKD_READ_MEMORY32, *PDBGKD_READ_MEMORY32;
struct _DBGKD_READ_MEMORY64
Referred from:
typedef struct _DBGKD_READ_MEMORY64 { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 TargetBaseAddress;
/*0x008*/ ULONG32 TransferCount;
/*0x00C*/ ULONG32 ActualBytesRead;
} DBGKD_READ_MEMORY64, *PDBGKD_READ_MEMORY64;
struct _DBGKD_READ_WRITE_IO32
Referred from:
typedef struct _DBGKD_READ_WRITE_IO32 { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 DataSize;
/*0x004*/ ULONG32 IoAddress;
/*0x008*/ ULONG32 DataValue;
} DBGKD_READ_WRITE_IO32, *PDBGKD_READ_WRITE_IO32;
struct _DBGKD_READ_WRITE_IO64
Referred from:
typedef struct _DBGKD_READ_WRITE_IO64 { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 IoAddress;
/*0x008*/ ULONG32 DataSize;
/*0x00C*/ ULONG32 DataValue;
} DBGKD_READ_WRITE_IO64, *PDBGKD_READ_WRITE_IO64;
struct _DBGKD_READ_WRITE_IO_EXTENDED32
Referred from:
typedef struct _DBGKD_READ_WRITE_IO_EXTENDED32 { // 6 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 DataSize;
/*0x004*/ ULONG32 InterfaceType;
/*0x008*/ ULONG32 BusNumber;
/*0x00C*/ ULONG32 AddressSpace;
/*0x010*/ ULONG32 IoAddress;
/*0x014*/ ULONG32 DataValue;
} DBGKD_READ_WRITE_IO_EXTENDED32, *PDBGKD_READ_WRITE_IO_EXTENDED32;
struct _DBGKD_READ_WRITE_IO_EXTENDED64
Referred from:
typedef struct _DBGKD_READ_WRITE_IO_EXTENDED64 { // 6 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 DataSize;
/*0x004*/ ULONG32 InterfaceType;
/*0x008*/ ULONG32 BusNumber;
/*0x00C*/ ULONG32 AddressSpace;
/*0x010*/ UINT64 IoAddress;
/*0x018*/ ULONG32 DataValue;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} DBGKD_READ_WRITE_IO_EXTENDED64, *PDBGKD_READ_WRITE_IO_EXTENDED64;
struct _DBGKD_READ_WRITE_MSR
Referred from:
typedef struct _DBGKD_READ_WRITE_MSR { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 Msr;
/*0x004*/ ULONG32 DataValueLow;
/*0x008*/ ULONG32 DataValueHigh;
} DBGKD_READ_WRITE_MSR, *PDBGKD_READ_WRITE_MSR;
struct _DBGKD_RESTORE_BREAKPOINT
Referred from:
typedef struct _DBGKD_RESTORE_BREAKPOINT { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 BreakPointHandle;
} DBGKD_RESTORE_BREAKPOINT, *PDBGKD_RESTORE_BREAKPOINT;
struct _DBGKD_SEARCH_MEMORY
Referred from:
typedef struct _DBGKD_SEARCH_MEMORY { // 4 elements, 0x18 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 SearchAddress;
/*0x000*/ UINT64 FoundAddress;
};
/*0x008*/ UINT64 SearchLength;
/*0x010*/ ULONG32 PatternLength;
/*0x014*/ UINT8 _PADDING0_[0x4];
} DBGKD_SEARCH_MEMORY, *PDBGKD_SEARCH_MEMORY;
struct _DBGKD_SET_CONTEXT
Referred from:
typedef struct _DBGKD_SET_CONTEXT { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 ContextFlags;
} DBGKD_SET_CONTEXT, *PDBGKD_SET_CONTEXT;
struct _DBGKD_SET_INTERNAL_BREAKPOINT32
Referred from:
typedef struct _DBGKD_SET_INTERNAL_BREAKPOINT32 { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 BreakpointAddress;
/*0x004*/ ULONG32 Flags;
} DBGKD_SET_INTERNAL_BREAKPOINT32, *PDBGKD_SET_INTERNAL_BREAKPOINT32;
struct _DBGKD_SET_INTERNAL_BREAKPOINT64
Referred from:
typedef struct _DBGKD_SET_INTERNAL_BREAKPOINT64 { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 BreakpointAddress;
/*0x008*/ ULONG32 Flags;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} DBGKD_SET_INTERNAL_BREAKPOINT64, *PDBGKD_SET_INTERNAL_BREAKPOINT64;
struct _DBGKD_SET_SPECIAL_CALL32
Referred from:
typedef struct _DBGKD_SET_SPECIAL_CALL32 { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 SpecialCall;
} DBGKD_SET_SPECIAL_CALL32, *PDBGKD_SET_SPECIAL_CALL32;
struct _DBGKD_SET_SPECIAL_CALL64
Referred from:
typedef struct _DBGKD_SET_SPECIAL_CALL64 { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 SpecialCall;
} DBGKD_SET_SPECIAL_CALL64, *PDBGKD_SET_SPECIAL_CALL64;
struct _DBGKD_SWITCH_PARTITION
Referred from:
typedef struct _DBGKD_SWITCH_PARTITION { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Partition;
} DBGKD_SWITCH_PARTITION, *PDBGKD_SWITCH_PARTITION;
struct _DBGKD_WRITE_BREAKPOINT32
Referred from:
typedef struct _DBGKD_WRITE_BREAKPOINT32 { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 BreakPointAddress;
/*0x004*/ ULONG32 BreakPointHandle;
} DBGKD_WRITE_BREAKPOINT32, *PDBGKD_WRITE_BREAKPOINT32;
struct _DBGKD_WRITE_BREAKPOINT64
Referred from:
typedef struct _DBGKD_WRITE_BREAKPOINT64 { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 BreakPointAddress;
/*0x008*/ ULONG32 BreakPointHandle;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} DBGKD_WRITE_BREAKPOINT64, *PDBGKD_WRITE_BREAKPOINT64;
struct _DBGKD_WRITE_MEMORY32
Referred from:
typedef struct _DBGKD_WRITE_MEMORY32 { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 TargetBaseAddress;
/*0x004*/ ULONG32 TransferCount;
/*0x008*/ ULONG32 ActualBytesWritten;
} DBGKD_WRITE_MEMORY32, *PDBGKD_WRITE_MEMORY32;
struct _DBGKD_WRITE_MEMORY64
Referred from:
typedef struct _DBGKD_WRITE_MEMORY64 { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 TargetBaseAddress;
/*0x008*/ ULONG32 TransferCount;
/*0x00C*/ ULONG32 ActualBytesWritten;
} DBGKD_WRITE_MEMORY64, *PDBGKD_WRITE_MEMORY64;
struct _DBGKM_EXCEPTION32
typedef struct _DBGKM_EXCEPTION32 { // 2 elements, 0x54 bytes (sizeof)
/*0x000*/ struct _EXCEPTION_RECORD32 ExceptionRecord; // 6 elements, 0x50 bytes (sizeof)
/*0x050*/ ULONG32 FirstChance;
} DBGKM_EXCEPTION32, *PDBGKM_EXCEPTION32;
struct _DBGKM_EXCEPTION64
typedef struct _DBGKM_EXCEPTION64 { // 2 elements, 0xA0 bytes (sizeof)
/*0x000*/ struct _EXCEPTION_RECORD64 ExceptionRecord; // 7 elements, 0x98 bytes (sizeof)
/*0x098*/ ULONG32 FirstChance;
/*0x09C*/ UINT8 _PADDING0_[0x4];
} DBGKM_EXCEPTION64, *PDBGKM_EXCEPTION64;
struct _DEFERRED_WRITE
typedef struct _DEFERRED_WRITE { // 10 elements, 0x50 bytes (sizeof)
/*0x000*/ INT16 NodeTypeCode;
/*0x002*/ INT16 NodeByteSize;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _FILE_OBJECT* FileObject;
/*0x010*/ ULONG32 BytesToWrite;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ struct _LIST_ENTRY DeferredWriteLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _KEVENT* Event;
/*0x030*/ PVOID PostRoutine;
/*0x038*/ VOID* Context1;
/*0x040*/ VOID* Context2;
/*0x048*/ UINT8 LimitModifiedPages;
/*0x049*/ UINT8 _PADDING2_[0x7];
} DEFERRED_WRITE, *PDEFERRED_WRITE;
struct _DEVICE_CAPABILITIES
Referred from:
typedef struct _DEVICE_CAPABILITIES { // 29 elements, 0x40 bytes (sizeof)
/*0x000*/ UINT16 Size;
/*0x002*/ UINT16 Version;
struct { // 19 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 DeviceD1 : 1; // 0 BitPosition
/*0x004*/ ULONG32 DeviceD2 : 1; // 1 BitPosition
/*0x004*/ ULONG32 LockSupported : 1; // 2 BitPosition
/*0x004*/ ULONG32 EjectSupported : 1; // 3 BitPosition
/*0x004*/ ULONG32 Removable : 1; // 4 BitPosition
/*0x004*/ ULONG32 DockDevice : 1; // 5 BitPosition
/*0x004*/ ULONG32 UniqueID : 1; // 6 BitPosition
/*0x004*/ ULONG32 SilentInstall : 1; // 7 BitPosition
/*0x004*/ ULONG32 RawDeviceOK : 1; // 8 BitPosition
/*0x004*/ ULONG32 SurpriseRemovalOK : 1; // 9 BitPosition
/*0x004*/ ULONG32 WakeFromD0 : 1; // 10 BitPosition
/*0x004*/ ULONG32 WakeFromD1 : 1; // 11 BitPosition
/*0x004*/ ULONG32 WakeFromD2 : 1; // 12 BitPosition
/*0x004*/ ULONG32 WakeFromD3 : 1; // 13 BitPosition
/*0x004*/ ULONG32 HardwareDisabled : 1; // 14 BitPosition
/*0x004*/ ULONG32 NonDynamic : 1; // 15 BitPosition
/*0x004*/ ULONG32 WarmEjectSupported : 1; // 16 BitPosition
/*0x004*/ ULONG32 NoDisplayInUI : 1; // 17 BitPosition
/*0x004*/ ULONG32 Reserved : 14; // 18 BitPosition
};
/*0x008*/ ULONG32 Address;
/*0x00C*/ ULONG32 UINumber;
/*0x010*/ enum _DEVICE_POWER_STATE DeviceState[7];
/*0x02C*/ enum _SYSTEM_POWER_STATE SystemWake;
/*0x030*/ enum _DEVICE_POWER_STATE DeviceWake;
/*0x034*/ ULONG32 D1Latency;
/*0x038*/ ULONG32 D2Latency;
/*0x03C*/ ULONG32 D3Latency;
} DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
struct _DEVICE_FLAGS
Referred from:
typedef struct _DEVICE_FLAGS { // 7 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Failed : 1; // 0 BitPosition
/*0x000*/ ULONG32 ReadOnly : 1; // 1 BitPosition
/*0x000*/ ULONG32 Removable : 1; // 2 BitPosition
/*0x000*/ ULONG32 ConsoleIn : 1; // 3 BitPosition
/*0x000*/ ULONG32 ConsoleOut : 1; // 4 BitPosition
/*0x000*/ ULONG32 Input : 1; // 5 BitPosition
/*0x000*/ ULONG32 Output : 1; // 6 BitPosition
} DEVICE_FLAGS, *PDEVICE_FLAGS;
struct _DEVICE_MAP
Referred from:
typedef struct _DEVICE_MAP { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _OBJECT_DIRECTORY* DosDevicesDirectory;
/*0x008*/ struct _OBJECT_DIRECTORY* GlobalDosDevicesDirectory;
/*0x010*/ ULONG32 ReferenceCount;
/*0x014*/ ULONG32 DriveMap;
/*0x018*/ UINT8 DriveType[32];
} DEVICE_MAP, *PDEVICE_MAP;
struct _DEVICE_NODE
Referred from:
typedef struct _DEVICE_NODE { // 50 elements, 0x220 bytes (sizeof)
/*0x000*/ struct _DEVICE_NODE* Sibling;
/*0x008*/ struct _DEVICE_NODE* Child;
/*0x010*/ struct _DEVICE_NODE* Parent;
/*0x018*/ struct _DEVICE_NODE* LastChild;
/*0x020*/ ULONG32 Level;
/*0x024*/ UINT8 _PADDING0_[0x4];
/*0x028*/ struct _PO_DEVICE_NOTIFY Notify; // 8 elements, 0x40 bytes (sizeof)
/*0x068*/ struct _PO_IRP_MANAGER PoIrpManager; // 2 elements, 0x20 bytes (sizeof)
/*0x088*/ enum _PNP_DEVNODE_STATE State;
/*0x08C*/ enum _PNP_DEVNODE_STATE PreviousState;
/*0x090*/ enum _PNP_DEVNODE_STATE StateHistory[20];
/*0x0E0*/ ULONG32 StateHistoryEntry;
/*0x0E4*/ LONG32 CompletionStatus;
/*0x0E8*/ struct _IRP* PendingIrp;
/*0x0F0*/ ULONG32 Flags;
/*0x0F4*/ ULONG32 UserFlags;
/*0x0F8*/ ULONG32 Problem;
/*0x0FC*/ UINT8 _PADDING1_[0x4];
/*0x100*/ struct _DEVICE_OBJECT* PhysicalDeviceObject;
/*0x108*/ struct _CM_RESOURCE_LIST* ResourceList;
/*0x110*/ struct _CM_RESOURCE_LIST* ResourceListTranslated;
/*0x118*/ struct _UNICODE_STRING InstancePath; // 3 elements, 0x10 bytes (sizeof)
/*0x128*/ struct _UNICODE_STRING ServiceName; // 3 elements, 0x10 bytes (sizeof)
/*0x138*/ struct _DEVICE_OBJECT* DuplicatePDO;
/*0x140*/ struct _IO_RESOURCE_REQUIREMENTS_LIST* ResourceRequirements;
/*0x148*/ enum _INTERFACE_TYPE InterfaceType;
/*0x14C*/ ULONG32 BusNumber;
/*0x150*/ enum _INTERFACE_TYPE ChildInterfaceType;
/*0x154*/ ULONG32 ChildBusNumber;
/*0x158*/ UINT16 ChildBusTypeIndex;
/*0x15A*/ UINT8 RemovalPolicy;
/*0x15B*/ UINT8 HardwareRemovalPolicy;
/*0x15C*/ UINT8 _PADDING2_[0x4];
/*0x160*/ struct _LIST_ENTRY TargetDeviceNotify; // 2 elements, 0x10 bytes (sizeof)
/*0x170*/ struct _LIST_ENTRY DeviceArbiterList; // 2 elements, 0x10 bytes (sizeof)
/*0x180*/ struct _LIST_ENTRY DeviceTranslatorList; // 2 elements, 0x10 bytes (sizeof)
/*0x190*/ UINT16 NoTranslatorMask;
/*0x192*/ UINT16 QueryTranslatorMask;
/*0x194*/ UINT16 NoArbiterMask;
/*0x196*/ UINT16 QueryArbiterMask;
union { // 3 elements, 0x8 bytes (sizeof)
/*0x198*/ struct _DEVICE_NODE* LegacyDeviceNode;
/*0x198*/ struct _DEVICE_RELATIONS* PendingDeviceRelations;
/*0x198*/ VOID* Information;
} OverUsed1;
union { // 1 elements, 0x8 bytes (sizeof)
/*0x1A0*/ struct _DEVICE_NODE* NextResourceDeviceNode;
} OverUsed2;
/*0x1A8*/ struct _CM_RESOURCE_LIST* BootResources;
/*0x1B0*/ struct _CM_RESOURCE_LIST* BootResourcesTranslated;
/*0x1B8*/ ULONG32 CapabilityFlags;
/*0x1BC*/ UINT8 _PADDING3_[0x4];
struct { // 3 elements, 0x20 bytes (sizeof)
/*0x1C0*/ enum _PROFILE_STATUS DockStatus;
/*0x1C4*/ UINT8 _PADDING4_[0x4];
/*0x1C8*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x1D8*/ UINT16* SerialNumber;
} DockInfo;
/*0x1E0*/ ULONG32 DisableableDepends;
/*0x1E4*/ UINT8 _PADDING4_[0x4];
/*0x1E8*/ struct _LIST_ENTRY PendedSetInterfaceState; // 2 elements, 0x10 bytes (sizeof)
/*0x1F8*/ struct _LIST_ENTRY LegacyBusListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x208*/ ULONG32 DriverUnloadRetryCount;
/*0x20C*/ UINT8 _PADDING5_[0x4];
/*0x210*/ struct _DEVICE_NODE* PreviousParent;
/*0x218*/ ULONG32 DeletedChildren;
/*0x21C*/ ULONG32 NumaNodeIndex;
} DEVICE_NODE, *PDEVICE_NODE;
struct _DEVICE_OBJECT
Referred from:
typedef struct _DEVICE_OBJECT { // 25 elements, 0x150 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ UINT16 Size;
/*0x004*/ LONG32 ReferenceCount;
/*0x008*/ struct _DRIVER_OBJECT* DriverObject;
/*0x010*/ struct _DEVICE_OBJECT* NextDevice;
/*0x018*/ struct _DEVICE_OBJECT* AttachedDevice;
/*0x020*/ struct _IRP* CurrentIrp;
/*0x028*/ struct _IO_TIMER* Timer;
/*0x030*/ ULONG32 Flags;
/*0x034*/ ULONG32 Characteristics;
/*0x038*/ struct _VPB* Vpb;
/*0x040*/ VOID* DeviceExtension;
/*0x048*/ ULONG32 DeviceType;
/*0x04C*/ CHAR StackSize;
/*0x04D*/ UINT8 _PADDING0_[0x3];
union { // 2 elements, 0x48 bytes (sizeof)
/*0x050*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _WAIT_CONTEXT_BLOCK Wcb; // 7 elements, 0x48 bytes (sizeof)
} Queue;
/*0x098*/ ULONG32 AlignmentRequirement;
/*0x09C*/ UINT8 _PADDING1_[0x4];
/*0x0A0*/ struct _KDEVICE_QUEUE DeviceQueue; // 7 elements, 0x28 bytes (sizeof)
/*0x0C8*/ struct _KDPC Dpc; // 9 elements, 0x40 bytes (sizeof)
/*0x108*/ ULONG32 ActiveThreadCount;
/*0x10C*/ UINT8 _PADDING2_[0x4];
/*0x110*/ VOID* SecurityDescriptor;
/*0x118*/ struct _KEVENT DeviceLock; // 1 elements, 0x18 bytes (sizeof)
/*0x130*/ UINT16 SectorSize;
/*0x132*/ UINT16 Spare1;
/*0x134*/ UINT8 _PADDING3_[0x4];
/*0x138*/ struct _DEVOBJ_EXTENSION* DeviceObjectExtension;
/*0x140*/ VOID* Reserved;
/*0x148*/ UINT8 _PADDING4_[0x8];
} DEVICE_OBJECT, *PDEVICE_OBJECT;
struct _DEVICE_OBJECT_POWER_EXTENSION
Referred from:
typedef struct _DEVICE_OBJECT_POWER_EXTENSION { // 12 elements, 0x88 bytes (sizeof)
/*0x000*/ LONG32 IdleCount;
/*0x004*/ ULONG32 ConservationIdleTime;
/*0x008*/ ULONG32 PerformanceIdleTime;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x018*/ struct _LIST_ENTRY IdleList; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ UINT8 DeviceType;
/*0x029*/ UINT8 _PADDING1_[0x3];
/*0x02C*/ enum _DEVICE_POWER_STATE State;
/*0x030*/ struct _LIST_ENTRY NotifySourceList; // 2 elements, 0x10 bytes (sizeof)
/*0x040*/ struct _LIST_ENTRY NotifyTargetList; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _POWER_CHANNEL_SUMMARY PowerChannelSummary; // 4 elements, 0x20 bytes (sizeof)
/*0x070*/ struct _LIST_ENTRY Volume; // 2 elements, 0x10 bytes (sizeof)
/*0x080*/ ULONG32 PreviousIdleCount;
/*0x084*/ UINT8 _PADDING2_[0x4];
} DEVICE_OBJECT_POWER_EXTENSION, *PDEVICE_OBJECT_POWER_EXTENSION;
struct _DEVICE_RELATIONS
Referred from:
typedef struct _DEVICE_RELATIONS { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _DEVICE_OBJECT* Objects[1];
} DEVICE_RELATIONS, *PDEVICE_RELATIONS;
struct _DEVOBJ_EXTENSION
Referred from:
typedef struct _DEVOBJ_EXTENSION { // 12 elements, 0x50 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ UINT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ ULONG32 PowerFlags;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ struct _DEVICE_OBJECT_POWER_EXTENSION* Dope;
/*0x020*/ ULONG32 ExtensionFlags;
/*0x024*/ UINT8 _PADDING2_[0x4];
/*0x028*/ VOID* DeviceNode;
/*0x030*/ struct _DEVICE_OBJECT* AttachedTo;
/*0x038*/ LONG32 StartIoCount;
/*0x03C*/ LONG32 StartIoKey;
/*0x040*/ ULONG32 StartIoFlags;
/*0x044*/ UINT8 _PADDING3_[0x4];
/*0x048*/ struct _VPB* Vpb;
} DEVOBJ_EXTENSION, *PDEVOBJ_EXTENSION;
Referred from:
typedef struct _DISPATCHER_HEADER { // 13 elements, 0x18 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT8 Type;
union { // 4 elements, 0x1 bytes (sizeof)
/*0x001*/ UINT8 Abandoned;
/*0x001*/ UINT8 Absolute;
/*0x001*/ UINT8 NpxIrql;
/*0x001*/ UINT8 Signalling;
};
union { // 2 elements, 0x1 bytes (sizeof)
/*0x002*/ UINT8 Size;
/*0x002*/ UINT8 Hand;
};
union { // 3 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 Inserted;
/*0x003*/ UINT8 DebugActive;
/*0x003*/ UINT8 DpcActive;
};
};
/*0x000*/ LONG32 Lock;
};
/*0x004*/ LONG32 SignalState;
/*0x008*/ struct _LIST_ENTRY WaitListHead; // 2 elements, 0x10 bytes (sizeof)
} DISPATCHER_HEADER, *PDISPATCHER_HEADER;
struct _DRIVER_EXTENSION
Referred from:
typedef struct _DRIVER_EXTENSION { // 6 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _DRIVER_OBJECT* DriverObject;
/*0x008*/ PVOID AddDevice;
/*0x010*/ ULONG32 Count;
/*0x014*/ UINT8 _PADDING0_[0x4];
/*0x018*/ struct _UNICODE_STRING ServiceKeyName; // 3 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _IO_CLIENT_EXTENSION* ClientDriverExtension;
/*0x030*/ struct _FS_FILTER_CALLBACKS* FsFilterCallbacks;
} DRIVER_EXTENSION, *PDRIVER_EXTENSION;
struct _DRIVER_OBJECT
Referred from:
typedef struct _DRIVER_OBJECT { // 15 elements, 0x150 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ ULONG32 Flags;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ VOID* DriverStart;
/*0x020*/ ULONG32 DriverSize;
/*0x024*/ UINT8 _PADDING2_[0x4];
/*0x028*/ VOID* DriverSection;
/*0x030*/ struct _DRIVER_EXTENSION* DriverExtension;
/*0x038*/ struct _UNICODE_STRING DriverName; // 3 elements, 0x10 bytes (sizeof)
/*0x048*/ struct _UNICODE_STRING* HardwareDatabase;
/*0x050*/ struct _FAST_IO_DISPATCH* FastIoDispatch;
/*0x058*/ PVOID DriverInit;
/*0x060*/ PVOID DriverStartIo;
/*0x068*/ PVOID DriverUnload;
/*0x070*/ PVOID MajorFunction[28];
} DRIVER_OBJECT, *PDRIVER_OBJECT;
struct _DUAL
Referred from:
typedef struct _DUAL { // 7 elements, 0x278 bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _HMAP_DIRECTORY* Map;
/*0x010*/ struct _HMAP_TABLE* SmallDir;
/*0x018*/ ULONG32 Guard;
/*0x01C*/ UINT8 _PADDING1_[0x4];
/*0x020*/ struct _FREE_DISPLAY FreeDisplay[24];
/*0x260*/ ULONG32 FreeSummary;
/*0x264*/ UINT8 _PADDING2_[0x4];
/*0x268*/ struct _LIST_ENTRY FreeBins; // 2 elements, 0x10 bytes (sizeof)
} DUAL, *PDUAL;
struct _DUMP_INITIALIZATION_CONTEXT
Referred from:
typedef struct _DUMP_INITIALIZATION_CONTEXT { // 19 elements, 0xA0 bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ ULONG32 Reserved;
/*0x008*/ VOID* MemoryBlock;
/*0x010*/ VOID* CommonBuffer[2];
/*0x020*/ union _LARGE_INTEGER PhysicalAddress[2];
/*0x030*/ PVOID StallRoutine;
/*0x038*/ PVOID OpenRoutine;
/*0x040*/ PVOID WriteRoutine;
/*0x048*/ PVOID FinishRoutine;
/*0x050*/ struct _ADAPTER_OBJECT* AdapterObject;
/*0x058*/ VOID* MappedRegisterBase;
/*0x060*/ VOID* PortConfiguration;
/*0x068*/ UINT8 CrashDump;
/*0x069*/ UINT8 _PADDING0_[0x3];
/*0x06C*/ ULONG32 MaximumTransferSize;
/*0x070*/ ULONG32 CommonBufferSize;
/*0x074*/ UINT8 _PADDING1_[0x4];
/*0x078*/ VOID* TargetAddress;
/*0x080*/ PVOID WritePendingRoutine;
/*0x088*/ ULONG32 PartitionStyle;
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x08C*/ ULONG32 Signature;
/*0x090*/ ULONG32 CheckSum;
} Mbr;
struct { // 1 elements, 0x10 bytes (sizeof)
/*0x08C*/ struct _GUID DiskId; // 4 elements, 0x10 bytes (sizeof)
} Gpt;
} DiskInfo;
} DUMP_INITIALIZATION_CONTEXT, *PDUMP_INITIALIZATION_CONTEXT;
struct _DUMP_STACK_CONTEXT
Referred from:
typedef struct _DUMP_STACK_CONTEXT { // 11 elements, 0x110 bytes (sizeof)
/*0x000*/ struct _DUMP_INITIALIZATION_CONTEXT Init; // 19 elements, 0xA0 bytes (sizeof)
/*0x0A0*/ union _LARGE_INTEGER PartitionOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x0A8*/ VOID* DumpPointers;
/*0x0B0*/ ULONG32 PointersLength;
/*0x0B4*/ UINT8 _PADDING0_[0x4];
/*0x0B8*/ UINT16* ModulePrefix;
/*0x0C0*/ struct _LIST_ENTRY DriverList; // 2 elements, 0x10 bytes (sizeof)
/*0x0D0*/ struct _STRING InitMsg; // 3 elements, 0x10 bytes (sizeof)
/*0x0E0*/ struct _STRING ProgMsg; // 3 elements, 0x10 bytes (sizeof)
/*0x0F0*/ struct _STRING DoneMsg; // 3 elements, 0x10 bytes (sizeof)
/*0x100*/ VOID* FileObject;
/*0x108*/ enum _DEVICE_USAGE_NOTIFICATION_TYPE UsageType;
/*0x10C*/ UINT8 _PADDING1_[0x4];
} DUMP_STACK_CONTEXT, *PDUMP_STACK_CONTEXT;
struct _ECP_LIST
Referred from:
typedef struct _ECP_LIST { // 0 elements, 0x0 bytes (sizeof)
} ECP_LIST, *PECP_LIST;
Referred from:
typedef struct _EFI_FIRMWARE_INFORMATION { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 FirmwareVersion;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _VIRTUAL_EFI_RUNTIME_SERVICES* VirtualEfiRuntimeServices;
/*0x010*/ LONG32 SetVirtualAddressMapStatus;
/*0x014*/ ULONG32 MissedMappingsCount;
} EFI_FIRMWARE_INFORMATION, *PEFI_FIRMWARE_INFORMATION;
struct _EJOB
Referred from:
typedef struct _EJOB { // 42 elements, 0x1B0 bytes (sizeof)
/*0x000*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY JobLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY ProcessListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _ERESOURCE JobLock; // 15 elements, 0x68 bytes (sizeof)
/*0x0A0*/ union _LARGE_INTEGER TotalUserTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0A8*/ union _LARGE_INTEGER TotalKernelTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0B0*/ union _LARGE_INTEGER ThisPeriodTotalUserTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0B8*/ union _LARGE_INTEGER ThisPeriodTotalKernelTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0C0*/ ULONG32 TotalPageFaultCount;
/*0x0C4*/ ULONG32 TotalProcesses;
/*0x0C8*/ ULONG32 ActiveProcesses;
/*0x0CC*/ ULONG32 TotalTerminatedProcesses;
/*0x0D0*/ union _LARGE_INTEGER PerProcessUserTimeLimit; // 4 elements, 0x8 bytes (sizeof)
/*0x0D8*/ union _LARGE_INTEGER PerJobUserTimeLimit; // 4 elements, 0x8 bytes (sizeof)
/*0x0E0*/ ULONG32 LimitFlags;
/*0x0E4*/ UINT8 _PADDING0_[0x4];
/*0x0E8*/ UINT64 MinimumWorkingSetSize;
/*0x0F0*/ UINT64 MaximumWorkingSetSize;
/*0x0F8*/ ULONG32 ActiveProcessLimit;
/*0x0FC*/ UINT8 _PADDING1_[0x4];
/*0x100*/ UINT64 Affinity;
/*0x108*/ UINT8 PriorityClass;
/*0x109*/ UINT8 _PADDING2_[0x7];
/*0x110*/ struct _JOB_ACCESS_STATE* AccessState;
/*0x118*/ ULONG32 UIRestrictionsClass;
/*0x11C*/ ULONG32 EndOfJobTimeAction;
/*0x120*/ VOID* CompletionPort;
/*0x128*/ VOID* CompletionKey;
/*0x130*/ ULONG32 SessionId;
/*0x134*/ ULONG32 SchedulingClass;
/*0x138*/ UINT64 ReadOperationCount;
/*0x140*/ UINT64 WriteOperationCount;
/*0x148*/ UINT64 OtherOperationCount;
/*0x150*/ UINT64 ReadTransferCount;
/*0x158*/ UINT64 WriteTransferCount;
/*0x160*/ UINT64 OtherTransferCount;
/*0x168*/ UINT64 ProcessMemoryLimit;
/*0x170*/ UINT64 JobMemoryLimit;
/*0x178*/ UINT64 PeakProcessMemoryUsed;
/*0x180*/ UINT64 PeakJobMemoryUsed;
/*0x188*/ UINT64 CurrentJobMemoryUsed;
/*0x190*/ struct _EX_PUSH_LOCK MemoryLimitsLock; // 7 elements, 0x8 bytes (sizeof)
/*0x198*/ struct _LIST_ENTRY JobSetLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x1A8*/ ULONG32 MemberLevel;
/*0x1AC*/ ULONG32 JobFlags;
} EJOB, *PEJOB;
struct _EPROCESS
Referred from:
typedef struct _EPROCESS { // 125 elements, 0x3E8 bytes (sizeof)
/*0x000*/ struct _KPROCESS Pcb; // 31 elements, 0xC0 bytes (sizeof)
/*0x0C0*/ struct _EX_PUSH_LOCK ProcessLock; // 7 elements, 0x8 bytes (sizeof)
/*0x0C8*/ union _LARGE_INTEGER CreateTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0D0*/ union _LARGE_INTEGER ExitTime; // 4 elements, 0x8 bytes (sizeof)
/*0x0D8*/ struct _EX_RUNDOWN_REF RundownProtect; // 2 elements, 0x8 bytes (sizeof)
/*0x0E0*/ VOID* UniqueProcessId;
/*0x0E8*/ struct _LIST_ENTRY ActiveProcessLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x0F8*/ UINT64 QuotaUsage[3];
/*0x110*/ UINT64 QuotaPeak[3];
/*0x128*/ UINT64 CommitCharge;
/*0x130*/ UINT64 PeakVirtualSize;
/*0x138*/ UINT64 VirtualSize;
/*0x140*/ struct _LIST_ENTRY SessionProcessLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x150*/ VOID* DebugPort;
union { // 3 elements, 0x8 bytes (sizeof)
/*0x158*/ VOID* ExceptionPortData;
/*0x158*/ UINT64 ExceptionPortValue;
/*0x158*/ UINT64 ExceptionPortState : 3; // 0 BitPosition
};
/*0x160*/ struct _HANDLE_TABLE* ObjectTable;
/*0x168*/ struct _EX_FAST_REF Token; // 3 elements, 0x8 bytes (sizeof)
/*0x170*/ UINT64 WorkingSetPage;
/*0x178*/ struct _EX_PUSH_LOCK AddressCreationLock; // 7 elements, 0x8 bytes (sizeof)
/*0x180*/ struct _ETHREAD* RotateInProgress;
/*0x188*/ struct _ETHREAD* ForkInProgress;
/*0x190*/ UINT64 HardwareTrigger;
/*0x198*/ struct _MM_AVL_TABLE* PhysicalVadRoot;
/*0x1A0*/ VOID* CloneRoot;
/*0x1A8*/ UINT64 NumberOfPrivatePages;
/*0x1B0*/ UINT64 NumberOfLockedPages;
/*0x1B8*/ VOID* Win32Process;
/*0x1C0*/ struct _EJOB* Job;
/*0x1C8*/ VOID* SectionObject;
/*0x1D0*/ VOID* SectionBaseAddress;
/*0x1D8*/ struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;
/*0x1E0*/ struct _PAGEFAULT_HISTORY* WorkingSetWatch;
/*0x1E8*/ VOID* Win32WindowStation;
/*0x1F0*/ VOID* InheritedFromUniqueProcessId;
/*0x1F8*/ VOID* LdtInformation;
/*0x200*/ VOID* VadFreeHint;
/*0x208*/ VOID* VdmObjects;
/*0x210*/ VOID* DeviceMap;
/*0x218*/ VOID* EtwDataSource;
/*0x220*/ VOID* FreeTebHint;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x228*/ struct _HARDWARE_PTE PageDirectoryPte; // 16 elements, 0x8 bytes (sizeof)
/*0x228*/ UINT64 Filler;
};
/*0x230*/ VOID* Session;
/*0x238*/ UINT8 ImageFileName[16];
/*0x248*/ struct _LIST_ENTRY JobLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x258*/ VOID* LockedPagesList;
/*0x260*/ struct _LIST_ENTRY ThreadListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x270*/ VOID* SecurityPort;
/*0x278*/ struct _WOW64_PROCESS* Wow64Process;
/*0x280*/ ULONG32 ActiveThreads;
/*0x284*/ ULONG32 ImagePathHash;
/*0x288*/ ULONG32 DefaultHardErrorProcessing;
/*0x28C*/ LONG32 LastThreadExitStatus;
/*0x290*/ struct _PEB* Peb;
/*0x298*/ struct _EX_FAST_REF PrefetchTrace; // 3 elements, 0x8 bytes (sizeof)
/*0x2A0*/ union _LARGE_INTEGER ReadOperationCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2A8*/ union _LARGE_INTEGER WriteOperationCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2B0*/ union _LARGE_INTEGER OtherOperationCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2B8*/ union _LARGE_INTEGER ReadTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2C0*/ union _LARGE_INTEGER WriteTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2C8*/ union _LARGE_INTEGER OtherTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2D0*/ UINT64 CommitChargeLimit;
/*0x2D8*/ UINT64 CommitChargePeak;
/*0x2E0*/ VOID* AweInfo;
/*0x2E8*/ struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo; // 1 elements, 0x8 bytes (sizeof)
/*0x2F0*/ struct _MMSUPPORT Vm; // 18 elements, 0x68 bytes (sizeof)
/*0x358*/ struct _LIST_ENTRY MmProcessLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x368*/ ULONG32 ModifiedPageCount;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x36C*/ ULONG32 Flags2;
struct { // 16 elements, 0x4 bytes (sizeof)
/*0x36C*/ ULONG32 JobNotReallyActive : 1; // 0 BitPosition
/*0x36C*/ ULONG32 AccountingFolded : 1; // 1 BitPosition
/*0x36C*/ ULONG32 NewProcessReported : 1; // 2 BitPosition
/*0x36C*/ ULONG32 ExitProcessReported : 1; // 3 BitPosition
/*0x36C*/ ULONG32 ReportCommitChanges : 1; // 4 BitPosition
/*0x36C*/ ULONG32 LastReportMemory : 1; // 5 BitPosition
/*0x36C*/ ULONG32 ReportPhysicalPageChanges : 1; // 6 BitPosition
/*0x36C*/ ULONG32 HandleTableRundown : 1; // 7 BitPosition
/*0x36C*/ ULONG32 NeedsHandleRundown : 1; // 8 BitPosition
/*0x36C*/ ULONG32 RefTraceEnabled : 1; // 9 BitPosition
/*0x36C*/ ULONG32 NumaAware : 1; // 10 BitPosition
/*0x36C*/ ULONG32 ProtectedProcess : 1; // 11 BitPosition
/*0x36C*/ ULONG32 DefaultPagePriority : 3; // 12 BitPosition
/*0x36C*/ ULONG32 PrimaryTokenFrozen : 1; // 15 BitPosition
/*0x36C*/ ULONG32 ProcessVerifierTarget : 1; // 16 BitPosition
/*0x36C*/ ULONG32 StackRandomizationDisabled : 1; // 17 BitPosition
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x370*/ ULONG32 Flags;
struct { // 28 elements, 0x4 bytes (sizeof)
/*0x370*/ ULONG32 CreateReported : 1; // 0 BitPosition
/*0x370*/ ULONG32 NoDebugInherit : 1; // 1 BitPosition
/*0x370*/ ULONG32 ProcessExiting : 1; // 2 BitPosition
/*0x370*/ ULONG32 ProcessDelete : 1; // 3 BitPosition
/*0x370*/ ULONG32 Wow64SplitPages : 1; // 4 BitPosition
/*0x370*/ ULONG32 VmDeleted : 1; // 5 BitPosition
/*0x370*/ ULONG32 OutswapEnabled : 1; // 6 BitPosition
/*0x370*/ ULONG32 Outswapped : 1; // 7 BitPosition
/*0x370*/ ULONG32 ForkFailed : 1; // 8 BitPosition
/*0x370*/ ULONG32 Wow64VaSpace4Gb : 1; // 9 BitPosition
/*0x370*/ ULONG32 AddressSpaceInitialized : 2; // 10 BitPosition
/*0x370*/ ULONG32 SetTimerResolution : 1; // 12 BitPosition
/*0x370*/ ULONG32 BreakOnTermination : 1; // 13 BitPosition
/*0x370*/ ULONG32 DeprioritizeViews : 1; // 14 BitPosition
/*0x370*/ ULONG32 WriteWatch : 1; // 15 BitPosition
/*0x370*/ ULONG32 ProcessInSession : 1; // 16 BitPosition
/*0x370*/ ULONG32 OverrideAddressSpace : 1; // 17 BitPosition
/*0x370*/ ULONG32 HasAddressSpace : 1; // 18 BitPosition
/*0x370*/ ULONG32 LaunchPrefetched : 1; // 19 BitPosition
/*0x370*/ ULONG32 InjectInpageErrors : 1; // 20 BitPosition
/*0x370*/ ULONG32 VmTopDown : 1; // 21 BitPosition
/*0x370*/ ULONG32 ImageNotifyDone : 1; // 22 BitPosition
/*0x370*/ ULONG32 PdeUpdateNeeded : 1; // 23 BitPosition
/*0x370*/ ULONG32 VdmAllowed : 1; // 24 BitPosition
/*0x370*/ ULONG32 SmapAllowed : 1; // 25 BitPosition
/*0x370*/ ULONG32 ProcessInserted : 1; // 26 BitPosition
/*0x370*/ ULONG32 DefaultIoPriority : 3; // 27 BitPosition
/*0x370*/ ULONG32 SparePsFlags1 : 2; // 30 BitPosition
};
};
/*0x374*/ LONG32 ExitStatus;
/*0x378*/ UINT16 Spare7;
union { // 2 elements, 0x2 bytes (sizeof)
struct { // 2 elements, 0x2 bytes (sizeof)
/*0x37A*/ UINT8 SubSystemMinorVersion;
/*0x37B*/ UINT8 SubSystemMajorVersion;
};
/*0x37A*/ UINT16 SubSystemVersion;
};
/*0x37C*/ UINT8 PriorityClass;
/*0x37D*/ UINT8 _PADDING0_[0x3];
/*0x380*/ struct _MM_AVL_TABLE VadRoot; // 6 elements, 0x40 bytes (sizeof)
/*0x3C0*/ ULONG32 Cookie;
/*0x3C4*/ UINT8 _PADDING1_[0x4];
/*0x3C8*/ struct _ALPC_PROCESS_CONTEXT AlpcContext; // 3 elements, 0x20 bytes (sizeof)
} EPROCESS, *PEPROCESS;
struct _EPROCESS_QUOTA_BLOCK
Referred from:
typedef struct _EPROCESS_QUOTA_BLOCK { // 0 elements, 0x0 bytes (sizeof)
} EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
struct _ERESOURCE
Referred from:
typedef struct _ERESOURCE { // 15 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY SystemResourcesList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _OWNER_ENTRY* OwnerTable;
/*0x018*/ INT16 ActiveCount;
/*0x01A*/ UINT16 Flag;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ struct _KSEMAPHORE* SharedWaiters;
/*0x028*/ struct _KEVENT* ExclusiveWaiters;
/*0x030*/ struct _OWNER_ENTRY OwnerEntry; // 3 elements, 0x10 bytes (sizeof)
/*0x040*/ ULONG32 ActiveEntries;
/*0x044*/ ULONG32 ContentionCount;
/*0x048*/ ULONG32 NumberOfSharedWaiters;
/*0x04C*/ ULONG32 NumberOfExclusiveWaiters;
/*0x050*/ VOID* Reserved2;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x058*/ VOID* Address;
/*0x058*/ UINT64 CreatorBackTraceIndex;
};
/*0x060*/ UINT64 SpinLock;
} ERESOURCE, *PERESOURCE;
struct _ETHREAD
Referred from:
typedef struct _ETHREAD { // 78 elements, 0x450 bytes (sizeof)
/*0x000*/ struct _KTHREAD Tcb; // 122 elements, 0x330 bytes (sizeof)
/*0x330*/ union _LARGE_INTEGER CreateTime; // 4 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x338*/ union _LARGE_INTEGER ExitTime; // 4 elements, 0x8 bytes (sizeof)
/*0x338*/ struct _LIST_ENTRY KeyedWaitChain; // 2 elements, 0x10 bytes (sizeof)
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x348*/ LONG32 ExitStatus;
/*0x348*/ VOID* OfsChain;
};
union { // 2 elements, 0x10 bytes (sizeof)
/*0x350*/ struct _LIST_ENTRY PostBlockList; // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x350*/ VOID* ForwardLinkShadow;
/*0x358*/ VOID* StartAddress;
};
};
union { // 4 elements, 0x8 bytes (sizeof)
/*0x360*/ struct _TERMINATION_PORT* TerminationPort;
/*0x360*/ struct _ETHREAD* ReaperLink;
/*0x360*/ VOID* KeyedWaitValue;
/*0x360*/ VOID* Win32StartParameter;
};
/*0x368*/ UINT64 ActiveTimerListLock;
/*0x370*/ struct _LIST_ENTRY ActiveTimerListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x380*/ struct _CLIENT_ID Cid; // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x20 bytes (sizeof)
/*0x390*/ struct _KSEMAPHORE KeyedWaitSemaphore; // 2 elements, 0x20 bytes (sizeof)
/*0x390*/ struct _KSEMAPHORE AlpcWaitSemaphore; // 2 elements, 0x20 bytes (sizeof)
};
/*0x3B0*/ union _PS_CLIENT_SECURITY_CONTEXT ClientSecurity; // 4 elements, 0x8 bytes (sizeof)
/*0x3B8*/ struct _LIST_ENTRY IrpList; // 2 elements, 0x10 bytes (sizeof)
/*0x3C8*/ UINT64 TopLevelIrp;
/*0x3D0*/ struct _DEVICE_OBJECT* DeviceToVerify;
/*0x3D8*/ union _PSP_RATE_APC* RateControlApc;
/*0x3E0*/ VOID* Win32StartAddress;
/*0x3E8*/ VOID* SparePtr0;
/*0x3F0*/ struct _LIST_ENTRY ThreadListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x400*/ struct _EX_RUNDOWN_REF RundownProtect; // 2 elements, 0x8 bytes (sizeof)
/*0x408*/ struct _EX_PUSH_LOCK ThreadLock; // 7 elements, 0x8 bytes (sizeof)
/*0x410*/ ULONG32 ReadClusterSize;
/*0x414*/ LONG32 MmLockOrdering;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x418*/ ULONG32 CrossThreadFlags;
struct { // 13 elements, 0x4 bytes (sizeof)
/*0x418*/ ULONG32 Terminated : 1; // 0 BitPosition
/*0x418*/ ULONG32 ThreadInserted : 1; // 1 BitPosition
/*0x418*/ ULONG32 HideFromDebugger : 1; // 2 BitPosition
/*0x418*/ ULONG32 ActiveImpersonationInfo : 1; // 3 BitPosition
/*0x418*/ ULONG32 SystemThread : 1; // 4 BitPosition
/*0x418*/ ULONG32 HardErrorsAreDisabled : 1; // 5 BitPosition
/*0x418*/ ULONG32 BreakOnTermination : 1; // 6 BitPosition
/*0x418*/ ULONG32 SkipCreationMsg : 1; // 7 BitPosition
/*0x418*/ ULONG32 SkipTerminationMsg : 1; // 8 BitPosition
/*0x418*/ ULONG32 CopyTokenOnOpen : 1; // 9 BitPosition
/*0x418*/ ULONG32 ThreadIoPriority : 3; // 10 BitPosition
/*0x418*/ ULONG32 ThreadPagePriority : 3; // 13 BitPosition
/*0x418*/ ULONG32 RundownFail : 1; // 16 BitPosition
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x41C*/ ULONG32 SameThreadPassiveFlags;
struct { // 7 elements, 0x4 bytes (sizeof)
/*0x41C*/ ULONG32 ActiveExWorker : 1; // 0 BitPosition
/*0x41C*/ ULONG32 ExWorkerCanWaitUser : 1; // 1 BitPosition
/*0x41C*/ ULONG32 MemoryMaker : 1; // 2 BitPosition
/*0x41C*/ ULONG32 ClonedThread : 1; // 3 BitPosition
/*0x41C*/ ULONG32 KeyedEventInUse : 1; // 4 BitPosition
/*0x41C*/ ULONG32 RateApcState : 2; // 5 BitPosition
/*0x41C*/ ULONG32 SelfTerminate : 1; // 7 BitPosition
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x420*/ ULONG32 SameThreadApcFlags;
struct { // 3 elements, 0x4 bytes (sizeof)
struct { // 8 elements, 0x1 bytes (sizeof)
/*0x420*/ UINT8 Spare : 1; // 0 BitPosition
/*0x420*/ UINT8 StartAddressInvalid : 1; // 1 BitPosition
/*0x420*/ UINT8 EtwPageFaultCalloutActive : 1; // 2 BitPosition
/*0x420*/ UINT8 OwnsProcessWorkingSetExclusive : 1; // 3 BitPosition
/*0x420*/ UINT8 OwnsProcessWorkingSetShared : 1; // 4 BitPosition
/*0x420*/ UINT8 OwnsSystemWorkingSetExclusive : 1; // 5 BitPosition
/*0x420*/ UINT8 OwnsSystemWorkingSetShared : 1; // 6 BitPosition
/*0x420*/ UINT8 OwnsSessionWorkingSetExclusive : 1; // 7 BitPosition
};
struct { // 8 elements, 0x1 bytes (sizeof)
/*0x421*/ UINT8 OwnsSessionWorkingSetShared : 1; // 0 BitPosition
/*0x421*/ UINT8 OwnsProcessAddressSpaceExclusive : 1; // 1 BitPosition
/*0x421*/ UINT8 OwnsProcessAddressSpaceShared : 1; // 2 BitPosition
/*0x421*/ UINT8 SuppressSymbolLoad : 1; // 3 BitPosition
/*0x421*/ UINT8 Prefetching : 1; // 4 BitPosition
/*0x421*/ UINT8 OwnsDynamicMemoryShared : 1; // 5 BitPosition
/*0x421*/ UINT8 OwnsChangeControlAreaExclusive : 1; // 6 BitPosition
/*0x421*/ UINT8 OwnsChangeControlAreaShared : 1; // 7 BitPosition
};
/*0x422*/ UINT16 PriorityRegionActive : 4; // 0 BitPosition
};
};
/*0x424*/ UINT8 CacheManagerActive;
/*0x425*/ UINT8 DisablePageFaultClustering;
/*0x426*/ UINT8 ActiveFaultCount;
/*0x427*/ UINT8 _PADDING0_[0x1];
/*0x428*/ UINT64 AlpcMessageId;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x430*/ VOID* AlpcMessage;
/*0x430*/ ULONG32 AlpcReceiveAttributeSet;
};
/*0x438*/ struct _LIST_ENTRY AlpcWaitListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x448*/ ULONG32 CacheManagerCount;
/*0x44C*/ UINT8 _PADDING1_[0x4];
} ETHREAD, *PETHREAD;
struct _ETIMER
typedef struct _ETIMER { // 9 elements, 0x108 bytes (sizeof)
/*0x000*/ struct _KTIMER KeTimer; // 5 elements, 0x40 bytes (sizeof)
/*0x040*/ struct _KAPC TimerApc; // 16 elements, 0x58 bytes (sizeof)
/*0x098*/ struct _KDPC TimerDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x0D8*/ struct _LIST_ENTRY ActiveTimerListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x0E8*/ UINT64 Lock;
/*0x0F0*/ LONG32 Period;
/*0x0F4*/ UINT8 ApcAssociated;
/*0x0F5*/ UINT8 WakeTimer;
/*0x0F6*/ UINT8 _PADDING0_[0x2];
/*0x0F8*/ struct _LIST_ENTRY WakeTimerListEntry; // 2 elements, 0x10 bytes (sizeof)
} ETIMER, *PETIMER;
struct _ETW_BUFFER_CONTEXT
Referred from:
typedef struct _ETW_BUFFER_CONTEXT { // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT8 ProcessorNumber;
/*0x001*/ UINT8 Alignment;
/*0x002*/ UINT16 LoggerId;
} ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT;
struct _ETW_GUID_ENTRY
Referred from:
typedef struct _ETW_GUID_ENTRY { // 9 elements, 0x170 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY GuidList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ LONG32 RefCount;
/*0x014*/ struct _GUID Guid; // 4 elements, 0x10 bytes (sizeof)
/*0x024*/ UINT8 _PADDING0_[0x4];
/*0x028*/ struct _LIST_ENTRY RegListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ VOID* SecurityDescriptor;
/*0x040*/ struct _TRACE_ENABLE_CONTEXT LegacyEnableContext; // 4 elements, 0x8 bytes (sizeof)
/*0x048*/ ULONG32 LegacyProviderEnabled;
/*0x04C*/ UINT8 _PADDING1_[0x4];
/*0x050*/ struct _TRACE_ENABLE_INFO ProviderEnableInfo; // 8 elements, 0x20 bytes (sizeof)
/*0x070*/ struct _TRACE_ENABLE_INFO EnableInfo[8];
} ETW_GUID_ENTRY, *PETW_GUID_ENTRY;
struct _ETW_KERNEL_TRACE_TIMESTAMP
Referred from:
typedef struct _ETW_KERNEL_TRACE_TIMESTAMP { // 1 elements, 0x10 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER KernelTraceTimeStamp[2];
} ETW_KERNEL_TRACE_TIMESTAMP, *PETW_KERNEL_TRACE_TIMESTAMP;
struct _ETW_PROVIDER_TABLE_ENTRY
typedef struct _ETW_PROVIDER_TABLE_ENTRY { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ LONG32 RefCount;
/*0x004*/ enum _ETW_PROVIDER_STATE State;
/*0x008*/ struct _ETW_REG_ENTRY* RegEntry;
/*0x010*/ VOID* Caller;
} ETW_PROVIDER_TABLE_ENTRY, *PETW_PROVIDER_TABLE_ENTRY;
struct _ETW_REF_CLOCK
Referred from:
typedef struct _ETW_REF_CLOCK { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER StartTime; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ union _LARGE_INTEGER StartPerfClock; // 4 elements, 0x8 bytes (sizeof)
} ETW_REF_CLOCK, *PETW_REF_CLOCK;
struct _ETW_REG_ENTRY
Referred from:
typedef struct _ETW_REG_ENTRY { // 10 elements, 0x50 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY RegList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _ETW_GUID_ENTRY* GuidEntry;
/*0x018*/ UINT16 Index;
/*0x01A*/ UINT16 Flags;
/*0x01C*/ UINT8 EnableMask;
/*0x01D*/ UINT8 _PADDING0_[0x3];
union { // 2 elements, 0x20 bytes (sizeof)
/*0x020*/ struct _ETW_REPLY_QUEUE* ReplyQueue;
/*0x020*/ struct _ETW_REG_ENTRY* ReplySlot[4];
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x040*/ struct _EPROCESS* Process;
/*0x040*/ VOID* Callback;
};
/*0x048*/ VOID* CallbackContext;
} ETW_REG_ENTRY, *PETW_REG_ENTRY;
struct _ETW_REPLY_QUEUE
Referred from:
typedef struct _ETW_REPLY_QUEUE { // 2 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _KQUEUE Queue; // 5 elements, 0x40 bytes (sizeof)
/*0x040*/ LONG32 EventsLost;
/*0x044*/ UINT8 _PADDING0_[0x4];
} ETW_REPLY_QUEUE, *PETW_REPLY_QUEUE;
struct _ETW_SYSTEMTIME
typedef struct _ETW_SYSTEMTIME { // 8 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Year;
/*0x002*/ UINT16 Month;
/*0x004*/ UINT16 DayOfWeek;
/*0x006*/ UINT16 Day;
/*0x008*/ UINT16 Hour;
/*0x00A*/ UINT16 Minute;
/*0x00C*/ UINT16 Second;
/*0x00E*/ UINT16 Milliseconds;
} ETW_SYSTEMTIME, *PETW_SYSTEMTIME;
struct _EVENT_DATA_DESCRIPTOR
typedef struct _EVENT_DATA_DESCRIPTOR { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Ptr;
/*0x008*/ ULONG32 Size;
/*0x00C*/ ULONG32 Reserved;
} EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR;
struct _EVENT_DESCRIPTOR
typedef struct _EVENT_DESCRIPTOR { // 7 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Id;
/*0x002*/ UINT8 Version;
/*0x003*/ UINT8 Channel;
/*0x004*/ UINT8 Level;
/*0x005*/ UINT8 Opcode;
/*0x006*/ UINT16 Task;
/*0x008*/ UINT64 Keyword;
} EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR;
struct _EXCEPTION_POINTERS
typedef struct _EXCEPTION_POINTERS { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _EXCEPTION_RECORD* ExceptionRecord;
/*0x008*/ struct _CONTEXT* ContextRecord;
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;
struct _EXCEPTION_RECORD
Referred from:
typedef struct _EXCEPTION_RECORD { // 6 elements, 0x98 bytes (sizeof)
/*0x000*/ LONG32 ExceptionCode;
/*0x004*/ ULONG32 ExceptionFlags;
/*0x008*/ struct _EXCEPTION_RECORD* ExceptionRecord;
/*0x010*/ VOID* ExceptionAddress;
/*0x018*/ ULONG32 NumberParameters;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ UINT64 ExceptionInformation[15];
} EXCEPTION_RECORD, *PEXCEPTION_RECORD;
struct _EXCEPTION_RECORD32
Referred from:
typedef struct _EXCEPTION_RECORD32 { // 6 elements, 0x50 bytes (sizeof)
/*0x000*/ LONG32 ExceptionCode;
/*0x004*/ ULONG32 ExceptionFlags;
/*0x008*/ ULONG32 ExceptionRecord;
/*0x00C*/ ULONG32 ExceptionAddress;
/*0x010*/ ULONG32 NumberParameters;
/*0x014*/ ULONG32 ExceptionInformation[15];
} EXCEPTION_RECORD32, *PEXCEPTION_RECORD32;
struct _EXCEPTION_RECORD64
Referred from:
typedef struct _EXCEPTION_RECORD64 { // 7 elements, 0x98 bytes (sizeof)
/*0x000*/ LONG32 ExceptionCode;
/*0x004*/ ULONG32 ExceptionFlags;
/*0x008*/ UINT64 ExceptionRecord;
/*0x010*/ UINT64 ExceptionAddress;
/*0x018*/ ULONG32 NumberParameters;
/*0x01C*/ ULONG32 __unusedAlignment;
/*0x020*/ UINT64 ExceptionInformation[15];
} EXCEPTION_RECORD64, *PEXCEPTION_RECORD64;
struct _EXCEPTION_REGISTRATION_RECORD
Referred from:
typedef struct _EXCEPTION_REGISTRATION_RECORD { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _EXCEPTION_REGISTRATION_RECORD* Next;
/*0x008*/ PVOID Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
struct _EX_FAST_REF
Referred from:
typedef struct _EX_FAST_REF { // 3 elements, 0x8 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ VOID* Object;
/*0x000*/ UINT64 RefCnt : 4; // 0 BitPosition
/*0x000*/ UINT64 Value;
};
} EX_FAST_REF, *PEX_FAST_REF;
struct _EX_PUSH_LOCK
Referred from:
typedef struct _EX_PUSH_LOCK { // 7 elements, 0x8 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
struct { // 5 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Locked : 1; // 0 BitPosition
/*0x000*/ UINT64 Waiting : 1; // 1 BitPosition
/*0x000*/ UINT64 Waking : 1; // 2 BitPosition
/*0x000*/ UINT64 MultipleShared : 1; // 3 BitPosition
/*0x000*/ UINT64 Shared : 60; // 4 BitPosition
};
/*0x000*/ UINT64 Value;
/*0x000*/ VOID* Ptr;
};
} EX_PUSH_LOCK, *PEX_PUSH_LOCK;
struct _EX_PUSH_LOCK_CACHE_AWARE
typedef struct _EX_PUSH_LOCK_CACHE_AWARE { // 1 elements, 0x100 bytes (sizeof)
/*0x000*/ struct _EX_PUSH_LOCK* Locks[32];
} EX_PUSH_LOCK_CACHE_AWARE, *PEX_PUSH_LOCK_CACHE_AWARE;
struct _EX_PUSH_LOCK_WAIT_BLOCK
Referred from:
typedef struct _EX_PUSH_LOCK_WAIT_BLOCK { // 7 elements, 0x40 bytes (sizeof)
union { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _KGATE WakeGate; // 1 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _KEVENT WakeEvent; // 1 elements, 0x18 bytes (sizeof)
};
/*0x018*/ struct _EX_PUSH_LOCK_WAIT_BLOCK* Next;
/*0x020*/ struct _EX_PUSH_LOCK_WAIT_BLOCK* Last;
/*0x028*/ struct _EX_PUSH_LOCK_WAIT_BLOCK* Previous;
/*0x030*/ LONG32 ShareCount;
/*0x034*/ LONG32 Flags;
/*0x038*/ UINT8 _PADDING0_[0x8];
} EX_PUSH_LOCK_WAIT_BLOCK, *PEX_PUSH_LOCK_WAIT_BLOCK;
struct _EX_RUNDOWN_REF
Referred from:
typedef struct _EX_RUNDOWN_REF { // 2 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Count;
/*0x000*/ VOID* Ptr;
};
} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
struct _EX_WORK_QUEUE
typedef struct _EX_WORK_QUEUE { // 6 elements, 0x58 bytes (sizeof)
/*0x000*/ struct _KQUEUE WorkerQueue; // 5 elements, 0x40 bytes (sizeof)
/*0x040*/ ULONG32 DynamicThreadCount;
/*0x044*/ ULONG32 WorkItemsProcessed;
/*0x048*/ ULONG32 WorkItemsProcessedLastPass;
/*0x04C*/ ULONG32 QueueDepthLastPass;
/*0x050*/ union _EX_QUEUE_WORKER_INFO Info; // 5 elements, 0x4 bytes (sizeof)
/*0x054*/ UINT8 _PADDING0_[0x4];
} EX_WORK_QUEUE, *PEX_WORK_QUEUE;
struct _FAST_IO_DISPATCH
Referred from:
typedef struct _FAST_IO_DISPATCH { // 28 elements, 0xE0 bytes (sizeof)
/*0x000*/ ULONG32 SizeOfFastIoDispatch;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ PVOID FastIoCheckIfPossible;
/*0x010*/ PVOID FastIoRead;
/*0x018*/ PVOID FastIoWrite;
/*0x020*/ PVOID FastIoQueryBasicInfo;
/*0x028*/ PVOID FastIoQueryStandardInfo;
/*0x030*/ PVOID FastIoLock;
/*0x038*/ PVOID FastIoUnlockSingle;
/*0x040*/ PVOID FastIoUnlockAll;
/*0x048*/ PVOID FastIoUnlockAllByKey;
/*0x050*/ PVOID FastIoDeviceControl;
/*0x058*/ PVOID AcquireFileForNtCreateSection;
/*0x060*/ PVOID ReleaseFileForNtCreateSection;
/*0x068*/ PVOID FastIoDetachDevice;
/*0x070*/ PVOID FastIoQueryNetworkOpenInfo;
/*0x078*/ PVOID AcquireForModWrite;
/*0x080*/ PVOID MdlRead;
/*0x088*/ PVOID MdlReadComplete;
/*0x090*/ PVOID PrepareMdlWrite;
/*0x098*/ PVOID MdlWriteComplete;
/*0x0A0*/ PVOID FastIoReadCompressed;
/*0x0A8*/ PVOID FastIoWriteCompressed;
/*0x0B0*/ PVOID MdlReadCompleteCompressed;
/*0x0B8*/ PVOID MdlWriteCompleteCompressed;
/*0x0C0*/ PVOID FastIoQueryOpen;
/*0x0C8*/ PVOID ReleaseForModWrite;
/*0x0D0*/ PVOID AcquireForCcFlush;
/*0x0D8*/ PVOID ReleaseForCcFlush;
} FAST_IO_DISPATCH, *PFAST_IO_DISPATCH;
struct _FAST_MUTEX
Referred from:
typedef struct _FAST_MUTEX { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ LONG32 Count;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KTHREAD* Owner;
/*0x010*/ ULONG32 Contention;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ struct _KEVENT Gate; // 1 elements, 0x18 bytes (sizeof)
/*0x030*/ ULONG32 OldIrql;
/*0x034*/ UINT8 _PADDING2_[0x4];
} FAST_MUTEX, *PFAST_MUTEX;
typedef struct _FILE_BASIC_INFORMATION { // 5 elements, 0x28 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER CreationTime; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ union _LARGE_INTEGER LastAccessTime; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ union _LARGE_INTEGER LastWriteTime; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER ChangeTime; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ ULONG32 FileAttributes;
/*0x024*/ UINT8 _PADDING0_[0x4];
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
Referred from:
typedef struct _FILE_GET_QUOTA_INFORMATION { // 3 elements, 0x14 bytes (sizeof)
/*0x000*/ ULONG32 NextEntryOffset;
/*0x004*/ ULONG32 SidLength;
/*0x008*/ struct _SID Sid; // 4 elements, 0xC bytes (sizeof)
} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
typedef struct _FILE_NETWORK_OPEN_INFORMATION { // 7 elements, 0x38 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER CreationTime; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ union _LARGE_INTEGER LastAccessTime; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ union _LARGE_INTEGER LastWriteTime; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER ChangeTime; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ union _LARGE_INTEGER AllocationSize; // 4 elements, 0x8 bytes (sizeof)
/*0x028*/ union _LARGE_INTEGER EndOfFile; // 4 elements, 0x8 bytes (sizeof)
/*0x030*/ ULONG32 FileAttributes;
/*0x034*/ UINT8 _PADDING0_[0x4];
} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
struct _FILE_OBJECT
Referred from:
typedef struct _FILE_OBJECT { // 30 elements, 0xD8 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ struct _VPB* Vpb;
/*0x018*/ VOID* FsContext;
/*0x020*/ VOID* FsContext2;
/*0x028*/ struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;
/*0x030*/ VOID* PrivateCacheMap;
/*0x038*/ LONG32 FinalStatus;
/*0x03C*/ UINT8 _PADDING1_[0x4];
/*0x040*/ struct _FILE_OBJECT* RelatedFileObject;
/*0x048*/ UINT8 LockOperation;
/*0x049*/ UINT8 DeletePending;
/*0x04A*/ UINT8 ReadAccess;
/*0x04B*/ UINT8 WriteAccess;
/*0x04C*/ UINT8 DeleteAccess;
/*0x04D*/ UINT8 SharedRead;
/*0x04E*/ UINT8 SharedWrite;
/*0x04F*/ UINT8 SharedDelete;
/*0x050*/ ULONG32 Flags;
/*0x054*/ UINT8 _PADDING2_[0x4];
/*0x058*/ struct _UNICODE_STRING FileName; // 3 elements, 0x10 bytes (sizeof)
/*0x068*/ union _LARGE_INTEGER CurrentByteOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x070*/ ULONG32 Waiters;
/*0x074*/ ULONG32 Busy;
/*0x078*/ VOID* LastLock;
/*0x080*/ struct _KEVENT Lock; // 1 elements, 0x18 bytes (sizeof)
/*0x098*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
/*0x0B0*/ struct _IO_COMPLETION_CONTEXT* CompletionContext;
/*0x0B8*/ UINT64 IrpListLock;
/*0x0C0*/ struct _LIST_ENTRY IrpList; // 2 elements, 0x10 bytes (sizeof)
/*0x0D0*/ VOID* FileObjectExtension;
} FILE_OBJECT, *PFILE_OBJECT;
typedef struct _FILE_STANDARD_INFORMATION { // 5 elements, 0x18 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER AllocationSize; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ union _LARGE_INTEGER EndOfFile; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ ULONG32 NumberOfLinks;
/*0x014*/ UINT8 DeletePending;
/*0x015*/ UINT8 Directory;
/*0x016*/ UINT8 _PADDING0_[0x2];
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
Referred from:
typedef struct _FIRMWARE_INFORMATION_LOADER_BLOCK { // 3 elements, 0x20 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 FirmwareTypeEfi : 1; // 0 BitPosition
/*0x000*/ ULONG32 Reserved : 31; // 1 BitPosition
};
union { // 2 elements, 0x18 bytes (sizeof)
/*0x008*/ struct _EFI_FIRMWARE_INFORMATION EfiInformation; // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ struct _PCAT_FIRMWARE_INFORMATION PcatInformation; // 1 elements, 0x4 bytes (sizeof)
} u;
} FIRMWARE_INFORMATION_LOADER_BLOCK, *PFIRMWARE_INFORMATION_LOADER_BLOCK;
struct _FLS_CALLBACK_INFO
Referred from:
typedef struct _FLS_CALLBACK_INFO { // 0 elements, 0x0 bytes (sizeof)
} FLS_CALLBACK_INFO, *PFLS_CALLBACK_INFO;
struct _FREE_DISPLAY
Referred from:
typedef struct _FREE_DISPLAY { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 RealVectorSize;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _RTL_BITMAP Display; // 2 elements, 0x10 bytes (sizeof)
} FREE_DISPLAY, *PFREE_DISPLAY;
struct _FS_FILTER_CALLBACKS
Referred from:
typedef struct _FS_FILTER_CALLBACKS { // 14 elements, 0x68 bytes (sizeof)
/*0x000*/ ULONG32 SizeOfFsFilterCallbacks;
/*0x004*/ ULONG32 Reserved;
/*0x008*/ PVOID PreAcquireForSectionSynchronization;
/*0x010*/ PVOID PostAcquireForSectionSynchronization;
/*0x018*/ PVOID PreReleaseForSectionSynchronization;
/*0x020*/ PVOID PostReleaseForSectionSynchronization;
/*0x028*/ PVOID PreAcquireForCcFlush;
/*0x030*/ PVOID PostAcquireForCcFlush;
/*0x038*/ PVOID PreReleaseForCcFlush;
/*0x040*/ PVOID PostReleaseForCcFlush;
/*0x048*/ PVOID PreAcquireForModifiedPageWriter;
/*0x050*/ PVOID PostAcquireForModifiedPageWriter;
/*0x058*/ PVOID PreReleaseForModifiedPageWriter;
/*0x060*/ PVOID PostReleaseForModifiedPageWriter;
} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
struct _FS_FILTER_CALLBACK_DATA
typedef struct _FS_FILTER_CALLBACK_DATA { // 6 elements, 0x40 bytes (sizeof)
/*0x000*/ ULONG32 SizeOfFsFilterCallbackData;
/*0x004*/ UINT8 Operation;
/*0x005*/ UINT8 Reserved;
/*0x006*/ UINT8 _PADDING0_[0x2];
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ struct _FILE_OBJECT* FileObject;
/*0x018*/ union _FS_FILTER_PARAMETERS Parameters; // 5 elements, 0x28 bytes (sizeof)
} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
struct _GDI_TEB_BATCH
Referred from:
typedef struct _GDI_TEB_BATCH { // 3 elements, 0x4E8 bytes (sizeof)
/*0x000*/ ULONG32 Offset;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 HDC;
/*0x010*/ ULONG32 Buffer[310];
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;
struct _GDI_TEB_BATCH32
Referred from:
typedef struct _GDI_TEB_BATCH32 { // 3 elements, 0x4E0 bytes (sizeof)
/*0x000*/ ULONG32 Offset;
/*0x004*/ ULONG32 HDC;
/*0x008*/ ULONG32 Buffer[310];
} GDI_TEB_BATCH32, *PGDI_TEB_BATCH32;
struct _GDI_TEB_BATCH64
Referred from:
typedef struct _GDI_TEB_BATCH64 { // 3 elements, 0x4E8 bytes (sizeof)
/*0x000*/ ULONG32 Offset;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 HDC;
/*0x010*/ ULONG32 Buffer[310];
} GDI_TEB_BATCH64, *PGDI_TEB_BATCH64;
struct _GENERAL_LOOKASIDE
Referred from:
typedef struct _GENERAL_LOOKASIDE { // 22 elements, 0x80 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ union _SLIST_HEADER ListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY SingleListHead; // 1 elements, 0x8 bytes (sizeof)
};
/*0x010*/ UINT16 Depth;
/*0x012*/ UINT16 MaximumDepth;
/*0x014*/ ULONG32 TotalAllocates;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x018*/ ULONG32 AllocateMisses;
/*0x018*/ ULONG32 AllocateHits;
};
/*0x01C*/ ULONG32 TotalFrees;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x020*/ ULONG32 FreeMisses;
/*0x020*/ ULONG32 FreeHits;
};
/*0x024*/ enum _POOL_TYPE Type;
/*0x028*/ ULONG32 Tag;
/*0x02C*/ ULONG32 Size;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x030*/ PVOID AllocateEx;
/*0x030*/ PVOID Allocate;
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ PVOID FreeEx;
/*0x038*/ PVOID Free;
};
/*0x040*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ ULONG32 LastTotalAllocates;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x054*/ ULONG32 LastAllocateMisses;
/*0x054*/ ULONG32 LastAllocateHits;
};
/*0x058*/ ULONG32 Future[2];
/*0x060*/ UINT8 _PADDING0_[0x20];
} GENERAL_LOOKASIDE, *PGENERAL_LOOKASIDE;
struct _GENERAL_LOOKASIDE_POOL
Referred from:
typedef struct _GENERAL_LOOKASIDE_POOL { // 22 elements, 0x60 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ union _SLIST_HEADER ListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY SingleListHead; // 1 elements, 0x8 bytes (sizeof)
};
/*0x010*/ UINT16 Depth;
/*0x012*/ UINT16 MaximumDepth;
/*0x014*/ ULONG32 TotalAllocates;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x018*/ ULONG32 AllocateMisses;
/*0x018*/ ULONG32 AllocateHits;
};
/*0x01C*/ ULONG32 TotalFrees;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x020*/ ULONG32 FreeMisses;
/*0x020*/ ULONG32 FreeHits;
};
/*0x024*/ enum _POOL_TYPE Type;
/*0x028*/ ULONG32 Tag;
/*0x02C*/ ULONG32 Size;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x030*/ PVOID AllocateEx;
/*0x030*/ PVOID Allocate;
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ PVOID FreeEx;
/*0x038*/ PVOID Free;
};
/*0x040*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ ULONG32 LastTotalAllocates;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x054*/ ULONG32 LastAllocateMisses;
/*0x054*/ ULONG32 LastAllocateHits;
};
/*0x058*/ ULONG32 Future[2];
} GENERAL_LOOKASIDE_POOL, *PGENERAL_LOOKASIDE_POOL;
struct _GENERIC_MAPPING
Referred from:
typedef struct _GENERIC_MAPPING {// 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 GenericRead;
/*0x004*/ ULONG32 GenericWrite;
/*0x008*/ ULONG32 GenericExecute;
/*0x00C*/ ULONG32 GenericAll;
} GENERIC_MAPPING, *PGENERIC_MAPPING;
struct _GUID
Referred from:
typedef struct _GUID { // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Data1;
/*0x004*/ UINT16 Data2;
/*0x006*/ UINT16 Data3;
/*0x008*/ UINT8 Data4[8];
} GUID, *PGUID;
struct _HANDLE_TABLE
Referred from:
typedef struct _HANDLE_TABLE { // 14 elements, 0x60 bytes (sizeof)
/*0x000*/ UINT64 TableCode;
/*0x008*/ struct _EPROCESS* QuotaProcess;
/*0x010*/ VOID* UniqueProcessId;
/*0x018*/ struct _EX_PUSH_LOCK HandleLock; // 7 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY HandleTableList; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _EX_PUSH_LOCK HandleContentionEvent; // 7 elements, 0x8 bytes (sizeof)
/*0x038*/ struct _HANDLE_TRACE_DEBUG_INFO* DebugInfo;
/*0x040*/ LONG32 ExtraInfoPages;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x044*/ ULONG32 Flags;
/*0x044*/ UINT8 StrictFIFO : 1; // 0 BitPosition
};
/*0x048*/ LONG32 FirstFreeHandle;
/*0x04C*/ UINT8 _PADDING0_[0x4];
/*0x050*/ struct _HANDLE_TABLE_ENTRY* LastFreeHandleEntry;
/*0x058*/ LONG32 HandleCount;
/*0x05C*/ ULONG32 NextHandleNeedingPool;
} HANDLE_TABLE, *PHANDLE_TABLE;
struct _HANDLE_TABLE_ENTRY
Referred from:
typedef struct _HANDLE_TABLE_ENTRY { // 8 elements, 0x10 bytes (sizeof)
union { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ VOID* Object;
/*0x000*/ ULONG32 ObAttributes;
/*0x000*/ struct _HANDLE_TABLE_ENTRY_INFO* InfoTable;
/*0x000*/ UINT64 Value;
};
union { // 3 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 GrantedAccess;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT16 GrantedAccessIndex;
/*0x00A*/ UINT16 CreatorBackTraceIndex;
/*0x00C*/ UINT8 _PADDING0_[0x4];
};
/*0x008*/ LONG32 NextFreeTableEntry;
};
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
struct _HANDLE_TABLE_ENTRY_INFO
Referred from:
typedef struct _HANDLE_TABLE_ENTRY_INFO { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 AuditMask;
} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;
struct _HANDLE_TRACE_DB_ENTRY
Referred from:
typedef struct _HANDLE_TRACE_DB_ENTRY { // 4 elements, 0xA0 bytes (sizeof)
/*0x000*/ struct _CLIENT_ID ClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* Handle;
/*0x018*/ ULONG32 Type;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ VOID* StackTrace[16];
} HANDLE_TRACE_DB_ENTRY, *PHANDLE_TRACE_DB_ENTRY;
struct _HANDLE_TRACE_DEBUG_INFO
Referred from:
typedef struct _HANDLE_TRACE_DEBUG_INFO { // 6 elements, 0xF0 bytes (sizeof)
/*0x000*/ LONG32 RefCount;
/*0x004*/ ULONG32 TableSize;
/*0x008*/ ULONG32 BitMaskFlags;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _FAST_MUTEX CloseCompactionLock; // 5 elements, 0x38 bytes (sizeof)
/*0x048*/ ULONG32 CurrentStackIndex;
/*0x04C*/ UINT8 _PADDING1_[0x4];
/*0x050*/ struct _HANDLE_TRACE_DB_ENTRY TraceDb[1];
} HANDLE_TRACE_DEBUG_INFO, *PHANDLE_TRACE_DEBUG_INFO;
struct _HARDWARE_PTE
Referred from:
typedef struct _HARDWARE_PTE { // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Write : 1; // 1 BitPosition
/*0x000*/ UINT64 Owner : 1; // 2 BitPosition
/*0x000*/ UINT64 WriteThrough : 1; // 3 BitPosition
/*0x000*/ UINT64 CacheDisable : 1; // 4 BitPosition
/*0x000*/ UINT64 Accessed : 1; // 5 BitPosition
/*0x000*/ UINT64 Dirty : 1; // 6 BitPosition
/*0x000*/ UINT64 LargePage : 1; // 7 BitPosition
/*0x000*/ UINT64 Global : 1; // 8 BitPosition
/*0x000*/ UINT64 CopyOnWrite : 1; // 9 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 reserved0 : 1; // 11 BitPosition
/*0x000*/ UINT64 PageFrameNumber : 28; // 12 BitPosition
/*0x000*/ UINT64 reserved1 : 12; // 40 BitPosition
/*0x000*/ UINT64 SoftwareWsIndex : 11; // 52 BitPosition
/*0x000*/ UINT64 NoExecute : 1; // 63 BitPosition
} HARDWARE_PTE, *PHARDWARE_PTE;
struct _HBASE_BLOCK
Referred from:
typedef struct _HBASE_BLOCK { // 25 elements, 0x1000 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ ULONG32 Sequence1;
/*0x008*/ ULONG32 Sequence2;
/*0x00C*/ union _LARGE_INTEGER TimeStamp; // 4 elements, 0x8 bytes (sizeof)
/*0x014*/ ULONG32 Major;
/*0x018*/ ULONG32 Minor;
/*0x01C*/ ULONG32 Type;
/*0x020*/ ULONG32 Format;
/*0x024*/ ULONG32 RootCell;
/*0x028*/ ULONG32 Length;
/*0x02C*/ ULONG32 Cluster;
/*0x030*/ UINT8 FileName[64];
/*0x070*/ struct _GUID RmId; // 4 elements, 0x10 bytes (sizeof)
/*0x080*/ struct _GUID LogId; // 4 elements, 0x10 bytes (sizeof)
/*0x090*/ ULONG32 Flags;
/*0x094*/ struct _GUID TmId; // 4 elements, 0x10 bytes (sizeof)
/*0x0A4*/ ULONG32 GuidSignature;
/*0x0A8*/ ULONG32 Reserved1[85];
/*0x1FC*/ ULONG32 CheckSum;
/*0x200*/ ULONG32 Reserved2[882];
/*0xFC8*/ struct _GUID ThawTmId; // 4 elements, 0x10 bytes (sizeof)
/*0xFD8*/ struct _GUID ThawRmId; // 4 elements, 0x10 bytes (sizeof)
/*0xFE8*/ struct _GUID ThawLogId; // 4 elements, 0x10 bytes (sizeof)
/*0xFF8*/ ULONG32 BootType;
/*0xFFC*/ ULONG32 BootRecover;
} HBASE_BLOCK, *PHBASE_BLOCK;
struct _HEADLESS_LOADER_BLOCK
Referred from:
typedef struct _HEADLESS_LOADER_BLOCK { // 17 elements, 0x40 bytes (sizeof)
/*0x000*/ UINT8 UsedBiosSettings;
/*0x001*/ UINT8 DataBits;
/*0x002*/ UINT8 StopBits;
/*0x003*/ UINT8 Parity;
/*0x004*/ ULONG32 BaudRate;
/*0x008*/ ULONG32 PortNumber;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT8* PortAddress;
/*0x018*/ UINT16 PciDeviceId;
/*0x01A*/ UINT16 PciVendorId;
/*0x01C*/ UINT8 PciBusNumber;
/*0x01D*/ UINT8 _PADDING1_[0x1];
/*0x01E*/ UINT16 PciBusSegment;
/*0x020*/ UINT8 PciSlotNumber;
/*0x021*/ UINT8 PciFunctionNumber;
/*0x022*/ UINT8 _PADDING2_[0x2];
/*0x024*/ ULONG32 PciFlags;
/*0x028*/ struct _GUID SystemGUID; // 4 elements, 0x10 bytes (sizeof)
/*0x038*/ UINT8 IsMMIODevice;
/*0x039*/ UINT8 TerminalType;
/*0x03A*/ UINT8 _PADDING3_[0x6];
} HEADLESS_LOADER_BLOCK, *PHEADLESS_LOADER_BLOCK;
struct _HEAP
Referred from:
typedef struct _HEAP { // 53 elements, 0x1F8 bytes (sizeof)
/*0x000*/ struct _HEAP_ENTRY Entry; // 22 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 SegmentSignature;
/*0x014*/ ULONG32 SegmentFlags;
/*0x018*/ struct _LIST_ENTRY SegmentListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _HEAP* Heap;
/*0x030*/ VOID* BaseAddress;
/*0x038*/ ULONG32 NumberOfPages;
/*0x03C*/ UINT8 _PADDING0_[0x4];
/*0x040*/ struct _HEAP_ENTRY* FirstEntry;
/*0x048*/ struct _HEAP_ENTRY* LastValidEntry;
/*0x050*/ ULONG32 NumberOfUnCommittedPages;
/*0x054*/ ULONG32 NumberOfUnCommittedRanges;
/*0x058*/ UINT16 SegmentAllocatorBackTraceIndex;
/*0x05A*/ UINT16 Reserved;
/*0x05C*/ UINT8 _PADDING1_[0x4];
/*0x060*/ struct _LIST_ENTRY UCRSegmentList; // 2 elements, 0x10 bytes (sizeof)
/*0x070*/ ULONG32 Flags;
/*0x074*/ ULONG32 ForceFlags;
/*0x078*/ ULONG32 CompatibilityFlags;
/*0x07C*/ ULONG32 EncodeFlagMask;
/*0x080*/ struct _HEAP_ENTRY Encoding; // 22 elements, 0x10 bytes (sizeof)
/*0x090*/ UINT64 PointerKey;
/*0x098*/ ULONG32 Interceptor;
/*0x09C*/ ULONG32 VirtualMemoryThreshold;
/*0x0A0*/ ULONG32 Signature;
/*0x0A4*/ UINT8 _PADDING2_[0x4];
/*0x0A8*/ UINT64 SegmentReserve;
/*0x0B0*/ UINT64 SegmentCommit;
/*0x0B8*/ UINT64 DeCommitFreeBlockThreshold;
/*0x0C0*/ UINT64 DeCommitTotalFreeThreshold;
/*0x0C8*/ UINT64 TotalFreeSize;
/*0x0D0*/ UINT64 MaximumAllocationSize;
/*0x0D8*/ UINT16 ProcessHeapsListIndex;
/*0x0DA*/ UINT16 HeaderValidateLength;
/*0x0DC*/ UINT8 _PADDING3_[0x4];
/*0x0E0*/ VOID* HeaderValidateCopy;
/*0x0E8*/ UINT16 NextAvailableTagIndex;
/*0x0EA*/ UINT16 MaximumTagIndex;
/*0x0EC*/ UINT8 _PADDING4_[0x4];
/*0x0F0*/ struct _HEAP_TAG_ENTRY* TagEntries;
/*0x0F8*/ struct _LIST_ENTRY UCRList; // 2 elements, 0x10 bytes (sizeof)
/*0x108*/ UINT64 AlignRound;
/*0x110*/ UINT64 AlignMask;
/*0x118*/ struct _LIST_ENTRY VirtualAllocdBlocks; // 2 elements, 0x10 bytes (sizeof)
/*0x128*/ struct _LIST_ENTRY SegmentList; // 2 elements, 0x10 bytes (sizeof)
/*0x138*/ UINT16 AllocatorBackTraceIndex;
/*0x13A*/ UINT8 _PADDING5_[0x2];
/*0x13C*/ ULONG32 NonDedicatedListLength;
/*0x140*/ VOID* BlocksIndex;
/*0x148*/ VOID* UCRIndex;
/*0x150*/ struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
/*0x158*/ struct _LIST_ENTRY FreeLists; // 2 elements, 0x10 bytes (sizeof)
/*0x168*/ struct _HEAP_LOCK* LockVariable;
/*0x170*/ PVOID CommitRoutine;
/*0x178*/ VOID* FrontEndHeap;
/*0x180*/ UINT16 FrontHeapLockCount;
/*0x182*/ UINT8 FrontEndHeapType;
/*0x183*/ UINT8 _PADDING6_[0x5];
/*0x188*/ struct _HEAP_COUNTERS Counters; // 18 elements, 0x60 bytes (sizeof)
/*0x1E8*/ struct _HEAP_TUNING_PARAMETERS TuningParameters; // 2 elements, 0x10 bytes (sizeof)
} HEAP, *PHEAP;
struct _HEAP_COUNTERS
Referred from:
typedef struct _HEAP_COUNTERS { // 18 elements, 0x60 bytes (sizeof)
/*0x000*/ UINT64 TotalMemoryReserved;
/*0x008*/ UINT64 TotalMemoryCommitted;
/*0x010*/ UINT64 TotalMemoryLargeUCR;
/*0x018*/ UINT64 TotalSizeInVirtualBlocks;
/*0x020*/ ULONG32 TotalSegments;
/*0x024*/ ULONG32 TotalUCRs;
/*0x028*/ ULONG32 CommittOps;
/*0x02C*/ ULONG32 DeCommitOps;
/*0x030*/ ULONG32 LockAcquires;
/*0x034*/ ULONG32 LockCollisions;
/*0x038*/ ULONG32 CommitRate;
/*0x03C*/ ULONG32 DecommittRate;
/*0x040*/ ULONG32 CommitFailures;
/*0x044*/ ULONG32 InBlockCommitFailures;
/*0x048*/ ULONG32 CompactHeapCalls;
/*0x04C*/ ULONG32 CompactedUCRs;
/*0x050*/ ULONG32 InBlockDeccommits;
/*0x054*/ UINT8 _PADDING0_[0x4];
/*0x058*/ UINT64 InBlockDeccomitSize;
} HEAP_COUNTERS, *PHEAP_COUNTERS;
typedef struct _HEAP_DEBUGGING_INFORMATION { // 7 elements, 0x30 bytes (sizeof)
/*0x000*/ VOID* InterceptorFunction;
/*0x008*/ UINT16 InterceptorValue;
/*0x00A*/ UINT8 _PADDING0_[0x2];
/*0x00C*/ ULONG32 ExtendedOptions;
/*0x010*/ ULONG32 StackTraceDepth;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ UINT64 MinTotalBlockSize;
/*0x020*/ UINT64 MaxTotalBlockSize;
/*0x028*/ PVOID HeapLeakEnumerationRoutine;
} HEAP_DEBUGGING_INFORMATION, *PHEAP_DEBUGGING_INFORMATION;
struct _HEAP_ENTRY
Referred from:
typedef struct _HEAP_ENTRY { // 22 elements, 0x10 bytes (sizeof)
union { // 3 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* PreviousBlockPrivateData;
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 6 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT16 Size;
/*0x00A*/ UINT8 Flags;
/*0x00B*/ UINT8 SmallTagIndex;
/*0x00C*/ UINT16 PreviousSize;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x00E*/ UINT8 SegmentOffset;
/*0x00E*/ UINT8 LFHFlags;
};
/*0x00F*/ UINT8 UnusedBytes;
};
/*0x008*/ UINT64 CompactHeader;
};
};
struct { // 5 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Reserved;
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x008*/ UINT16 FunctionIndex;
/*0x00A*/ UINT16 ContextValue;
};
/*0x008*/ ULONG32 InterceptorValue;
};
/*0x00C*/ UINT16 UnusedBytesLength;
/*0x00E*/ UINT8 EntryOffset;
/*0x00F*/ UINT8 ExtendedBlockSignature;
};
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* ReservedForAlignment;
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 Code1;
/*0x00C*/ UINT16 Code2;
/*0x00E*/ UINT8 Code3;
/*0x00F*/ UINT8 Code4;
};
/*0x008*/ UINT64 AgregateCode;
};
};
};
} HEAP_ENTRY, *PHEAP_ENTRY;
Referred from:
typedef struct _HEAP_ENTRY_EXTRA { // 5 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 AllocatorBackTraceIndex;
/*0x002*/ UINT16 TagIndex;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 Settable;
};
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 ZeroInit;
/*0x008*/ UINT64 ZeroInit1;
};
};
} HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA;
struct _HEAP_FREE_ENTRY
typedef struct _HEAP_FREE_ENTRY { // 23 elements, 0x20 bytes (sizeof)
union { // 3 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* PreviousBlockPrivateData;
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 6 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT16 Size;
/*0x00A*/ UINT8 Flags;
/*0x00B*/ UINT8 SmallTagIndex;
/*0x00C*/ UINT16 PreviousSize;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x00E*/ UINT8 SegmentOffset;
/*0x00E*/ UINT8 LFHFlags;
};
/*0x00F*/ UINT8 UnusedBytes;
};
/*0x008*/ UINT64 CompactHeader;
};
};
struct { // 5 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Reserved;
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x008*/ UINT16 FunctionIndex;
/*0x00A*/ UINT16 ContextValue;
};
/*0x008*/ ULONG32 InterceptorValue;
};
/*0x00C*/ UINT16 UnusedBytesLength;
/*0x00E*/ UINT8 EntryOffset;
/*0x00F*/ UINT8 ExtendedBlockSignature;
};
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* ReservedForAlignment;
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 Code1;
/*0x00C*/ UINT16 Code2;
/*0x00E*/ UINT8 Code3;
/*0x00F*/ UINT8 Code4;
};
/*0x008*/ UINT64 AgregateCode;
};
};
};
/*0x010*/ struct _LIST_ENTRY FreeList; // 2 elements, 0x10 bytes (sizeof)
} HEAP_FREE_ENTRY, *PHEAP_FREE_ENTRY;
typedef struct _HEAP_FREE_ENTRY_EXTRA { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT16 TagIndex;
/*0x002*/ UINT16 FreeBackTraceIndex;
} HEAP_FREE_ENTRY_EXTRA, *PHEAP_FREE_ENTRY_EXTRA;
struct _HEAP_LIST_LOOKUP
Referred from:
typedef struct _HEAP_LIST_LOOKUP { // 9 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _HEAP_LIST_LOOKUP* ExtendedLookup;
/*0x008*/ ULONG32 ArraySize;
/*0x00C*/ ULONG32 ExtraItem;
/*0x010*/ ULONG32 ItemCount;
/*0x014*/ ULONG32 OutOfRangeItems;
/*0x018*/ ULONG32 BaseIndex;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ struct _LIST_ENTRY* ListHead;
/*0x028*/ ULONG32* ListsInUseUlong;
/*0x030*/ struct _LIST_ENTRY** ListHints;
} HEAP_LIST_LOOKUP, *PHEAP_LIST_LOOKUP;
struct _HEAP_LOCAL_SEGMENT_INFO
Referred from:
typedef struct _HEAP_LOCAL_SEGMENT_INFO { // 0 elements, 0x0 bytes (sizeof)
} HEAP_LOCAL_SEGMENT_INFO, *PHEAP_LOCAL_SEGMENT_INFO;
struct _HEAP_LOCK
Referred from:
typedef struct _HEAP_LOCK { // 1 elements, 0x28 bytes (sizeof)
union { // 1 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _RTL_CRITICAL_SECTION CriticalSection; // 6 elements, 0x28 bytes (sizeof)
} Lock;
} HEAP_LOCK, *PHEAP_LOCK;
struct _HEAP_LOOKASIDE
typedef struct _HEAP_LOOKASIDE { // 10 elements, 0x40 bytes (sizeof)
/*0x000*/ union _SLIST_HEADER ListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT16 Depth;
/*0x012*/ UINT16 MaximumDepth;
/*0x014*/ ULONG32 TotalAllocates;
/*0x018*/ ULONG32 AllocateMisses;
/*0x01C*/ ULONG32 TotalFrees;
/*0x020*/ ULONG32 FreeMisses;
/*0x024*/ ULONG32 LastTotalAllocates;
/*0x028*/ ULONG32 LastAllocateMisses;
/*0x02C*/ ULONG32 Counters[2];
/*0x034*/ UINT8 _PADDING0_[0xC];
} HEAP_LOOKASIDE, *PHEAP_LOOKASIDE;
struct _HEAP_PSEUDO_TAG_ENTRY
Referred from:
typedef struct _HEAP_PSEUDO_TAG_ENTRY { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Allocs;
/*0x004*/ ULONG32 Frees;
/*0x008*/ UINT64 Size;
} HEAP_PSEUDO_TAG_ENTRY, *PHEAP_PSEUDO_TAG_ENTRY;
struct _HEAP_SEGMENT
typedef struct _HEAP_SEGMENT { // 14 elements, 0x70 bytes (sizeof)
/*0x000*/ struct _HEAP_ENTRY Entry; // 22 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 SegmentSignature;
/*0x014*/ ULONG32 SegmentFlags;
/*0x018*/ struct _LIST_ENTRY SegmentListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _HEAP* Heap;
/*0x030*/ VOID* BaseAddress;
/*0x038*/ ULONG32 NumberOfPages;
/*0x03C*/ UINT8 _PADDING0_[0x4];
/*0x040*/ struct _HEAP_ENTRY* FirstEntry;
/*0x048*/ struct _HEAP_ENTRY* LastValidEntry;
/*0x050*/ ULONG32 NumberOfUnCommittedPages;
/*0x054*/ ULONG32 NumberOfUnCommittedRanges;
/*0x058*/ UINT16 SegmentAllocatorBackTraceIndex;
/*0x05A*/ UINT16 Reserved;
/*0x05C*/ UINT8 _PADDING1_[0x4];
/*0x060*/ struct _LIST_ENTRY UCRSegmentList; // 2 elements, 0x10 bytes (sizeof)
} HEAP_SEGMENT, *PHEAP_SEGMENT;
struct _HEAP_STOP_ON_TAG
Referred from:
typedef struct _HEAP_STOP_ON_TAG { // 3 elements, 0x4 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 HeapAndTagIndex;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT16 TagIndex;
/*0x002*/ UINT16 HeapIndex;
};
};
} HEAP_STOP_ON_TAG, *PHEAP_STOP_ON_TAG;
struct _HEAP_STOP_ON_VALUES
typedef struct _HEAP_STOP_ON_VALUES { // 6 elements, 0x30 bytes (sizeof)
/*0x000*/ UINT64 AllocAddress;
/*0x008*/ struct _HEAP_STOP_ON_TAG AllocTag; // 3 elements, 0x4 bytes (sizeof)
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 ReAllocAddress;
/*0x018*/ struct _HEAP_STOP_ON_TAG ReAllocTag; // 3 elements, 0x4 bytes (sizeof)
/*0x01C*/ UINT8 _PADDING1_[0x4];
/*0x020*/ UINT64 FreeAddress;
/*0x028*/ struct _HEAP_STOP_ON_TAG FreeTag; // 3 elements, 0x4 bytes (sizeof)
/*0x02C*/ UINT8 _PADDING2_[0x4];
} HEAP_STOP_ON_VALUES, *PHEAP_STOP_ON_VALUES;
struct _HEAP_SUBSEGMENT
Referred from:
typedef struct _HEAP_SUBSEGMENT { // 11 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _HEAP_LOCAL_SEGMENT_INFO* LocalInfo;
/*0x008*/ struct _HEAP_USERDATA_HEADER* UserBlocks;
/*0x010*/ struct _INTERLOCK_SEQ AggregateExchg; // 5 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 5 elements, 0x8 bytes (sizeof)
/*0x018*/ UINT16 BlockSize;
/*0x01A*/ UINT16 Flags;
/*0x01C*/ UINT16 BlockCount;
/*0x01E*/ UINT8 SizeIndex;
/*0x01F*/ UINT8 AffinityIndex;
};
/*0x018*/ ULONG32 Alignment[2];
};
/*0x020*/ struct _SINGLE_LIST_ENTRY SFreeListEntry; // 1 elements, 0x8 bytes (sizeof)
/*0x028*/ ULONG32 Lock;
/*0x02C*/ UINT8 _PADDING0_[0x4];
} HEAP_SUBSEGMENT, *PHEAP_SUBSEGMENT;
struct _HEAP_TAG_ENTRY
Referred from:
typedef struct _HEAP_TAG_ENTRY { // 6 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 Allocs;
/*0x004*/ ULONG32 Frees;
/*0x008*/ UINT64 Size;
/*0x010*/ UINT16 TagIndex;
/*0x012*/ UINT16 CreatorBackTraceIndex;
/*0x014*/ WCHAR TagName[24];
/*0x044*/ UINT8 _PADDING0_[0x4];
} HEAP_TAG_ENTRY, *PHEAP_TAG_ENTRY;
struct _HEAP_TUNING_PARAMETERS
Referred from:
typedef struct _HEAP_TUNING_PARAMETERS { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 CommittThresholdShift;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 MaxPreCommittThreshold;
} HEAP_TUNING_PARAMETERS, *PHEAP_TUNING_PARAMETERS;
struct _HEAP_UCR_DESCRIPTOR
typedef struct _HEAP_UCR_DESCRIPTOR {// 4 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY SegmentEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ VOID* Address;
/*0x028*/ UINT64 Size;
} HEAP_UCR_DESCRIPTOR, *PHEAP_UCR_DESCRIPTOR;
Referred from:
typedef struct _HEAP_USERDATA_HEADER { // 5 elements, 0x20 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY SFreeListEntry; // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _HEAP_SUBSEGMENT* SubSegment;
};
/*0x008*/ VOID* Reserved;
/*0x010*/ UINT64 SizeIndex;
/*0x018*/ UINT64 Signature;
} HEAP_USERDATA_HEADER, *PHEAP_USERDATA_HEADER;
struct _HEAP_VIRTUAL_ALLOC_ENTRY
typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY { // 5 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Entry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _HEAP_ENTRY_EXTRA ExtraStuff; // 5 elements, 0x10 bytes (sizeof)
/*0x020*/ UINT64 CommitSize;
/*0x028*/ UINT64 ReserveSize;
/*0x030*/ struct _HEAP_ENTRY BusyBlock; // 22 elements, 0x10 bytes (sizeof)
} HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY;
struct _HHIVE
Referred from:
typedef struct _HHIVE { // 29 elements, 0x590 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ PVOID GetCellRoutine;
/*0x010*/ PVOID ReleaseCellRoutine;
/*0x018*/ PVOID Allocate;
/*0x020*/ PVOID Free;
/*0x028*/ PVOID FileSetSize;
/*0x030*/ PVOID FileWrite;
/*0x038*/ PVOID FileRead;
/*0x040*/ PVOID FileFlush;
/*0x048*/ struct _HBASE_BLOCK* BaseBlock;
/*0x050*/ struct _RTL_BITMAP DirtyVector; // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ ULONG32 DirtyCount;
/*0x064*/ ULONG32 DirtyAlloc;
/*0x068*/ ULONG32 BaseBlockAlloc;
/*0x06C*/ ULONG32 Cluster;
/*0x070*/ UINT8 Flat;
/*0x071*/ UINT8 ReadOnly;
/*0x072*/ UINT8 DirtyFlag;
/*0x073*/ UINT8 _PADDING1_[0x1];
/*0x074*/ ULONG32 HvBinHeadersUse;
/*0x078*/ ULONG32 HvFreeCellsUse;
/*0x07C*/ ULONG32 HvUsedCellsUse;
/*0x080*/ ULONG32 CmUsedCellsUse;
/*0x084*/ ULONG32 HiveFlags;
/*0x088*/ ULONG32 CurrentLog;
/*0x08C*/ ULONG32 LogSize[2];
/*0x094*/ ULONG32 RefreshCount;
/*0x098*/ ULONG32 StorageTypeCount;
/*0x09C*/ ULONG32 Version;
/*0x0A0*/ struct _DUAL Storage[2];
} HHIVE, *PHHIVE;
struct _HIVE_LIST_ENTRY
typedef struct _HIVE_LIST_ENTRY { // 11 elements, 0x38 bytes (sizeof)
/*0x000*/ UINT16* FileName;
/*0x008*/ UINT16* BaseName;
/*0x010*/ UINT16* RegRootName;
/*0x018*/ struct _CMHIVE* CmHive;
/*0x020*/ ULONG32 HHiveFlags;
/*0x024*/ ULONG32 CmHiveFlags;
/*0x028*/ struct _CMHIVE* CmHive2;
/*0x030*/ UINT8 ThreadFinished;
/*0x031*/ UINT8 ThreadStarted;
/*0x032*/ UINT8 Allocate;
/*0x033*/ UINT8 WinPERequired;
/*0x034*/ UINT8 _PADDING0_[0x4];
} HIVE_LIST_ENTRY, *PHIVE_LIST_ENTRY;
struct _HMAP_DIRECTORY
Referred from:
typedef struct _HMAP_DIRECTORY { // 1 elements, 0x2000 bytes (sizeof)
/*0x000*/ struct _HMAP_TABLE* Directory[1024];
} HMAP_DIRECTORY, *PHMAP_DIRECTORY;
struct _HMAP_ENTRY
Referred from:
typedef struct _HMAP_ENTRY { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 BlockAddress;
/*0x008*/ UINT64 BinAddress;
/*0x010*/ struct _CM_VIEW_OF_FILE* CmView;
/*0x018*/ ULONG32 MemAlloc;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} HMAP_ENTRY, *PHMAP_ENTRY;
struct _HMAP_TABLE
Referred from:
typedef struct _HMAP_TABLE { // 1 elements, 0x4000 bytes (sizeof)
/*0x000*/ struct _HMAP_ENTRY Table[512];
} HMAP_TABLE, *PHMAP_TABLE;
struct _I386_LOADER_BLOCK
Referred from:
typedef struct _I386_LOADER_BLOCK { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* CommonDataArea;
/*0x008*/ ULONG32 MachineType;
/*0x00C*/ ULONG32 VirtualBias;
} I386_LOADER_BLOCK, *PI386_LOADER_BLOCK;
struct _IA64_DBGKD_CONTROL_SET
Referred from:
typedef struct _IA64_DBGKD_CONTROL_SET { // 3 elements, 0x14 bytes (sizeof)
/*0x000*/ ULONG32 Continue;
/*0x004*/ UINT64 CurrentSymbolStart;
/*0x00C*/ UINT64 CurrentSymbolEnd;
} IA64_DBGKD_CONTROL_SET, *PIA64_DBGKD_CONTROL_SET;
struct _IA64_LOADER_BLOCK
Referred from:
typedef struct _IA64_LOADER_BLOCK { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 PlaceHolder;
} IA64_LOADER_BLOCK, *PIA64_LOADER_BLOCK;
struct _IMAGE_DATA_DIRECTORY
Referred from:
typedef struct _IMAGE_DATA_DIRECTORY { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 VirtualAddress;
/*0x004*/ ULONG32 Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
struct _IMAGE_DEBUG_DIRECTORY
typedef struct _IMAGE_DEBUG_DIRECTORY { // 8 elements, 0x1C bytes (sizeof)
/*0x000*/ ULONG32 Characteristics;
/*0x004*/ ULONG32 TimeDateStamp;
/*0x008*/ UINT16 MajorVersion;
/*0x00A*/ UINT16 MinorVersion;
/*0x00C*/ ULONG32 Type;
/*0x010*/ ULONG32 SizeOfData;
/*0x014*/ ULONG32 AddressOfRawData;
/*0x018*/ ULONG32 PointerToRawData;
} IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY;
typedef struct _IMAGE_DOS_HEADER { // 19 elements, 0x40 bytes (sizeof)
/*0x000*/ UINT16 e_magic;
/*0x002*/ UINT16 e_cblp;
/*0x004*/ UINT16 e_cp;
/*0x006*/ UINT16 e_crlc;
/*0x008*/ UINT16 e_cparhdr;
/*0x00A*/ UINT16 e_minalloc;
/*0x00C*/ UINT16 e_maxalloc;
/*0x00E*/ UINT16 e_ss;
/*0x010*/ UINT16 e_sp;
/*0x012*/ UINT16 e_csum;
/*0x014*/ UINT16 e_ip;
/*0x016*/ UINT16 e_cs;
/*0x018*/ UINT16 e_lfarlc;
/*0x01A*/ UINT16 e_ovno;
/*0x01C*/ UINT16 e_res[4];
/*0x024*/ UINT16 e_oemid;
/*0x026*/ UINT16 e_oeminfo;
/*0x028*/ UINT16 e_res2[10];
/*0x03C*/ LONG32 e_lfanew;
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
Referred from:
typedef struct _IMAGE_FILE_HEADER { // 7 elements, 0x14 bytes (sizeof)
/*0x000*/ UINT16 Machine;
/*0x002*/ UINT16 NumberOfSections;
/*0x004*/ ULONG32 TimeDateStamp;
/*0x008*/ ULONG32 PointerToSymbolTable;
/*0x00C*/ ULONG32 NumberOfSymbols;
/*0x010*/ UINT16 SizeOfOptionalHeader;
/*0x012*/ UINT16 Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
typedef struct _IMAGE_NT_HEADERS64 { // 3 elements, 0x108 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ struct _IMAGE_FILE_HEADER FileHeader; // 7 elements, 0x14 bytes (sizeof)
/*0x018*/ struct _IMAGE_OPTIONAL_HEADER64 OptionalHeader; // 30 elements, 0xF0 bytes (sizeof)
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
Referred from:
typedef struct _IMAGE_OPTIONAL_HEADER64 { // 30 elements, 0xF0 bytes (sizeof)
/*0x000*/ UINT16 Magic;
/*0x002*/ UINT8 MajorLinkerVersion;
/*0x003*/ UINT8 MinorLinkerVersion;
/*0x004*/ ULONG32 SizeOfCode;
/*0x008*/ ULONG32 SizeOfInitializedData;
/*0x00C*/ ULONG32 SizeOfUninitializedData;
/*0x010*/ ULONG32 AddressOfEntryPoint;
/*0x014*/ ULONG32 BaseOfCode;
/*0x018*/ UINT64 ImageBase;
/*0x020*/ ULONG32 SectionAlignment;
/*0x024*/ ULONG32 FileAlignment;
/*0x028*/ UINT16 MajorOperatingSystemVersion;
/*0x02A*/ UINT16 MinorOperatingSystemVersion;
/*0x02C*/ UINT16 MajorImageVersion;
/*0x02E*/ UINT16 MinorImageVersion;
/*0x030*/ UINT16 MajorSubsystemVersion;
/*0x032*/ UINT16 MinorSubsystemVersion;
/*0x034*/ ULONG32 Win32VersionValue;
/*0x038*/ ULONG32 SizeOfImage;
/*0x03C*/ ULONG32 SizeOfHeaders;
/*0x040*/ ULONG32 CheckSum;
/*0x044*/ UINT16 Subsystem;
/*0x046*/ UINT16 DllCharacteristics;
/*0x048*/ UINT64 SizeOfStackReserve;
/*0x050*/ UINT64 SizeOfStackCommit;
/*0x058*/ UINT64 SizeOfHeapReserve;
/*0x060*/ UINT64 SizeOfHeapCommit;
/*0x068*/ ULONG32 LoaderFlags;
/*0x06C*/ ULONG32 NumberOfRvaAndSizes;
/*0x070*/ struct _IMAGE_DATA_DIRECTORY DataDirectory[16];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
typedef struct _IMAGE_ROM_OPTIONAL_HEADER { // 13 elements, 0x38 bytes (sizeof)
/*0x000*/ UINT16 Magic;
/*0x002*/ UINT8 MajorLinkerVersion;
/*0x003*/ UINT8 MinorLinkerVersion;
/*0x004*/ ULONG32 SizeOfCode;
/*0x008*/ ULONG32 SizeOfInitializedData;
/*0x00C*/ ULONG32 SizeOfUninitializedData;
/*0x010*/ ULONG32 AddressOfEntryPoint;
/*0x014*/ ULONG32 BaseOfCode;
/*0x018*/ ULONG32 BaseOfData;
/*0x01C*/ ULONG32 BaseOfBss;
/*0x020*/ ULONG32 GprMask;
/*0x024*/ ULONG32 CprMask[4];
/*0x034*/ ULONG32 GpValue;
} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
typedef struct _IMAGE_SECTION_HEADER { // 10 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT8 Name[8];
union { // 2 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 PhysicalAddress;
/*0x008*/ ULONG32 VirtualSize;
} Misc;
/*0x00C*/ ULONG32 VirtualAddress;
/*0x010*/ ULONG32 SizeOfRawData;
/*0x014*/ ULONG32 PointerToRawData;
/*0x018*/ ULONG32 PointerToRelocations;
/*0x01C*/ ULONG32 PointerToLinenumbers;
/*0x020*/ UINT16 NumberOfRelocations;
/*0x022*/ UINT16 NumberOfLinenumbers;
/*0x024*/ ULONG32 Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
struct _IMAGE_SECURITY_CONTEXT
Referred from:
typedef struct _IMAGE_SECURITY_CONTEXT { // 6 elements, 0x8 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ VOID* PageHashes;
/*0x000*/ UINT64 Value;
struct { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 SecurityBeingCreated : 1; // 0 BitPosition
/*0x000*/ UINT64 SecurityMandatory : 1; // 1 BitPosition
/*0x000*/ UINT64 Unused : 1; // 2 BitPosition
/*0x000*/ UINT64 PageHashPointer : 61; // 3 BitPosition
};
};
} IMAGE_SECURITY_CONTEXT, *PIMAGE_SECURITY_CONTEXT;
struct _INITIAL_PRIVILEGE_SET
Referred from:
typedef struct _INITIAL_PRIVILEGE_SET { // 3 elements, 0x2C bytes (sizeof)
/*0x000*/ ULONG32 PrivilegeCount;
/*0x004*/ ULONG32 Control;
/*0x008*/ struct _LUID_AND_ATTRIBUTES Privilege[3];
} INITIAL_PRIVILEGE_SET, *PINITIAL_PRIVILEGE_SET;
struct _INTERFACE
Referred from:
typedef struct _INTERFACE { // 5 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT16 Size;
/*0x002*/ UINT16 Version;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* Context;
/*0x010*/ PVOID InterfaceReference;
/*0x018*/ PVOID InterfaceDereference;
} INTERFACE, *PINTERFACE;
struct _INTERLOCK_SEQ
Referred from:
typedef struct _INTERLOCK_SEQ { // 5 elements, 0x8 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT16 Depth;
/*0x002*/ UINT16 FreeEntryOffset;
/*0x004*/ UINT8 _PADDING0_[0x4];
};
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 OffsetAndDepth;
/*0x004*/ ULONG32 Sequence;
};
/*0x000*/ INT64 Exchg;
};
} INTERLOCK_SEQ, *PINTERLOCK_SEQ;
struct _IOV_FORCED_PENDING_TRACE
typedef struct _IOV_FORCED_PENDING_TRACE { // 2 elements, 0x200 bytes (sizeof)
/*0x000*/ struct _IRP* Irp;
/*0x008*/ VOID* StackTrace[63];
} IOV_FORCED_PENDING_TRACE, *PIOV_FORCED_PENDING_TRACE;
struct _IO_CLIENT_EXTENSION
Referred from:
typedef struct _IO_CLIENT_EXTENSION { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _IO_CLIENT_EXTENSION* NextExtension;
/*0x008*/ VOID* ClientIdentificationAddress;
} IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
struct _IO_COMPLETION_CONTEXT
Referred from:
typedef struct _IO_COMPLETION_CONTEXT { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Port;
/*0x008*/ VOID* Key;
} IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
struct _IO_DRIVER_CREATE_CONTEXT
typedef struct _IO_DRIVER_CREATE_CONTEXT { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ INT16 Size;
/*0x002*/ UINT8 _PADDING0_[0x6];
/*0x008*/ struct _ECP_LIST* ExtraCreateParameter;
/*0x010*/ VOID* DeviceObjectHint;
/*0x018*/ struct _TXN_PARAMETER_BLOCK* TxnParameters;
} IO_DRIVER_CREATE_CONTEXT, *PIO_DRIVER_CREATE_CONTEXT;
struct _IO_PRIORITY_INFO
typedef struct _IO_PRIORITY_INFO { // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Size;
/*0x004*/ ULONG32 ThreadPriority;
/*0x008*/ ULONG32 PagePriority;
/*0x00C*/ enum _IO_PRIORITY_HINT IoPriority;
} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
struct _IO_RESOURCE_DESCRIPTOR
Referred from:
typedef struct _IO_RESOURCE_DESCRIPTOR { // 7 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT8 Option;
/*0x001*/ UINT8 Type;
/*0x002*/ UINT8 ShareDisposition;
/*0x003*/ UINT8 Spare1;
/*0x004*/ UINT16 Flags;
/*0x006*/ UINT16 Spare2;
union { // 11 elements, 0x18 bytes (sizeof)
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ ULONG32 Alignment;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Port;
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ ULONG32 Alignment;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Memory;
struct { // 5 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 MinimumVector;
/*0x00C*/ ULONG32 MaximumVector;
/*0x010*/ enum _IRQ_DEVICE_POLICY AffinityPolicy;
/*0x014*/ enum _IRQ_PRIORITY PriorityPolicy;
/*0x018*/ UINT64 TargetedProcessors;
} Interrupt;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 MinimumChannel;
/*0x00C*/ ULONG32 MaximumChannel;
} Dma;
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ ULONG32 Alignment;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Generic;
struct { // 1 elements, 0xC bytes (sizeof)
/*0x008*/ ULONG32 Data[3];
} DevicePrivate;
struct { // 4 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ ULONG32 MinBusNumber;
/*0x010*/ ULONG32 MaxBusNumber;
/*0x014*/ ULONG32 Reserved;
} BusNumber;
struct { // 3 elements, 0xC bytes (sizeof)
/*0x008*/ ULONG32 Priority;
/*0x00C*/ ULONG32 Reserved1;
/*0x010*/ ULONG32 Reserved2;
} ConfigData;
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length40;
/*0x00C*/ ULONG32 Alignment40;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Memory40;
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length48;
/*0x00C*/ ULONG32 Alignment48;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Memory48;
struct { // 4 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length64;
/*0x00C*/ ULONG32 Alignment64;
/*0x010*/ union _LARGE_INTEGER MinimumAddress; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER MaximumAddress; // 4 elements, 0x8 bytes (sizeof)
} Memory64;
} u;
} IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
struct _IO_RESOURCE_LIST
Referred from:
typedef struct _IO_RESOURCE_LIST { // 4 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT16 Version;
/*0x002*/ UINT16 Revision;
/*0x004*/ ULONG32 Count;
/*0x008*/ struct _IO_RESOURCE_DESCRIPTOR Descriptors[1];
} IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
struct _IO_RESOURCE_REQUIREMENTS_LIST
Referred from:
typedef struct _IO_RESOURCE_REQUIREMENTS_LIST { // 7 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 ListSize;
/*0x004*/ enum _INTERFACE_TYPE InterfaceType;
/*0x008*/ ULONG32 BusNumber;
/*0x00C*/ ULONG32 SlotNumber;
/*0x010*/ ULONG32 Reserved[3];
/*0x01C*/ ULONG32 AlternativeLists;
/*0x020*/ struct _IO_RESOURCE_LIST List[1];
} IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
struct _IO_SECURITY_CONTEXT
Referred from:
typedef struct _IO_SECURITY_CONTEXT { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos;
/*0x008*/ struct _ACCESS_STATE* AccessState;
/*0x010*/ ULONG32 DesiredAccess;
/*0x014*/ ULONG32 FullCreateOptions;
} IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
struct _IO_STACK_LOCATION
Referred from:
typedef struct _IO_STACK_LOCATION { // 9 elements, 0x48 bytes (sizeof)
/*0x000*/ UINT8 MajorFunction;
/*0x001*/ UINT8 MinorFunction;
/*0x002*/ UINT8 Flags;
/*0x003*/ UINT8 Control;
/*0x004*/ UINT8 _PADDING0_[0x4];
union { // 38 elements, 0x20 bytes (sizeof)
struct { // 5 elements, 0x20 bytes (sizeof)
/*0x008*/ struct _IO_SECURITY_CONTEXT* SecurityContext;
/*0x010*/ ULONG32 Options;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ UINT16 FileAttributes;
/*0x01A*/ UINT16 ShareAccess;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ ULONG32 EaLength;
/*0x024*/ UINT8 _PADDING3_[0x4];
} Create;
struct { // 5 elements, 0x20 bytes (sizeof)
/*0x008*/ struct _IO_SECURITY_CONTEXT* SecurityContext;
/*0x010*/ ULONG32 Options;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ UINT16 Reserved;
/*0x01A*/ UINT16 ShareAccess;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters;
} CreatePipe;
struct { // 5 elements, 0x20 bytes (sizeof)
/*0x008*/ struct _IO_SECURITY_CONTEXT* SecurityContext;
/*0x010*/ ULONG32 Options;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ UINT16 Reserved;
/*0x01A*/ UINT16 ShareAccess;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ struct _MAILSLOT_CREATE_PARAMETERS* Parameters;
} CreateMailslot;
struct { // 3 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 Key;
/*0x014*/ UINT8 _PADDING2_[0x4];
/*0x018*/ union _LARGE_INTEGER ByteOffset; // 4 elements, 0x8 bytes (sizeof)
} Read;
struct { // 3 elements, 0x18 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 Key;
/*0x014*/ UINT8 _PADDING2_[0x4];
/*0x018*/ union _LARGE_INTEGER ByteOffset; // 4 elements, 0x8 bytes (sizeof)
} Write;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ struct _UNICODE_STRING* FileName;
/*0x018*/ enum _FILE_INFORMATION_CLASS FileInformationClass;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ ULONG32 FileIndex;
/*0x024*/ UINT8 _PADDING3_[0x4];
} QueryDirectory;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 CompletionFilter;
/*0x014*/ UINT8 _PADDING2_[0x4];
} NotifyDirectory;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ enum _FILE_INFORMATION_CLASS FileInformationClass;
/*0x014*/ UINT8 _PADDING2_[0x4];
} QueryFile;
struct { // 7 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ enum _FILE_INFORMATION_CLASS FileInformationClass;
/*0x014*/ UINT8 _PADDING2_[0x4];
/*0x018*/ struct _FILE_OBJECT* FileObject;
union { // 3 elements, 0x8 bytes (sizeof)
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ UINT8 ReplaceIfExists;
/*0x021*/ UINT8 AdvanceOnly;
/*0x022*/ UINT8 _PADDING3_[0x6];
};
/*0x020*/ ULONG32 ClusterCount;
/*0x020*/ VOID* DeleteHandle;
};
} SetFile;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ VOID* EaList;
/*0x018*/ ULONG32 EaListLength;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ ULONG32 EaIndex;
/*0x024*/ UINT8 _PADDING3_[0x4];
} QueryEa;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 Length;
} SetEa;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ enum _FSINFOCLASS FsInformationClass;
/*0x014*/ UINT8 _PADDING2_[0x4];
} QueryVolume;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ enum _FSINFOCLASS FsInformationClass;
/*0x014*/ UINT8 _PADDING2_[0x4];
} SetVolume;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 OutputBufferLength;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 InputBufferLength;
/*0x014*/ UINT8 _PADDING2_[0x4];
/*0x018*/ ULONG32 FsControlCode;
/*0x01C*/ UINT8 _PADDING3_[0x4];
/*0x020*/ VOID* Type3InputBuffer;
} FileSystemControl;
struct { // 3 elements, 0x18 bytes (sizeof)
/*0x008*/ union _LARGE_INTEGER* Length;
/*0x010*/ ULONG32 Key;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ union _LARGE_INTEGER ByteOffset; // 4 elements, 0x8 bytes (sizeof)
} LockControl;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 OutputBufferLength;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 InputBufferLength;
/*0x014*/ UINT8 _PADDING2_[0x4];
/*0x018*/ ULONG32 IoControlCode;
/*0x01C*/ UINT8 _PADDING3_[0x4];
/*0x020*/ VOID* Type3InputBuffer;
} DeviceIoControl;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 SecurityInformation;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 Length;
/*0x014*/ UINT8 _PADDING2_[0x4];
} QuerySecurity;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ ULONG32 SecurityInformation;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ VOID* SecurityDescriptor;
} SetSecurity;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ struct _VPB* Vpb;
/*0x010*/ struct _DEVICE_OBJECT* DeviceObject;
} MountVolume;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ struct _VPB* Vpb;
/*0x010*/ struct _DEVICE_OBJECT* DeviceObject;
} VerifyVolume;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _SCSI_REQUEST_BLOCK* Srb;
} Scsi;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 Length;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ VOID* StartSid;
/*0x018*/ struct _FILE_GET_QUOTA_INFORMATION* SidList;
/*0x020*/ ULONG32 SidListLength;
/*0x024*/ UINT8 _PADDING2_[0x4];
} QueryQuota;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 Length;
} SetQuota;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x008*/ enum _DEVICE_RELATION_TYPE Type;
} QueryDeviceRelations;
struct { // 5 elements, 0x20 bytes (sizeof)
/*0x008*/ struct _GUID* InterfaceType;
/*0x010*/ UINT16 Size;
/*0x012*/ UINT16 Version;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ struct _INTERFACE* Interface;
/*0x020*/ VOID* InterfaceSpecificData;
} QueryInterface;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _DEVICE_CAPABILITIES* Capabilities;
} DeviceCapabilities;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _IO_RESOURCE_REQUIREMENTS_LIST* IoResourceRequirementList;
} FilterResourceRequirements;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ ULONG32 WhichSpace;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ VOID* Buffer;
/*0x018*/ ULONG32 Offset;
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ ULONG32 Length;
/*0x024*/ UINT8 _PADDING3_[0x4];
} ReadWriteConfig;
struct { // 1 elements, 0x1 bytes (sizeof)
/*0x008*/ UINT8 Lock;
} SetLock;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x008*/ enum _BUS_QUERY_ID_TYPE IdType;
} QueryId;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ enum _DEVICE_TEXT_TYPE DeviceTextType;
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ ULONG32 LocaleId;
/*0x014*/ UINT8 _PADDING2_[0x4];
} QueryDeviceText;
struct { // 3 elements, 0x10 bytes (sizeof)
/*0x008*/ UINT8 InPath;
/*0x009*/ UINT8 Reserved[3];
/*0x00C*/ UINT8 _PADDING1_[0x4];
/*0x010*/ enum _DEVICE_USAGE_NOTIFICATION_TYPE Type;
/*0x014*/ UINT8 _PADDING2_[0x4];
} UsageNotification;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x008*/ enum _SYSTEM_POWER_STATE PowerState;
} WaitWake;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _POWER_SEQUENCE* PowerSequence;
} PowerSequence;
struct { // 5 elements, 0x20 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 SystemContext;
/*0x008*/ struct _SYSTEM_POWER_STATE_CONTEXT SystemPowerStateContext; // 7 elements, 0x4 bytes (sizeof)
};
/*0x010*/ enum _POWER_STATE_TYPE Type;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ union _POWER_STATE State; // 2 elements, 0x4 bytes (sizeof)
/*0x01C*/ UINT8 _PADDING2_[0x4];
/*0x020*/ enum _POWER_ACTION ShutdownType;
/*0x024*/ UINT8 _PADDING3_[0x4];
} Power;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ struct _CM_RESOURCE_LIST* AllocatedResources;
/*0x010*/ struct _CM_RESOURCE_LIST* AllocatedResourcesTranslated;
} StartDevice;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ UINT64 ProviderId;
/*0x010*/ VOID* DataPath;
/*0x018*/ ULONG32 BufferSize;
/*0x01C*/ UINT8 _PADDING1_[0x4];
/*0x020*/ VOID* Buffer;
} WMI;
struct { // 4 elements, 0x20 bytes (sizeof)
/*0x008*/ VOID* Argument1;
/*0x010*/ VOID* Argument2;
/*0x018*/ VOID* Argument3;
/*0x020*/ VOID* Argument4;
} Others;
} Parameters;
/*0x028*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x030*/ struct _FILE_OBJECT* FileObject;
/*0x038*/ PVOID CompletionRoutine;
/*0x040*/ VOID* Context;
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;
struct _IO_STATUS_BLOCK
Referred from:
typedef struct _IO_STATUS_BLOCK { // 3 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ LONG32 Status;
/*0x000*/ VOID* Pointer;
};
/*0x008*/ UINT64 Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
struct _IO_TIMER
Referred from:
typedef struct _IO_TIMER { // 6 elements, 0x30 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 TimerFlag;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _LIST_ENTRY TimerList; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ PVOID TimerRoutine;
/*0x020*/ VOID* Context;
/*0x028*/ struct _DEVICE_OBJECT* DeviceObject;
} IO_TIMER, *PIO_TIMER;
struct _IRP
Referred from:
typedef struct _IRP { // 21 elements, 0xD0 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ UINT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _MDL* MdlAddress;
/*0x010*/ ULONG32 Flags;
/*0x014*/ UINT8 _PADDING1_[0x4];
union { // 3 elements, 0x8 bytes (sizeof)
/*0x018*/ struct _IRP* MasterIrp;
/*0x018*/ LONG32 IrpCount;
/*0x018*/ VOID* SystemBuffer;
} AssociatedIrp;
/*0x020*/ struct _LIST_ENTRY ThreadListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _IO_STATUS_BLOCK IoStatus; // 3 elements, 0x10 bytes (sizeof)
/*0x040*/ CHAR RequestorMode;
/*0x041*/ UINT8 PendingReturned;
/*0x042*/ CHAR StackCount;
/*0x043*/ CHAR CurrentLocation;
/*0x044*/ UINT8 Cancel;
/*0x045*/ UINT8 CancelIrql;
/*0x046*/ CHAR ApcEnvironment;
/*0x047*/ UINT8 AllocationFlags;
/*0x048*/ struct _IO_STATUS_BLOCK* UserIosb;
/*0x050*/ struct _KEVENT* UserEvent;
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 3 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x058*/ PVOID UserApcRoutine;
/*0x058*/ VOID* IssuingProcess;
};
/*0x060*/ VOID* UserApcContext;
} AsynchronousParameters;
/*0x058*/ union _LARGE_INTEGER AllocationSize; // 4 elements, 0x8 bytes (sizeof)
} Overlay;
/*0x068*/ PVOID CancelRoutine;
/*0x070*/ VOID* UserBuffer;
union { // 3 elements, 0x58 bytes (sizeof)
struct { // 8 elements, 0x50 bytes (sizeof)
union { // 2 elements, 0x20 bytes (sizeof)
/*0x078*/ struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; // 3 elements, 0x18 bytes (sizeof)
/*0x078*/ VOID* DriverContext[4];
};
/*0x098*/ struct _ETHREAD* Thread;
/*0x0A0*/ CHAR* AuxiliaryBuffer;
/*0x0A8*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x0B8*/ struct _IO_STACK_LOCATION* CurrentStackLocation;
/*0x0B8*/ ULONG32 PacketType;
};
/*0x0C0*/ struct _FILE_OBJECT* OriginalFileObject;
} Overlay;
/*0x078*/ struct _KAPC Apc; // 16 elements, 0x58 bytes (sizeof)
/*0x078*/ VOID* CompletionKey;
} Tail;
} IRP, *PIRP;
struct _JOB_ACCESS_STATE
Referred from:
typedef struct _JOB_ACCESS_STATE { // 0 elements, 0x0 bytes (sizeof)
} JOB_ACCESS_STATE, *PJOB_ACCESS_STATE;
struct _KAPC
Referred from:
typedef struct _KAPC { // 16 elements, 0x58 bytes (sizeof)
/*0x000*/ UINT8 Type;
/*0x001*/ UINT8 SpareByte0;
/*0x002*/ UINT8 Size;
/*0x003*/ UINT8 SpareByte1;
/*0x004*/ ULONG32 SpareLong0;
/*0x008*/ struct _KTHREAD* Thread;
/*0x010*/ struct _LIST_ENTRY ApcListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ PVOID KernelRoutine;
/*0x028*/ PVOID RundownRoutine;
/*0x030*/ PVOID NormalRoutine;
/*0x038*/ VOID* NormalContext;
/*0x040*/ VOID* SystemArgument1;
/*0x048*/ VOID* SystemArgument2;
/*0x050*/ CHAR ApcStateIndex;
/*0x051*/ CHAR ApcMode;
/*0x052*/ UINT8 Inserted;
/*0x053*/ UINT8 _PADDING0_[0x5];
} KAPC, *PKAPC;
struct _KAPC_STATE
Referred from:
typedef struct _KAPC_STATE { // 5 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ApcListHead[2];
/*0x020*/ struct _KPROCESS* Process;
/*0x028*/ UINT8 KernelApcInProgress;
/*0x029*/ UINT8 KernelApcPending;
/*0x02A*/ UINT8 UserApcPending;
/*0x02B*/ UINT8 _PADDING0_[0x5];
} KAPC_STATE, *PKAPC_STATE;
struct _KDESCRIPTOR
Referred from:
typedef struct _KDESCRIPTOR { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Pad[3];
/*0x006*/ UINT16 Limit;
/*0x008*/ VOID* Base;
} KDESCRIPTOR, *PKDESCRIPTOR;
struct _KDEVICE_QUEUE
Referred from:
typedef struct _KDEVICE_QUEUE { // 7 elements, 0x28 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _LIST_ENTRY DeviceListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ UINT64 Lock;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ UINT8 Busy;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ INT64 Reserved : 8; // 0 BitPosition
/*0x020*/ INT64 Hint : 56; // 8 BitPosition
};
};
} KDEVICE_QUEUE, *PKDEVICE_QUEUE;
struct _KDEVICE_QUEUE_ENTRY
Referred from:
typedef struct _KDEVICE_QUEUE_ENTRY { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY DeviceListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 SortKey;
/*0x014*/ UINT8 Inserted;
/*0x015*/ UINT8 _PADDING0_[0x3];
} KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY;
struct _KDPC
Referred from:
typedef struct _KDPC { // 9 elements, 0x40 bytes (sizeof)
/*0x000*/ UINT8 Type;
/*0x001*/ UINT8 Importance;
/*0x002*/ UINT16 Number;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _LIST_ENTRY DpcListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ PVOID DeferredRoutine;
/*0x020*/ VOID* DeferredContext;
/*0x028*/ VOID* SystemArgument1;
/*0x030*/ VOID* SystemArgument2;
/*0x038*/ VOID* DpcData;
} KDPC, *PKDPC;
struct _KDPC_DATA
Referred from:
typedef struct _KDPC_DATA { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY DpcListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT64 DpcLock;
/*0x018*/ LONG32 DpcQueueDepth;
/*0x01C*/ ULONG32 DpcCount;
} KDPC_DATA, *PKDPC_DATA;
struct _KENLISTMENT
Referred from:
typedef struct _KENLISTMENT { // 26 elements, 0x1E0 bytes (sizeof)
/*0x000*/ ULONG32 cookie;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KTMOBJECT_NAMESPACE_LINK NamespaceLink; // 2 elements, 0x28 bytes (sizeof)
/*0x030*/ struct _GUID EnlistmentId; // 4 elements, 0x10 bytes (sizeof)
/*0x040*/ struct _KMUTANT Mutex; // 5 elements, 0x38 bytes (sizeof)
/*0x078*/ struct _LIST_ENTRY NextSameTx; // 2 elements, 0x10 bytes (sizeof)
/*0x088*/ struct _LIST_ENTRY NextSameRm; // 2 elements, 0x10 bytes (sizeof)
/*0x098*/ struct _KRESOURCEMANAGER* ResourceManager;
/*0x0A0*/ struct _KTRANSACTION* Transaction;
/*0x0A8*/ enum _KENLISTMENT_STATE State;
/*0x0AC*/ ULONG32 Flags;
/*0x0B0*/ ULONG32 NotificationMask;
/*0x0B4*/ UINT8 _PADDING1_[0x4];
/*0x0B8*/ VOID* Key;
/*0x0C0*/ ULONG32 KeyRefCount;
/*0x0C4*/ UINT8 _PADDING2_[0x4];
/*0x0C8*/ VOID* RecoveryInformation;
/*0x0D0*/ ULONG32 RecoveryInformationLength;
/*0x0D4*/ UINT8 _PADDING3_[0x4];
/*0x0D8*/ VOID* DynamicNameInformation;
/*0x0E0*/ ULONG32 DynamicNameInformationLength;
/*0x0E4*/ UINT8 _PADDING4_[0x4];
/*0x0E8*/ struct _KTMNOTIFICATION_PACKET* FinalNotification;
/*0x0F0*/ struct _KENLISTMENT* SupSubEnlistment;
/*0x0F8*/ VOID* SupSubEnlHandle;
/*0x100*/ VOID* SubordinateTxHandle;
/*0x108*/ struct _GUID CrmEnlistmentEnId; // 4 elements, 0x10 bytes (sizeof)
/*0x118*/ struct _GUID CrmEnlistmentTmId; // 4 elements, 0x10 bytes (sizeof)
/*0x128*/ struct _GUID CrmEnlistmentRmId; // 4 elements, 0x10 bytes (sizeof)
/*0x138*/ ULONG32 NextHistory;
/*0x13C*/ struct _KENLISTMENT_HISTORY History[20];
/*0x1DC*/ UINT8 _PADDING5_[0x4];
} KENLISTMENT, *PKENLISTMENT;
struct _KENLISTMENT_HISTORY
Referred from:
typedef struct _KENLISTMENT_HISTORY { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Notification;
/*0x004*/ enum _KENLISTMENT_STATE NewState;
} KENLISTMENT_HISTORY, *PKENLISTMENT_HISTORY;
struct _KERNEL_STACK_CONTROL
typedef struct _KERNEL_STACK_CONTROL { // 3 elements, 0x250 bytes (sizeof)
/*0x000*/ struct _XMM_SAVE_AREA32 XmmSaveArea; // 16 elements, 0x200 bytes (sizeof)
/*0x200*/ struct _KERNEL_STACK_SEGMENT Current; // 5 elements, 0x28 bytes (sizeof)
/*0x228*/ struct _KERNEL_STACK_SEGMENT Previous; // 5 elements, 0x28 bytes (sizeof)
} KERNEL_STACK_CONTROL, *PKERNEL_STACK_CONTROL;
struct _KERNEL_STACK_SEGMENT
Referred from:
typedef struct _KERNEL_STACK_SEGMENT { // 5 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT64 StackBase;
/*0x008*/ UINT64 StackLimit;
/*0x010*/ UINT64 KernelStack;
/*0x018*/ UINT64 InitialStack;
/*0x020*/ UINT64 ActualLimit;
} KERNEL_STACK_SEGMENT, *PKERNEL_STACK_SEGMENT;
struct _KEVENT
Referred from:
typedef struct _KEVENT { // 1 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
} KEVENT, *PKEVENT;
struct _KEXCEPTION_FRAME
typedef struct _KEXCEPTION_FRAME { // 30 elements, 0x140 bytes (sizeof)
/*0x000*/ UINT64 P1Home;
/*0x008*/ UINT64 P2Home;
/*0x010*/ UINT64 P3Home;
/*0x018*/ UINT64 P4Home;
/*0x020*/ UINT64 P5;
/*0x028*/ UINT64 InitialStack;
/*0x030*/ struct _M128A Xmm6; // 2 elements, 0x10 bytes (sizeof)
/*0x040*/ struct _M128A Xmm7; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _M128A Xmm8; // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _M128A Xmm9; // 2 elements, 0x10 bytes (sizeof)
/*0x070*/ struct _M128A Xmm10; // 2 elements, 0x10 bytes (sizeof)
/*0x080*/ struct _M128A Xmm11; // 2 elements, 0x10 bytes (sizeof)
/*0x090*/ struct _M128A Xmm12; // 2 elements, 0x10 bytes (sizeof)
/*0x0A0*/ struct _M128A Xmm13; // 2 elements, 0x10 bytes (sizeof)
/*0x0B0*/ struct _M128A Xmm14; // 2 elements, 0x10 bytes (sizeof)
/*0x0C0*/ struct _M128A Xmm15; // 2 elements, 0x10 bytes (sizeof)
/*0x0D0*/ UINT64 TrapFrame;
/*0x0D8*/ UINT64 CallbackStack;
/*0x0E0*/ UINT64 OutputBuffer;
/*0x0E8*/ UINT64 OutputLength;
/*0x0F0*/ UINT64 MxCsr;
/*0x0F8*/ UINT64 Rbp;
/*0x100*/ UINT64 Rbx;
/*0x108*/ UINT64 Rdi;
/*0x110*/ UINT64 Rsi;
/*0x118*/ UINT64 R12;
/*0x120*/ UINT64 R13;
/*0x128*/ UINT64 R14;
/*0x130*/ UINT64 R15;
/*0x138*/ UINT64 Return;
} KEXCEPTION_FRAME, *PKEXCEPTION_FRAME;
struct _KEXECUTE_OPTIONS
Referred from:
typedef struct _KEXECUTE_OPTIONS { // 7 elements, 0x1 bytes (sizeof)
/*0x000*/ UINT8 ExecuteDisable : 1; // 0 BitPosition
/*0x000*/ UINT8 ExecuteEnable : 1; // 1 BitPosition
/*0x000*/ UINT8 DisableThunkEmulation : 1; // 2 BitPosition
/*0x000*/ UINT8 Permanent : 1; // 3 BitPosition
/*0x000*/ UINT8 ExecuteDispatchEnable : 1; // 4 BitPosition
/*0x000*/ UINT8 ImageDispatchEnable : 1; // 5 BitPosition
/*0x000*/ UINT8 Spare : 2; // 6 BitPosition
} KEXECUTE_OPTIONS, *PKEXECUTE_OPTIONS;
struct _KGATE
Referred from:
typedef struct _KGATE { // 1 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
} KGATE, *PKGATE;
struct _KGUARDED_MUTEX
Referred from:
typedef struct _KGUARDED_MUTEX { // 7 elements, 0x38 bytes (sizeof)
/*0x000*/ LONG32 Count;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KTHREAD* Owner;
/*0x010*/ ULONG32 Contention;
/*0x014*/ UINT8 _PADDING1_[0x4];
/*0x018*/ struct _KGATE Gate; // 1 elements, 0x18 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x030*/ INT16 KernelApcDisable;
/*0x032*/ INT16 SpecialApcDisable;
/*0x034*/ UINT8 _PADDING2_[0x4];
};
/*0x030*/ ULONG32 CombinedApcDisable;
};
} KGUARDED_MUTEX, *PKGUARDED_MUTEX;
struct _KINTERRUPT
typedef struct _KINTERRUPT { // 26 elements, 0xA0 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 Size;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _LIST_ENTRY InterruptListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ PVOID ServiceRoutine;
/*0x020*/ PVOID MessageServiceRoutine;
/*0x028*/ ULONG32 MessageIndex;
/*0x02C*/ UINT8 _PADDING1_[0x4];
/*0x030*/ VOID* ServiceContext;
/*0x038*/ UINT64 SpinLock;
/*0x040*/ ULONG32 TickCount;
/*0x044*/ UINT8 _PADDING2_[0x4];
/*0x048*/ UINT64* ActualLock;
/*0x050*/ PVOID DispatchAddress;
/*0x058*/ ULONG32 Vector;
/*0x05C*/ UINT8 Irql;
/*0x05D*/ UINT8 SynchronizeIrql;
/*0x05E*/ UINT8 FloatingSave;
/*0x05F*/ UINT8 Connected;
/*0x060*/ CHAR Number;
/*0x061*/ UINT8 ShareVector;
/*0x062*/ UINT8 _PADDING3_[0x2];
/*0x064*/ enum _KINTERRUPT_MODE Mode;
/*0x068*/ enum _KINTERRUPT_POLARITY Polarity;
/*0x06C*/ ULONG32 ServiceCount;
/*0x070*/ ULONG32 DispatchCount;
/*0x074*/ UINT8 _PADDING4_[0x4];
/*0x078*/ UINT64 Rsvd1;
/*0x080*/ struct _KTRAP_FRAME* TrapFrame;
/*0x088*/ VOID* Reserved;
/*0x090*/ ULONG32 DispatchCode[4];
} KINTERRUPT, *PKINTERRUPT;
struct _KLOCK_QUEUE_HANDLE
typedef struct _KLOCK_QUEUE_HANDLE { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _KSPIN_LOCK_QUEUE LockQueue; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT8 OldIrql;
/*0x011*/ UINT8 _PADDING0_[0x7];
} KLOCK_QUEUE_HANDLE, *PKLOCK_QUEUE_HANDLE;
struct _KMUTANT
Referred from:
typedef struct _KMUTANT { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY MutantListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _KTHREAD* OwnerThread;
/*0x030*/ UINT8 Abandoned;
/*0x031*/ UINT8 ApcDisable;
/*0x032*/ UINT8 _PADDING0_[0x6];
} KMUTANT, *PKMUTANT;
struct _KNODE
Referred from:
typedef struct _KNODE { // 14 elements, 0xC0 bytes (sizeof)
/*0x000*/ union _SLIST_HEADER PagedPoolSListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x010*/ union _SLIST_HEADER NonPagedPoolSListHead[3];
/*0x040*/ union _SLIST_HEADER PfnDereferenceSListHead; // 4 elements, 0x10 bytes (sizeof)
/*0x050*/ UINT64 ProcessorMask;
/*0x058*/ UINT8 Color;
/*0x059*/ UINT8 Seed;
/*0x05A*/ UINT8 NodeNumber;
/*0x05B*/ struct _flags Flags; // 2 elements, 0x1 bytes (sizeof)
/*0x05C*/ ULONG32 MmShiftedColor;
/*0x060*/ UINT64 FreeCount[2];
/*0x070*/ struct _SLIST_ENTRY* PfnDeferredList;
/*0x078*/ ULONG32 Right;
/*0x07C*/ ULONG32 Left;
/*0x080*/ struct _CACHED_KSTACK_LIST CachedKernelStacks; // 4 elements, 0x20 bytes (sizeof)
/*0x0A0*/ UINT8 _PADDING0_[0x20];
} KNODE, *PKNODE;
struct _KPCR
Referred from:
typedef struct _KPCR { // 27 elements, 0x3BA0 bytes (sizeof)
union { // 2 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _NT_TIB NtTib; // 8 elements, 0x38 bytes (sizeof)
struct { // 7 elements, 0x38 bytes (sizeof)
/*0x000*/ union _KGDTENTRY64* GdtBase;
/*0x008*/ struct _KTSS64* TssBase;
/*0x010*/ UINT64 UserRsp;
/*0x018*/ struct _KPCR* Self;
/*0x020*/ struct _KPRCB* CurrentPrcb;
/*0x028*/ struct _KSPIN_LOCK_QUEUE* LockArray;
/*0x030*/ VOID* Used_Self;
};
};
/*0x038*/ union _KIDTENTRY64* IdtBase;
/*0x040*/ UINT64 Unused[2];
/*0x050*/ UINT8 Irql;
/*0x051*/ UINT8 SecondLevelCacheAssociativity;
/*0x052*/ UINT8 ObsoleteNumber;
/*0x053*/ UINT8 Fill0;
/*0x054*/ ULONG32 Unused0[3];
/*0x060*/ UINT16 MajorVersion;
/*0x062*/ UINT16 MinorVersion;
/*0x064*/ ULONG32 StallScaleFactor;
/*0x068*/ VOID* Unused1[3];
/*0x080*/ ULONG32 KernelReserved[15];
/*0x0BC*/ ULONG32 SecondLevelCacheSize;
/*0x0C0*/ ULONG32 HalReserved[16];
/*0x100*/ ULONG32 Unused2;
/*0x104*/ UINT8 _PADDING0_[0x4];
/*0x108*/ VOID* KdVersionBlock;
/*0x110*/ VOID* Unused3;
/*0x118*/ ULONG32 PcrAlign1[24];
/*0x178*/ UINT8 _PADDING1_[0x8];
/*0x180*/ struct _KPRCB Prcb; // 185 elements, 0x3A20 bytes (sizeof)
} KPCR, *PKPCR;
struct _KPRCB
Referred from:
typedef struct _KPRCB { // 185 elements, 0x3A20 bytes (sizeof)
/*0x000*/ ULONG32 MxCsr;
/*0x004*/ UINT16 Number;
/*0x006*/ UINT8 InterruptRequest;
/*0x007*/ UINT8 IdleHalt;
/*0x008*/ struct _KTHREAD* CurrentThread;
/*0x010*/ struct _KTHREAD* NextThread;
/*0x018*/ struct _KTHREAD* IdleThread;
/*0x020*/ UINT8 NestingLevel;
/*0x021*/ UINT8 Group;
/*0x022*/ UINT8 PrcbPad00[6];
/*0x028*/ UINT64 RspBase;
/*0x030*/ UINT64 PrcbLock;
/*0x038*/ UINT64 SetMember;
/*0x040*/ struct _KPROCESSOR_STATE ProcessorState; // 2 elements, 0x5B0 bytes (sizeof)
/*0x5F0*/ CHAR CpuType;
/*0x5F1*/ CHAR CpuID;
union { // 2 elements, 0x2 bytes (sizeof)
/*0x5F2*/ UINT16 CpuStep;
struct { // 2 elements, 0x2 bytes (sizeof)
/*0x5F2*/ UINT8 CpuStepping;
/*0x5F3*/ UINT8 CpuModel;
};
};
/*0x5F4*/ ULONG32 MHz;
/*0x5F8*/ UINT64 HalReserved[8];
/*0x638*/ UINT16 MinorVersion;
/*0x63A*/ UINT16 MajorVersion;
/*0x63C*/ UINT8 BuildType;
/*0x63D*/ UINT8 CpuVendor;
/*0x63E*/ UINT8 CoresPerPhysicalProcessor;
/*0x63F*/ UINT8 LogicalProcessorsPerCore;
/*0x640*/ ULONG32 ApicMask;
/*0x644*/ ULONG32 CFlushSize;
/*0x648*/ VOID* AcpiReserved;
/*0x650*/ ULONG32 InitialApicId;
/*0x654*/ ULONG32 Stride;
/*0x658*/ UINT64 PrcbPad01[3];
/*0x670*/ struct _KSPIN_LOCK_QUEUE LockQueue[33];
/*0x880*/ struct _PP_LOOKASIDE_LIST PPLookasideList[16];
/*0x980*/ struct _GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32];
/*0x1580*/ struct _GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32];
/*0x2180*/ UINT64 PacketBarrier;
/*0x2188*/ struct _SINGLE_LIST_ENTRY DeferredReadyListHead; // 1 elements, 0x8 bytes (sizeof)
/*0x2190*/ LONG32 MmPageFaultCount;
/*0x2194*/ LONG32 MmCopyOnWriteCount;
/*0x2198*/ LONG32 MmTransitionCount;
/*0x219C*/ LONG32 MmDemandZeroCount;
/*0x21A0*/ LONG32 MmPageReadCount;
/*0x21A4*/ LONG32 MmPageReadIoCount;
/*0x21A8*/ LONG32 MmDirtyPagesWriteCount;
/*0x21AC*/ LONG32 MmDirtyWriteIoCount;
/*0x21B0*/ LONG32 MmMappedPagesWriteCount;
/*0x21B4*/ LONG32 MmMappedWriteIoCount;
/*0x21B8*/ ULONG32 KeSystemCalls;
/*0x21BC*/ ULONG32 KeContextSwitches;
/*0x21C0*/ ULONG32 CcFastReadNoWait;
/*0x21C4*/ ULONG32 CcFastReadWait;
/*0x21C8*/ ULONG32 CcFastReadNotPossible;
/*0x21CC*/ ULONG32 CcCopyReadNoWait;
/*0x21D0*/ ULONG32 CcCopyReadWait;
/*0x21D4*/ ULONG32 CcCopyReadNoWaitMiss;
/*0x21D8*/ LONG32 LookasideIrpFloat;
/*0x21DC*/ LONG32 IoReadOperationCount;
/*0x21E0*/ LONG32 IoWriteOperationCount;
/*0x21E4*/ LONG32 IoOtherOperationCount;
/*0x21E8*/ union _LARGE_INTEGER IoReadTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x21F0*/ union _LARGE_INTEGER IoWriteTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x21F8*/ union _LARGE_INTEGER IoOtherTransferCount; // 4 elements, 0x8 bytes (sizeof)
/*0x2200*/ UINT64 TargetSet;
/*0x2208*/ ULONG32 IpiFrozen;
/*0x220C*/ UINT8 PrcbPad3[116];
/*0x2280*/ struct _REQUEST_MAILBOX RequestMailbox[64];
/*0x3280*/ UINT64 SenderSummary;
/*0x3288*/ UINT8 PrcbPad4[120];
/*0x3300*/ struct _KDPC_DATA DpcData[2];
/*0x3340*/ VOID* DpcStack;
/*0x3348*/ VOID* SavedRsp;
/*0x3350*/ LONG32 MaximumDpcQueueDepth;
/*0x3354*/ ULONG32 DpcRequestRate;
/*0x3358*/ ULONG32 MinimumDpcRate;
/*0x335C*/ UINT8 DpcInterruptRequested;
/*0x335D*/ UINT8 DpcThreadRequested;
/*0x335E*/ UINT8 DpcRoutineActive;
/*0x335F*/ UINT8 DpcThreadActive;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x3360*/ UINT64 TimerHand;
/*0x3360*/ UINT64 TimerRequest;
};
/*0x3368*/ LONG32 TickOffset;
/*0x336C*/ LONG32 MasterOffset;
/*0x3370*/ ULONG32 DpcLastCount;
/*0x3374*/ UINT8 ThreadDpcEnable;
/*0x3375*/ UINT8 QuantumEnd;
/*0x3376*/ UINT8 PrcbPad50;
/*0x3377*/ UINT8 IdleSchedule;
/*0x3378*/ LONG32 DpcSetEventRequest;
/*0x337C*/ ULONG32 KeExceptionDispatchCount;
/*0x3380*/ struct _KEVENT DpcEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x3398*/ VOID* PrcbPad51;
/*0x33A0*/ struct _KDPC CallDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x33E0*/ LONG32 ClockKeepAlive;
/*0x33E4*/ UINT8 ClockCheckSlot;
/*0x33E5*/ UINT8 ClockPollCycle;
/*0x33E6*/ UINT8 PrcbPad6[2];
/*0x33E8*/ LONG32 DpcWatchdogPeriod;
/*0x33EC*/ LONG32 DpcWatchdogCount;
/*0x33F0*/ UINT64 PrcbPad70[2];
/*0x3400*/ struct _LIST_ENTRY WaitListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x3410*/ UINT64 WaitLock;
/*0x3418*/ ULONG32 ReadySummary;
/*0x341C*/ ULONG32 QueueIndex;
/*0x3420*/ UINT64 PrcbPad71[12];
/*0x3480*/ struct _LIST_ENTRY DispatcherReadyListHead[32];
/*0x3680*/ ULONG32 InterruptCount;
/*0x3684*/ ULONG32 KernelTime;
/*0x3688*/ ULONG32 UserTime;
/*0x368C*/ ULONG32 DpcTime;
/*0x3690*/ ULONG32 InterruptTime;
/*0x3694*/ ULONG32 AdjustDpcThreshold;
/*0x3698*/ UINT8 SkipTick;
/*0x3699*/ UINT8 DebuggerSavedIRQL;
/*0x369A*/ UINT8 PollSlot;
/*0x369B*/ UINT8 PrcbPad80[5];
/*0x36A0*/ ULONG32 DpcTimeCount;
/*0x36A4*/ ULONG32 DpcTimeLimit;
/*0x36A8*/ ULONG32 PeriodicCount;
/*0x36AC*/ ULONG32 PeriodicBias;
/*0x36B0*/ UINT64 PrcbPad81[2];
/*0x36C0*/ struct _KNODE* ParentNode;
/*0x36C8*/ UINT64 MultiThreadProcessorSet;
/*0x36D0*/ struct _KPRCB* MultiThreadSetMaster;
/*0x36D8*/ UINT64 StartCycles;
/*0x36E0*/ LONG32 MmSpinLockOrdering;
/*0x36E4*/ ULONG32 PageColor;
/*0x36E8*/ ULONG32 NodeColor;
/*0x36EC*/ ULONG32 NodeShiftedColor;
/*0x36F0*/ ULONG32 SecondaryColorMask;
/*0x36F4*/ LONG32 Sleeping;
/*0x36F8*/ UINT64 CycleTime;
/*0x3700*/ ULONG32 CcFastMdlReadNoWait;
/*0x3704*/ ULONG32 CcFastMdlReadWait;
/*0x3708*/ ULONG32 CcFastMdlReadNotPossible;
/*0x370C*/ ULONG32 CcMapDataNoWait;
/*0x3710*/ ULONG32 CcMapDataWait;
/*0x3714*/ ULONG32 CcPinMappedDataCount;
/*0x3718*/ ULONG32 CcPinReadNoWait;
/*0x371C*/ ULONG32 CcPinReadWait;
/*0x3720*/ ULONG32 CcMdlReadNoWait;
/*0x3724*/ ULONG32 CcMdlReadWait;
/*0x3728*/ ULONG32 CcLazyWriteHotSpots;
/*0x372C*/ ULONG32 CcLazyWriteIos;
/*0x3730*/ ULONG32 CcLazyWritePages;
/*0x3734*/ ULONG32 CcDataFlushes;
/*0x3738*/ ULONG32 CcDataPages;
/*0x373C*/ ULONG32 CcLostDelayedWrites;
/*0x3740*/ ULONG32 CcFastReadResourceMiss;
/*0x3744*/ ULONG32 CcCopyReadWaitMiss;
/*0x3748*/ ULONG32 CcFastMdlReadResourceMiss;
/*0x374C*/ ULONG32 CcMapDataNoWaitMiss;
/*0x3750*/ ULONG32 CcMapDataWaitMiss;
/*0x3754*/ ULONG32 CcPinReadNoWaitMiss;
/*0x3758*/ ULONG32 CcPinReadWaitMiss;
/*0x375C*/ ULONG32 CcMdlReadNoWaitMiss;
/*0x3760*/ ULONG32 CcMdlReadWaitMiss;
/*0x3764*/ ULONG32 CcReadAheadIos;
/*0x3768*/ LONG32 MmCacheTransitionCount;
/*0x376C*/ LONG32 MmCacheReadCount;
/*0x3770*/ LONG32 MmCacheIoCount;
/*0x3774*/ ULONG32 PrcbPad91[3];
/*0x3780*/ struct _PROCESSOR_POWER_STATE PowerState; // 29 elements, 0x138 bytes (sizeof)
/*0x38B8*/ ULONG32 KeAlignmentFixupCount;
/*0x38BC*/ UINT8 VendorString[13];
/*0x38C9*/ UINT8 PrcbPad10[3];
/*0x38CC*/ ULONG32 FeatureBits;
/*0x38D0*/ union _LARGE_INTEGER UpdateSignature; // 4 elements, 0x8 bytes (sizeof)
/*0x38D8*/ struct _KDPC DpcWatchdogDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x3918*/ struct _KTIMER DpcWatchdogTimer; // 5 elements, 0x40 bytes (sizeof)
/*0x3958*/ struct _CACHE_DESCRIPTOR Cache[5];
/*0x3994*/ ULONG32 CacheCount;
/*0x3998*/ ULONG32 CachedCommit;
/*0x399C*/ ULONG32 CachedResidentAvailable;
/*0x39A0*/ VOID* HyperPte;
/*0x39A8*/ VOID* WheaInfo;
/*0x39B0*/ VOID* EtwSupport;
/*0x39B8*/ UINT8 _PADDING0_[0x8];
/*0x39C0*/ union _SLIST_HEADER InterruptObjectPool; // 4 elements, 0x10 bytes (sizeof)
/*0x39D0*/ union _LARGE_INTEGER HypercallPagePhysical; // 4 elements, 0x8 bytes (sizeof)
/*0x39D8*/ VOID* HypercallPageVirtual;
/*0x39E0*/ VOID* RateControl;
/*0x39E8*/ UINT64 CacheProcessorMask[5];
/*0x3A10*/ UINT64 PackageProcessorSet;
/*0x3A18*/ UINT64 CoreProcessorSet;
} KPRCB, *PKPRCB;
struct _KPROCESS
Referred from:
typedef struct _KPROCESS { // 31 elements, 0xC0 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY ProfileListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ UINT64 DirectoryTableBase;
/*0x030*/ UINT64 Unused0;
/*0x038*/ UINT16 IopmOffset;
/*0x03A*/ UINT8 _PADDING0_[0x6];
/*0x040*/ UINT64 ActiveProcessors;
/*0x048*/ ULONG32 KernelTime;
/*0x04C*/ ULONG32 UserTime;
/*0x050*/ struct _LIST_ENTRY ReadyListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _SINGLE_LIST_ENTRY SwapListEntry; // 1 elements, 0x8 bytes (sizeof)
/*0x068*/ VOID* InstrumentationCallback;
/*0x070*/ struct _LIST_ENTRY ThreadListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x080*/ UINT64 ProcessLock;
/*0x088*/ UINT64 Affinity;
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x090*/ LONG32 AutoAlignment : 1; // 0 BitPosition
/*0x090*/ LONG32 DisableBoost : 1; // 1 BitPosition
/*0x090*/ LONG32 DisableQuantum : 1; // 2 BitPosition
/*0x090*/ LONG32 ReservedFlags : 29; // 3 BitPosition
};
/*0x090*/ LONG32 ProcessFlags;
};
/*0x094*/ CHAR BasePriority;
/*0x095*/ CHAR QuantumReset;
/*0x096*/ UINT8 State;
/*0x097*/ UINT8 ThreadSeed;
/*0x098*/ UINT8 PowerState;
/*0x099*/ UINT8 IdealNode;
/*0x09A*/ UINT8 Visited;
union { // 2 elements, 0x5 bytes (sizeof)
/*0x09B*/ struct _KEXECUTE_OPTIONS Flags; // 7 elements, 0x1 bytes (sizeof)
/*0x09B*/ UINT8 ExecuteOptions;
};
/*0x0A0*/ UINT64 StackCount;
/*0x0A8*/ struct _LIST_ENTRY ProcessListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x0B8*/ UINT64 CycleTime;
} KPROCESS, *PKPROCESS;
struct _KPROCESSOR_STATE
Referred from:
typedef struct _KPROCESSOR_STATE { // 2 elements, 0x5B0 bytes (sizeof)
/*0x000*/ struct _KSPECIAL_REGISTERS SpecialRegisters; // 27 elements, 0xD8 bytes (sizeof)
/*0x0D8*/ UINT8 _PADDING0_[0x8];
/*0x0E0*/ struct _CONTEXT ContextFrame; // 64 elements, 0x4D0 bytes (sizeof)
} KPROCESSOR_STATE, *PKPROCESSOR_STATE;
struct _KQUEUE
Referred from:
typedef struct _KQUEUE { // 5 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY EntryListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ ULONG32 CurrentCount;
/*0x02C*/ ULONG32 MaximumCount;
/*0x030*/ struct _LIST_ENTRY ThreadListHead; // 2 elements, 0x10 bytes (sizeof)
} KQUEUE, *PKQUEUE;
struct _KREQUEST_PACKET
Referred from:
typedef struct _KREQUEST_PACKET { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ VOID* CurrentPacket[3];
/*0x018*/ PVOID WorkerRoutine;
} KREQUEST_PACKET, *PKREQUEST_PACKET;
struct _KRESOURCEMANAGER
Referred from:
typedef struct _KRESOURCEMANAGER { // 20 elements, 0x250 bytes (sizeof)
/*0x000*/ struct _KEVENT NotificationAvailable; // 1 elements, 0x18 bytes (sizeof)
/*0x018*/ ULONG32 cookie;
/*0x01C*/ enum _KRESOURCEMANAGER_STATE State;
/*0x020*/ ULONG32 Flags;
/*0x024*/ UINT8 _PADDING0_[0x4];
/*0x028*/ struct _KMUTANT Mutex; // 5 elements, 0x38 bytes (sizeof)
/*0x060*/ struct _KTMOBJECT_NAMESPACE_LINK NamespaceLink; // 2 elements, 0x28 bytes (sizeof)
/*0x088*/ struct _GUID RmId; // 4 elements, 0x10 bytes (sizeof)
/*0x098*/ struct _KQUEUE NotificationQueue; // 5 elements, 0x40 bytes (sizeof)
/*0x0D8*/ struct _KMUTANT NotificationMutex; // 5 elements, 0x38 bytes (sizeof)
/*0x110*/ struct _LIST_ENTRY EnlistmentHead; // 2 elements, 0x10 bytes (sizeof)
/*0x120*/ ULONG32 EnlistmentCount;
/*0x124*/ UINT8 _PADDING1_[0x4];
/*0x128*/ PVOID NotificationRoutine;
/*0x130*/ VOID* Key;
/*0x138*/ struct _LIST_ENTRY ProtocolListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x148*/ struct _LIST_ENTRY PendingPropReqListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x158*/ struct _LIST_ENTRY CRMListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x168*/ struct _KTM* Tm;
/*0x170*/ struct _UNICODE_STRING Description; // 3 elements, 0x10 bytes (sizeof)
/*0x180*/ struct _KTMOBJECT_NAMESPACE Enlistments; // 5 elements, 0xA8 bytes (sizeof)
/*0x228*/ struct _KRESOURCEMANAGER_COMPLETION_BINDING CompletionBinding; // 4 elements, 0x28 bytes (sizeof)
} KRESOURCEMANAGER, *PKRESOURCEMANAGER;
struct _KRESOURCEMANAGER_COMPLETION_BINDING
Referred from:
typedef struct _KRESOURCEMANAGER_COMPLETION_BINDING { // 4 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY NotificationListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* Port;
/*0x018*/ UINT64 Key;
/*0x020*/ struct _EPROCESS* BindingProcess;
} KRESOURCEMANAGER_COMPLETION_BINDING, *PKRESOURCEMANAGER_COMPLETION_BINDING;
struct _KSEMAPHORE
Referred from:
typedef struct _KSEMAPHORE { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ LONG32 Limit;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} KSEMAPHORE, *PKSEMAPHORE;
struct _KSPECIAL_REGISTERS
Referred from:
typedef struct _KSPECIAL_REGISTERS { // 27 elements, 0xD8 bytes (sizeof)
/*0x000*/ UINT64 Cr0;
/*0x008*/ UINT64 Cr2;
/*0x010*/ UINT64 Cr3;
/*0x018*/ UINT64 Cr4;
/*0x020*/ UINT64 KernelDr0;
/*0x028*/ UINT64 KernelDr1;
/*0x030*/ UINT64 KernelDr2;
/*0x038*/ UINT64 KernelDr3;
/*0x040*/ UINT64 KernelDr6;
/*0x048*/ UINT64 KernelDr7;
/*0x050*/ struct _KDESCRIPTOR Gdtr; // 3 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _KDESCRIPTOR Idtr; // 3 elements, 0x10 bytes (sizeof)
/*0x070*/ UINT16 Tr;
/*0x072*/ UINT16 Ldtr;
/*0x074*/ ULONG32 MxCsr;
/*0x078*/ UINT64 DebugControl;
/*0x080*/ UINT64 LastBranchToRip;
/*0x088*/ UINT64 LastBranchFromRip;
/*0x090*/ UINT64 LastExceptionToRip;
/*0x098*/ UINT64 LastExceptionFromRip;
/*0x0A0*/ UINT64 Cr8;
/*0x0A8*/ UINT64 MsrGsBase;
/*0x0B0*/ UINT64 MsrGsSwap;
/*0x0B8*/ UINT64 MsrStar;
/*0x0C0*/ UINT64 MsrLStar;
/*0x0C8*/ UINT64 MsrCStar;
/*0x0D0*/ UINT64 MsrSyscallMask;
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
struct _KSPIN_LOCK_QUEUE
Referred from:
typedef struct _KSPIN_LOCK_QUEUE { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _KSPIN_LOCK_QUEUE* Next;
/*0x008*/ UINT64* Lock;
} KSPIN_LOCK_QUEUE, *PKSPIN_LOCK_QUEUE;
struct _KSYSTEM_TIME
Referred from:
typedef struct _KSYSTEM_TIME { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 LowPart;
/*0x004*/ LONG32 High1Time;
/*0x008*/ LONG32 High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;
struct _KTHREAD
Referred from:
typedef struct _KTHREAD { // 122 elements, 0x330 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ UINT64 CycleTime;
/*0x020*/ UINT64 QuantumTarget;
/*0x028*/ VOID* InitialStack;
/*0x030*/ VOID* StackLimit;
/*0x038*/ VOID* KernelStack;
/*0x040*/ UINT64 ThreadLock;
union { // 2 elements, 0x30 bytes (sizeof)
/*0x048*/ struct _KAPC_STATE ApcState; // 5 elements, 0x30 bytes (sizeof)
struct { // 4 elements, 0x30 bytes (sizeof)
/*0x048*/ UINT8 ApcStateFill[43];
/*0x073*/ CHAR Priority;
/*0x074*/ UINT16 NextProcessor;
/*0x076*/ UINT16 DeferredProcessor;
};
};
/*0x078*/ UINT64 ApcQueueLock;
/*0x080*/ INT64 WaitStatus;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x088*/ struct _KWAIT_BLOCK* WaitBlockList;
/*0x088*/ struct _KGATE* GateObject;
};
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 8 elements, 0x4 bytes (sizeof)
/*0x090*/ ULONG32 KernelStackResident : 1; // 0 BitPosition
/*0x090*/ ULONG32 ReadyTransition : 1; // 1 BitPosition
/*0x090*/ ULONG32 ProcessReadyQueue : 1; // 2 BitPosition
/*0x090*/ ULONG32 WaitNext : 1; // 3 BitPosition
/*0x090*/ ULONG32 SystemAffinityActive : 1; // 4 BitPosition
/*0x090*/ ULONG32 Alertable : 1; // 5 BitPosition
/*0x090*/ ULONG32 GdiFlushActive : 1; // 6 BitPosition
/*0x090*/ ULONG32 Reserved : 25; // 7 BitPosition
};
/*0x090*/ LONG32 MiscFlags;
};
/*0x094*/ UINT8 WaitReason;
/*0x095*/ UINT8 SwapBusy;
/*0x096*/ UINT8 Alerted[2];
union { // 2 elements, 0x10 bytes (sizeof)
/*0x098*/ struct _LIST_ENTRY WaitListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x098*/ struct _SINGLE_LIST_ENTRY SwapListEntry; // 1 elements, 0x8 bytes (sizeof)
};
/*0x0A8*/ struct _KQUEUE* Queue;
/*0x0B0*/ VOID* Teb;
union { // 2 elements, 0x40 bytes (sizeof)
/*0x0B8*/ struct _KTIMER Timer; // 5 elements, 0x40 bytes (sizeof)
struct { // 2 elements, 0x40 bytes (sizeof)
/*0x0B8*/ UINT8 TimerFill[60];
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 10 elements, 0x4 bytes (sizeof)
/*0x0F4*/ ULONG32 AutoAlignment : 1; // 0 BitPosition
/*0x0F4*/ ULONG32 DisableBoost : 1; // 1 BitPosition
/*0x0F4*/ ULONG32 EtwStackTraceApc1Inserted : 1; // 2 BitPosition
/*0x0F4*/ ULONG32 EtwStackTraceApc2Inserted : 1; // 3 BitPosition
/*0x0F4*/ ULONG32 CycleChargePending : 1; // 4 BitPosition
/*0x0F4*/ ULONG32 CalloutActive : 1; // 5 BitPosition
/*0x0F4*/ ULONG32 ApcQueueable : 1; // 6 BitPosition
/*0x0F4*/ ULONG32 EnableStackSwap : 1; // 7 BitPosition
/*0x0F4*/ ULONG32 GuiThread : 1; // 8 BitPosition
/*0x0F4*/ ULONG32 ReservedFlags : 23; // 9 BitPosition
};
/*0x0F4*/ LONG32 ThreadFlags;
};
};
};
union { // 9 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ struct _KWAIT_BLOCK WaitBlock[4];
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill0[43];
/*0x123*/ UINT8 IdealProcessor;
/*0x124*/ UINT8 _PADDING0_[0x94];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill1[91];
/*0x153*/ CHAR PreviousMode;
/*0x154*/ UINT8 _PADDING1_[0x64];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill2[139];
/*0x183*/ UINT8 ResourceIndex;
/*0x184*/ UINT8 _PADDING2_[0x34];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill3[187];
/*0x1B3*/ UINT8 LargeStack;
/*0x1B4*/ UINT8 _PADDING3_[0x4];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill4[44];
/*0x124*/ ULONG32 ContextSwitches;
/*0x128*/ UINT8 _PADDING4_[0x90];
};
struct { // 5 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill5[92];
/*0x154*/ UINT8 State;
/*0x155*/ UINT8 NpxState;
/*0x156*/ UINT8 WaitIrql;
/*0x157*/ CHAR WaitMode;
/*0x158*/ UINT8 _PADDING5_[0x60];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill6[140];
/*0x184*/ ULONG32 WaitTime;
/*0x188*/ UINT8 _PADDING6_[0x30];
};
struct { // 2 elements, 0xC0 bytes (sizeof)
/*0x0F8*/ UINT8 WaitBlockFill7[188];
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x1B4*/ INT16 KernelApcDisable;
/*0x1B6*/ INT16 SpecialApcDisable;
};
/*0x1B4*/ ULONG32 CombinedApcDisable;
};
};
};
/*0x1B8*/ struct _LIST_ENTRY QueueListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x1C8*/ struct _KTRAP_FRAME* TrapFrame;
/*0x1D0*/ VOID* FirstArgument;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x1D8*/ VOID* CallbackStack;
/*0x1D8*/ UINT64 CallbackDepth;
};
/*0x1E0*/ UINT8 ApcStateIndex;
/*0x1E1*/ CHAR BasePriority;
/*0x1E2*/ CHAR PriorityDecrement;
/*0x1E3*/ UINT8 Preempted;
/*0x1E4*/ UINT8 AdjustReason;
/*0x1E5*/ CHAR AdjustIncrement;
/*0x1E6*/ UINT8 Spare01;
/*0x1E7*/ CHAR Saturation;
/*0x1E8*/ ULONG32 SystemCallNumber;
/*0x1EC*/ ULONG32 Spare02;
/*0x1F0*/ UINT64 UserAffinity;
/*0x1F8*/ struct _KPROCESS* Process;
/*0x200*/ UINT64 Affinity;
/*0x208*/ struct _KAPC_STATE* ApcStatePointer[2];
union { // 2 elements, 0x30 bytes (sizeof)
/*0x218*/ struct _KAPC_STATE SavedApcState; // 5 elements, 0x30 bytes (sizeof)
struct { // 6 elements, 0x30 bytes (sizeof)
/*0x218*/ UINT8 SavedApcStateFill[43];
/*0x243*/ CHAR FreezeCount;
/*0x244*/ CHAR SuspendCount;
/*0x245*/ UINT8 UserIdealProcessor;
/*0x246*/ UINT8 Spare03;
/*0x247*/ UINT8 CodePatchInProgress;
};
};
/*0x248*/ VOID* Win32Thread;
/*0x250*/ VOID* StackBase;
union { // 7 elements, 0x58 bytes (sizeof)
/*0x258*/ struct _KAPC SuspendApc; // 16 elements, 0x58 bytes (sizeof)
struct { // 2 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill0[1];
/*0x259*/ CHAR Spare04;
/*0x25A*/ UINT8 _PADDING7_[0x56];
};
struct { // 2 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill1[3];
/*0x25B*/ UINT8 QuantumReset;
/*0x25C*/ UINT8 _PADDING8_[0x54];
};
struct { // 2 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill2[4];
/*0x25C*/ ULONG32 KernelTime;
/*0x260*/ UINT8 _PADDING9_[0x50];
};
struct { // 2 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill3[64];
/*0x298*/ struct _KPRCB* WaitPrcb;
/*0x2A0*/ UINT8 _PADDING10_[0x10];
};
struct { // 2 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill4[72];
/*0x2A0*/ VOID* LegoData;
/*0x2A8*/ UINT8 _PADDING11_[0x8];
};
struct { // 3 elements, 0x58 bytes (sizeof)
/*0x258*/ UINT8 SuspendApcFill5[83];
/*0x2AB*/ UINT8 PowerState;
/*0x2AC*/ ULONG32 UserTime;
};
};
union { // 2 elements, 0x20 bytes (sizeof)
/*0x2B0*/ struct _KSEMAPHORE SuspendSemaphore; // 2 elements, 0x20 bytes (sizeof)
struct { // 2 elements, 0x20 bytes (sizeof)
/*0x2B0*/ UINT8 SuspendSemaphorefill[28];
/*0x2CC*/ ULONG32 SListFaultCount;
};
};
/*0x2D0*/ struct _LIST_ENTRY ThreadListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x2E0*/ struct _LIST_ENTRY MutantListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x2F0*/ VOID* SListFaultAddress;
/*0x2F8*/ INT64 ReadOperationCount;
/*0x300*/ INT64 WriteOperationCount;
/*0x308*/ INT64 OtherOperationCount;
/*0x310*/ INT64 ReadTransferCount;
/*0x318*/ INT64 WriteTransferCount;
/*0x320*/ INT64 OtherTransferCount;
/*0x328*/ VOID* MdlForLockedTeb;
} KTHREAD, *PKTHREAD;
struct _KTIMER
Referred from:
typedef struct _KTIMER { // 5 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _DISPATCHER_HEADER Header; // 13 elements, 0x18 bytes (sizeof)
/*0x018*/ union _ULARGE_INTEGER DueTime; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY TimerListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _KDPC* Dpc;
/*0x038*/ LONG32 Period;
/*0x03C*/ UINT8 _PADDING0_[0x4];
} KTIMER, *PKTIMER;
struct _KTIMER_TABLE_ENTRY
typedef struct _KTIMER_TABLE_ENTRY { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Entry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ union _ULARGE_INTEGER Time; // 4 elements, 0x8 bytes (sizeof)
} KTIMER_TABLE_ENTRY, *PKTIMER_TABLE_ENTRY;
struct _KTM
Referred from:
typedef struct _KTM { // 29 elements, 0x380 bytes (sizeof)
/*0x000*/ ULONG32 cookie;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KMUTANT Mutex; // 5 elements, 0x38 bytes (sizeof)
/*0x040*/ enum _KTM_STATE State;
/*0x044*/ UINT8 _PADDING1_[0x4];
/*0x048*/ struct _KTMOBJECT_NAMESPACE_LINK NamespaceLink; // 2 elements, 0x28 bytes (sizeof)
/*0x070*/ struct _GUID TmIdentity; // 4 elements, 0x10 bytes (sizeof)
/*0x080*/ ULONG32 Flags;
/*0x084*/ ULONG32 VolatileFlags;
/*0x088*/ struct _UNICODE_STRING LogFileName; // 3 elements, 0x10 bytes (sizeof)
/*0x098*/ struct _FILE_OBJECT* LogFileObject;
/*0x0A0*/ VOID* MarshallingContext;
/*0x0A8*/ VOID* LogManagementContext;
/*0x0B0*/ struct _KTMOBJECT_NAMESPACE Transactions; // 5 elements, 0xA8 bytes (sizeof)
/*0x158*/ struct _KTMOBJECT_NAMESPACE ResourceManagers; // 5 elements, 0xA8 bytes (sizeof)
/*0x200*/ struct _KMUTANT LsnOrderedMutex; // 5 elements, 0x38 bytes (sizeof)
/*0x238*/ struct _LIST_ENTRY LsnOrderedList; // 2 elements, 0x10 bytes (sizeof)
/*0x248*/ union _LARGE_INTEGER CommitVirtualClock; // 4 elements, 0x8 bytes (sizeof)
/*0x250*/ struct _FAST_MUTEX CommitVirtualClockMutex; // 5 elements, 0x38 bytes (sizeof)
/*0x288*/ union _CLS_LSN BaseLsn; // 2 elements, 0x8 bytes (sizeof)
/*0x290*/ union _CLS_LSN CurrentReadLsn; // 2 elements, 0x8 bytes (sizeof)
/*0x298*/ VOID* TmRmHandle;
/*0x2A0*/ struct _KRESOURCEMANAGER* TmRm;
/*0x2A8*/ struct _KEVENT LogFullNotifyEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x2C0*/ struct _WORK_QUEUE_ITEM CheckpointWorkItem; // 3 elements, 0x20 bytes (sizeof)
/*0x2E0*/ union _CLS_LSN CheckpointTargetLsn; // 2 elements, 0x8 bytes (sizeof)
/*0x2E8*/ struct _WORK_QUEUE_ITEM LogFullCompletedWorkItem; // 3 elements, 0x20 bytes (sizeof)
/*0x308*/ struct _ERESOURCE LogWriteResource; // 15 elements, 0x68 bytes (sizeof)
/*0x370*/ ULONG32 LogFlags;
/*0x374*/ LONG32 LogFullStatus;
/*0x378*/ LONG32 RecoveryStatus;
/*0x37C*/ UINT8 _PADDING2_[0x4];
} KTM, *PKTM;
struct _KTMNOTIFICATION_PACKET
Referred from:
typedef struct _KTMNOTIFICATION_PACKET { // 0 elements, 0x0 bytes (sizeof)
} KTMNOTIFICATION_PACKET, *PKTMNOTIFICATION_PACKET;
struct _KTMOBJECT_NAMESPACE
Referred from:
typedef struct _KTMOBJECT_NAMESPACE { // 5 elements, 0xA8 bytes (sizeof)
/*0x000*/ struct _RTL_AVL_TABLE Table; // 11 elements, 0x68 bytes (sizeof)
/*0x068*/ struct _KMUTANT Mutex; // 5 elements, 0x38 bytes (sizeof)
/*0x0A0*/ UINT16 LinksOffset;
/*0x0A2*/ UINT16 GuidOffset;
/*0x0A4*/ UINT8 Expired;
/*0x0A5*/ UINT8 _PADDING0_[0x3];
} KTMOBJECT_NAMESPACE, *PKTMOBJECT_NAMESPACE;
struct _KTMOBJECT_NAMESPACE_LINK
Referred from:
typedef struct _KTMOBJECT_NAMESPACE_LINK { // 2 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _RTL_BALANCED_LINKS Links; // 5 elements, 0x20 bytes (sizeof)
/*0x020*/ UINT8 Expired;
/*0x021*/ UINT8 _PADDING0_[0x7];
} KTMOBJECT_NAMESPACE_LINK, *PKTMOBJECT_NAMESPACE_LINK;
struct _KTRANSACTION
Referred from:
typedef struct _KTRANSACTION { // 36 elements, 0x268 bytes (sizeof)
/*0x000*/ struct _KEVENT OutcomeEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x018*/ ULONG32 cookie;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ struct _KMUTANT Mutex; // 5 elements, 0x38 bytes (sizeof)
/*0x058*/ struct _KTRANSACTION* TreeTx;
/*0x060*/ struct _KTMOBJECT_NAMESPACE_LINK GlobalNamespaceLink; // 2 elements, 0x28 bytes (sizeof)
/*0x088*/ struct _KTMOBJECT_NAMESPACE_LINK TmNamespaceLink; // 2 elements, 0x28 bytes (sizeof)
/*0x0B0*/ struct _GUID UOW; // 4 elements, 0x10 bytes (sizeof)
/*0x0C0*/ enum _KTRANSACTION_STATE State;
/*0x0C4*/ ULONG32 Flags;
/*0x0C8*/ struct _LIST_ENTRY EnlistmentHead; // 2 elements, 0x10 bytes (sizeof)
/*0x0D8*/ ULONG32 EnlistmentCount;
/*0x0DC*/ ULONG32 RecoverableEnlistmentCount;
/*0x0E0*/ ULONG32 PrePrepareRequiredEnlistmentCount;
/*0x0E4*/ ULONG32 PrepareRequiredEnlistmentCount;
/*0x0E8*/ ULONG32 OutcomeRequiredEnlistmentCount;
/*0x0EC*/ ULONG32 PendingResponses;
/*0x0F0*/ struct _KENLISTMENT* SuperiorEnlistment;
/*0x0F8*/ union _CLS_LSN LastLsn; // 2 elements, 0x8 bytes (sizeof)
/*0x100*/ struct _LIST_ENTRY PromotedEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x110*/ struct _KTRANSACTION* PromoterTransaction;
/*0x118*/ VOID* PromotePropagation;
/*0x120*/ ULONG32 IsolationLevel;
/*0x124*/ ULONG32 IsolationFlags;
/*0x128*/ union _LARGE_INTEGER Timeout; // 4 elements, 0x8 bytes (sizeof)
/*0x130*/ struct _UNICODE_STRING Description; // 3 elements, 0x10 bytes (sizeof)
/*0x140*/ struct _KTHREAD* RollbackThread;
/*0x148*/ struct _WORK_QUEUE_ITEM RollbackWorkItem; // 3 elements, 0x20 bytes (sizeof)
/*0x168*/ struct _KDPC RollbackDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x1A8*/ struct _KTIMER RollbackTimer; // 5 elements, 0x40 bytes (sizeof)
/*0x1E8*/ struct _LIST_ENTRY LsnOrderedEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x1F8*/ enum _KTRANSACTION_OUTCOME Outcome;
/*0x1FC*/ ULONG32 NextSavepoint;
/*0x200*/ struct _KTM* Tm;
/*0x208*/ INT64 CommitReservation;
/*0x210*/ struct _KTRANSACTION_HISTORY TransactionHistory[10];
/*0x260*/ ULONG32 TransactionHistoryCount;
/*0x264*/ UINT8 _PADDING1_[0x4];
} KTRANSACTION, *PKTRANSACTION;
struct _KTRANSACTION_HISTORY
Referred from:
typedef struct _KTRANSACTION_HISTORY { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ enum ___20100701102B1C00428CCE753AA77AFA2_RecordType RecordType;
/*0x004*/ ULONG32 Payload;
} KTRANSACTION_HISTORY, *PKTRANSACTION_HISTORY;
struct _KTRAP_FRAME
Referred from:
typedef struct _KTRAP_FRAME { // 64 elements, 0x190 bytes (sizeof)
/*0x000*/ UINT64 P1Home;
/*0x008*/ UINT64 P2Home;
/*0x010*/ UINT64 P3Home;
/*0x018*/ UINT64 P4Home;
/*0x020*/ UINT64 P5;
/*0x028*/ CHAR PreviousMode;
/*0x029*/ UINT8 PreviousIrql;
/*0x02A*/ UINT8 FaultIndicator;
/*0x02B*/ UINT8 ExceptionActive;
/*0x02C*/ ULONG32 MxCsr;
/*0x030*/ UINT64 Rax;
/*0x038*/ UINT64 Rcx;
/*0x040*/ UINT64 Rdx;
/*0x048*/ UINT64 R8;
/*0x050*/ UINT64 R9;
/*0x058*/ UINT64 R10;
/*0x060*/ UINT64 R11;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x068*/ UINT64 GsBase;
/*0x068*/ UINT64 GsSwap;
};
/*0x070*/ struct _M128A Xmm0; // 2 elements, 0x10 bytes (sizeof)
/*0x080*/ struct _M128A Xmm1; // 2 elements, 0x10 bytes (sizeof)
/*0x090*/ struct _M128A Xmm2; // 2 elements, 0x10 bytes (sizeof)
/*0x0A0*/ struct _M128A Xmm3; // 2 elements, 0x10 bytes (sizeof)
/*0x0B0*/ struct _M128A Xmm4; // 2 elements, 0x10 bytes (sizeof)
/*0x0C0*/ struct _M128A Xmm5; // 2 elements, 0x10 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
/*0x0D0*/ UINT64 FaultAddress;
/*0x0D0*/ UINT64 ContextRecord;
/*0x0D0*/ UINT64 TimeStampCKCL;
};
/*0x0D8*/ UINT64 Dr0;
/*0x0E0*/ UINT64 Dr1;
/*0x0E8*/ UINT64 Dr2;
/*0x0F0*/ UINT64 Dr3;
/*0x0F8*/ UINT64 Dr6;
/*0x100*/ UINT64 Dr7;
union { // 2 elements, 0x28 bytes (sizeof)
struct { // 5 elements, 0x28 bytes (sizeof)
/*0x108*/ UINT64 DebugControl;
/*0x110*/ UINT64 LastBranchToRip;
/*0x118*/ UINT64 LastBranchFromRip;
/*0x120*/ UINT64 LastExceptionToRip;
/*0x128*/ UINT64 LastExceptionFromRip;
};
struct { // 2 elements, 0x28 bytes (sizeof)
/*0x108*/ UINT64 LastBranchControl;
/*0x110*/ ULONG32 LastBranchMSR;
/*0x114*/ UINT8 _PADDING0_[0x1C];
};
};
/*0x130*/ UINT16 SegDs;
/*0x132*/ UINT16 SegEs;
/*0x134*/ UINT16 SegFs;
/*0x136*/ UINT16 SegGs;
/*0x138*/ UINT64 TrapFrame;
/*0x140*/ UINT64 Rbx;
/*0x148*/ UINT64 Rdi;
/*0x150*/ UINT64 Rsi;
/*0x158*/ UINT64 Rbp;
union { // 3 elements, 0x8 bytes (sizeof)
/*0x160*/ UINT64 ErrorCode;
/*0x160*/ UINT64 ExceptionFrame;
/*0x160*/ UINT64 TimeStampKlog;
};
/*0x168*/ UINT64 Rip;
/*0x170*/ UINT16 SegCs;
/*0x172*/ UINT8 Fill0;
/*0x173*/ UINT8 Logging;
/*0x174*/ UINT16 Fill1[2];
/*0x178*/ ULONG32 EFlags;
/*0x17C*/ ULONG32 Fill2;
/*0x180*/ UINT64 Rsp;
/*0x188*/ UINT16 SegSs;
/*0x18A*/ UINT16 Fill3;
/*0x18C*/ LONG32 CodePatchCycle;
} KTRAP_FRAME, *PKTRAP_FRAME;
struct _KTSS64
Referred from:
typedef struct _KTSS64 { // 8 elements, 0x68 bytes (sizeof)
/*0x000*/ ULONG32 Reserved0;
/*0x004*/ UINT64 Rsp0;
/*0x00C*/ UINT64 Rsp1;
/*0x014*/ UINT64 Rsp2;
/*0x01C*/ UINT64 Ist[8];
/*0x05C*/ UINT64 Reserved1;
/*0x064*/ UINT16 Reserved2;
/*0x066*/ UINT16 IoMapBase;
} KTSS64, *PKTSS64;
struct _KUSER_SHARED_DATA
typedef struct _KUSER_SHARED_DATA { // 55 elements, 0x3B8 bytes (sizeof)
/*0x000*/ ULONG32 TickCountLowDeprecated;
/*0x004*/ ULONG32 TickCountMultiplier;
/*0x008*/ struct _KSYSTEM_TIME InterruptTime; // 3 elements, 0xC bytes (sizeof)
/*0x014*/ struct _KSYSTEM_TIME SystemTime; // 3 elements, 0xC bytes (sizeof)
/*0x020*/ struct _KSYSTEM_TIME TimeZoneBias; // 3 elements, 0xC bytes (sizeof)
/*0x02C*/ UINT16 ImageNumberLow;
/*0x02E*/ UINT16 ImageNumberHigh;
/*0x030*/ WCHAR NtSystemRoot[260];
/*0x238*/ ULONG32 MaxStackTraceDepth;
/*0x23C*/ ULONG32 CryptoExponent;
/*0x240*/ ULONG32 TimeZoneId;
/*0x244*/ ULONG32 LargePageMinimum;
/*0x248*/ ULONG32 Reserved2[7];
/*0x264*/ enum _NT_PRODUCT_TYPE NtProductType;
/*0x268*/ UINT8 ProductTypeIsValid;
/*0x269*/ UINT8 _PADDING0_[0x3];
/*0x26C*/ ULONG32 NtMajorVersion;
/*0x270*/ ULONG32 NtMinorVersion;
/*0x274*/ UINT8 ProcessorFeatures[64];
/*0x2B4*/ ULONG32 Reserved1;
/*0x2B8*/ ULONG32 Reserved3;
/*0x2BC*/ ULONG32 TimeSlip;
/*0x2C0*/ enum _ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
/*0x2C4*/ UINT8 _PADDING1_[0x4];
/*0x2C8*/ union _LARGE_INTEGER SystemExpirationDate; // 4 elements, 0x8 bytes (sizeof)
/*0x2D0*/ ULONG32 SuiteMask;
/*0x2D4*/ UINT8 KdDebuggerEnabled;
/*0x2D5*/ UINT8 NXSupportPolicy;
/*0x2D6*/ UINT8 _PADDING2_[0x2];
/*0x2D8*/ ULONG32 ActiveConsoleId;
/*0x2DC*/ ULONG32 DismountCount;
/*0x2E0*/ ULONG32 ComPlusPackage;
/*0x2E4*/ ULONG32 LastSystemRITEventTickCount;
/*0x2E8*/ ULONG32 NumberOfPhysicalPages;
/*0x2EC*/ UINT8 SafeBootMode;
/*0x2ED*/ UINT8 _PADDING3_[0x3];
union { // 2 elements, 0x4 bytes (sizeof)
/*0x2F0*/ ULONG32 SharedDataFlags;
struct { // 6 elements, 0x4 bytes (sizeof)
/*0x2F0*/ ULONG32 DbgErrorPortPresent : 1; // 0 BitPosition
/*0x2F0*/ ULONG32 DbgElevationEnabled : 1; // 1 BitPosition
/*0x2F0*/ ULONG32 DbgVirtEnabled : 1; // 2 BitPosition
/*0x2F0*/ ULONG32 DbgInstallerDetectEnabled : 1; // 3 BitPosition
/*0x2F0*/ ULONG32 SystemDllRelocated : 1; // 4 BitPosition
/*0x2F0*/ ULONG32 SpareBits : 27; // 5 BitPosition
};
};
/*0x2F8*/ UINT64 TestRetInstruction;
/*0x300*/ ULONG32 SystemCall;
/*0x304*/ ULONG32 SystemCallReturn;
/*0x308*/ UINT64 SystemCallPad[3];
union { // 2 elements, 0x10 bytes (sizeof)
/*0x320*/ struct _KSYSTEM_TIME TickCount; // 3 elements, 0xC bytes (sizeof)
/*0x320*/ UINT64 TickCountQuad;
};
/*0x330*/ ULONG32 Cookie;
/*0x334*/ UINT8 _PADDING4_[0x4];
/*0x338*/ INT64 ConsoleSessionForegroundProcessId;
/*0x340*/ ULONG32 Wow64SharedInformation[16];
/*0x380*/ UINT16 UserModeGlobalLogger[8];
/*0x390*/ ULONG32 HeapTracingPid[2];
/*0x398*/ ULONG32 CritSecTracingPid[2];
/*0x3A0*/ ULONG32 ImageFileExecutionOptions;
/*0x3A4*/ UINT8 _PADDING5_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x3A8*/ UINT64 AffinityPad;
/*0x3A8*/ UINT64 ActiveProcessorAffinity;
};
/*0x3B0*/ UINT64 InterruptTimeBias;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
struct _KWAIT_BLOCK
Referred from:
typedef struct _KWAIT_BLOCK { // 8 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY WaitListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _KTHREAD* Thread;
/*0x018*/ VOID* Object;
/*0x020*/ struct _KWAIT_BLOCK* NextWaitBlock;
/*0x028*/ UINT16 WaitKey;
/*0x02A*/ UINT8 WaitType;
/*0x02B*/ UINT8 SpareByte;
/*0x02C*/ LONG32 SpareLong;
} KWAIT_BLOCK, *PKWAIT_BLOCK;
struct _LDR_DATA_TABLE_ENTRY
typedef struct _LDR_DATA_TABLE_ENTRY { // 21 elements, 0xC8 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY InLoadOrderLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY InMemoryOrderLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY InInitializationOrderLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ VOID* DllBase;
/*0x038*/ VOID* EntryPoint;
/*0x040*/ ULONG32 SizeOfImage;
/*0x044*/ UINT8 _PADDING0_[0x4];
/*0x048*/ struct _UNICODE_STRING FullDllName; // 3 elements, 0x10 bytes (sizeof)
/*0x058*/ struct _UNICODE_STRING BaseDllName; // 3 elements, 0x10 bytes (sizeof)
/*0x068*/ ULONG32 Flags;
/*0x06C*/ UINT16 LoadCount;
/*0x06E*/ UINT16 TlsIndex;
union { // 2 elements, 0x10 bytes (sizeof)
/*0x070*/ struct _LIST_ENTRY HashLinks; // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x070*/ VOID* SectionPointer;
/*0x078*/ ULONG32 CheckSum;
/*0x07C*/ UINT8 _PADDING1_[0x4];
};
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x080*/ ULONG32 TimeDateStamp;
/*0x080*/ VOID* LoadedImports;
};
/*0x088*/ struct _ACTIVATION_CONTEXT* EntryPointActivationContext;
/*0x090*/ VOID* PatchInformation;
/*0x098*/ struct _LIST_ENTRY ForwarderLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x0A8*/ struct _LIST_ENTRY ServiceTagLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x0B8*/ struct _LIST_ENTRY StaticLinks; // 2 elements, 0x10 bytes (sizeof)
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
struct _LIST_ENTRY
Referred from:
typedef struct _LIST_ENTRY { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY* Flink;
/*0x008*/ struct _LIST_ENTRY* Blink;
} LIST_ENTRY, *PLIST_ENTRY;
struct _LIST_ENTRY32
Referred from:
typedef struct _LIST_ENTRY32 { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Flink;
/*0x004*/ ULONG32 Blink;
} LIST_ENTRY32, *PLIST_ENTRY32;
struct _LIST_ENTRY64
Referred from:
typedef struct _LIST_ENTRY64 { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Flink;
/*0x008*/ UINT64 Blink;
} LIST_ENTRY64, *PLIST_ENTRY64;
struct _LOADER_PARAMETER_BLOCK
typedef struct _LOADER_PARAMETER_BLOCK { // 22 elements, 0xE8 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY LoadOrderListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY MemoryDescriptorListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY BootDriverListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ UINT64 KernelStack;
/*0x038*/ UINT64 Prcb;
/*0x040*/ UINT64 Process;
/*0x048*/ UINT64 Thread;
/*0x050*/ ULONG32 RegistryLength;
/*0x054*/ UINT8 _PADDING0_[0x4];
/*0x058*/ VOID* RegistryBase;
/*0x060*/ struct _CONFIGURATION_COMPONENT_DATA* ConfigurationRoot;
/*0x068*/ CHAR* ArcBootDeviceName;
/*0x070*/ CHAR* ArcHalDeviceName;
/*0x078*/ CHAR* NtBootPathName;
/*0x080*/ CHAR* NtHalPathName;
/*0x088*/ CHAR* LoadOptions;
/*0x090*/ struct _NLS_DATA_BLOCK* NlsData;
/*0x098*/ struct _ARC_DISK_INFORMATION* ArcDiskInformation;
/*0x0A0*/ VOID* OemFontFile;
/*0x0A8*/ struct _SETUP_LOADER_BLOCK* SetupLoaderBlock;
/*0x0B0*/ struct _LOADER_PARAMETER_EXTENSION* Extension;
union { // 3 elements, 0x10 bytes (sizeof)
/*0x0B8*/ struct _I386_LOADER_BLOCK I386; // 3 elements, 0x10 bytes (sizeof)
/*0x0B8*/ struct _ALPHA_LOADER_BLOCK Alpha; // 1 elements, 0x4 bytes (sizeof)
/*0x0B8*/ struct _IA64_LOADER_BLOCK Ia64; // 1 elements, 0x4 bytes (sizeof)
} u;
/*0x0C8*/ struct _FIRMWARE_INFORMATION_LOADER_BLOCK FirmwareInformation; // 3 elements, 0x20 bytes (sizeof)
} LOADER_PARAMETER_BLOCK, *PLOADER_PARAMETER_BLOCK;
struct _LOADER_PARAMETER_EXTENSION
Referred from:
typedef struct _LOADER_PARAMETER_EXTENSION { // 22 elements, 0xB8 bytes (sizeof)
/*0x000*/ ULONG32 Size;
/*0x004*/ struct _PROFILE_PARAMETER_BLOCK Profile; // 6 elements, 0x10 bytes (sizeof)
/*0x014*/ ULONG32 MajorVersion;
/*0x018*/ ULONG32 MinorVersion;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ VOID* EmInfFileImage;
/*0x028*/ ULONG32 EmInfFileSize;
/*0x02C*/ UINT8 _PADDING1_[0x4];
/*0x030*/ VOID* TriageDumpBlock;
/*0x038*/ ULONG32 LoaderPagesSpanned;
/*0x03C*/ UINT8 _PADDING2_[0x4];
/*0x040*/ struct _HEADLESS_LOADER_BLOCK* HeadlessLoaderBlock;
/*0x048*/ struct _SMBIOS_TABLE_HEADER* SMBiosEPSHeader;
/*0x050*/ VOID* DrvDBImage;
/*0x058*/ ULONG32 DrvDBSize;
/*0x05C*/ UINT8 _PADDING3_[0x4];
/*0x060*/ struct _NETWORK_LOADER_BLOCK* NetworkLoaderBlock;
/*0x068*/ struct _LIST_ENTRY FirmwareDescriptorListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x078*/ VOID* AcpiTable;
/*0x080*/ ULONG32 AcpiTableSize;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x084*/ ULONG32 BootViaWinload : 1; // 0 BitPosition
/*0x084*/ ULONG32 Reserved : 31; // 1 BitPosition
};
/*0x088*/ struct _LOADER_PERFORMANCE_DATA* LoaderPerformanceData;
/*0x090*/ struct _LIST_ENTRY BootApplicationPersistentData; // 2 elements, 0x10 bytes (sizeof)
/*0x0A0*/ VOID* WmdTestResult;
/*0x0A8*/ struct _GUID BootIdentifier; // 4 elements, 0x10 bytes (sizeof)
} LOADER_PARAMETER_EXTENSION, *PLOADER_PARAMETER_EXTENSION;
Referred from:
typedef struct _LOADER_PERFORMANCE_DATA { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 StartTime;
/*0x008*/ UINT64 EndTime;
} LOADER_PERFORMANCE_DATA, *PLOADER_PERFORMANCE_DATA;
struct _LOOKASIDE_LIST_EX
typedef struct _LOOKASIDE_LIST_EX { // 1 elements, 0x60 bytes (sizeof)
/*0x000*/ struct _GENERAL_LOOKASIDE_POOL L; // 22 elements, 0x60 bytes (sizeof)
} LOOKASIDE_LIST_EX, *PLOOKASIDE_LIST_EX;
struct _LPCP_MESSAGE
typedef struct _LPCP_MESSAGE { // 7 elements, 0x50 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Entry; // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY FreeEntry; // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 Reserved0;
/*0x00C*/ UINT8 _PADDING0_[0x4];
};
};
/*0x010*/ VOID* SenderPort;
/*0x018*/ struct _ETHREAD* RepliedToThread;
/*0x020*/ VOID* PortContext;
/*0x028*/ struct _PORT_MESSAGE Request; // 7 elements, 0x28 bytes (sizeof)
} LPCP_MESSAGE, *PLPCP_MESSAGE;
struct _LPCP_NONPAGED_PORT_QUEUE
Referred from:
typedef struct _LPCP_NONPAGED_PORT_QUEUE { // 2 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _KSEMAPHORE Semaphore; // 2 elements, 0x20 bytes (sizeof)
/*0x020*/ struct _LPCP_PORT_OBJECT* BackPointer;
} LPCP_NONPAGED_PORT_QUEUE, *PLPCP_NONPAGED_PORT_QUEUE;
struct _LPCP_PORT_OBJECT
Referred from:
typedef struct _LPCP_PORT_OBJECT { // 18 elements, 0x100 bytes (sizeof)
/*0x000*/ struct _LPCP_PORT_OBJECT* ConnectionPort;
/*0x008*/ struct _LPCP_PORT_OBJECT* ConnectedPort;
/*0x010*/ struct _LPCP_PORT_QUEUE MsgQueue; // 3 elements, 0x20 bytes (sizeof)
/*0x030*/ struct _CLIENT_ID Creator; // 2 elements, 0x10 bytes (sizeof)
/*0x040*/ VOID* ClientSectionBase;
/*0x048*/ VOID* ServerSectionBase;
/*0x050*/ VOID* PortContext;
/*0x058*/ struct _ETHREAD* ClientThread;
/*0x060*/ struct _SECURITY_QUALITY_OF_SERVICE SecurityQos; // 4 elements, 0xC bytes (sizeof)
/*0x06C*/ UINT8 _PADDING0_[0x4];
/*0x070*/ struct _SECURITY_CLIENT_CONTEXT StaticSecurity; // 6 elements, 0x48 bytes (sizeof)
/*0x0B8*/ struct _LIST_ENTRY LpcReplyChainHead; // 2 elements, 0x10 bytes (sizeof)
/*0x0C8*/ struct _LIST_ENTRY LpcDataInfoChainHead; // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x0D8*/ struct _EPROCESS* ServerProcess;
/*0x0D8*/ struct _EPROCESS* MappingProcess;
};
/*0x0E0*/ UINT16 MaxMessageLength;
/*0x0E2*/ UINT16 MaxConnectionInfoLength;
/*0x0E4*/ ULONG32 Flags;
/*0x0E8*/ struct _KEVENT WaitEvent; // 1 elements, 0x18 bytes (sizeof)
} LPCP_PORT_OBJECT, *PLPCP_PORT_OBJECT;
struct _LPCP_PORT_QUEUE
Referred from:
typedef struct _LPCP_PORT_QUEUE { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LPCP_NONPAGED_PORT_QUEUE* NonPagedPortQueue;
/*0x008*/ struct _KSEMAPHORE* Semaphore;
/*0x010*/ struct _LIST_ENTRY ReceiveHead; // 2 elements, 0x10 bytes (sizeof)
} LPCP_PORT_QUEUE, *PLPCP_PORT_QUEUE;
struct _LUID
Referred from:
typedef struct _LUID { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 LowPart;
/*0x004*/ LONG32 HighPart;
} LUID, *PLUID;
struct _LUID_AND_ATTRIBUTES
Referred from:
typedef struct _LUID_AND_ATTRIBUTES { // 2 elements, 0xC bytes (sizeof)
/*0x000*/ struct _LUID Luid; // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 Attributes;
} LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
struct _M128A
Referred from:
typedef struct _M128A {// 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Low;
/*0x008*/ INT64 High;
} M128A, *PM128A;
struct _MAILSLOT_CREATE_PARAMETERS
Referred from:
typedef struct _MAILSLOT_CREATE_PARAMETERS { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 MailslotQuota;
/*0x004*/ ULONG32 MaximumMessageSize;
/*0x008*/ union _LARGE_INTEGER ReadTimeout; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT8 TimeoutSpecified;
/*0x011*/ UINT8 _PADDING0_[0x7];
} MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS;
struct _MAPPED_FILE_SEGMENT
typedef struct _MAPPED_FILE_SEGMENT { // 10 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _CONTROL_AREA* ControlArea;
/*0x008*/ ULONG32 TotalNumberOfPtes;
/*0x00C*/ ULONG32 NonExtendedPtes;
/*0x010*/ UINT64 NumberOfCommittedPages;
/*0x018*/ UINT64 SizeOfSegment;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _MMEXTEND_INFO* ExtendInfo;
/*0x020*/ VOID* BasedAddress;
};
/*0x028*/ struct _EX_PUSH_LOCK SegmentLock; // 7 elements, 0x8 bytes (sizeof)
/*0x030*/ struct _SEGMENT_FLAGS SegmentFlags; // 12 elements, 0x8 bytes (sizeof)
/*0x038*/ struct _MSUBSECTION* LastSubsectionHint;
} MAPPED_FILE_SEGMENT, *PMAPPED_FILE_SEGMENT;
struct _MBCB
Referred from:
typedef struct _MBCB { // 10 elements, 0xB8 bytes (sizeof)
/*0x000*/ INT16 NodeTypeCode;
/*0x002*/ INT16 NodeIsInZone;
/*0x004*/ ULONG32 PagesToWrite;
/*0x008*/ ULONG32 DirtyPages;
/*0x00C*/ ULONG32 Reserved;
/*0x010*/ struct _LIST_ENTRY BitmapRanges; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ INT64 ResumeWritePage;
/*0x028*/ struct _BITMAP_RANGE BitmapRange1; // 6 elements, 0x30 bytes (sizeof)
/*0x058*/ struct _BITMAP_RANGE BitmapRange2; // 6 elements, 0x30 bytes (sizeof)
/*0x088*/ struct _BITMAP_RANGE BitmapRange3; // 6 elements, 0x30 bytes (sizeof)
} MBCB, *PMBCB;
struct _MDL
Referred from:
typedef struct _MDL { // 8 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _MDL* Next;
/*0x008*/ INT16 Size;
/*0x00A*/ INT16 MdlFlags;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _EPROCESS* Process;
/*0x018*/ VOID* MappedSystemVa;
/*0x020*/ VOID* StartVa;
/*0x028*/ ULONG32 ByteCount;
/*0x02C*/ ULONG32 ByteOffset;
} MDL, *PMDL;
struct _MEMORY_ALLOCATION_DESCRIPTOR
typedef struct _MEMORY_ALLOCATION_DESCRIPTOR { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ enum _TYPE_OF_MEMORY MemoryType;
/*0x014*/ ULONG32 BasePage;
/*0x018*/ ULONG32 PageCount;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} MEMORY_ALLOCATION_DESCRIPTOR, *PMEMORY_ALLOCATION_DESCRIPTOR;
struct _MI_COLOR_BASE
typedef struct _MI_COLOR_BASE { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16* ColorPointer;
/*0x008*/ UINT16 ColorMask;
/*0x00A*/ UINT16 ColorNode;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} MI_COLOR_BASE, *PMI_COLOR_BASE;
Referred from:
typedef struct _MI_EXTRA_IMAGE_INFORMATION { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 SizeOfHeaders;
} MI_EXTRA_IMAGE_INFORMATION, *PMI_EXTRA_IMAGE_INFORMATION;
struct _MI_IMAGE_SECURITY_REFERENCE
Referred from:
typedef struct _MI_IMAGE_SECURITY_REFERENCE { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _IMAGE_SECURITY_CONTEXT SecurityContext; // 6 elements, 0x8 bytes (sizeof)
/*0x008*/ VOID* DynamicRelocations;
/*0x010*/ LONG32 ReferenceCount;
/*0x014*/ UINT8 _PADDING0_[0x4];
} MI_IMAGE_SECURITY_REFERENCE, *PMI_IMAGE_SECURITY_REFERENCE;
struct _MI_PAGEFILE_TRACES
typedef struct _MI_PAGEFILE_TRACES { // 9 elements, 0x68 bytes (sizeof)
/*0x000*/ LONG32 Status;
/*0x004*/ UINT8 Priority;
/*0x005*/ UINT8 IrpPriority;
/*0x006*/ UINT8 _PADDING0_[0x2];
/*0x008*/ union _LARGE_INTEGER CurrentTime; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT64 AvailablePages;
/*0x018*/ UINT64 ModifiedPagesTotal;
/*0x020*/ UINT64 ModifiedPagefilePages;
/*0x028*/ UINT64 ModifiedNoWritePages;
struct { // 2 elements, 0x38 bytes (sizeof)
/*0x030*/ struct _MDL Mdl; // 8 elements, 0x30 bytes (sizeof)
/*0x060*/ UINT64 Page[1];
} MdlHack;
} MI_PAGEFILE_TRACES, *PMI_PAGEFILE_TRACES;
struct _MI_PER_SESSION_PROTOS
Referred from:
typedef struct _MI_PER_SESSION_PROTOS { // 9 elements, 0x38 bytes (sizeof)
union { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 Balance : 2; // 0 BitPosition
/*0x000*/ struct _MMADDRESS_NODE* Parent;
/*0x000*/ struct _MI_PER_SESSION_PROTOS* NextToFree;
} u1;
/*0x008*/ struct _MMADDRESS_NODE* LeftChild;
/*0x010*/ struct _MMADDRESS_NODE* RightChild;
union { // 3 elements, 0x8 bytes (sizeof)
/*0x018*/ ULONG32 SessionId;
/*0x018*/ UINT64 StartingVpn;
/*0x018*/ struct _SUBSECTION* Subsection;
};
/*0x020*/ UINT64 EndingVpn;
/*0x028*/ struct _MMPTE* SubsectionBase;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x030*/ ULONG32 ReferenceCount;
/*0x030*/ ULONG32 NumberOfPtesToFree;
} u2;
} MI_PER_SESSION_PROTOS, *PMI_PER_SESSION_PROTOS;
struct _MI_SECTION_CREATION_EVENT
Referred from:
typedef struct _MI_SECTION_CREATION_EVENT { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _MI_SECTION_CREATION_EVENT* Next;
/*0x008*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
} MI_SECTION_CREATION_EVENT, *PMI_SECTION_CREATION_EVENT;
Referred from:
typedef struct _MI_SECTION_IMAGE_INFORMATION { // 2 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _SECTION_IMAGE_INFORMATION ExportedImageInformation; // 21 elements, 0x40 bytes (sizeof)
/*0x040*/ struct _MI_EXTRA_IMAGE_INFORMATION InternalImageInformation; // 1 elements, 0x4 bytes (sizeof)
/*0x044*/ UINT8 _PADDING0_[0x4];
} MI_SECTION_IMAGE_INFORMATION, *PMI_SECTION_IMAGE_INFORMATION;
struct _MI_SPECIAL_POOL
Referred from:
typedef struct _MI_SPECIAL_POOL { // 5 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _MMPTE* PteBase;
/*0x008*/ struct _MMPTE FreePteHead; // 1 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _MMPTE FreePteTail; // 1 elements, 0x8 bytes (sizeof)
/*0x018*/ INT64 PagesInUse;
/*0x020*/ struct _RTL_BITMAP SpecialPoolPdes; // 2 elements, 0x10 bytes (sizeof)
} MI_SPECIAL_POOL, *PMI_SPECIAL_POOL;
struct _MI_SYSTEM_PTE_TYPE
Referred from:
typedef struct _MI_SYSTEM_PTE_TYPE { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _MMPTE* FirstFreePte;
/*0x008*/ ULONG32* FailureCount;
/*0x010*/ struct _KGUARDED_MUTEX* GlobalMutex;
/*0x018*/ ULONG32 TbFlushTimeStamp;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} MI_SYSTEM_PTE_TYPE, *PMI_SYSTEM_PTE_TYPE;
struct _MI_VERIFIER_DRIVER_ENTRY
typedef struct _MI_VERIFIER_DRIVER_ENTRY { // 18 elements, 0xA0 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Links; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 Loads;
/*0x014*/ ULONG32 Unloads;
/*0x018*/ struct _UNICODE_STRING BaseName; // 3 elements, 0x10 bytes (sizeof)
/*0x028*/ VOID* StartAddress;
/*0x030*/ VOID* EndAddress;
/*0x038*/ ULONG32 Flags;
/*0x03C*/ UINT8 _PADDING0_[0x4];
/*0x040*/ UINT64 Signature;
/*0x048*/ UINT8 _PADDING1_[0x8];
/*0x050*/ union _SLIST_HEADER PoolPageHeaders; // 4 elements, 0x10 bytes (sizeof)
/*0x060*/ union _SLIST_HEADER PoolTrackers; // 4 elements, 0x10 bytes (sizeof)
/*0x070*/ ULONG32 CurrentPagedPoolAllocations;
/*0x074*/ ULONG32 CurrentNonPagedPoolAllocations;
/*0x078*/ ULONG32 PeakPagedPoolAllocations;
/*0x07C*/ ULONG32 PeakNonPagedPoolAllocations;
/*0x080*/ UINT64 PagedBytes;
/*0x088*/ UINT64 NonPagedBytes;
/*0x090*/ UINT64 PeakPagedBytes;
/*0x098*/ UINT64 PeakNonPagedBytes;
} MI_VERIFIER_DRIVER_ENTRY, *PMI_VERIFIER_DRIVER_ENTRY;
typedef struct _MI_VERIFIER_POOL_HEADER { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _VI_POOL_ENTRY* VerifierPoolEntry;
} MI_VERIFIER_POOL_HEADER, *PMI_VERIFIER_POOL_HEADER;
struct _MMADDRESS_LIST
Referred from:
typedef struct _MMADDRESS_LIST { // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMSECURE_FLAGS Flags; // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ VOID* StartVa;
} u1;
/*0x008*/ VOID* EndVa;
} MMADDRESS_LIST, *PMMADDRESS_LIST;
struct _MMADDRESS_NODE
Referred from:
typedef struct _MMADDRESS_NODE { // 5 elements, 0x28 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 Balance : 2; // 0 BitPosition
/*0x000*/ struct _MMADDRESS_NODE* Parent;
} u1;
/*0x008*/ struct _MMADDRESS_NODE* LeftChild;
/*0x010*/ struct _MMADDRESS_NODE* RightChild;
/*0x018*/ UINT64 StartingVpn;
/*0x020*/ UINT64 EndingVpn;
} MMADDRESS_NODE, *PMMADDRESS_NODE;
struct _MMBANKED_SECTION
Referred from:
typedef struct _MMBANKED_SECTION { // 8 elements, 0x38 bytes (sizeof)
/*0x000*/ UINT64 BasePhysicalPage;
/*0x008*/ struct _MMPTE* BasedPte;
/*0x010*/ ULONG32 BankSize;
/*0x014*/ ULONG32 BankShift;
/*0x018*/ PVOID BankedRoutine;
/*0x020*/ VOID* Context;
/*0x028*/ struct _MMPTE* CurrentMappedPte;
/*0x030*/ struct _MMPTE BankTemplate[1];
} MMBANKED_SECTION, *PMMBANKED_SECTION;
struct _MMEXTEND_INFO
Referred from:
typedef struct _MMEXTEND_INFO { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 CommittedSize;
/*0x008*/ ULONG32 ReferenceCount;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} MMEXTEND_INFO, *PMMEXTEND_INFO;
struct _MMMOD_WRITER_MDL_ENTRY
Referred from:
typedef struct _MMMOD_WRITER_MDL_ENTRY { // 13 elements, 0xA0 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Links; // 2 elements, 0x10 bytes (sizeof)
union { // 1 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _IO_STATUS_BLOCK IoStatus; // 3 elements, 0x10 bytes (sizeof)
} u;
/*0x020*/ struct _IRP* Irp;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 LastPageToWrite;
/*0x028*/ UINT64 KeepForever;
} u1;
/*0x030*/ struct _MMPAGING_FILE* PagingFile;
/*0x038*/ struct _FILE_OBJECT* File;
/*0x040*/ struct _CONTROL_AREA* ControlArea;
/*0x048*/ struct _ERESOURCE* FileResource;
/*0x050*/ union _LARGE_INTEGER WriteOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x058*/ union _LARGE_INTEGER IssueTime; // 4 elements, 0x8 bytes (sizeof)
/*0x060*/ struct _MDL* PointerMdl;
/*0x068*/ struct _MDL Mdl; // 8 elements, 0x30 bytes (sizeof)
/*0x098*/ UINT64 Page[1];
} MMMOD_WRITER_MDL_ENTRY, *PMMMOD_WRITER_MDL_ENTRY;
struct _MMPAGING_FILE
Referred from:
typedef struct _MMPAGING_FILE { // 20 elements, 0xA0 bytes (sizeof)
/*0x000*/ UINT64 Size;
/*0x008*/ UINT64 MaximumSize;
/*0x010*/ UINT64 MinimumSize;
/*0x018*/ UINT64 FreeSpace;
/*0x020*/ UINT64 PeakUsage;
/*0x028*/ UINT64 HighestPage;
/*0x030*/ struct _FILE_OBJECT* File;
/*0x038*/ struct _MMMOD_WRITER_MDL_ENTRY* Entry[2];
/*0x048*/ struct _UNICODE_STRING PageFileName; // 3 elements, 0x10 bytes (sizeof)
/*0x058*/ struct _RTL_BITMAP* Bitmap;
/*0x060*/ ULONG32 BitmapHint;
/*0x064*/ ULONG32 LastAllocationSize;
struct { // 3 elements, 0x2 bytes (sizeof)
/*0x068*/ UINT16 PageFileNumber : 4; // 0 BitPosition
/*0x068*/ UINT16 BootPartition : 1; // 4 BitPosition
/*0x068*/ UINT16 Spare0 : 11; // 5 BitPosition
};
struct { // 2 elements, 0x2 bytes (sizeof)
/*0x06A*/ UINT16 AdriftMdls : 1; // 0 BitPosition
/*0x06A*/ UINT16 Spare1 : 15; // 1 BitPosition
};
/*0x070*/ VOID* FileHandle;
/*0x078*/ UINT8 _PADDING0_[0x8];
/*0x080*/ union _SLIST_HEADER AvailableList; // 4 elements, 0x10 bytes (sizeof)
/*0x090*/ union _SLIST_HEADER NeedProcessingList; // 4 elements, 0x10 bytes (sizeof)
} MMPAGING_FILE, *PMMPAGING_FILE;
struct _MMPAGING_FILE_FREE_ENTRY
typedef struct _MMPAGING_FILE_FREE_ENTRY { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY ListEntry; // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 FreeBit;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} MMPAGING_FILE_FREE_ENTRY, *PMMPAGING_FILE_FREE_ENTRY;
struct _MMPFN
typedef struct _MMPFN { // 11 elements, 0x30 bytes (sizeof)
union { // 7 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Flink;
/*0x000*/ ULONG32 WsIndex;
/*0x000*/ struct _KEVENT* Event;
/*0x000*/ VOID* Next;
/*0x000*/ VOID* VolatileNext;
/*0x000*/ struct _KTHREAD* KernelStackOwner;
/*0x000*/ struct _SINGLE_LIST_ENTRY NextStackPfn; // 1 elements, 0x8 bytes (sizeof)
} u1;
union { // 3 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT64 Blink;
/*0x008*/ struct _MMPTE* ImageProtoPte;
/*0x008*/ UINT64 ShareCount;
} u2;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _MMPTE* PteAddress;
/*0x010*/ VOID* VolatilePteAddress;
};
union { // 4 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x018*/ UINT16 ReferenceCount;
/*0x01A*/ struct _MMPFNENTRY e1; // 11 elements, 0x2 bytes (sizeof)
};
struct { // 3 elements, 0x4 bytes (sizeof)
union { // 2 elements, 0x2 bytes (sizeof)
/*0x018*/ UINT16 ReferenceCount;
/*0x018*/ INT16 VolatileReferenceCount;
};
/*0x01A*/ UINT16 ShortFlags;
} e2;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x018*/ UINT16 ReferenceCount;
/*0x01A*/ UINT8 ByteFlags;
/*0x01B*/ UINT8 InterlockedByteFlags;
} e3;
} u3;
/*0x01C*/ UINT16 UsedPageTableEntries;
/*0x01E*/ UINT8 VaType;
/*0x01F*/ UINT8 ViewCount;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _MMPTE OriginalPte; // 1 elements, 0x8 bytes (sizeof)
/*0x020*/ LONG32 AweReferenceCount;
};
union { // 6 elements, 0x8 bytes (sizeof)
struct { // 6 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 PteFrame : 52; // 0 BitPosition
/*0x028*/ UINT64 Unused : 3; // 52 BitPosition
/*0x028*/ UINT64 PfnImageVerified : 1; // 55 BitPosition
/*0x028*/ UINT64 AweAllocation : 1; // 56 BitPosition
/*0x028*/ UINT64 PrototypePte : 1; // 57 BitPosition
/*0x028*/ UINT64 PageColor : 6; // 58 BitPosition
};
} u4;
} MMPFN, *PMMPFN;
struct _MMPFNENTRY
Referred from:
typedef struct _MMPFNENTRY { // 11 elements, 0x2 bytes (sizeof)
struct { // 5 elements, 0x1 bytes (sizeof)
/*0x000*/ UINT8 PageLocation : 3; // 0 BitPosition
/*0x000*/ UINT8 WriteInProgress : 1; // 3 BitPosition
/*0x000*/ UINT8 Modified : 1; // 4 BitPosition
/*0x000*/ UINT8 ReadInProgress : 1; // 5 BitPosition
/*0x000*/ UINT8 CacheAttribute : 2; // 6 BitPosition
};
struct { // 6 elements, 0x1 bytes (sizeof)
/*0x001*/ UINT8 Priority : 3; // 0 BitPosition
/*0x001*/ UINT8 Rom : 1; // 3 BitPosition
/*0x001*/ UINT8 InPageError : 1; // 4 BitPosition
/*0x001*/ UINT8 KernelStack : 1; // 5 BitPosition
/*0x001*/ UINT8 RemovalRequested : 1; // 6 BitPosition
/*0x001*/ UINT8 ParityError : 1; // 7 BitPosition
};
} MMPFNENTRY, *PMMPFNENTRY;
struct _MMPFNLIST
typedef struct _MMPFNLIST { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 Total;
/*0x008*/ enum _MMLISTS ListName;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 Flink;
/*0x018*/ UINT64 Blink;
} MMPFNLIST, *PMMPFNLIST;
struct _MMPTE
Referred from:
typedef struct _MMPTE { // 1 elements, 0x8 bytes (sizeof)
union { // 10 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Long;
/*0x000*/ UINT64 VolatileLong;
/*0x000*/ struct _MMPTE_HARDWARE Hard; // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_HARDWARE_LARGEPAGE HardLarge; // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _HARDWARE_PTE Flush; // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_PROTOTYPE Proto; // 7 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_SOFTWARE Soft; // 8 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_TRANSITION Trans; // 10 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_SUBSECTION Subsect; // 6 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMPTE_LIST List; // 8 elements, 0x8 bytes (sizeof)
} u;
} MMPTE, *PMMPTE;
struct _MMPTE_HARDWARE
Referred from:
typedef struct _MMPTE_HARDWARE { // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Dirty1 : 1; // 1 BitPosition
/*0x000*/ UINT64 Owner : 1; // 2 BitPosition
/*0x000*/ UINT64 WriteThrough : 1; // 3 BitPosition
/*0x000*/ UINT64 CacheDisable : 1; // 4 BitPosition
/*0x000*/ UINT64 Accessed : 1; // 5 BitPosition
/*0x000*/ UINT64 Dirty : 1; // 6 BitPosition
/*0x000*/ UINT64 LargePage : 1; // 7 BitPosition
/*0x000*/ UINT64 Global : 1; // 8 BitPosition
/*0x000*/ UINT64 CopyOnWrite : 1; // 9 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Write : 1; // 11 BitPosition
/*0x000*/ UINT64 PageFrameNumber : 28; // 12 BitPosition
/*0x000*/ UINT64 reserved1 : 12; // 40 BitPosition
/*0x000*/ UINT64 SoftwareWsIndex : 11; // 52 BitPosition
/*0x000*/ UINT64 NoExecute : 1; // 63 BitPosition
} MMPTE_HARDWARE, *PMMPTE_HARDWARE;
struct _MMPTE_HARDWARE_LARGEPAGE
Referred from:
typedef struct _MMPTE_HARDWARE_LARGEPAGE { // 16 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Dirty1 : 1; // 1 BitPosition
/*0x000*/ UINT64 Owner : 1; // 2 BitPosition
/*0x000*/ UINT64 WriteThrough : 1; // 3 BitPosition
/*0x000*/ UINT64 CacheDisable : 1; // 4 BitPosition
/*0x000*/ UINT64 Accessed : 1; // 5 BitPosition
/*0x000*/ UINT64 Dirty : 1; // 6 BitPosition
/*0x000*/ UINT64 LargePage : 1; // 7 BitPosition
/*0x000*/ UINT64 Global : 1; // 8 BitPosition
/*0x000*/ UINT64 CopyOnWrite : 1; // 9 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Write : 1; // 11 BitPosition
/*0x000*/ UINT64 PAT : 1; // 12 BitPosition
/*0x000*/ UINT64 reserved1 : 8; // 13 BitPosition
/*0x000*/ UINT64 PageFrameNumber : 19; // 21 BitPosition
/*0x000*/ UINT64 reserved2 : 24; // 40 BitPosition
} MMPTE_HARDWARE_LARGEPAGE, *PMMPTE_HARDWARE_LARGEPAGE;
struct _MMPTE_LIST
Referred from:
typedef struct _MMPTE_LIST { // 8 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 OneEntry : 1; // 1 BitPosition
/*0x000*/ UINT64 filler0 : 3; // 2 BitPosition
/*0x000*/ UINT64 Protection : 5; // 5 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Transition : 1; // 11 BitPosition
/*0x000*/ UINT64 filler1 : 20; // 12 BitPosition
/*0x000*/ UINT64 NextEntry : 32; // 32 BitPosition
} MMPTE_LIST, *PMMPTE_LIST;
struct _MMPTE_PROTOTYPE
Referred from:
typedef struct _MMPTE_PROTOTYPE { // 7 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Unused0 : 7; // 1 BitPosition
/*0x000*/ UINT64 ReadOnly : 1; // 8 BitPosition
/*0x000*/ UINT64 Unused1 : 1; // 9 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Protection : 5; // 11 BitPosition
/*0x000*/ INT64 ProtoAddress : 48; // 16 BitPosition
} MMPTE_PROTOTYPE, *PMMPTE_PROTOTYPE;
struct _MMPTE_SOFTWARE
Referred from:
typedef struct _MMPTE_SOFTWARE { // 8 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 PageFileLow : 4; // 1 BitPosition
/*0x000*/ UINT64 Protection : 5; // 5 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Transition : 1; // 11 BitPosition
/*0x000*/ UINT64 UsedPageTableEntries : 10; // 12 BitPosition
/*0x000*/ UINT64 Reserved : 10; // 22 BitPosition
/*0x000*/ UINT64 PageFileHigh : 32; // 32 BitPosition
} MMPTE_SOFTWARE, *PMMPTE_SOFTWARE;
struct _MMPTE_SUBSECTION
Referred from:
typedef struct _MMPTE_SUBSECTION { // 6 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Unused0 : 4; // 1 BitPosition
/*0x000*/ UINT64 Protection : 5; // 5 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Unused1 : 5; // 11 BitPosition
/*0x000*/ INT64 SubsectionAddress : 48; // 16 BitPosition
} MMPTE_SUBSECTION, *PMMPTE_SUBSECTION;
struct _MMPTE_TRANSITION
Referred from:
typedef struct _MMPTE_TRANSITION { // 10 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 Write : 1; // 1 BitPosition
/*0x000*/ UINT64 Owner : 1; // 2 BitPosition
/*0x000*/ UINT64 WriteThrough : 1; // 3 BitPosition
/*0x000*/ UINT64 CacheDisable : 1; // 4 BitPosition
/*0x000*/ UINT64 Protection : 5; // 5 BitPosition
/*0x000*/ UINT64 Prototype : 1; // 10 BitPosition
/*0x000*/ UINT64 Transition : 1; // 11 BitPosition
/*0x000*/ UINT64 PageFrameNumber : 28; // 12 BitPosition
/*0x000*/ UINT64 Unused : 24; // 40 BitPosition
} MMPTE_TRANSITION, *PMMPTE_TRANSITION;
struct _MMSECTION_FLAGS
Referred from:
typedef struct _MMSECTION_FLAGS { // 27 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT32 BeingDeleted : 1; // 0 BitPosition
/*0x000*/ UINT32 BeingCreated : 1; // 1 BitPosition
/*0x000*/ UINT32 BeingPurged : 1; // 2 BitPosition
/*0x000*/ UINT32 NoModifiedWriting : 1; // 3 BitPosition
/*0x000*/ UINT32 FailAllIo : 1; // 4 BitPosition
/*0x000*/ UINT32 Image : 1; // 5 BitPosition
/*0x000*/ UINT32 Based : 1; // 6 BitPosition
/*0x000*/ UINT32 File : 1; // 7 BitPosition
/*0x000*/ UINT32 Networked : 1; // 8 BitPosition
/*0x000*/ UINT32 Rom : 1; // 9 BitPosition
/*0x000*/ UINT32 PhysicalMemory : 1; // 10 BitPosition
/*0x000*/ UINT32 CopyOnWrite : 1; // 11 BitPosition
/*0x000*/ UINT32 Reserve : 1; // 12 BitPosition
/*0x000*/ UINT32 Commit : 1; // 13 BitPosition
/*0x000*/ UINT32 Accessed : 1; // 14 BitPosition
/*0x000*/ UINT32 WasPurged : 1; // 15 BitPosition
/*0x000*/ UINT32 UserReference : 1; // 16 BitPosition
/*0x000*/ UINT32 GlobalMemory : 1; // 17 BitPosition
/*0x000*/ UINT32 DeleteOnClose : 1; // 18 BitPosition
/*0x000*/ UINT32 FilePointerNull : 1; // 19 BitPosition
/*0x000*/ UINT32 GlobalOnlyPerSession : 1; // 20 BitPosition
/*0x000*/ UINT32 SetMappedFileIoComplete : 1; // 21 BitPosition
/*0x000*/ UINT32 CollidedFlush : 1; // 22 BitPosition
/*0x000*/ UINT32 NoChange : 1; // 23 BitPosition
/*0x000*/ UINT32 Spare : 1; // 24 BitPosition
/*0x000*/ UINT32 UserWritable : 1; // 25 BitPosition
/*0x000*/ UINT32 PreferredNode : 6; // 26 BitPosition
} MMSECTION_FLAGS, *PMMSECTION_FLAGS;
struct _MMSECURE_FLAGS
Referred from:
typedef struct _MMSECURE_FLAGS { // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 ReadOnly : 1; // 0 BitPosition
/*0x000*/ ULONG32 NoWrite : 1; // 1 BitPosition
/*0x000*/ ULONG32 Spare : 10; // 2 BitPosition
} MMSECURE_FLAGS, *PMMSECURE_FLAGS;
struct _MMSESSION
Referred from:
typedef struct _MMSESSION { // 7 elements, 0x58 bytes (sizeof)
/*0x000*/ struct _KGUARDED_MUTEX SystemSpaceViewLock; // 7 elements, 0x38 bytes (sizeof)
/*0x038*/ struct _KGUARDED_MUTEX* SystemSpaceViewLockPointer;
/*0x040*/ struct _MMVIEW* SystemSpaceViewTable;
/*0x048*/ ULONG32 SystemSpaceHashSize;
/*0x04C*/ ULONG32 SystemSpaceHashEntries;
/*0x050*/ ULONG32 SystemSpaceHashKey;
/*0x054*/ ULONG32 BitmapFailures;
} MMSESSION, *PMMSESSION;
struct _MMSUBSECTION_FLAGS
Referred from:
typedef struct _MMSUBSECTION_FLAGS { // 8 elements, 0x4 bytes (sizeof)
struct { // 3 elements, 0x2 bytes (sizeof)
/*0x000*/ UINT16 SubsectionAccessed : 1; // 0 BitPosition
/*0x000*/ UINT16 Protection : 5; // 1 BitPosition
/*0x000*/ UINT16 StartingSector4132 : 10; // 6 BitPosition
};
struct { // 5 elements, 0x2 bytes (sizeof)
/*0x002*/ UINT16 SubsectionStatic : 1; // 0 BitPosition
/*0x002*/ UINT16 GlobalMemory : 1; // 1 BitPosition
/*0x002*/ UINT16 DirtyPages : 1; // 2 BitPosition
/*0x002*/ UINT16 Spare : 1; // 3 BitPosition
/*0x002*/ UINT16 SectorEndOffset : 12; // 4 BitPosition
};
} MMSUBSECTION_FLAGS, *PMMSUBSECTION_FLAGS;
struct _MMSUBSECTION_NODE
Referred from:
typedef struct _MMSUBSECTION_NODE { // 6 elements, 0x28 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 LongFlags;
/*0x000*/ struct _MMSUBSECTION_FLAGS SubsectionFlags; // 8 elements, 0x4 bytes (sizeof)
} u;
/*0x004*/ ULONG32 StartingSector;
/*0x008*/ ULONG32 NumberOfFullSectors;
/*0x00C*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ INT64 Balance : 2; // 0 BitPosition
/*0x010*/ struct _MMSUBSECTION_NODE* Parent;
} u1;
/*0x018*/ struct _MMSUBSECTION_NODE* LeftChild;
/*0x020*/ struct _MMSUBSECTION_NODE* RightChild;
} MMSUBSECTION_NODE, *PMMSUBSECTION_NODE;
struct _MMSUPPORT
Referred from:
typedef struct _MMSUPPORT { // 18 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY WorkingSetExpansionLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT16 LastTrimStamp;
/*0x012*/ UINT16 NextPageColor;
/*0x014*/ struct _MMSUPPORT_FLAGS Flags; // 14 elements, 0x4 bytes (sizeof)
/*0x018*/ ULONG32 PageFaultCount;
/*0x01C*/ ULONG32 PeakWorkingSetSize;
/*0x020*/ ULONG32 Spare0;
/*0x024*/ ULONG32 MinimumWorkingSetSize;
/*0x028*/ ULONG32 MaximumWorkingSetSize;
/*0x02C*/ UINT8 _PADDING0_[0x4];
/*0x030*/ struct _MMWSL* VmWorkingSetList;
/*0x038*/ ULONG32 Claim;
/*0x03C*/ ULONG32 Spare[1];
/*0x040*/ ULONG32 WorkingSetPrivateSize;
/*0x044*/ ULONG32 WorkingSetSizeOverhead;
/*0x048*/ ULONG32 WorkingSetSize;
/*0x04C*/ UINT8 _PADDING1_[0x4];
/*0x050*/ struct _KEVENT* ExitEvent;
/*0x058*/ struct _EX_PUSH_LOCK WorkingSetMutex; // 7 elements, 0x8 bytes (sizeof)
/*0x060*/ VOID* AccessLog;
} MMSUPPORT, *PMMSUPPORT;
struct _MMSUPPORT_FLAGS
Referred from:
typedef struct _MMSUPPORT_FLAGS { // 14 elements, 0x4 bytes (sizeof)
struct { // 8 elements, 0x1 bytes (sizeof)
/*0x000*/ UINT8 SessionSpace : 1; // 0 BitPosition
/*0x000*/ UINT8 ModwriterAttached : 1; // 1 BitPosition
/*0x000*/ UINT8 TrimHard : 1; // 2 BitPosition
/*0x000*/ UINT8 MaximumWorkingSetHard : 1; // 3 BitPosition
/*0x000*/ UINT8 ForceTrim : 1; // 4 BitPosition
/*0x000*/ UINT8 MinimumWorkingSetHard : 1; // 5 BitPosition
/*0x000*/ UINT8 SessionMaster : 1; // 6 BitPosition
/*0x000*/ UINT8 TrimmerAttached : 1; // 7 BitPosition
};
struct { // 2 elements, 0x1 bytes (sizeof)
/*0x001*/ UINT8 TrimmerDetaching : 1; // 0 BitPosition
/*0x001*/ UINT8 Reserved : 7; // 1 BitPosition
};
/*0x002*/ UINT8 MemoryPriority : 8; // 0 BitPosition
struct { // 3 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 WsleDeleted : 1; // 0 BitPosition
/*0x003*/ UINT8 VmExiting : 1; // 1 BitPosition
/*0x003*/ UINT8 Available : 6; // 2 BitPosition
};
} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
struct _MMVAD
Referred from:
typedef struct _MMVAD { // 13 elements, 0x60 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 Balance : 2; // 0 BitPosition
/*0x000*/ struct _MMVAD* Parent;
} u1;
/*0x008*/ struct _MMVAD* LeftChild;
/*0x010*/ struct _MMVAD* RightChild;
/*0x018*/ UINT64 StartingVpn;
/*0x020*/ UINT64 EndingVpn;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 LongFlags;
/*0x028*/ struct _MMVAD_FLAGS VadFlags; // 7 elements, 0x8 bytes (sizeof)
} u;
/*0x030*/ struct _EX_PUSH_LOCK PushLock; // 7 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ UINT64 LongFlags3;
/*0x038*/ struct _MMVAD_FLAGS3 VadFlags3; // 7 elements, 0x8 bytes (sizeof)
} u5;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x040*/ ULONG32 LongFlags2;
/*0x040*/ struct _MMVAD_FLAGS2 VadFlags2; // 9 elements, 0x4 bytes (sizeof)
} u2;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x048*/ struct _SUBSECTION* Subsection;
/*0x048*/ struct _MSUBSECTION* MappedSubsection;
};
/*0x050*/ struct _MMPTE* FirstPrototypePte;
/*0x058*/ struct _MMPTE* LastContiguousPte;
} MMVAD, *PMMVAD;
struct _MMVAD_FLAGS
Referred from:
typedef struct _MMVAD_FLAGS { // 7 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 CommitCharge : 51; // 0 BitPosition
/*0x000*/ UINT64 NoChange : 1; // 51 BitPosition
/*0x000*/ UINT64 VadType : 3; // 52 BitPosition
/*0x000*/ UINT64 MemCommit : 1; // 55 BitPosition
/*0x000*/ UINT64 Protection : 5; // 56 BitPosition
/*0x000*/ UINT64 Spare : 2; // 61 BitPosition
/*0x000*/ UINT64 PrivateMemory : 1; // 63 BitPosition
} MMVAD_FLAGS, *PMMVAD_FLAGS;
struct _MMVAD_FLAGS2
Referred from:
typedef struct _MMVAD_FLAGS2 { // 9 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT32 FileOffset : 24; // 0 BitPosition
/*0x000*/ UINT32 SecNoChange : 1; // 24 BitPosition
/*0x000*/ UINT32 OneSecured : 1; // 25 BitPosition
/*0x000*/ UINT32 MultipleSecured : 1; // 26 BitPosition
/*0x000*/ UINT32 Spare : 1; // 27 BitPosition
/*0x000*/ UINT32 LongVad : 1; // 28 BitPosition
/*0x000*/ UINT32 ExtendableFile : 1; // 29 BitPosition
/*0x000*/ UINT32 Inherit : 1; // 30 BitPosition
/*0x000*/ UINT32 CopyOnWrite : 1; // 31 BitPosition
} MMVAD_FLAGS2, *PMMVAD_FLAGS2;
struct _MMVAD_FLAGS3
Referred from:
typedef struct _MMVAD_FLAGS3 { // 7 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 PreferredNode : 6; // 0 BitPosition
/*0x000*/ UINT64 Spare : 2; // 6 BitPosition
/*0x000*/ UINT64 SequentialAccess : 1; // 8 BitPosition
/*0x000*/ UINT64 LastSequentialTrim : 15; // 9 BitPosition
/*0x000*/ UINT64 Spare2 : 8; // 24 BitPosition
/*0x000*/ UINT64 LargePageCreating : 1; // 32 BitPosition
/*0x000*/ UINT64 Spare3 : 31; // 33 BitPosition
} MMVAD_FLAGS3, *PMMVAD_FLAGS3;
struct _MMVAD_LONG
typedef struct _MMVAD_LONG { // 14 elements, 0x78 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 Balance : 2; // 0 BitPosition
/*0x000*/ struct _MMVAD* Parent;
} u1;
/*0x008*/ struct _MMVAD* LeftChild;
/*0x010*/ struct _MMVAD* RightChild;
/*0x018*/ UINT64 StartingVpn;
/*0x020*/ UINT64 EndingVpn;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 LongFlags;
/*0x028*/ struct _MMVAD_FLAGS VadFlags; // 7 elements, 0x8 bytes (sizeof)
} u;
/*0x030*/ struct _EX_PUSH_LOCK PushLock; // 7 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ UINT64 LongFlags3;
/*0x038*/ struct _MMVAD_FLAGS3 VadFlags3; // 7 elements, 0x8 bytes (sizeof)
} u5;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x040*/ ULONG32 LongFlags2;
/*0x040*/ struct _MMVAD_FLAGS2 VadFlags2; // 9 elements, 0x4 bytes (sizeof)
} u2;
/*0x048*/ struct _SUBSECTION* Subsection;
/*0x050*/ struct _MMPTE* FirstPrototypePte;
/*0x058*/ struct _MMPTE* LastContiguousPte;
union { // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _LIST_ENTRY List; // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _MMADDRESS_LIST Secured; // 2 elements, 0x10 bytes (sizeof)
} u3;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x070*/ struct _MMBANKED_SECTION* Banked;
/*0x070*/ struct _MMEXTEND_INFO* ExtendedInfo;
} u4;
} MMVAD_LONG, *PMMVAD_LONG;
struct _MMVAD_SHORT
typedef struct _MMVAD_SHORT { // 8 elements, 0x40 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 Balance : 2; // 0 BitPosition
/*0x000*/ struct _MMVAD* Parent;
} u1;
/*0x008*/ struct _MMVAD* LeftChild;
/*0x010*/ struct _MMVAD* RightChild;
/*0x018*/ UINT64 StartingVpn;
/*0x020*/ UINT64 EndingVpn;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 LongFlags;
/*0x028*/ struct _MMVAD_FLAGS VadFlags; // 7 elements, 0x8 bytes (sizeof)
} u;
/*0x030*/ struct _EX_PUSH_LOCK PushLock; // 7 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ UINT64 LongFlags3;
/*0x038*/ struct _MMVAD_FLAGS3 VadFlags3; // 7 elements, 0x8 bytes (sizeof)
} u5;
} MMVAD_SHORT, *PMMVAD_SHORT;
struct _MMVIEW
Referred from:
typedef struct _MMVIEW { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 Entry;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT64 Writable : 1; // 0 BitPosition
/*0x008*/ struct _CONTROL_AREA* ControlArea;
};
} MMVIEW, *PMMVIEW;
struct _MMWSL
Referred from:
typedef struct _MMWSL { // 25 elements, 0x488 bytes (sizeof)
/*0x000*/ ULONG32 FirstFree;
/*0x004*/ ULONG32 FirstDynamic;
/*0x008*/ ULONG32 LastEntry;
/*0x00C*/ ULONG32 NextSlot;
/*0x010*/ struct _MMWSLE* Wsle;
/*0x018*/ VOID* LowestPagableAddress;
/*0x020*/ ULONG32 LastInitializedWsle;
/*0x024*/ ULONG32 NextEstimationSlot;
/*0x028*/ ULONG32 NextAgingSlot;
/*0x02C*/ ULONG32 EstimatedAvailable;
/*0x030*/ ULONG32 GrowthSinceLastEstimate;
/*0x034*/ ULONG32 NumberOfCommittedPageTables;
/*0x038*/ ULONG32 VadBitMapHint;
/*0x03C*/ ULONG32 NonDirectCount;
/*0x040*/ struct _MMWSLE_NONDIRECT_HASH* NonDirectHash;
/*0x048*/ struct _MMWSLE_HASH* HashTableStart;
/*0x050*/ struct _MMWSLE_HASH* HighestPermittedHashAddress;
/*0x058*/ VOID* HighestUserAddress;
/*0x060*/ ULONG32 MaximumUserPageTablePages;
/*0x064*/ ULONG32 MaximumUserPageDirectoryPages;
/*0x068*/ ULONG32* CommittedPageTables;
/*0x070*/ ULONG32 NumberOfCommittedPageDirectories;
/*0x074*/ UINT8 _PADDING0_[0x4];
/*0x078*/ UINT64 CommittedPageDirectories[128];
/*0x478*/ ULONG32 NumberOfCommittedPageDirectoryParents;
/*0x47C*/ UINT8 _PADDING1_[0x4];
/*0x480*/ UINT64 CommittedPageDirectoryParents[1];
} MMWSL, *PMMWSL;
struct _MMWSLE
Referred from:
typedef struct _MMWSLE { // 1 elements, 0x8 bytes (sizeof)
union { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ VOID* VirtualAddress;
/*0x000*/ UINT64 Long;
/*0x000*/ struct _MMWSLENTRY e1; // 8 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _MMWSLE_FREE_ENTRY e2; // 3 elements, 0x8 bytes (sizeof)
} u1;
} MMWSLE, *PMMWSLE;
struct _MMWSLENTRY
Referred from:
typedef struct _MMWSLENTRY { // 8 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Valid : 1; // 0 BitPosition
/*0x000*/ UINT64 LockedInWs : 1; // 1 BitPosition
/*0x000*/ UINT64 LockedInMemory : 1; // 2 BitPosition
/*0x000*/ UINT64 Protection : 5; // 3 BitPosition
/*0x000*/ UINT64 Hashed : 1; // 8 BitPosition
/*0x000*/ UINT64 Direct : 1; // 9 BitPosition
/*0x000*/ UINT64 Age : 2; // 10 BitPosition
/*0x000*/ UINT64 VirtualPageNumber : 52; // 12 BitPosition
} MMWSLENTRY, *PMMWSLENTRY;
struct _MMWSLE_FREE_ENTRY
Referred from:
typedef struct _MMWSLE_FREE_ENTRY { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 MustBeZero : 1; // 0 BitPosition
/*0x000*/ UINT64 PreviousFree : 31; // 1 BitPosition
/*0x000*/ UINT64 NextFree : 32; // 32 BitPosition
} MMWSLE_FREE_ENTRY, *PMMWSLE_FREE_ENTRY;
struct _MMWSLE_HASH
Referred from:
typedef struct _MMWSLE_HASH { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Index;
} MMWSLE_HASH, *PMMWSLE_HASH;
struct _MMWSLE_NONDIRECT_HASH
Referred from:
typedef struct _MMWSLE_NONDIRECT_HASH { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Key;
/*0x008*/ ULONG32 Index;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} MMWSLE_NONDIRECT_HASH, *PMMWSLE_NONDIRECT_HASH;
struct _MM_AVL_TABLE
Referred from:
typedef struct _MM_AVL_TABLE { // 6 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _MMADDRESS_NODE BalancedRoot; // 5 elements, 0x28 bytes (sizeof)
struct { // 3 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 DepthOfTree : 5; // 0 BitPosition
/*0x028*/ UINT64 Unused : 3; // 5 BitPosition
/*0x028*/ UINT64 NumberGenericTableElements : 56; // 8 BitPosition
};
/*0x030*/ VOID* NodeHint;
/*0x038*/ VOID* NodeFreeHint;
} MM_AVL_TABLE, *PMM_AVL_TABLE;
struct _MM_DRIVER_VERIFIER_DATA
typedef struct _MM_DRIVER_VERIFIER_DATA { // 28 elements, 0x80 bytes (sizeof)
/*0x000*/ ULONG32 Level;
/*0x004*/ ULONG32 RaiseIrqls;
/*0x008*/ ULONG32 AcquireSpinLocks;
/*0x00C*/ ULONG32 SynchronizeExecutions;
/*0x010*/ ULONG32 AllocationsAttempted;
/*0x014*/ ULONG32 AllocationsSucceeded;
/*0x018*/ ULONG32 AllocationsSucceededSpecialPool;
/*0x01C*/ ULONG32 AllocationsWithNoTag;
/*0x020*/ ULONG32 TrimRequests;
/*0x024*/ ULONG32 Trims;
/*0x028*/ ULONG32 AllocationsFailed;
/*0x02C*/ ULONG32 AllocationsFailedDeliberately;
/*0x030*/ ULONG32 Loads;
/*0x034*/ ULONG32 Unloads;
/*0x038*/ ULONG32 UnTrackedPool;
/*0x03C*/ ULONG32 UserTrims;
/*0x040*/ ULONG32 CurrentPagedPoolAllocations;
/*0x044*/ ULONG32 CurrentNonPagedPoolAllocations;
/*0x048*/ ULONG32 PeakPagedPoolAllocations;
/*0x04C*/ ULONG32 PeakNonPagedPoolAllocations;
/*0x050*/ UINT64 PagedBytes;
/*0x058*/ UINT64 NonPagedBytes;
/*0x060*/ UINT64 PeakPagedBytes;
/*0x068*/ UINT64 PeakNonPagedBytes;
/*0x070*/ ULONG32 BurstAllocationsFailedDeliberately;
/*0x074*/ ULONG32 SessionTrims;
/*0x078*/ ULONG32 OptionChanges;
/*0x07C*/ ULONG32 VerifyMode;
} MM_DRIVER_VERIFIER_DATA, *PMM_DRIVER_VERIFIER_DATA;
struct _MM_PAGED_POOL_INFO
Referred from:
typedef struct _MM_PAGED_POOL_INFO { // 6 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _KGUARDED_MUTEX Mutex; // 7 elements, 0x38 bytes (sizeof)
/*0x038*/ struct _RTL_BITMAP PagedPoolAllocationMap; // 2 elements, 0x10 bytes (sizeof)
/*0x048*/ struct _MMPTE* FirstPteForPagedPool;
/*0x050*/ ULONG32 PagedPoolHint;
/*0x054*/ UINT8 _PADDING0_[0x4];
/*0x058*/ UINT64 PagedPoolCommit;
/*0x060*/ UINT64 AllocatedPagedPool;
} MM_PAGED_POOL_INFO, *PMM_PAGED_POOL_INFO;
struct _MM_PAGE_ACCESS_INFO
Referred from:
typedef struct _MM_PAGE_ACCESS_INFO { // 4 elements, 0x8 bytes (sizeof)
union { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ union _MM_PAGE_ACCESS_INFO_FLAGS Flags; // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT64 FileOffset;
/*0x000*/ VOID* VirtualAddress;
/*0x000*/ VOID* PointerProtoPte;
};
} MM_PAGE_ACCESS_INFO, *PMM_PAGE_ACCESS_INFO;
typedef struct _MM_PAGE_ACCESS_INFO_HEADER { // 14 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY Link; // 1 elements, 0x8 bytes (sizeof)
/*0x008*/ enum _MM_PAGE_ACCESS_TYPE Type;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x00C*/ ULONG32 EmptySequenceNumber;
/*0x00C*/ ULONG32 CurrentFileIndex;
};
/*0x010*/ UINT64 CreateTime;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x018*/ UINT64 EmptyTime;
/*0x018*/ struct _MM_PAGE_ACCESS_INFO* TempEntry;
};
union { // 2 elements, 0x24 bytes (sizeof)
struct { // 5 elements, 0x24 bytes (sizeof)
/*0x020*/ struct _MM_PAGE_ACCESS_INFO* PageEntry;
/*0x028*/ UINT64* FileEntry;
/*0x030*/ UINT64* FirstFileEntry;
/*0x038*/ struct _EPROCESS* Process;
/*0x040*/ ULONG32 SessionId;
};
struct { // 2 elements, 0x24 bytes (sizeof)
/*0x020*/ UINT64* PageFrameEntry;
/*0x028*/ UINT64* LastPageFrameEntry;
/*0x030*/ UINT8 _PADDING0_[0x14];
};
};
} MM_PAGE_ACCESS_INFO_HEADER, *PMM_PAGE_ACCESS_INFO_HEADER;
struct _MM_SESSION_SPACE
typedef struct _MM_SESSION_SPACE { // 44 elements, 0x1E00 bytes (sizeof)
/*0x000*/ LONG32 ReferenceCount;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 LongFlags;
/*0x004*/ struct _MM_SESSION_SPACE_FLAGS Flags; // 8 elements, 0x4 bytes (sizeof)
} u;
/*0x008*/ ULONG32 SessionId;
/*0x00C*/ LONG32 ProcessReferenceToSession;
/*0x010*/ struct _LIST_ENTRY ProcessList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ union _LARGE_INTEGER LastProcessSwappedOutTime; // 4 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 SessionPageDirectoryIndex;
/*0x030*/ UINT64 NonPagablePages;
/*0x038*/ UINT64 CommittedPages;
/*0x040*/ VOID* PagedPoolStart;
/*0x048*/ VOID* PagedPoolEnd;
/*0x050*/ VOID* SessionObject;
/*0x058*/ VOID* SessionObjectHandle;
/*0x060*/ LONG32 ResidentProcessCount;
/*0x064*/ LONG32 ImageLoadingCount;
/*0x068*/ ULONG32 SessionPoolAllocationFailures[4];
/*0x078*/ struct _LIST_ENTRY ImageList; // 2 elements, 0x10 bytes (sizeof)
/*0x088*/ ULONG32 LocaleId;
/*0x08C*/ ULONG32 AttachCount;
/*0x090*/ struct _KEVENT AttachEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x0A8*/ struct _LIST_ENTRY WsListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x0B8*/ UINT8 _PADDING0_[0x8];
/*0x0C0*/ struct _GENERAL_LOOKASIDE Lookaside[21];
/*0xB40*/ struct _MMSESSION Session; // 7 elements, 0x58 bytes (sizeof)
/*0xB98*/ struct _MM_PAGED_POOL_INFO PagedPoolInfo; // 6 elements, 0x68 bytes (sizeof)
/*0xC00*/ struct _MMSUPPORT Vm; // 18 elements, 0x68 bytes (sizeof)
/*0xC68*/ struct _MMWSLE* Wsle;
/*0xC70*/ PVOID DriverUnload;
/*0xC78*/ struct _POOL_DESCRIPTOR PagedPool; // 14 elements, 0x1048 bytes (sizeof)
/*0x1CC0*/ struct _MMPTE PageDirectory; // 1 elements, 0x8 bytes (sizeof)
/*0x1CC8*/ struct _KGUARDED_MUTEX SessionVaLock; // 7 elements, 0x38 bytes (sizeof)
/*0x1D00*/ struct _RTL_BITMAP DynamicVaBitMap; // 2 elements, 0x10 bytes (sizeof)
/*0x1D10*/ ULONG32 DynamicVaHint;
/*0x1D14*/ UINT8 _PADDING1_[0x4];
/*0x1D18*/ struct _MI_SPECIAL_POOL SpecialPool; // 5 elements, 0x30 bytes (sizeof)
/*0x1D48*/ struct _KGUARDED_MUTEX SessionPteLock; // 7 elements, 0x38 bytes (sizeof)
/*0x1D80*/ LONG32 PoolBigEntriesInUse;
/*0x1D84*/ ULONG32 PagedPoolPdeCount;
/*0x1D88*/ ULONG32 SpecialPoolPdeCount;
/*0x1D8C*/ ULONG32 DynamicSessionPdeCount;
/*0x1D90*/ struct _MMPTE SessionPteFreeHead; // 1 elements, 0x8 bytes (sizeof)
/*0x1D98*/ struct _MI_SYSTEM_PTE_TYPE SystemPteInfo; // 4 elements, 0x20 bytes (sizeof)
/*0x1DB8*/ VOID* PoolTrackTableExpansion;
/*0x1DC0*/ UINT64 PoolTrackTableExpansionSize;
/*0x1DC8*/ VOID* PoolTrackBigPages;
/*0x1DD0*/ UINT64 PoolTrackBigPagesSize;
/*0x1DD8*/ UINT8 _PADDING2_[0x28];
} MM_SESSION_SPACE, *PMM_SESSION_SPACE;
struct _MM_SESSION_SPACE_FLAGS
Referred from:
typedef struct _MM_SESSION_SPACE_FLAGS { // 8 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Initialized : 1; // 0 BitPosition
/*0x000*/ ULONG32 DeletePending : 1; // 1 BitPosition
/*0x000*/ ULONG32 PoolInitialized : 1; // 2 BitPosition
/*0x000*/ ULONG32 DynamicVaInitialized : 1; // 3 BitPosition
/*0x000*/ ULONG32 WsInitialized : 1; // 4 BitPosition
/*0x000*/ ULONG32 PoolDestroyed : 1; // 5 BitPosition
/*0x000*/ ULONG32 ObjectInitialized : 1; // 6 BitPosition
/*0x000*/ ULONG32 Filler : 25; // 7 BitPosition
} MM_SESSION_SPACE_FLAGS, *PMM_SESSION_SPACE_FLAGS;
struct _MM_SUBSECTION_AVL_TABLE
Referred from:
typedef struct _MM_SUBSECTION_AVL_TABLE { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _MMSUBSECTION_NODE BalancedRoot; // 6 elements, 0x28 bytes (sizeof)
struct { // 3 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 DepthOfTree : 5; // 0 BitPosition
/*0x028*/ UINT64 Unused : 3; // 5 BitPosition
/*0x028*/ UINT64 NumberGenericTableElements : 56; // 8 BitPosition
};
/*0x030*/ VOID* NodeHint;
} MM_SUBSECTION_AVL_TABLE, *PMM_SUBSECTION_AVL_TABLE;
struct _MSUBSECTION
Referred from:
typedef struct _MSUBSECTION { // 15 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _CONTROL_AREA* ControlArea;
/*0x008*/ struct _MMPTE* SubsectionBase;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _SUBSECTION* NextSubsection;
/*0x010*/ struct _MSUBSECTION* NextMappedSubsection;
};
/*0x018*/ ULONG32 PtesInSubsection;
/*0x01C*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ ULONG32 UnusedPtes;
/*0x020*/ struct _MM_AVL_TABLE* GlobalPerSessionHead;
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x028*/ ULONG32 LongFlags;
/*0x028*/ struct _MMSUBSECTION_FLAGS SubsectionFlags; // 8 elements, 0x4 bytes (sizeof)
} u;
/*0x02C*/ ULONG32 StartingSector;
/*0x030*/ ULONG32 NumberOfFullSectors;
/*0x034*/ UINT8 _PADDING1_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ INT64 Balance : 2; // 0 BitPosition
/*0x038*/ struct _MMSUBSECTION_NODE* Parent;
} u1;
/*0x040*/ struct _MMSUBSECTION_NODE* LeftChild;
/*0x048*/ struct _MMSUBSECTION_NODE* RightChild;
/*0x050*/ struct _LIST_ENTRY DereferenceList; // 2 elements, 0x10 bytes (sizeof)
/*0x060*/ UINT64 NumberOfMappedViews;
} MSUBSECTION, *PMSUBSECTION;
struct _NAMED_PIPE_CREATE_PARAMETERS
Referred from:
typedef struct _NAMED_PIPE_CREATE_PARAMETERS { // 8 elements, 0x28 bytes (sizeof)
/*0x000*/ ULONG32 NamedPipeType;
/*0x004*/ ULONG32 ReadMode;
/*0x008*/ ULONG32 CompletionMode;
/*0x00C*/ ULONG32 MaximumInstances;
/*0x010*/ ULONG32 InboundQuota;
/*0x014*/ ULONG32 OutboundQuota;
/*0x018*/ union _LARGE_INTEGER DefaultTimeout; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ UINT8 TimeoutSpecified;
/*0x021*/ UINT8 _PADDING0_[0x7];
} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
struct _NETWORK_LOADER_BLOCK
Referred from:
typedef struct _NETWORK_LOADER_BLOCK { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT8* DHCPServerACK;
/*0x008*/ ULONG32 DHCPServerACKLength;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT8* BootServerReplyPacket;
/*0x018*/ ULONG32 BootServerReplyPacketLength;
/*0x01C*/ UINT8 _PADDING1_[0x4];
} NETWORK_LOADER_BLOCK, *PNETWORK_LOADER_BLOCK;
struct _NLS_DATA_BLOCK
Referred from:
typedef struct _NLS_DATA_BLOCK { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ VOID* AnsiCodePageData;
/*0x008*/ VOID* OemCodePageData;
/*0x010*/ VOID* UnicodeCaseTableData;
} NLS_DATA_BLOCK, *PNLS_DATA_BLOCK;
struct _NPAGED_LOOKASIDE_LIST
typedef struct _NPAGED_LOOKASIDE_LIST { // 1 elements, 0x80 bytes (sizeof)
/*0x000*/ struct _GENERAL_LOOKASIDE L; // 22 elements, 0x80 bytes (sizeof)
} NPAGED_LOOKASIDE_LIST, *PNPAGED_LOOKASIDE_LIST;
struct _NT_TIB
Referred from:
typedef struct _NT_TIB { // 8 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _EXCEPTION_REGISTRATION_RECORD* ExceptionList;
/*0x008*/ VOID* StackBase;
/*0x010*/ VOID* StackLimit;
/*0x018*/ VOID* SubSystemTib;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ VOID* FiberData;
/*0x020*/ ULONG32 Version;
};
/*0x028*/ VOID* ArbitraryUserPointer;
/*0x030*/ struct _NT_TIB* Self;
} NT_TIB, *PNT_TIB;
struct _NT_TIB32
Referred from:
typedef struct _NT_TIB32 { // 8 elements, 0x1C bytes (sizeof)
/*0x000*/ ULONG32 ExceptionList;
/*0x004*/ ULONG32 StackBase;
/*0x008*/ ULONG32 StackLimit;
/*0x00C*/ ULONG32 SubSystemTib;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x010*/ ULONG32 FiberData;
/*0x010*/ ULONG32 Version;
};
/*0x014*/ ULONG32 ArbitraryUserPointer;
/*0x018*/ ULONG32 Self;
} NT_TIB32, *PNT_TIB32;
struct _NT_TIB64
Referred from:
typedef struct _NT_TIB64 { // 8 elements, 0x38 bytes (sizeof)
/*0x000*/ UINT64 ExceptionList;
/*0x008*/ UINT64 StackBase;
/*0x010*/ UINT64 StackLimit;
/*0x018*/ UINT64 SubSystemTib;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ UINT64 FiberData;
/*0x020*/ ULONG32 Version;
};
/*0x028*/ UINT64 ArbitraryUserPointer;
/*0x030*/ UINT64 Self;
} NT_TIB64, *PNT_TIB64;
struct _OBJECT_ATTRIBUTES
typedef struct _OBJECT_ATTRIBUTES { // 6 elements, 0x30 bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* RootDirectory;
/*0x010*/ struct _UNICODE_STRING* ObjectName;
/*0x018*/ ULONG32 Attributes;
/*0x01C*/ UINT8 _PADDING1_[0x4];
/*0x020*/ VOID* SecurityDescriptor;
/*0x028*/ VOID* SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
Referred from:
typedef struct _OBJECT_CREATE_INFORMATION { // 10 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 Attributes;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* RootDirectory;
/*0x010*/ VOID* ParseContext;
/*0x018*/ CHAR ProbeMode;
/*0x019*/ UINT8 _PADDING1_[0x3];
/*0x01C*/ ULONG32 PagedPoolCharge;
/*0x020*/ ULONG32 NonPagedPoolCharge;
/*0x024*/ ULONG32 SecurityDescriptorCharge;
/*0x028*/ VOID* SecurityDescriptor;
/*0x030*/ struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos;
/*0x038*/ struct _SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService; // 4 elements, 0xC bytes (sizeof)
/*0x044*/ UINT8 _PADDING2_[0x4];
} OBJECT_CREATE_INFORMATION, *POBJECT_CREATE_INFORMATION;
struct _OBJECT_DIRECTORY
Referred from:
typedef struct _OBJECT_DIRECTORY { // 6 elements, 0x150 bytes (sizeof)
/*0x000*/ struct _OBJECT_DIRECTORY_ENTRY* HashBuckets[37];
/*0x128*/ struct _EX_PUSH_LOCK Lock; // 7 elements, 0x8 bytes (sizeof)
/*0x130*/ struct _DEVICE_MAP* DeviceMap;
/*0x138*/ ULONG32 SessionId;
/*0x13C*/ UINT8 _PADDING0_[0x4];
/*0x140*/ VOID* NamespaceEntry;
/*0x148*/ ULONG32 Flags;
/*0x14C*/ UINT8 _PADDING1_[0x4];
} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;
struct _OBJECT_DIRECTORY_ENTRY
Referred from:
typedef struct _OBJECT_DIRECTORY_ENTRY { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _OBJECT_DIRECTORY_ENTRY* ChainLink;
/*0x008*/ VOID* Object;
/*0x010*/ ULONG32 HashValue;
/*0x014*/ UINT8 _PADDING0_[0x4];
} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;
struct _OBJECT_DUMP_CONTROL
typedef struct _OBJECT_DUMP_CONTROL { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Stream;
/*0x008*/ ULONG32 Detail;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} OBJECT_DUMP_CONTROL, *POBJECT_DUMP_CONTROL;
struct _OBJECT_HANDLE_COUNT_DATABASE
Referred from:
typedef struct _OBJECT_HANDLE_COUNT_DATABASE { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 CountEntries;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _OBJECT_HANDLE_COUNT_ENTRY HandleCountEntries[1];
} OBJECT_HANDLE_COUNT_DATABASE, *POBJECT_HANDLE_COUNT_DATABASE;
struct _OBJECT_HANDLE_COUNT_ENTRY
Referred from:
typedef struct _OBJECT_HANDLE_COUNT_ENTRY { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _EPROCESS* Process;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 HandleCount : 24; // 0 BitPosition
/*0x008*/ ULONG32 LockCount : 8; // 24 BitPosition
};
} OBJECT_HANDLE_COUNT_ENTRY, *POBJECT_HANDLE_COUNT_ENTRY;
typedef struct _OBJECT_HANDLE_INFORMATION { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 HandleAttributes;
/*0x004*/ ULONG32 GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
typedef struct _OBJECT_HEADER { // 12 elements, 0x38 bytes (sizeof)
/*0x000*/ INT64 PointerCount;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ INT64 HandleCount;
/*0x008*/ VOID* NextToFree;
};
/*0x010*/ struct _OBJECT_TYPE* Type;
/*0x018*/ UINT8 NameInfoOffset;
/*0x019*/ UINT8 HandleInfoOffset;
/*0x01A*/ UINT8 QuotaInfoOffset;
/*0x01B*/ UINT8 Flags;
/*0x01C*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _OBJECT_CREATE_INFORMATION* ObjectCreateInfo;
/*0x020*/ VOID* QuotaBlockCharged;
};
/*0x028*/ VOID* SecurityDescriptor;
/*0x030*/ struct _QUAD Body; // 2 elements, 0x8 bytes (sizeof)
} OBJECT_HEADER, *POBJECT_HEADER;
typedef struct _OBJECT_HEADER_CREATOR_INFO { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY TypeList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* CreatorUniqueProcess;
/*0x018*/ UINT16 CreatorBackTraceIndex;
/*0x01A*/ UINT16 Reserved;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} OBJECT_HEADER_CREATOR_INFO, *POBJECT_HEADER_CREATOR_INFO;
struct _OBJECT_HEADER_HANDLE_INFO
typedef struct _OBJECT_HEADER_HANDLE_INFO { // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _OBJECT_HANDLE_COUNT_DATABASE* HandleCountDataBase;
/*0x000*/ struct _OBJECT_HANDLE_COUNT_ENTRY SingleEntry; // 3 elements, 0x10 bytes (sizeof)
};
} OBJECT_HEADER_HANDLE_INFO, *POBJECT_HEADER_HANDLE_INFO;
typedef struct _OBJECT_HEADER_NAME_INFO {// 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _OBJECT_DIRECTORY* Directory;
/*0x008*/ struct _UNICODE_STRING Name; // 3 elements, 0x10 bytes (sizeof)
/*0x018*/ ULONG32 QueryReferences;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} OBJECT_HEADER_NAME_INFO, *POBJECT_HEADER_NAME_INFO;
typedef struct _OBJECT_HEADER_QUOTA_INFO { // 5 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 PagedPoolCharge;
/*0x004*/ ULONG32 NonPagedPoolCharge;
/*0x008*/ ULONG32 SecurityDescriptorCharge;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _EPROCESS* ExclusiveProcess;
/*0x018*/ UINT64 Reserved;
} OBJECT_HEADER_QUOTA_INFO, *POBJECT_HEADER_QUOTA_INFO;
Referred from:
typedef struct _OBJECT_NAME_INFORMATION { // 1 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _UNICODE_STRING Name; // 3 elements, 0x10 bytes (sizeof)
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
struct _OBJECT_SYMBOLIC_LINK
typedef struct _OBJECT_SYMBOLIC_LINK { // 5 elements, 0x38 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER CreationTime; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _UNICODE_STRING LinkTarget; // 3 elements, 0x10 bytes (sizeof)
/*0x018*/ struct _UNICODE_STRING LinkTargetRemaining; // 3 elements, 0x10 bytes (sizeof)
/*0x028*/ VOID* LinkTargetObject;
/*0x030*/ ULONG32 DosDeviceDriveIndex;
/*0x034*/ UINT8 _PADDING0_[0x4];
} OBJECT_SYMBOLIC_LINK, *POBJECT_SYMBOLIC_LINK;
struct _OBJECT_TYPE
Referred from:
typedef struct _OBJECT_TYPE { // 12 elements, 0x220 bytes (sizeof)
/*0x000*/ struct _ERESOURCE Mutex; // 15 elements, 0x68 bytes (sizeof)
/*0x068*/ struct _LIST_ENTRY TypeList; // 2 elements, 0x10 bytes (sizeof)
/*0x078*/ struct _UNICODE_STRING Name; // 3 elements, 0x10 bytes (sizeof)
/*0x088*/ VOID* DefaultObject;
/*0x090*/ ULONG32 Index;
/*0x094*/ ULONG32 TotalNumberOfObjects;
/*0x098*/ ULONG32 TotalNumberOfHandles;
/*0x09C*/ ULONG32 HighWaterNumberOfObjects;
/*0x0A0*/ ULONG32 HighWaterNumberOfHandles;
/*0x0A4*/ UINT8 _PADDING0_[0x4];
/*0x0A8*/ struct _OBJECT_TYPE_INITIALIZER TypeInfo; // 23 elements, 0x70 bytes (sizeof)
/*0x118*/ ULONG32 Key;
/*0x11C*/ UINT8 _PADDING1_[0x4];
/*0x120*/ struct _EX_PUSH_LOCK ObjectLocks[32];
} OBJECT_TYPE, *POBJECT_TYPE;
struct _OBJECT_TYPE_INITIALIZER
Referred from:
typedef struct _OBJECT_TYPE_INITIALIZER { // 23 elements, 0x70 bytes (sizeof)
/*0x000*/ UINT16 Length;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x002*/ UINT8 ObjectTypeFlags;
struct { // 6 elements, 0x1 bytes (sizeof)
/*0x002*/ UINT8 CaseInsensitive : 1; // 0 BitPosition
/*0x002*/ UINT8 UnnamedObjectsOnly : 1; // 1 BitPosition
/*0x002*/ UINT8 UseDefaultObject : 1; // 2 BitPosition
/*0x002*/ UINT8 SecurityRequired : 1; // 3 BitPosition
/*0x002*/ UINT8 MaintainHandleCount : 1; // 4 BitPosition
/*0x002*/ UINT8 MaintainTypeList : 1; // 5 BitPosition
};
};
/*0x004*/ ULONG32 ObjectTypeCode;
/*0x008*/ ULONG32 InvalidAttributes;
/*0x00C*/ struct _GENERIC_MAPPING GenericMapping; // 4 elements, 0x10 bytes (sizeof)
/*0x01C*/ ULONG32 ValidAccessMask;
/*0x020*/ enum _POOL_TYPE PoolType;
/*0x024*/ ULONG32 DefaultPagedPoolCharge;
/*0x028*/ ULONG32 DefaultNonPagedPoolCharge;
/*0x02C*/ UINT8 _PADDING0_[0x4];
/*0x030*/ PVOID DumpProcedure;
/*0x038*/ PVOID OpenProcedure;
/*0x040*/ PVOID CloseProcedure;
/*0x048*/ PVOID DeleteProcedure;
/*0x050*/ PVOID ParseProcedure;
/*0x058*/ PVOID SecurityProcedure;
/*0x060*/ PVOID QueryNameProcedure;
/*0x068*/ PVOID OkayToCloseProcedure;
} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
struct _OWNER_ENTRY
Referred from:
typedef struct _OWNER_ENTRY { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 OwnerThread;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ LONG32 OwnerCount;
/*0x008*/ ULONG32 TableSize;
};
} OWNER_ENTRY, *POWNER_ENTRY;
struct _PAGED_LOOKASIDE_LIST
typedef struct _PAGED_LOOKASIDE_LIST { // 1 elements, 0x80 bytes (sizeof)
/*0x000*/ struct _GENERAL_LOOKASIDE L; // 22 elements, 0x80 bytes (sizeof)
} PAGED_LOOKASIDE_LIST, *PPAGED_LOOKASIDE_LIST;
struct _PAGEFAULT_HISTORY
Referred from:
typedef struct _PAGEFAULT_HISTORY { // 0 elements, 0x0 bytes (sizeof)
} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
Referred from:
typedef struct _PCAT_FIRMWARE_INFORMATION { // 1 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 PlaceHolder;
} PCAT_FIRMWARE_INFORMATION, *PPCAT_FIRMWARE_INFORMATION;
struct _PCIE_DEVICE_ID
Referred from:
typedef struct _PCIE_DEVICE_ID { // 11 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 VendorID;
/*0x002*/ UINT16 DeviceID;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 ClassCode : 24; // 0 BitPosition
/*0x004*/ ULONG32 FunctionNumber : 8; // 24 BitPosition
};
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 DeviceNumber : 8; // 0 BitPosition
/*0x008*/ ULONG32 Segment : 16; // 8 BitPosition
/*0x008*/ ULONG32 PrimaryBusNumber : 8; // 24 BitPosition
};
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x00C*/ ULONG32 SecondaryBusNumber : 8; // 0 BitPosition
/*0x00C*/ ULONG32 Reserved1 : 2; // 8 BitPosition
/*0x00C*/ ULONG32 SlotNumber : 14; // 10 BitPosition
/*0x00C*/ ULONG32 Reserved2 : 8; // 24 BitPosition
};
} PCIE_DEVICE_ID, *PPCIE_DEVICE_ID;
struct _PEB
Referred from:
typedef struct _PEB { // 81 elements, 0x368 bytes (sizeof)
/*0x000*/ UINT8 InheritedAddressSpace;
/*0x001*/ UINT8 ReadImageFileExecOptions;
/*0x002*/ UINT8 BeingDebugged;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 BitField;
struct { // 5 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 ImageUsesLargePages : 1; // 0 BitPosition
/*0x003*/ UINT8 IsProtectedProcess : 1; // 1 BitPosition
/*0x003*/ UINT8 IsLegacyProcess : 1; // 2 BitPosition
/*0x003*/ UINT8 IsImageDynamicallyRelocated : 1; // 3 BitPosition
/*0x003*/ UINT8 SpareBits : 4; // 4 BitPosition
};
};
/*0x008*/ VOID* Mutant;
/*0x010*/ VOID* ImageBaseAddress;
/*0x018*/ struct _PEB_LDR_DATA* Ldr;
/*0x020*/ struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
/*0x028*/ VOID* SubSystemData;
/*0x030*/ VOID* ProcessHeap;
/*0x038*/ struct _RTL_CRITICAL_SECTION* FastPebLock;
/*0x040*/ VOID* AtlThunkSListPtr;
/*0x048*/ VOID* IFEOKey;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x050*/ ULONG32 CrossProcessFlags;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x050*/ ULONG32 ProcessInJob : 1; // 0 BitPosition
/*0x050*/ ULONG32 ProcessInitializing : 1; // 1 BitPosition
/*0x050*/ ULONG32 ReservedBits0 : 30; // 2 BitPosition
};
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x058*/ VOID* KernelCallbackTable;
/*0x058*/ VOID* UserSharedInfoPtr;
};
/*0x060*/ ULONG32 SystemReserved[1];
/*0x064*/ ULONG32 SpareUlong;
/*0x068*/ struct _PEB_FREE_BLOCK* FreeList;
/*0x070*/ ULONG32 TlsExpansionCounter;
/*0x074*/ UINT8 _PADDING0_[0x4];
/*0x078*/ VOID* TlsBitmap;
/*0x080*/ ULONG32 TlsBitmapBits[2];
/*0x088*/ VOID* ReadOnlySharedMemoryBase;
/*0x090*/ VOID* HotpatchInformation;
/*0x098*/ VOID** ReadOnlyStaticServerData;
/*0x0A0*/ VOID* AnsiCodePageData;
/*0x0A8*/ VOID* OemCodePageData;
/*0x0B0*/ VOID* UnicodeCaseTableData;
/*0x0B8*/ ULONG32 NumberOfProcessors;
/*0x0BC*/ ULONG32 NtGlobalFlag;
/*0x0C0*/ union _LARGE_INTEGER CriticalSectionTimeout; // 4 elements, 0x8 bytes (sizeof)
/*0x0C8*/ UINT64 HeapSegmentReserve;
/*0x0D0*/ UINT64 HeapSegmentCommit;
/*0x0D8*/ UINT64 HeapDeCommitTotalFreeThreshold;
/*0x0E0*/ UINT64 HeapDeCommitFreeBlockThreshold;
/*0x0E8*/ ULONG32 NumberOfHeaps;
/*0x0EC*/ ULONG32 MaximumNumberOfHeaps;
/*0x0F0*/ VOID** ProcessHeaps;
/*0x0F8*/ VOID* GdiSharedHandleTable;
/*0x100*/ VOID* ProcessStarterHelper;
/*0x108*/ ULONG32 GdiDCAttributeList;
/*0x10C*/ UINT8 _PADDING1_[0x4];
/*0x110*/ struct _RTL_CRITICAL_SECTION* LoaderLock;
/*0x118*/ ULONG32 OSMajorVersion;
/*0x11C*/ ULONG32 OSMinorVersion;
/*0x120*/ UINT16 OSBuildNumber;
/*0x122*/ UINT16 OSCSDVersion;
/*0x124*/ ULONG32 OSPlatformId;
/*0x128*/ ULONG32 ImageSubsystem;
/*0x12C*/ ULONG32 ImageSubsystemMajorVersion;
/*0x130*/ ULONG32 ImageSubsystemMinorVersion;
/*0x134*/ UINT8 _PADDING2_[0x4];
/*0x138*/ UINT64 ImageProcessAffinityMask;
/*0x140*/ ULONG32 GdiHandleBuffer[60];
/*0x230*/ PVOID PostProcessInitRoutine;
/*0x238*/ VOID* TlsExpansionBitmap;
/*0x240*/ ULONG32 TlsExpansionBitmapBits[32];
/*0x2C0*/ ULONG32 SessionId;
/*0x2C4*/ UINT8 _PADDING3_[0x4];
/*0x2C8*/ union _ULARGE_INTEGER AppCompatFlags; // 4 elements, 0x8 bytes (sizeof)
/*0x2D0*/ union _ULARGE_INTEGER AppCompatFlagsUser; // 4 elements, 0x8 bytes (sizeof)
/*0x2D8*/ VOID* pShimData;
/*0x2E0*/ VOID* AppCompatInfo;
/*0x2E8*/ struct _UNICODE_STRING CSDVersion; // 3 elements, 0x10 bytes (sizeof)
/*0x2F8*/ struct _ACTIVATION_CONTEXT_DATA* ActivationContextData;
/*0x300*/ struct _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap;
/*0x308*/ struct _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData;
/*0x310*/ struct _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap;
/*0x318*/ UINT64 MinimumStackCommit;
/*0x320*/ struct _FLS_CALLBACK_INFO* FlsCallback;
/*0x328*/ struct _LIST_ENTRY FlsListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x338*/ VOID* FlsBitmap;
/*0x340*/ ULONG32 FlsBitmapBits[4];
/*0x350*/ ULONG32 FlsHighIndex;
/*0x354*/ UINT8 _PADDING4_[0x4];
/*0x358*/ VOID* WerRegistrationData;
/*0x360*/ VOID* WerShipAssertPtr;
} PEB, *PPEB;
struct _PEB32
typedef struct _PEB32 { // 81 elements, 0x238 bytes (sizeof)
/*0x000*/ UINT8 InheritedAddressSpace;
/*0x001*/ UINT8 ReadImageFileExecOptions;
/*0x002*/ UINT8 BeingDebugged;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 BitField;
struct { // 5 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 ImageUsesLargePages : 1; // 0 BitPosition
/*0x003*/ UINT8 IsProtectedProcess : 1; // 1 BitPosition
/*0x003*/ UINT8 IsLegacyProcess : 1; // 2 BitPosition
/*0x003*/ UINT8 IsImageDynamicallyRelocated : 1; // 3 BitPosition
/*0x003*/ UINT8 SpareBits : 4; // 4 BitPosition
};
};
/*0x004*/ ULONG32 Mutant;
/*0x008*/ ULONG32 ImageBaseAddress;
/*0x00C*/ ULONG32 Ldr;
/*0x010*/ ULONG32 ProcessParameters;
/*0x014*/ ULONG32 SubSystemData;
/*0x018*/ ULONG32 ProcessHeap;
/*0x01C*/ ULONG32 FastPebLock;
/*0x020*/ ULONG32 AtlThunkSListPtr;
/*0x024*/ ULONG32 IFEOKey;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x028*/ ULONG32 CrossProcessFlags;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x028*/ ULONG32 ProcessInJob : 1; // 0 BitPosition
/*0x028*/ ULONG32 ProcessInitializing : 1; // 1 BitPosition
/*0x028*/ ULONG32 ReservedBits0 : 30; // 2 BitPosition
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x02C*/ ULONG32 KernelCallbackTable;
/*0x02C*/ ULONG32 UserSharedInfoPtr;
};
/*0x030*/ ULONG32 SystemReserved[1];
/*0x034*/ ULONG32 SpareUlong;
/*0x038*/ ULONG32 FreeList;
/*0x03C*/ ULONG32 TlsExpansionCounter;
/*0x040*/ ULONG32 TlsBitmap;
/*0x044*/ ULONG32 TlsBitmapBits[2];
/*0x04C*/ ULONG32 ReadOnlySharedMemoryBase;
/*0x050*/ ULONG32 HotpatchInformation;
/*0x054*/ ULONG32 ReadOnlyStaticServerData;
/*0x058*/ ULONG32 AnsiCodePageData;
/*0x05C*/ ULONG32 OemCodePageData;
/*0x060*/ ULONG32 UnicodeCaseTableData;
/*0x064*/ ULONG32 NumberOfProcessors;
/*0x068*/ ULONG32 NtGlobalFlag;
/*0x06C*/ UINT8 _PADDING0_[0x4];
/*0x070*/ union _LARGE_INTEGER CriticalSectionTimeout; // 4 elements, 0x8 bytes (sizeof)
/*0x078*/ ULONG32 HeapSegmentReserve;
/*0x07C*/ ULONG32 HeapSegmentCommit;
/*0x080*/ ULONG32 HeapDeCommitTotalFreeThreshold;
/*0x084*/ ULONG32 HeapDeCommitFreeBlockThreshold;
/*0x088*/ ULONG32 NumberOfHeaps;
/*0x08C*/ ULONG32 MaximumNumberOfHeaps;
/*0x090*/ ULONG32 ProcessHeaps;
/*0x094*/ ULONG32 GdiSharedHandleTable;
/*0x098*/ ULONG32 ProcessStarterHelper;
/*0x09C*/ ULONG32 GdiDCAttributeList;
/*0x0A0*/ ULONG32 LoaderLock;
/*0x0A4*/ ULONG32 OSMajorVersion;
/*0x0A8*/ ULONG32 OSMinorVersion;
/*0x0AC*/ UINT16 OSBuildNumber;
/*0x0AE*/ UINT16 OSCSDVersion;
/*0x0B0*/ ULONG32 OSPlatformId;
/*0x0B4*/ ULONG32 ImageSubsystem;
/*0x0B8*/ ULONG32 ImageSubsystemMajorVersion;
/*0x0BC*/ ULONG32 ImageSubsystemMinorVersion;
/*0x0C0*/ ULONG32 ImageProcessAffinityMask;
/*0x0C4*/ ULONG32 GdiHandleBuffer[34];
/*0x14C*/ ULONG32 PostProcessInitRoutine;
/*0x150*/ ULONG32 TlsExpansionBitmap;
/*0x154*/ ULONG32 TlsExpansionBitmapBits[32];
/*0x1D4*/ ULONG32 SessionId;
/*0x1D8*/ union _ULARGE_INTEGER AppCompatFlags; // 4 elements, 0x8 bytes (sizeof)
/*0x1E0*/ union _ULARGE_INTEGER AppCompatFlagsUser; // 4 elements, 0x8 bytes (sizeof)
/*0x1E8*/ ULONG32 pShimData;
/*0x1EC*/ ULONG32 AppCompatInfo;
/*0x1F0*/ struct _STRING32 CSDVersion; // 3 elements, 0x8 bytes (sizeof)
/*0x1F8*/ ULONG32 ActivationContextData;
/*0x1FC*/ ULONG32 ProcessAssemblyStorageMap;
/*0x200*/ ULONG32 SystemDefaultActivationContextData;
/*0x204*/ ULONG32 SystemAssemblyStorageMap;
/*0x208*/ ULONG32 MinimumStackCommit;
/*0x20C*/ ULONG32 FlsCallback;
/*0x210*/ struct _LIST_ENTRY32 FlsListHead; // 2 elements, 0x8 bytes (sizeof)
/*0x218*/ ULONG32 FlsBitmap;
/*0x21C*/ ULONG32 FlsBitmapBits[4];
/*0x22C*/ ULONG32 FlsHighIndex;
/*0x230*/ ULONG32 WerRegistrationData;
/*0x234*/ ULONG32 WerShipAssertPtr;
} PEB32, *PPEB32;
struct _PEB64
typedef struct _PEB64 { // 81 elements, 0x368 bytes (sizeof)
/*0x000*/ UINT8 InheritedAddressSpace;
/*0x001*/ UINT8 ReadImageFileExecOptions;
/*0x002*/ UINT8 BeingDebugged;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 BitField;
struct { // 5 elements, 0x1 bytes (sizeof)
/*0x003*/ UINT8 ImageUsesLargePages : 1; // 0 BitPosition
/*0x003*/ UINT8 IsProtectedProcess : 1; // 1 BitPosition
/*0x003*/ UINT8 IsLegacyProcess : 1; // 2 BitPosition
/*0x003*/ UINT8 IsImageDynamicallyRelocated : 1; // 3 BitPosition
/*0x003*/ UINT8 SpareBits : 4; // 4 BitPosition
};
};
/*0x008*/ UINT64 Mutant;
/*0x010*/ UINT64 ImageBaseAddress;
/*0x018*/ UINT64 Ldr;
/*0x020*/ UINT64 ProcessParameters;
/*0x028*/ UINT64 SubSystemData;
/*0x030*/ UINT64 ProcessHeap;
/*0x038*/ UINT64 FastPebLock;
/*0x040*/ UINT64 AtlThunkSListPtr;
/*0x048*/ UINT64 IFEOKey;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x050*/ ULONG32 CrossProcessFlags;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x050*/ ULONG32 ProcessInJob : 1; // 0 BitPosition
/*0x050*/ ULONG32 ProcessInitializing : 1; // 1 BitPosition
/*0x050*/ ULONG32 ReservedBits0 : 30; // 2 BitPosition
};
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x058*/ UINT64 KernelCallbackTable;
/*0x058*/ UINT64 UserSharedInfoPtr;
};
/*0x060*/ ULONG32 SystemReserved[1];
/*0x064*/ ULONG32 SpareUlong;
/*0x068*/ UINT64 FreeList;
/*0x070*/ ULONG32 TlsExpansionCounter;
/*0x074*/ UINT8 _PADDING0_[0x4];
/*0x078*/ UINT64 TlsBitmap;
/*0x080*/ ULONG32 TlsBitmapBits[2];
/*0x088*/ UINT64 ReadOnlySharedMemoryBase;
/*0x090*/ UINT64 HotpatchInformation;
/*0x098*/ UINT64 ReadOnlyStaticServerData;
/*0x0A0*/ UINT64 AnsiCodePageData;
/*0x0A8*/ UINT64 OemCodePageData;
/*0x0B0*/ UINT64 UnicodeCaseTableData;
/*0x0B8*/ ULONG32 NumberOfProcessors;
/*0x0BC*/ ULONG32 NtGlobalFlag;
/*0x0C0*/ union _LARGE_INTEGER CriticalSectionTimeout; // 4 elements, 0x8 bytes (sizeof)
/*0x0C8*/ UINT64 HeapSegmentReserve;
/*0x0D0*/ UINT64 HeapSegmentCommit;
/*0x0D8*/ UINT64 HeapDeCommitTotalFreeThreshold;
/*0x0E0*/ UINT64 HeapDeCommitFreeBlockThreshold;
/*0x0E8*/ ULONG32 NumberOfHeaps;
/*0x0EC*/ ULONG32 MaximumNumberOfHeaps;
/*0x0F0*/ UINT64 ProcessHeaps;
/*0x0F8*/ UINT64 GdiSharedHandleTable;
/*0x100*/ UINT64 ProcessStarterHelper;
/*0x108*/ ULONG32 GdiDCAttributeList;
/*0x10C*/ UINT8 _PADDING1_[0x4];
/*0x110*/ UINT64 LoaderLock;
/*0x118*/ ULONG32 OSMajorVersion;
/*0x11C*/ ULONG32 OSMinorVersion;
/*0x120*/ UINT16 OSBuildNumber;
/*0x122*/ UINT16 OSCSDVersion;
/*0x124*/ ULONG32 OSPlatformId;
/*0x128*/ ULONG32 ImageSubsystem;
/*0x12C*/ ULONG32 ImageSubsystemMajorVersion;
/*0x130*/ ULONG32 ImageSubsystemMinorVersion;
/*0x134*/ UINT8 _PADDING2_[0x4];
/*0x138*/ UINT64 ImageProcessAffinityMask;
/*0x140*/ ULONG32 GdiHandleBuffer[60];
/*0x230*/ UINT64 PostProcessInitRoutine;
/*0x238*/ UINT64 TlsExpansionBitmap;
/*0x240*/ ULONG32 TlsExpansionBitmapBits[32];
/*0x2C0*/ ULONG32 SessionId;
/*0x2C4*/ UINT8 _PADDING3_[0x4];
/*0x2C8*/ union _ULARGE_INTEGER AppCompatFlags; // 4 elements, 0x8 bytes (sizeof)
/*0x2D0*/ union _ULARGE_INTEGER AppCompatFlagsUser; // 4 elements, 0x8 bytes (sizeof)
/*0x2D8*/ UINT64 pShimData;
/*0x2E0*/ UINT64 AppCompatInfo;
/*0x2E8*/ struct _STRING64 CSDVersion; // 3 elements, 0x10 bytes (sizeof)
/*0x2F8*/ UINT64 ActivationContextData;
/*0x300*/ UINT64 ProcessAssemblyStorageMap;
/*0x308*/ UINT64 SystemDefaultActivationContextData;
/*0x310*/ UINT64 SystemAssemblyStorageMap;
/*0x318*/ UINT64 MinimumStackCommit;
/*0x320*/ UINT64 FlsCallback;
/*0x328*/ struct _LIST_ENTRY64 FlsListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x338*/ UINT64 FlsBitmap;
/*0x340*/ ULONG32 FlsBitmapBits[4];
/*0x350*/ ULONG32 FlsHighIndex;
/*0x354*/ UINT8 _PADDING4_[0x4];
/*0x358*/ UINT64 WerRegistrationData;
/*0x360*/ UINT64 WerShipAssertPtr;
} PEB64, *PPEB64;
struct _PEB_FREE_BLOCK
Referred from:
typedef struct _PEB_FREE_BLOCK { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _PEB_FREE_BLOCK* Next;
/*0x008*/ ULONG32 Size;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
struct _PEB_LDR_DATA
Referred from:
typedef struct _PEB_LDR_DATA { // 7 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ UINT8 Initialized;
/*0x005*/ UINT8 _PADDING0_[0x3];
/*0x008*/ VOID* SsHandle;
/*0x010*/ struct _LIST_ENTRY InLoadOrderModuleList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _LIST_ENTRY InMemoryOrderModuleList; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _LIST_ENTRY InInitializationOrderModuleList; // 2 elements, 0x10 bytes (sizeof)
/*0x040*/ VOID* EntryInProgress;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
struct _PERFINFO_GROUPMASK
typedef struct _PERFINFO_GROUPMASK { // 1 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 Masks[8];
} PERFINFO_GROUPMASK, *PPERFINFO_GROUPMASK;
struct _PERFINFO_HARDPAGEFAULT_INFORMATION
Referred from:
typedef struct _PERFINFO_HARDPAGEFAULT_INFORMATION { // 5 elements, 0x20 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER ReadOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ VOID* VirtualAddress;
/*0x010*/ VOID* FileObject;
/*0x018*/ ULONG32 ThreadId;
/*0x01C*/ ULONG32 ByteCount;
} PERFINFO_HARDPAGEFAULT_INFORMATION, *PPERFINFO_HARDPAGEFAULT_INFORMATION;
typedef struct _PERFINFO_TRACE_HEADER { // 9 elements, 0x18 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Marker;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT16 Version;
/*0x002*/ UINT8 HeaderType;
/*0x003*/ UINT8 Flags;
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 Header;
/*0x004*/ struct _WMI_TRACE_PACKET Packet; // 4 elements, 0x4 bytes (sizeof)
};
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT64 TS;
/*0x008*/ union _LARGE_INTEGER SystemTime; // 4 elements, 0x8 bytes (sizeof)
};
/*0x010*/ UINT8 Data[1];
/*0x011*/ UINT8 _PADDING0_[0x7];
} PERFINFO_TRACE_HEADER, *PPERFINFO_TRACE_HEADER;
struct _PF_HARD_FAULT_INFO
typedef struct _PF_HARD_FAULT_INFO { // 3 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _ETW_KERNEL_TRACE_TIMESTAMP KernelTimeStamp; // 1 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _PERFINFO_HARDPAGEFAULT_INFORMATION HardFaultEvent; // 5 elements, 0x20 bytes (sizeof)
/*0x030*/ union _LARGE_INTEGER IoTimeInTicks; // 4 elements, 0x8 bytes (sizeof)
} PF_HARD_FAULT_INFO, *PPF_HARD_FAULT_INFO;
struct _PF_KERNEL_GLOBALS
typedef struct _PF_KERNEL_GLOBALS { // 8 elements, 0x60 bytes (sizeof)
/*0x000*/ UINT64 AccessBufferAgeThreshold;
/*0x008*/ struct _EX_RUNDOWN_REF AccessBufferRef; // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _KEVENT AccessBufferExistsEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x028*/ ULONG32 AccessBufferMax;
/*0x02C*/ UINT8 _PADDING0_[0x14];
/*0x040*/ union _SLIST_HEADER AccessBufferList; // 4 elements, 0x10 bytes (sizeof)
/*0x050*/ LONG32 StreamSequenceNumber;
/*0x054*/ ULONG32 Flags;
/*0x058*/ LONG32 ScenarioPrefetchCount;
/*0x05C*/ UINT8 _PADDING1_[0x4];
} PF_KERNEL_GLOBALS, *PPF_KERNEL_GLOBALS;
struct _PHYSICAL_MEMORY_DESCRIPTOR
typedef struct _PHYSICAL_MEMORY_DESCRIPTOR { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 NumberOfRuns;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 NumberOfPages;
/*0x010*/ struct _PHYSICAL_MEMORY_RUN Run[1];
} PHYSICAL_MEMORY_DESCRIPTOR, *PPHYSICAL_MEMORY_DESCRIPTOR;
struct _PHYSICAL_MEMORY_RUN
Referred from:
typedef struct _PHYSICAL_MEMORY_RUN { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT64 BasePage;
/*0x008*/ UINT64 PageCount;
} PHYSICAL_MEMORY_RUN, *PPHYSICAL_MEMORY_RUN;
struct _PI_BUS_EXTENSION
Referred from:
typedef struct _PI_BUS_EXTENSION { // 17 elements, 0x70 bytes (sizeof)
/*0x000*/ ULONG32 Flags;
/*0x004*/ UINT8 NumberCSNs;
/*0x005*/ UINT8 _PADDING0_[0x3];
/*0x008*/ UINT8* ReadDataPort;
/*0x010*/ UINT8 DataPortMapped;
/*0x011*/ UINT8 _PADDING1_[0x7];
/*0x018*/ UINT8* AddressPort;
/*0x020*/ UINT8 AddrPortMapped;
/*0x021*/ UINT8 _PADDING2_[0x7];
/*0x028*/ UINT8* CommandPort;
/*0x030*/ UINT8 CmdPortMapped;
/*0x031*/ UINT8 _PADDING3_[0x3];
/*0x034*/ ULONG32 NextSlotNumber;
/*0x038*/ struct _SINGLE_LIST_ENTRY DeviceList; // 1 elements, 0x8 bytes (sizeof)
/*0x040*/ struct _SINGLE_LIST_ENTRY CardList; // 1 elements, 0x8 bytes (sizeof)
/*0x048*/ struct _DEVICE_OBJECT* PhysicalBusDevice;
/*0x050*/ struct _DEVICE_OBJECT* FunctionalBusDevice;
/*0x058*/ struct _DEVICE_OBJECT* AttachedDevice;
/*0x060*/ ULONG32 BusNumber;
/*0x064*/ enum _SYSTEM_POWER_STATE SystemPowerState;
/*0x068*/ enum _DEVICE_POWER_STATE DevicePowerState;
/*0x06C*/ UINT8 _PADDING4_[0x4];
} PI_BUS_EXTENSION, *PPI_BUS_EXTENSION;
struct _PI_RESOURCE_ARBITER_ENTRY
typedef struct _PI_RESOURCE_ARBITER_ENTRY { // 10 elements, 0x70 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY DeviceArbiterList; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT8 ResourceType;
/*0x011*/ UINT8 _PADDING0_[0x7];
/*0x018*/ struct _ARBITER_INTERFACE* ArbiterInterface;
/*0x020*/ struct _DEVICE_NODE* DeviceNode;
/*0x028*/ struct _LIST_ENTRY ResourceList; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _LIST_ENTRY BestResourceList; // 2 elements, 0x10 bytes (sizeof)
/*0x048*/ struct _LIST_ENTRY BestConfig; // 2 elements, 0x10 bytes (sizeof)
/*0x058*/ struct _LIST_ENTRY ActiveArbiterList; // 2 elements, 0x10 bytes (sizeof)
/*0x068*/ UINT8 State;
/*0x069*/ UINT8 ResourcesChanged;
/*0x06A*/ UINT8 _PADDING1_[0x6];
} PI_RESOURCE_ARBITER_ENTRY, *PPI_RESOURCE_ARBITER_ENTRY;
struct _PLUGPLAY_EVENT_BLOCK
Referred from:
typedef struct _PLUGPLAY_EVENT_BLOCK { // 7 elements, 0x50 bytes (sizeof)
/*0x000*/ struct _GUID EventGuid; // 4 elements, 0x10 bytes (sizeof)
/*0x010*/ enum _PLUGPLAY_EVENT_CATEGORY EventCategory;
/*0x014*/ UINT8 _PADDING0_[0x4];
/*0x018*/ ULONG32* Result;
/*0x020*/ ULONG32 Flags;
/*0x024*/ ULONG32 TotalSize;
/*0x028*/ VOID* DeviceObject;
union { // 10 elements, 0x20 bytes (sizeof)
struct { // 2 elements, 0x14 bytes (sizeof)
/*0x030*/ struct _GUID ClassGuid; // 4 elements, 0x10 bytes (sizeof)
/*0x040*/ WCHAR SymbolicLinkName[1];
/*0x042*/ UINT8 _PADDING1_[0x2];
} DeviceClass;
struct { // 1 elements, 0x2 bytes (sizeof)
/*0x030*/ WCHAR DeviceIds[1];
} TargetDevice;
struct { // 1 elements, 0x2 bytes (sizeof)
/*0x030*/ WCHAR DeviceId[1];
} InstallDevice;
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ VOID* NotificationStructure;
/*0x038*/ WCHAR DeviceIds[1];
/*0x03A*/ UINT8 _PADDING1_[0x6];
} CustomNotification;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x030*/ VOID* Notification;
} ProfileNotification;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x030*/ ULONG32 NotificationCode;
/*0x034*/ ULONG32 NotificationData;
} PowerNotification;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x030*/ enum _PNP_VETO_TYPE VetoType;
/*0x034*/ WCHAR DeviceIdVetoNameBuffer[1];
/*0x036*/ UINT8 _PADDING1_[0x2];
} VetoNotification;
struct { // 1 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _GUID BlockedDriverGuid; // 4 elements, 0x10 bytes (sizeof)
} BlockedDriverNotification;
struct { // 1 elements, 0x2 bytes (sizeof)
/*0x030*/ WCHAR ParentId[1];
} InvalidIDNotification;
struct { // 4 elements, 0x1C bytes (sizeof)
/*0x030*/ struct _GUID PowerSettingGuid; // 4 elements, 0x10 bytes (sizeof)
/*0x040*/ UINT8 PowerSettingChanged;
/*0x041*/ UINT8 _PADDING1_[0x3];
/*0x044*/ ULONG32 DataLength;
/*0x048*/ UINT8 Data[1];
/*0x049*/ UINT8 _PADDING2_[0x3];
} PowerSettingNotification;
} u;
/*0x01C*/ UINT8 _PADDING1_[0x4];
} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK;
struct _PNP_ASSIGN_RESOURCES_CONTEXT
typedef struct _PNP_ASSIGN_RESOURCES_CONTEXT { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 IncludeFailedDevices;
/*0x004*/ ULONG32 DeviceCount;
/*0x008*/ struct _DEVICE_OBJECT* DeviceList[1];
} PNP_ASSIGN_RESOURCES_CONTEXT, *PPNP_ASSIGN_RESOURCES_CONTEXT;
struct _PNP_DEVICE_COMPLETION_QUEUE
typedef struct _PNP_DEVICE_COMPLETION_QUEUE { // 5 elements, 0x50 bytes (sizeof)
/*0x000*/ UINT64 SpinLock;
/*0x008*/ ULONG32 DispatchedCount;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _LIST_ENTRY DispatchedList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _KSEMAPHORE CompletedSemaphore; // 2 elements, 0x20 bytes (sizeof)
/*0x040*/ struct _LIST_ENTRY CompletedList; // 2 elements, 0x10 bytes (sizeof)
} PNP_DEVICE_COMPLETION_QUEUE, *PPNP_DEVICE_COMPLETION_QUEUE;
struct _PNP_DEVICE_EVENT_ENTRY
typedef struct _PNP_DEVICE_EVENT_ENTRY { // 8 elements, 0x90 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 Argument;
/*0x014*/ UINT8 _PADDING0_[0x4];
/*0x018*/ struct _KEVENT* CallerEvent;
/*0x020*/ PVOID Callback;
/*0x028*/ VOID* Context;
/*0x030*/ enum _PNP_VETO_TYPE* VetoType;
/*0x038*/ struct _UNICODE_STRING* VetoName;
/*0x040*/ struct _PLUGPLAY_EVENT_BLOCK Data; // 7 elements, 0x50 bytes (sizeof)
} PNP_DEVICE_EVENT_ENTRY, *PPNP_DEVICE_EVENT_ENTRY;
struct _PNP_DEVICE_EVENT_LIST
typedef struct _PNP_DEVICE_EVENT_LIST { // 4 elements, 0x88 bytes (sizeof)
/*0x000*/ LONG32 Status;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _KMUTANT EventQueueMutex; // 5 elements, 0x38 bytes (sizeof)
/*0x040*/ struct _KGUARDED_MUTEX Lock; // 7 elements, 0x38 bytes (sizeof)
/*0x078*/ struct _LIST_ENTRY List; // 2 elements, 0x10 bytes (sizeof)
} PNP_DEVICE_EVENT_LIST, *PPNP_DEVICE_EVENT_LIST;
struct _PNP_RESOURCE_REQUEST
typedef struct _PNP_RESOURCE_REQUEST { // 10 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _DEVICE_OBJECT* PhysicalDevice;
/*0x008*/ ULONG32 Flags;
/*0x00C*/ enum _ARBITER_REQUEST_SOURCE AllocationType;
/*0x010*/ ULONG32 Priority;
/*0x014*/ ULONG32 Position;
/*0x018*/ struct _IO_RESOURCE_REQUIREMENTS_LIST* ResourceRequirements;
/*0x020*/ VOID* ReqList;
/*0x028*/ struct _CM_RESOURCE_LIST* ResourceAssignment;
/*0x030*/ struct _CM_RESOURCE_LIST* TranslatedResourceAssignment;
/*0x038*/ LONG32 Status;
/*0x03C*/ UINT8 _PADDING0_[0x4];
} PNP_RESOURCE_REQUEST, *PPNP_RESOURCE_REQUEST;
struct _POOL_BLOCK_HEAD
typedef struct _POOL_BLOCK_HEAD { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _POOL_HEADER Header; // 9 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY List; // 2 elements, 0x10 bytes (sizeof)
} POOL_BLOCK_HEAD, *PPOOL_BLOCK_HEAD;
struct _POOL_DESCRIPTOR
Referred from:
typedef struct _POOL_DESCRIPTOR { // 14 elements, 0x1048 bytes (sizeof)
/*0x000*/ enum _POOL_TYPE PoolType;
/*0x004*/ ULONG32 PoolIndex;
/*0x008*/ LONG32 RunningAllocs;
/*0x00C*/ LONG32 RunningDeAllocs;
/*0x010*/ LONG32 TotalPages;
/*0x014*/ LONG32 TotalBigPages;
/*0x018*/ ULONG32 Threshold;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ VOID* LockAddress;
/*0x028*/ VOID** PendingFrees;
/*0x030*/ LONG32 ThreadsProcessingDeferrals;
/*0x034*/ LONG32 PendingFreeDepth;
/*0x038*/ UINT64 TotalBytes;
/*0x040*/ UINT64 Spare0;
/*0x048*/ struct _LIST_ENTRY ListHeads[256];
} POOL_DESCRIPTOR, *PPOOL_DESCRIPTOR;
struct _POOL_HACKER
typedef struct _POOL_HACKER { // 2 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _POOL_HEADER Header; // 9 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 Contents[8];
} POOL_HACKER, *PPOOL_HACKER;
Referred from:
typedef struct _POOL_HEADER { // 9 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 PreviousSize : 8; // 0 BitPosition
/*0x000*/ ULONG32 PoolIndex : 8; // 8 BitPosition
/*0x000*/ ULONG32 BlockSize : 8; // 16 BitPosition
/*0x000*/ ULONG32 PoolType : 8; // 24 BitPosition
};
/*0x000*/ ULONG32 Ulong1;
};
/*0x004*/ ULONG32 PoolTag;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _EPROCESS* ProcessBilled;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT16 AllocatorBackTraceIndex;
/*0x00A*/ UINT16 PoolTagHash;
/*0x00C*/ UINT8 _PADDING0_[0x4];
};
};
} POOL_HEADER, *PPOOL_HEADER;
struct _POOL_TRACKER_BIG_PAGES
typedef struct _POOL_TRACKER_BIG_PAGES { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ VOID* Va;
/*0x008*/ ULONG32 Key;
/*0x00C*/ ULONG32 PoolType;
/*0x010*/ UINT64 NumberOfBytes;
} POOL_TRACKER_BIG_PAGES, *PPOOL_TRACKER_BIG_PAGES;
struct _POOL_TRACKER_TABLE
typedef struct _POOL_TRACKER_TABLE { // 7 elements, 0x28 bytes (sizeof)
/*0x000*/ LONG32 Key;
/*0x004*/ LONG32 NonPagedAllocs;
/*0x008*/ LONG32 NonPagedFrees;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 NonPagedBytes;
/*0x018*/ ULONG32 PagedAllocs;
/*0x01C*/ ULONG32 PagedFrees;
/*0x020*/ UINT64 PagedBytes;
} POOL_TRACKER_TABLE, *PPOOL_TRACKER_TABLE;
struct _POP_ACTION_TRIGGER
Referred from:
typedef struct _POP_ACTION_TRIGGER { // 5 elements, 0x18 bytes (sizeof)
/*0x000*/ enum _POP_POLICY_DEVICE_TYPE Type;
/*0x004*/ ULONG32 Flags;
/*0x008*/ struct _POP_TRIGGER_WAIT* Wait;
union { // 2 elements, 0x8 bytes (sizeof)
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ ULONG32 Level;
} Battery;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x010*/ ULONG32 Type;
} Button;
};
} POP_ACTION_TRIGGER, *PPOP_ACTION_TRIGGER;
struct _POP_DEVICE_SYS_STATE
Referred from:
typedef struct _POP_DEVICE_SYS_STATE { // 19 elements, 0x2B8 bytes (sizeof)
/*0x000*/ UINT8 IrpMinor;
/*0x001*/ UINT8 _PADDING0_[0x3];
/*0x004*/ enum _SYSTEM_POWER_STATE SystemState;
/*0x008*/ UINT64 SpinLock;
/*0x010*/ struct _KTHREAD* Thread;
/*0x018*/ struct _KEVENT* AbortEvent;
/*0x020*/ struct _KSEMAPHORE* ReadySemaphore;
/*0x028*/ struct _KSEMAPHORE* FinishedSemaphore;
/*0x030*/ UINT8 GetNewDeviceList;
/*0x031*/ UINT8 _PADDING1_[0x7];
/*0x038*/ struct _PO_DEVICE_NOTIFY_ORDER Order; // 3 elements, 0x250 bytes (sizeof)
/*0x288*/ LONG32 NotifyGdiLevelForPowerOn;
/*0x28C*/ LONG32 NotifyGdiLevelForResumeUI;
/*0x290*/ struct _LIST_ENTRY Pending; // 2 elements, 0x10 bytes (sizeof)
/*0x2A0*/ LONG32 Status;
/*0x2A4*/ UINT8 _PADDING2_[0x4];
/*0x2A8*/ struct _DEVICE_OBJECT* FailedDevice;
/*0x2B0*/ UINT8 Waking;
/*0x2B1*/ UINT8 Cancelled;
/*0x2B2*/ UINT8 IgnoreErrors;
/*0x2B3*/ UINT8 IgnoreNotImplemented;
/*0x2B4*/ UINT8 TimeRefreshLockAcquired;
/*0x2B5*/ UINT8 _PADDING3_[0x3];
} POP_DEVICE_SYS_STATE, *PPOP_DEVICE_SYS_STATE;
struct _POP_DISPLAY_RESUME_CONTEXT
Referred from:
typedef struct _POP_DISPLAY_RESUME_CONTEXT { // 8 elements, 0x80 bytes (sizeof)
/*0x000*/ struct _WORK_QUEUE_ITEM WorkItem; // 3 elements, 0x20 bytes (sizeof)
/*0x020*/ struct _ETHREAD* WorkerThread;
/*0x028*/ struct _KEVENT PrepareUIEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x040*/ struct _KEVENT PowerOnEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x058*/ struct _KEVENT DoneEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x070*/ ULONG32 WorkerQueued;
/*0x074*/ ULONG32 WorkerAbort;
/*0x078*/ ULONG32 NoResumeUI;
/*0x07C*/ UINT8 _PADDING0_[0x4];
} POP_DISPLAY_RESUME_CONTEXT, *PPOP_DISPLAY_RESUME_CONTEXT;
struct _POP_HIBER_CONTEXT
Referred from:
typedef struct _POP_HIBER_CONTEXT { // 35 elements, 0x158 bytes (sizeof)
/*0x000*/ UINT8 WriteToFile;
/*0x001*/ UINT8 ReserveLoaderMemory;
/*0x002*/ UINT8 ReserveFreeMemory;
/*0x003*/ UINT8 VerifyOnWake;
/*0x004*/ UINT8 Reset;
/*0x005*/ UINT8 HiberFlags;
/*0x006*/ UINT8 WroteHiberFile;
/*0x007*/ UINT8 _PADDING0_[0x1];
/*0x008*/ UINT64 Lock;
/*0x010*/ UINT8 MapFrozen;
/*0x011*/ UINT8 _PADDING1_[0x7];
/*0x018*/ struct _RTL_BITMAP MemoryMap; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _RTL_BITMAP DiscardedMemoryPages; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _LIST_ENTRY ClonedRanges; // 2 elements, 0x10 bytes (sizeof)
/*0x048*/ ULONG32 ClonedRangeCount;
/*0x04C*/ UINT8 _PADDING2_[0x4];
/*0x050*/ struct _LIST_ENTRY* NextCloneRange;
/*0x058*/ UINT64 NextPreserve;
/*0x060*/ struct _MDL* LoaderMdl;
/*0x068*/ struct _MDL* AllocatedMdl;
/*0x070*/ UINT64 PagesOut;
/*0x078*/ VOID* IoPages;
/*0x080*/ VOID* CurrentMcb;
/*0x088*/ struct _DUMP_STACK_CONTEXT* DumpStack;
/*0x090*/ struct _KPROCESSOR_STATE* WakeState;
/*0x098*/ UINT64 HiberVa;
/*0x0A0*/ union _LARGE_INTEGER HiberPte; // 4 elements, 0x8 bytes (sizeof)
/*0x0A8*/ LONG32 Status;
/*0x0AC*/ UINT8 _PADDING3_[0x4];
/*0x0B0*/ struct _PO_MEMORY_IMAGE* MemoryImage;
/*0x0B8*/ struct _PO_MEMORY_RANGE_ARRAY* TableHead;
/*0x0C0*/ UINT8* CompressionWorkspace;
/*0x0C8*/ UINT8* CompressedWriteBuffer;
/*0x0D0*/ ULONG32* PerformanceStats;
/*0x0D8*/ VOID* CompressionBlock;
/*0x0E0*/ VOID* DmaIO;
/*0x0E8*/ VOID* TemporaryHeap;
/*0x0F0*/ struct _PO_HIBER_PERF PerfInfo; // 16 elements, 0x60 bytes (sizeof)
/*0x150*/ struct _MDL* BootLoaderLogMdl;
} POP_HIBER_CONTEXT, *PPOP_HIBER_CONTEXT;
struct _POP_POWER_ACTION
typedef struct _POP_POWER_ACTION { // 23 elements, 0xB0 bytes (sizeof)
/*0x000*/ UINT8 Updates;
/*0x001*/ UINT8 State;
/*0x002*/ UINT8 Shutdown;
/*0x003*/ UINT8 _PADDING0_[0x1];
/*0x004*/ enum _POWER_ACTION Action;
/*0x008*/ enum _SYSTEM_POWER_STATE LightestState;
/*0x00C*/ ULONG32 Flags;
/*0x010*/ LONG32 Status;
/*0x014*/ enum _POP_POLICY_DEVICE_TYPE DeviceType;
/*0x018*/ ULONG32 DeviceTypeFlags;
/*0x01C*/ UINT8 IrpMinor;
/*0x01D*/ UINT8 Waking;
/*0x01E*/ UINT8 _PADDING1_[0x2];
/*0x020*/ enum _SYSTEM_POWER_STATE SystemState;
/*0x024*/ enum _SYSTEM_POWER_STATE NextSystemState;
/*0x028*/ enum _SYSTEM_POWER_STATE EffectiveSystemState;
/*0x02C*/ enum _SYSTEM_POWER_STATE CurrentSystemState;
/*0x030*/ struct _POP_SHUTDOWN_BUG_CHECK* ShutdownBugCode;
/*0x038*/ struct _POP_DEVICE_SYS_STATE* DevState;
/*0x040*/ struct _POP_DISPLAY_RESUME_CONTEXT* DisplayResumeContext;
/*0x048*/ struct _POP_HIBER_CONTEXT* HiberContext;
/*0x050*/ UINT64 WakeTime;
/*0x058*/ UINT64 SleepTime;
/*0x060*/ struct _SYSTEM_POWER_STATE_CONTEXT SystemContext; // 7 elements, 0x4 bytes (sizeof)
/*0x064*/ struct _SYSTEM_POWER_CAPABILITIES FilteredCapabilities; // 29 elements, 0x4C bytes (sizeof)
} POP_POWER_ACTION, *PPOP_POWER_ACTION;
struct _POP_SHUTDOWN_BUG_CHECK
Referred from:
typedef struct _POP_SHUTDOWN_BUG_CHECK { // 5 elements, 0x28 bytes (sizeof)
/*0x000*/ ULONG32 Code;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 Parameter1;
/*0x010*/ UINT64 Parameter2;
/*0x018*/ UINT64 Parameter3;
/*0x020*/ UINT64 Parameter4;
} POP_SHUTDOWN_BUG_CHECK, *PPOP_SHUTDOWN_BUG_CHECK;
struct _POP_THERMAL_ZONE
typedef struct _POP_THERMAL_ZONE { // 16 elements, 0x128 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Link; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT8 State;
/*0x011*/ UINT8 Flags;
/*0x012*/ UINT8 Mode;
/*0x013*/ UINT8 PendingMode;
/*0x014*/ UINT8 ActivePoint;
/*0x015*/ UINT8 PendingActivePoint;
/*0x016*/ UINT8 _PADDING0_[0x2];
/*0x018*/ LONG32 Throttle;
/*0x01C*/ UINT8 _PADDING1_[0x4];
/*0x020*/ UINT64 LastTime;
/*0x028*/ ULONG32 SampleRate;
/*0x02C*/ ULONG32 LastTemp;
/*0x030*/ struct _KTIMER PassiveTimer; // 5 elements, 0x40 bytes (sizeof)
/*0x070*/ struct _KDPC PassiveDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x0B0*/ struct _POP_ACTION_TRIGGER OverThrottled; // 5 elements, 0x18 bytes (sizeof)
/*0x0C8*/ struct _IRP* Irp;
/*0x0D0*/ struct _THERMAL_INFORMATION_EX Info; // 11 elements, 0x58 bytes (sizeof)
} POP_THERMAL_ZONE, *PPOP_THERMAL_ZONE;
struct _POP_TRIGGER_WAIT
Referred from:
typedef struct _POP_TRIGGER_WAIT { // 4 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
/*0x018*/ LONG32 Status;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ struct _LIST_ENTRY Link; // 2 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _POP_ACTION_TRIGGER* Trigger;
} POP_TRIGGER_WAIT, *PPOP_TRIGGER_WAIT;
struct _PORT_MESSAGE
Referred from:
typedef struct _PORT_MESSAGE { // 7 elements, 0x28 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ INT16 DataLength;
/*0x002*/ INT16 TotalLength;
} s1;
/*0x000*/ ULONG32 Length;
} u1;
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ INT16 Type;
/*0x006*/ INT16 DataInfoOffset;
} s2;
/*0x004*/ ULONG32 ZeroInit;
} u2;
union { // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ struct _CLIENT_ID ClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x008*/ FLOAT64 DoNotUseThisField;
};
/*0x018*/ ULONG32 MessageId;
/*0x01C*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ UINT64 ClientViewSize;
/*0x020*/ ULONG32 CallbackId;
};
} PORT_MESSAGE, *PPORT_MESSAGE;
struct _POWER_ACTION_POLICY
Referred from:
typedef struct _POWER_ACTION_POLICY { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ enum _POWER_ACTION Action;
/*0x004*/ ULONG32 Flags;
/*0x008*/ ULONG32 EventCode;
} POWER_ACTION_POLICY, *PPOWER_ACTION_POLICY;
struct _POWER_CHANNEL_SUMMARY
Referred from:
typedef struct _POWER_CHANNEL_SUMMARY { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ ULONG32 TotalCount;
/*0x008*/ ULONG32 D0Count;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ struct _LIST_ENTRY NotifyList; // 2 elements, 0x10 bytes (sizeof)
} POWER_CHANNEL_SUMMARY, *PPOWER_CHANNEL_SUMMARY;
struct _POWER_SEQUENCE
Referred from:
typedef struct _POWER_SEQUENCE { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 SequenceD1;
/*0x004*/ ULONG32 SequenceD2;
/*0x008*/ ULONG32 SequenceD3;
} POWER_SEQUENCE, *PPOWER_SEQUENCE;
struct _PO_DEVICE_NOTIFY
Referred from:
typedef struct _PO_DEVICE_NOTIFY { // 8 elements, 0x40 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Link; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _DEVICE_OBJECT* TargetDevice;
/*0x018*/ UINT8 OrderLevel;
/*0x019*/ UINT8 _PADDING0_[0x7];
/*0x020*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x028*/ UINT16* DeviceName;
/*0x030*/ UINT16* DriverName;
/*0x038*/ ULONG32 ChildCount;
/*0x03C*/ ULONG32 ActiveChild;
} PO_DEVICE_NOTIFY, *PPO_DEVICE_NOTIFY;
struct _PO_DEVICE_NOTIFY_ORDER
Referred from:
typedef struct _PO_DEVICE_NOTIFY_ORDER { // 3 elements, 0x250 bytes (sizeof)
/*0x000*/ UINT8 Locked;
/*0x001*/ UINT8 _PADDING0_[0x7];
/*0x008*/ struct _DEVICE_OBJECT** WarmEjectPdoPointer;
/*0x010*/ struct _PO_NOTIFY_ORDER_LEVEL OrderLevel[8];
} PO_DEVICE_NOTIFY_ORDER, *PPO_DEVICE_NOTIFY_ORDER;
struct _PO_HIBER_PERF
Referred from:
typedef struct _PO_HIBER_PERF { // 16 elements, 0x60 bytes (sizeof)
/*0x000*/ UINT64 IoTicks;
/*0x008*/ UINT64 InitTicks;
/*0x010*/ UINT64 CopyTicks;
/*0x018*/ UINT64 StartCount;
/*0x020*/ ULONG32 ElapsedTime;
/*0x024*/ ULONG32 IoTime;
/*0x028*/ ULONG32 CopyTime;
/*0x02C*/ ULONG32 InitTime;
/*0x030*/ ULONG32 PagesWritten;
/*0x034*/ ULONG32 PagesProcessed;
/*0x038*/ ULONG32 BytesCopied;
/*0x03C*/ ULONG32 DumpCount;
/*0x040*/ ULONG32 FileRuns;
/*0x044*/ UINT8 _PADDING0_[0x4];
/*0x048*/ UINT64 ResumeAppStartTime;
/*0x050*/ UINT64 ResumeAppEndTime;
/*0x058*/ UINT64 HiberFileResumeTime;
} PO_HIBER_PERF, *PPO_HIBER_PERF;
struct _PO_IRP_MANAGER
Referred from:
typedef struct _PO_IRP_MANAGER { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _PO_IRP_QUEUE DeviceIrpQueue; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _PO_IRP_QUEUE SystemIrpQueue; // 2 elements, 0x10 bytes (sizeof)
} PO_IRP_MANAGER, *PPO_IRP_MANAGER;
struct _PO_IRP_QUEUE
Referred from:
typedef struct _PO_IRP_QUEUE { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _IRP* CurrentIrp;
/*0x008*/ struct _IRP* PendingIrpList;
} PO_IRP_QUEUE, *PPO_IRP_QUEUE;
struct _PO_MEMORY_IMAGE
Referred from:
typedef struct _PO_MEMORY_IMAGE { // 24 elements, 0x128 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ ULONG32 ImageType;
/*0x008*/ ULONG32 CheckSum;
/*0x00C*/ ULONG32 LengthSelf;
/*0x010*/ UINT64 PageSelf;
/*0x018*/ ULONG32 PageSize;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ union _LARGE_INTEGER SystemTime; // 4 elements, 0x8 bytes (sizeof)
/*0x028*/ UINT64 InterruptTime;
/*0x030*/ ULONG32 FeatureFlags;
/*0x034*/ UINT8 HiberFlags;
/*0x035*/ UINT8 spare[3];
/*0x038*/ ULONG32 NoHiberPtes;
/*0x03C*/ UINT8 _PADDING1_[0x4];
/*0x040*/ UINT64 HiberVa;
/*0x048*/ union _LARGE_INTEGER HiberPte; // 4 elements, 0x8 bytes (sizeof)
/*0x050*/ ULONG32 NoFreePages;
/*0x054*/ ULONG32 FreeMapCheck;
/*0x058*/ ULONG32 WakeCheck;
/*0x05C*/ UINT8 _PADDING2_[0x4];
/*0x060*/ UINT64 TotalPages;
/*0x068*/ UINT64 FirstTablePage;
/*0x070*/ UINT64 LastFilePage;
/*0x078*/ struct _PO_HIBER_PERF PerfInfo; // 16 elements, 0x60 bytes (sizeof)
/*0x0D8*/ ULONG32 NoBootLoaderLogPages;
/*0x0DC*/ UINT8 _PADDING3_[0x4];
/*0x0E0*/ UINT64 BootLoaderLogPages[8];
/*0x120*/ ULONG32 TotalPhysicalMemoryCount;
/*0x124*/ UINT8 _PADDING4_[0x4];
} PO_MEMORY_IMAGE, *PPO_MEMORY_IMAGE;
struct _PO_MEMORY_RANGE_ARRAY
Referred from:
typedef struct _PO_MEMORY_RANGE_ARRAY { // 2 elements, 0x20 bytes (sizeof)
union { // 2 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _PO_MEMORY_RANGE_ARRAY_RANGE Range; // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _PO_MEMORY_RANGE_ARRAY_LINK Link; // 4 elements, 0x18 bytes (sizeof)
};
} PO_MEMORY_RANGE_ARRAY, *PPO_MEMORY_RANGE_ARRAY;
struct _PO_MEMORY_RANGE_ARRAY_LINK
Referred from:
typedef struct _PO_MEMORY_RANGE_ARRAY_LINK { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _PO_MEMORY_RANGE_ARRAY* Next;
/*0x008*/ UINT64 NextTable;
/*0x010*/ ULONG32 CheckSum;
/*0x014*/ ULONG32 EntryCount;
} PO_MEMORY_RANGE_ARRAY_LINK, *PPO_MEMORY_RANGE_ARRAY_LINK;
struct _PO_MEMORY_RANGE_ARRAY_RANGE
Referred from:
typedef struct _PO_MEMORY_RANGE_ARRAY_RANGE { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 PageNo;
/*0x008*/ UINT64 StartPage;
/*0x010*/ UINT64 EndPage;
/*0x018*/ ULONG32 CheckSum;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} PO_MEMORY_RANGE_ARRAY_RANGE, *PPO_MEMORY_RANGE_ARRAY_RANGE;
struct _PO_NOTIFY_ORDER_LEVEL
Referred from:
typedef struct _PO_NOTIFY_ORDER_LEVEL { // 6 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 DeviceCount;
/*0x004*/ ULONG32 ActiveCount;
/*0x008*/ struct _LIST_ENTRY WaitSleep; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY ReadySleep; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY ReadyS0; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _LIST_ENTRY WaitS0; // 2 elements, 0x10 bytes (sizeof)
} PO_NOTIFY_ORDER_LEVEL, *PPO_NOTIFY_ORDER_LEVEL;
struct _PPM_IDLE_ACCOUNTING
Referred from:
typedef struct _PPM_IDLE_ACCOUNTING { // 5 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 StateCount;
/*0x004*/ ULONG32 TotalTransitions;
/*0x008*/ ULONG32 ResetCount;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 StartTime;
/*0x018*/ struct _PPM_IDLE_STATE_ACCOUNTING State[1];
} PPM_IDLE_ACCOUNTING, *PPPM_IDLE_ACCOUNTING;
struct _PPM_IDLE_STATE
Referred from:
typedef struct _PPM_IDLE_STATE { // 11 elements, 0x28 bytes (sizeof)
/*0x000*/ PVOID IdleHandler;
/*0x008*/ UINT64 Context;
/*0x010*/ ULONG32 Latency;
/*0x014*/ ULONG32 Power;
/*0x018*/ ULONG32 TimeCheck;
/*0x01C*/ ULONG32 StateFlags;
/*0x020*/ UINT8 PromotePercent;
/*0x021*/ UINT8 DemotePercent;
/*0x022*/ UINT8 PromotePercentBase;
/*0x023*/ UINT8 DemotePercentBase;
/*0x024*/ UINT8 StateType;
/*0x025*/ UINT8 _PADDING0_[0x3];
} PPM_IDLE_STATE, *PPPM_IDLE_STATE;
struct _PPM_IDLE_STATES
Referred from:
typedef struct _PPM_IDLE_STATES { // 8 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 Type;
/*0x004*/ ULONG32 Count;
union { // 4 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 AsULONG;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x008*/ ULONG32 AllowScaling : 1; // 0 BitPosition
/*0x008*/ ULONG32 Disabled : 1; // 1 BitPosition
/*0x008*/ ULONG32 Reserved : 30; // 2 BitPosition
};
} Flags;
/*0x00C*/ ULONG32 TargetState;
/*0x010*/ ULONG32 ActualState;
/*0x014*/ ULONG32 OldState;
/*0x018*/ UINT64 TargetProcessors;
/*0x020*/ struct _PPM_IDLE_STATE State[1];
} PPM_IDLE_STATES, *PPPM_IDLE_STATES;
struct _PPM_IDLE_STATE_ACCOUNTING
Referred from:
typedef struct _PPM_IDLE_STATE_ACCOUNTING { // 5 elements, 0x30 bytes (sizeof)
/*0x000*/ ULONG32 IdleTransitions;
/*0x004*/ ULONG32 FailedTransitions;
/*0x008*/ ULONG32 InvalidBucketIndex;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 TotalTime;
/*0x018*/ ULONG32 IdleTimeBuckets[6];
} PPM_IDLE_STATE_ACCOUNTING, *PPPM_IDLE_STATE_ACCOUNTING;
struct _PPM_PERF_STATE
Referred from:
typedef struct _PPM_PERF_STATE { // 10 elements, 0x28 bytes (sizeof)
/*0x000*/ ULONG32 Frequency;
/*0x004*/ ULONG32 Power;
/*0x008*/ UINT8 PercentFrequency;
/*0x009*/ UINT8 IncreaseLevel;
/*0x00A*/ UINT8 DecreaseLevel;
/*0x00B*/ UINT8 Type;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 Control;
/*0x018*/ UINT64 Status;
/*0x020*/ ULONG32 TotalHitCount;
/*0x024*/ ULONG32 DesiredCount;
} PPM_PERF_STATE, *PPPM_PERF_STATE;
struct _PPM_PERF_STATES
Referred from:
typedef struct _PPM_PERF_STATES { // 20 elements, 0x80 bytes (sizeof)
/*0x000*/ ULONG32 Count;
/*0x004*/ ULONG32 MaxFrequency;
/*0x008*/ ULONG32 MaxPerfState;
/*0x00C*/ ULONG32 MinPerfState;
/*0x010*/ ULONG32 LowestPState;
/*0x014*/ ULONG32 IncreaseTime;
/*0x018*/ ULONG32 DecreaseTime;
/*0x01C*/ UINT8 BusyAdjThreshold;
/*0x01D*/ UINT8 Reserved;
/*0x01E*/ UINT8 ThrottleStatesOnly;
/*0x01F*/ UINT8 PolicyType;
/*0x020*/ ULONG32 TimerInterval;
union { // 6 elements, 0x4 bytes (sizeof)
/*0x024*/ ULONG32 AsULONG;
struct { // 5 elements, 0x4 bytes (sizeof)
/*0x024*/ ULONG32 UsingHypervisor : 1; // 0 BitPosition
/*0x024*/ ULONG32 NoDomainAccounting : 1; // 1 BitPosition
/*0x024*/ ULONG32 IncreasePolicy : 2; // 2 BitPosition
/*0x024*/ ULONG32 DecreasePolicy : 2; // 4 BitPosition
/*0x024*/ ULONG32 Reserved : 26; // 6 BitPosition
};
} Flags;
/*0x028*/ UINT64 TargetProcessors;
/*0x030*/ PVOID PStateHandler;
/*0x038*/ UINT64 PStateContext;
/*0x040*/ PVOID TStateHandler;
/*0x048*/ UINT64 TStateContext;
/*0x050*/ PVOID FeedbackHandler;
/*0x058*/ struct _PPM_PERF_STATE State[1];
} PPM_PERF_STATES, *PPPM_PERF_STATES;
struct _PP_LOOKASIDE_LIST
Referred from:
typedef struct _PP_LOOKASIDE_LIST { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _GENERAL_LOOKASIDE* P;
/*0x008*/ struct _GENERAL_LOOKASIDE* L;
} PP_LOOKASIDE_LIST, *PPP_LOOKASIDE_LIST;
struct _PRIVATE_CACHE_MAP
Referred from:
typedef struct _PRIVATE_CACHE_MAP { // 13 elements, 0x60 bytes (sizeof)
union { // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ INT16 NodeTypeCode;
/*0x000*/ struct _PRIVATE_CACHE_MAP_FLAGS Flags; // 5 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 UlongFlags;
};
/*0x004*/ ULONG32 ReadAheadMask;
/*0x008*/ struct _FILE_OBJECT* FileObject;
/*0x010*/ union _LARGE_INTEGER FileOffset1; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ union _LARGE_INTEGER BeyondLastByte1; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ union _LARGE_INTEGER FileOffset2; // 4 elements, 0x8 bytes (sizeof)
/*0x028*/ union _LARGE_INTEGER BeyondLastByte2; // 4 elements, 0x8 bytes (sizeof)
/*0x030*/ union _LARGE_INTEGER ReadAheadOffset[2];
/*0x040*/ ULONG32 ReadAheadLength[2];
/*0x048*/ UINT64 ReadAheadSpinLock;
/*0x050*/ struct _LIST_ENTRY PrivateLinks; // 2 elements, 0x10 bytes (sizeof)
} PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;
struct _PRIVATE_CACHE_MAP_FLAGS
Referred from:
typedef struct _PRIVATE_CACHE_MAP_FLAGS { // 5 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 DontUse : 16; // 0 BitPosition
/*0x000*/ ULONG32 ReadAheadActive : 1; // 16 BitPosition
/*0x000*/ ULONG32 ReadAheadEnabled : 1; // 17 BitPosition
/*0x000*/ ULONG32 PagePriority : 3; // 18 BitPosition
/*0x000*/ ULONG32 Available : 11; // 21 BitPosition
} PRIVATE_CACHE_MAP_FLAGS, *PPRIVATE_CACHE_MAP_FLAGS;
struct _PRIVILEGE_SET
Referred from:
typedef struct _PRIVILEGE_SET { // 3 elements, 0x14 bytes (sizeof)
/*0x000*/ ULONG32 PrivilegeCount;
/*0x004*/ ULONG32 Control;
/*0x008*/ struct _LUID_AND_ATTRIBUTES Privilege[1];
} PRIVILEGE_SET, *PPRIVILEGE_SET;
struct _PROCESSOR_IDLESTATE_INFO
Referred from:
typedef struct _PROCESSOR_IDLESTATE_INFO { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 TimeCheck;
/*0x004*/ UINT8 DemotePercent;
/*0x005*/ UINT8 PromotePercent;
/*0x006*/ UINT8 Spare[2];
} PROCESSOR_IDLESTATE_INFO, *PPROCESSOR_IDLESTATE_INFO;
struct _PROCESSOR_IDLESTATE_POLICY
typedef struct _PROCESSOR_IDLESTATE_POLICY { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT16 Revision;
union { // 4 elements, 0x2 bytes (sizeof)
/*0x002*/ UINT16 AsUSHORT;
struct { // 3 elements, 0x2 bytes (sizeof)
/*0x002*/ UINT16 AllowScaling : 1; // 0 BitPosition
/*0x002*/ UINT16 Disabled : 1; // 1 BitPosition
/*0x002*/ UINT16 Reserved : 14; // 2 BitPosition
};
} Flags;
/*0x004*/ ULONG32 PolicyCount;
/*0x008*/ struct _PROCESSOR_IDLESTATE_INFO Policy[3];
} PROCESSOR_IDLESTATE_POLICY, *PPROCESSOR_IDLESTATE_POLICY;
struct _PROCESSOR_IDLE_TIMES
Referred from:
typedef struct _PROCESSOR_IDLE_TIMES { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 StartTime;
/*0x008*/ UINT64 EndTime;
/*0x010*/ ULONG32 Reserved[4];
} PROCESSOR_IDLE_TIMES, *PPROCESSOR_IDLE_TIMES;
struct _PROCESSOR_PERFSTATE_POLICY
typedef struct _PROCESSOR_PERFSTATE_POLICY { // 11 elements, 0x1C bytes (sizeof)
/*0x000*/ ULONG32 Revision;
/*0x004*/ UINT8 MaxThrottle;
/*0x005*/ UINT8 MinThrottle;
/*0x006*/ UINT8 BusyAdjThreshold;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x007*/ UINT8 Spare;
union { // 5 elements, 0x1 bytes (sizeof)
/*0x007*/ UINT8 AsUCHAR;
struct { // 4 elements, 0x1 bytes (sizeof)
/*0x007*/ UINT8 NoDomainAccounting : 1; // 0 BitPosition
/*0x007*/ UINT8 IncreasePolicy : 2; // 1 BitPosition
/*0x007*/ UINT8 DecreasePolicy : 2; // 3 BitPosition
/*0x007*/ UINT8 Reserved : 3; // 5 BitPosition
};
} Flags;
};
/*0x008*/ ULONG32 TimeCheck;
/*0x00C*/ ULONG32 IncreaseTime;
/*0x010*/ ULONG32 DecreaseTime;
/*0x014*/ ULONG32 IncreasePercent;
/*0x018*/ ULONG32 DecreasePercent;
} PROCESSOR_PERFSTATE_POLICY, *PPROCESSOR_PERFSTATE_POLICY;
struct _PROCESSOR_POWER_STATE
Referred from:
typedef struct _PROCESSOR_POWER_STATE { // 29 elements, 0x138 bytes (sizeof)
/*0x000*/ PVOID IdleFunction;
/*0x008*/ struct _PPM_IDLE_STATES* IdleStates;
/*0x010*/ UINT64 LastTimeCheck;
/*0x018*/ UINT64 LastIdleTime;
/*0x020*/ struct _PROCESSOR_IDLE_TIMES IdleTimes; // 3 elements, 0x20 bytes (sizeof)
/*0x040*/ struct _PPM_IDLE_ACCOUNTING* IdleAccounting;
/*0x048*/ struct _PPM_PERF_STATES* PerfStates;
/*0x050*/ ULONG32 LastKernelUserTime;
/*0x054*/ ULONG32 LastIdleThreadKTime;
/*0x058*/ UINT64 LastGlobalTimeHv;
/*0x060*/ UINT64 LastProcessorTimeHv;
/*0x068*/ UINT8 ThermalConstraint;
/*0x069*/ UINT8 LastBusyPercentage;
union { // 4 elements, 0x2 bytes (sizeof)
/*0x06A*/ UINT16 AsUSHORT;
struct { // 3 elements, 0x2 bytes (sizeof)
/*0x06A*/ UINT16 PStateDomain : 1; // 0 BitPosition
/*0x06A*/ UINT16 PStateDomainIdleAccounting : 1; // 1 BitPosition
/*0x06A*/ UINT16 Reserved : 14; // 2 BitPosition
};
} Flags;
/*0x070*/ struct _KTIMER PerfTimer; // 5 elements, 0x40 bytes (sizeof)
/*0x0B0*/ struct _KDPC PerfDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x0F0*/ ULONG32 LastSysTime;
/*0x0F4*/ UINT8 _PADDING0_[0x4];
/*0x0F8*/ struct _KPRCB* PStateMaster;
/*0x100*/ UINT64 PStateSet;
/*0x108*/ ULONG32 CurrentPState;
/*0x10C*/ ULONG32 Reserved0;
/*0x110*/ ULONG32 DesiredPState;
/*0x114*/ ULONG32 Reserved1;
/*0x118*/ ULONG32 PStateIdleStartTime;
/*0x11C*/ ULONG32 PStateIdleTime;
/*0x120*/ ULONG32 LastPStateIdleTime;
/*0x124*/ ULONG32 PStateStartTime;
/*0x128*/ UINT64 WmiDispatchPtr;
/*0x130*/ LONG32 WmiInterfaceEnabled;
/*0x134*/ UINT8 _PADDING1_[0x4];
} PROCESSOR_POWER_STATE, *PPROCESSOR_POWER_STATE;
struct _PROFILE_PARAMETER_BLOCK
Referred from:
typedef struct _PROFILE_PARAMETER_BLOCK { // 6 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Status;
/*0x002*/ UINT16 Reserved;
/*0x004*/ UINT16 DockingState;
/*0x006*/ UINT16 Capabilities;
/*0x008*/ ULONG32 DockID;
/*0x00C*/ ULONG32 SerialNumber;
} PROFILE_PARAMETER_BLOCK, *PPROFILE_PARAMETER_BLOCK;
struct _QUAD
Referred from:
typedef struct _QUAD { // 2 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ INT64 UseThisFieldToCopy;
/*0x000*/ FLOAT64 DoNotUseThisField;
};
} QUAD, *PQUAD;
struct _REQUEST_MAILBOX
Referred from:
typedef struct _REQUEST_MAILBOX { // 3 elements, 0x40 bytes (sizeof)
/*0x000*/ INT64 RequestSummary;
union { // 2 elements, 0x38 bytes (sizeof)
/*0x008*/ struct _KREQUEST_PACKET RequestPacket; // 2 elements, 0x20 bytes (sizeof)
/*0x008*/ VOID* Virtual[7];
};
} REQUEST_MAILBOX, *PREQUEST_MAILBOX;
struct _RTLP_RANGE_LIST_ENTRY
typedef struct _RTLP_RANGE_LIST_ENTRY { // 8 elements, 0x38 bytes (sizeof)
/*0x000*/ UINT64 Start;
/*0x008*/ UINT64 End;
union { // 2 elements, 0x10 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ VOID* UserData;
/*0x018*/ VOID* Owner;
} Allocated;
struct { // 1 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY ListHead; // 2 elements, 0x10 bytes (sizeof)
} Merged;
};
/*0x020*/ UINT8 Attributes;
/*0x021*/ UINT8 PublicFlags;
/*0x022*/ UINT16 PrivateFlags;
/*0x024*/ UINT8 _PADDING0_[0x4];
/*0x028*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
} RTLP_RANGE_LIST_ENTRY, *PRTLP_RANGE_LIST_ENTRY;
struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
Referred from:
typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous;
/*0x008*/ struct _ACTIVATION_CONTEXT* ActivationContext;
/*0x010*/ ULONG32 Flags;
/*0x014*/ UINT8 _PADDING0_[0x4];
} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
struct _RTL_ATOM_TABLE
typedef struct _RTL_ATOM_TABLE { // 5 elements, 0x70 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _RTL_CRITICAL_SECTION CriticalSection; // 6 elements, 0x28 bytes (sizeof)
/*0x030*/ struct _RTL_HANDLE_TABLE RtlHandleTable; // 7 elements, 0x30 bytes (sizeof)
/*0x060*/ ULONG32 NumberOfBuckets;
/*0x064*/ UINT8 _PADDING1_[0x4];
/*0x068*/ struct _RTL_ATOM_TABLE_ENTRY* Buckets[1];
} RTL_ATOM_TABLE, *PRTL_ATOM_TABLE;
struct _RTL_ATOM_TABLE_ENTRY
Referred from:
typedef struct _RTL_ATOM_TABLE_ENTRY { // 7 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _RTL_ATOM_TABLE_ENTRY* HashLink;
/*0x008*/ UINT16 HandleIndex;
/*0x00A*/ UINT16 Atom;
/*0x00C*/ UINT16 ReferenceCount;
/*0x00E*/ UINT8 Flags;
/*0x00F*/ UINT8 NameLength;
/*0x010*/ WCHAR Name[1];
/*0x012*/ UINT8 _PADDING0_[0x6];
} RTL_ATOM_TABLE_ENTRY, *PRTL_ATOM_TABLE_ENTRY;
struct _RTL_AVL_TABLE
Referred from:
typedef struct _RTL_AVL_TABLE { // 11 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _RTL_BALANCED_LINKS BalancedRoot; // 5 elements, 0x20 bytes (sizeof)
/*0x020*/ VOID* OrderedPointer;
/*0x028*/ ULONG32 WhichOrderedElement;
/*0x02C*/ ULONG32 NumberGenericTableElements;
/*0x030*/ ULONG32 DepthOfTree;
/*0x034*/ UINT8 _PADDING0_[0x4];
/*0x038*/ struct _RTL_BALANCED_LINKS* RestartKey;
/*0x040*/ ULONG32 DeleteCount;
/*0x044*/ UINT8 _PADDING1_[0x4];
/*0x048*/ PVOID CompareRoutine;
/*0x050*/ PVOID AllocateRoutine;
/*0x058*/ PVOID FreeRoutine;
/*0x060*/ VOID* TableContext;
} RTL_AVL_TABLE, *PRTL_AVL_TABLE;
struct _RTL_BALANCED_LINKS
Referred from:
typedef struct _RTL_BALANCED_LINKS { // 5 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _RTL_BALANCED_LINKS* Parent;
/*0x008*/ struct _RTL_BALANCED_LINKS* LeftChild;
/*0x010*/ struct _RTL_BALANCED_LINKS* RightChild;
/*0x018*/ CHAR Balance;
/*0x019*/ UINT8 Reserved[3];
/*0x01C*/ UINT8 _PADDING0_[0x4];
} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
struct _RTL_BITMAP
Referred from:
typedef struct _RTL_BITMAP { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 SizeOfBitMap;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ ULONG32* Buffer;
} RTL_BITMAP, *PRTL_BITMAP;
struct _RTL_CRITICAL_SECTION
Referred from:
typedef struct _RTL_CRITICAL_SECTION { // 6 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _RTL_CRITICAL_SECTION_DEBUG* DebugInfo;
/*0x008*/ LONG32 LockCount;
/*0x00C*/ LONG32 RecursionCount;
/*0x010*/ VOID* OwningThread;
/*0x018*/ VOID* LockSemaphore;
/*0x020*/ UINT64 SpinCount;
} RTL_CRITICAL_SECTION, *PRTL_CRITICAL_SECTION;
struct _RTL_CRITICAL_SECTION_DEBUG
Referred from:
typedef struct _RTL_CRITICAL_SECTION_DEBUG { // 9 elements, 0x30 bytes (sizeof)
/*0x000*/ UINT16 Type;
/*0x002*/ UINT16 CreatorBackTraceIndex;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _RTL_CRITICAL_SECTION* CriticalSection;
/*0x010*/ struct _LIST_ENTRY ProcessLocksList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ ULONG32 EntryCount;
/*0x024*/ ULONG32 ContentionCount;
/*0x028*/ ULONG32 Flags;
/*0x02C*/ UINT16 CreatorBackTraceIndexHigh;
/*0x02E*/ UINT16 SpareUSHORT;
} RTL_CRITICAL_SECTION_DEBUG, *PRTL_CRITICAL_SECTION_DEBUG;
struct _RTL_DRIVE_LETTER_CURDIR
Referred from:
typedef struct _RTL_DRIVE_LETTER_CURDIR { // 4 elements, 0x18 bytes (sizeof)
/*0x000*/ UINT16 Flags;
/*0x002*/ UINT16 Length;
/*0x004*/ ULONG32 TimeStamp;
/*0x008*/ struct _STRING DosPath; // 3 elements, 0x10 bytes (sizeof)
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
struct _RTL_HANDLE_TABLE
Referred from:
typedef struct _RTL_HANDLE_TABLE { // 7 elements, 0x30 bytes (sizeof)
/*0x000*/ ULONG32 MaximumNumberOfHandles;
/*0x004*/ ULONG32 SizeOfHandleTableEntry;
/*0x008*/ ULONG32 Reserved[2];
/*0x010*/ struct _RTL_HANDLE_TABLE_ENTRY* FreeHandles;
/*0x018*/ struct _RTL_HANDLE_TABLE_ENTRY* CommittedHandles;
/*0x020*/ struct _RTL_HANDLE_TABLE_ENTRY* UnCommittedHandles;
/*0x028*/ struct _RTL_HANDLE_TABLE_ENTRY* MaxReservedHandles;
} RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE;
struct _RTL_HANDLE_TABLE_ENTRY
Referred from:
typedef struct _RTL_HANDLE_TABLE_ENTRY { // 2 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ ULONG32 Flags;
/*0x000*/ struct _RTL_HANDLE_TABLE_ENTRY* NextFree;
};
} RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY;
struct _RTL_RANGE
typedef struct _RTL_RANGE { // 6 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT64 Start;
/*0x008*/ UINT64 End;
/*0x010*/ VOID* UserData;
/*0x018*/ VOID* Owner;
/*0x020*/ UINT8 Attributes;
/*0x021*/ UINT8 Flags;
/*0x022*/ UINT8 _PADDING0_[0x6];
} RTL_RANGE, *PRTL_RANGE;
struct _RTL_RANGE_LIST
Referred from:
typedef struct _RTL_RANGE_LIST { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 Flags;
/*0x014*/ ULONG32 Count;
/*0x018*/ ULONG32 Stamp;
/*0x01C*/ UINT8 _PADDING0_[0x4];
} RTL_RANGE_LIST, *PRTL_RANGE_LIST;
struct _RTL_USER_PROCESS_PARAMETERS
Referred from:
typedef struct _RTL_USER_PROCESS_PARAMETERS { // 29 elements, 0x3F8 bytes (sizeof)
/*0x000*/ ULONG32 MaximumLength;
/*0x004*/ ULONG32 Length;
/*0x008*/ ULONG32 Flags;
/*0x00C*/ ULONG32 DebugFlags;
/*0x010*/ VOID* ConsoleHandle;
/*0x018*/ ULONG32 ConsoleFlags;
/*0x01C*/ UINT8 _PADDING0_[0x4];
/*0x020*/ VOID* StandardInput;
/*0x028*/ VOID* StandardOutput;
/*0x030*/ VOID* StandardError;
/*0x038*/ struct _CURDIR CurrentDirectory; // 2 elements, 0x18 bytes (sizeof)
/*0x050*/ struct _UNICODE_STRING DllPath; // 3 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _UNICODE_STRING ImagePathName; // 3 elements, 0x10 bytes (sizeof)
/*0x070*/ struct _UNICODE_STRING CommandLine; // 3 elements, 0x10 bytes (sizeof)
/*0x080*/ VOID* Environment;
/*0x088*/ ULONG32 StartingX;
/*0x08C*/ ULONG32 StartingY;
/*0x090*/ ULONG32 CountX;
/*0x094*/ ULONG32 CountY;
/*0x098*/ ULONG32 CountCharsX;
/*0x09C*/ ULONG32 CountCharsY;
/*0x0A0*/ ULONG32 FillAttribute;
/*0x0A4*/ ULONG32 WindowFlags;
/*0x0A8*/ ULONG32 ShowWindowFlags;
/*0x0AC*/ UINT8 _PADDING1_[0x4];
/*0x0B0*/ struct _UNICODE_STRING WindowTitle; // 3 elements, 0x10 bytes (sizeof)
/*0x0C0*/ struct _UNICODE_STRING DesktopInfo; // 3 elements, 0x10 bytes (sizeof)
/*0x0D0*/ struct _UNICODE_STRING ShellInfo; // 3 elements, 0x10 bytes (sizeof)
/*0x0E0*/ struct _UNICODE_STRING RuntimeData; // 3 elements, 0x10 bytes (sizeof)
/*0x0F0*/ struct _RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
/*0x3F0*/ UINT64 EnvironmentSize;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
struct _SCSI_REQUEST_BLOCK
Referred from:
typedef struct _SCSI_REQUEST_BLOCK { // 0 elements, 0x0 bytes (sizeof)
} SCSI_REQUEST_BLOCK, *PSCSI_REQUEST_BLOCK;
Referred from:
typedef struct _SECTION_IMAGE_INFORMATION { // 21 elements, 0x40 bytes (sizeof)
/*0x000*/ VOID* TransferAddress;
/*0x008*/ ULONG32 ZeroBits;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 MaximumStackSize;
/*0x018*/ UINT64 CommittedStackSize;
/*0x020*/ ULONG32 SubSystemType;
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x024*/ UINT16 SubSystemMinorVersion;
/*0x026*/ UINT16 SubSystemMajorVersion;
};
/*0x024*/ ULONG32 SubSystemVersion;
};
/*0x028*/ ULONG32 GpValue;
/*0x02C*/ UINT16 ImageCharacteristics;
/*0x02E*/ UINT16 DllCharacteristics;
/*0x030*/ UINT16 Machine;
/*0x032*/ UINT8 ImageContainsCode;
union { // 2 elements, 0x1 bytes (sizeof)
/*0x033*/ UINT8 ImageFlags;
struct { // 4 elements, 0x1 bytes (sizeof)
/*0x033*/ UINT8 ComPlusNativeReady : 1; // 0 BitPosition
/*0x033*/ UINT8 ComPlusILOnly : 1; // 1 BitPosition
/*0x033*/ UINT8 ImageDynamicallyRelocated : 1; // 2 BitPosition
/*0x033*/ UINT8 Reserved : 5; // 3 BitPosition
};
};
/*0x034*/ ULONG32 LoaderFlags;
/*0x038*/ ULONG32 ImageFileSize;
/*0x03C*/ ULONG32 CheckSum;
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
struct _SECTION_OBJECT
typedef struct _SECTION_OBJECT { // 6 elements, 0x30 bytes (sizeof)
/*0x000*/ VOID* StartingVa;
/*0x008*/ VOID* EndingVa;
/*0x010*/ VOID* Parent;
/*0x018*/ VOID* LeftChild;
/*0x020*/ VOID* RightChild;
/*0x028*/ struct _SEGMENT_OBJECT* Segment;
} SECTION_OBJECT, *PSECTION_OBJECT;
struct _SECTION_OBJECT_POINTERS
Referred from:
typedef struct _SECTION_OBJECT_POINTERS { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ VOID* DataSectionObject;
/*0x008*/ VOID* SharedCacheMap;
/*0x010*/ VOID* ImageSectionObject;
} SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
struct _SECURITY_CLIENT_CONTEXT
Referred from:
typedef struct _SECURITY_CLIENT_CONTEXT { // 6 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _SECURITY_QUALITY_OF_SERVICE SecurityQos; // 4 elements, 0xC bytes (sizeof)
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ VOID* ClientToken;
/*0x018*/ UINT8 DirectlyAccessClientToken;
/*0x019*/ UINT8 DirectAccessEffectiveOnly;
/*0x01A*/ UINT8 ServerIsRemote;
/*0x01B*/ UINT8 _PADDING1_[0x1];
/*0x01C*/ struct _TOKEN_CONTROL ClientTokenControl; // 4 elements, 0x28 bytes (sizeof)
/*0x044*/ UINT8 _PADDING2_[0x4];
} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
struct _SECURITY_DESCRIPTOR
typedef struct _SECURITY_DESCRIPTOR { // 7 elements, 0x28 bytes (sizeof)
/*0x000*/ UINT8 Revision;
/*0x001*/ UINT8 Sbz1;
/*0x002*/ UINT16 Control;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* Owner;
/*0x010*/ VOID* Group;
/*0x018*/ struct _ACL* Sacl;
/*0x020*/ struct _ACL* Dacl;
} SECURITY_DESCRIPTOR, *PSECURITY_DESCRIPTOR;
struct _SECURITY_DESCRIPTOR_RELATIVE
Referred from:
typedef struct _SECURITY_DESCRIPTOR_RELATIVE { // 7 elements, 0x14 bytes (sizeof)
/*0x000*/ UINT8 Revision;
/*0x001*/ UINT8 Sbz1;
/*0x002*/ UINT16 Control;
/*0x004*/ ULONG32 Owner;
/*0x008*/ ULONG32 Group;
/*0x00C*/ ULONG32 Sacl;
/*0x010*/ ULONG32 Dacl;
} SECURITY_DESCRIPTOR_RELATIVE, *PSECURITY_DESCRIPTOR_RELATIVE;
struct _SECURITY_QUALITY_OF_SERVICE
Referred from:
typedef struct _SECURITY_QUALITY_OF_SERVICE { // 4 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
/*0x008*/ UINT8 ContextTrackingMode;
/*0x009*/ UINT8 EffectiveOnly;
/*0x00A*/ UINT8 _PADDING0_[0x2];
} SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE;
struct _SECURITY_SUBJECT_CONTEXT
Referred from:
typedef struct _SECURITY_SUBJECT_CONTEXT { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ VOID* ClientToken;
/*0x008*/ enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ VOID* PrimaryToken;
/*0x018*/ VOID* ProcessAuditId;
} SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
struct _SECURITY_TOKEN_AUDIT_DATA
Referred from:
typedef struct _SECURITY_TOKEN_AUDIT_DATA { // 3 elements, 0xC bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ ULONG32 GrantMask;
/*0x008*/ ULONG32 DenyMask;
} SECURITY_TOKEN_AUDIT_DATA, *PSECURITY_TOKEN_AUDIT_DATA;
struct _SECURITY_TOKEN_PROXY_DATA
Referred from:
typedef struct _SECURITY_TOKEN_PROXY_DATA { // 5 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 Length;
/*0x004*/ enum _PROXY_CLASS ProxyClass;
/*0x008*/ struct _UNICODE_STRING PathInfo; // 3 elements, 0x10 bytes (sizeof)
/*0x018*/ ULONG32 ContainerMask;
/*0x01C*/ ULONG32 ObjectMask;
} SECURITY_TOKEN_PROXY_DATA, *PSECURITY_TOKEN_PROXY_DATA;
struct _SEGMENT
Referred from:
typedef struct _SEGMENT { // 13 elements, 0x58 bytes (sizeof)
/*0x000*/ struct _CONTROL_AREA* ControlArea;
/*0x008*/ ULONG32 TotalNumberOfPtes;
/*0x00C*/ ULONG32 NonExtendedPtes;
/*0x010*/ UINT64 NumberOfCommittedPages;
/*0x018*/ UINT64 SizeOfSegment;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _MMEXTEND_INFO* ExtendInfo;
/*0x020*/ VOID* BasedAddress;
};
/*0x028*/ struct _EX_PUSH_LOCK SegmentLock; // 7 elements, 0x8 bytes (sizeof)
/*0x030*/ struct _SEGMENT_FLAGS SegmentFlags; // 12 elements, 0x8 bytes (sizeof)
union { // 2 elements, 0x8 bytes (sizeof)
/*0x038*/ UINT64 ImageCommitment;
/*0x038*/ struct _EPROCESS* CreatingProcess;
} u1;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x040*/ struct _MI_SECTION_IMAGE_INFORMATION* ImageInformation;
/*0x040*/ VOID* FirstMappedVa;
} u2;
/*0x048*/ struct _MMPTE* PrototypePte;
/*0x050*/ struct _MMPTE ThePtes[1];
} SEGMENT, *PSEGMENT;
struct _SEGMENT_FLAGS
Referred from:
typedef struct _SEGMENT_FLAGS { // 12 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 TotalNumberOfPtes4132 : 10; // 0 BitPosition
/*0x000*/ UINT64 ExtraSharedWowSubsections : 1; // 10 BitPosition
/*0x000*/ UINT64 LargePages : 1; // 11 BitPosition
/*0x000*/ UINT64 WatchProto : 1; // 12 BitPosition
/*0x000*/ UINT64 DebugSymbolsLoaded : 1; // 13 BitPosition
/*0x000*/ UINT64 WriteCombined : 1; // 14 BitPosition
/*0x000*/ UINT64 NoCache : 1; // 15 BitPosition
/*0x000*/ UINT64 FloppyMedia : 1; // 16 BitPosition
/*0x000*/ UINT64 DefaultProtectionMask : 5; // 17 BitPosition
/*0x000*/ UINT64 ContainsPxeSubsection : 1; // 22 BitPosition
/*0x000*/ UINT64 Spare : 40; // 23 BitPosition
/*0x000*/ UINT64 Binary32 : 1; // 63 BitPosition
} SEGMENT_FLAGS, *PSEGMENT_FLAGS;
struct _SEGMENT_OBJECT
Referred from:
typedef struct _SEGMENT_OBJECT { // 9 elements, 0x40 bytes (sizeof)
/*0x000*/ VOID* BaseAddress;
/*0x008*/ ULONG32 TotalNumberOfPtes;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ union _LARGE_INTEGER SizeOfSegment; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ ULONG32 NonExtendedPtes;
/*0x01C*/ ULONG32 ImageCommitment;
/*0x020*/ struct _CONTROL_AREA* ControlArea;
/*0x028*/ struct _SUBSECTION* Subsection;
/*0x030*/ struct _MMSECTION_FLAGS* MmSectionFlags;
/*0x038*/ struct _MMSUBSECTION_FLAGS* MmSubSectionFlags;
} SEGMENT_OBJECT, *PSEGMENT_OBJECT;
struct _SEP_AUDIT_POLICY
Referred from:
typedef struct _SEP_AUDIT_POLICY { // 2 elements, 0x1B bytes (sizeof)
/*0x000*/ struct _TOKEN_AUDIT_POLICY AdtTokenPolicy; // 1 elements, 0x1A bytes (sizeof)
/*0x01A*/ UINT8 PolicySetStatus;
} SEP_AUDIT_POLICY, *PSEP_AUDIT_POLICY;
struct _SEP_LOGON_SESSION_REFERENCES
Referred from:
typedef struct _SEP_LOGON_SESSION_REFERENCES { // 9 elements, 0x50 bytes (sizeof)
/*0x000*/ struct _SEP_LOGON_SESSION_REFERENCES* Next;
/*0x008*/ struct _LUID LogonId; // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _LUID BuddyLogonId; // 2 elements, 0x8 bytes (sizeof)
/*0x018*/ ULONG32 ReferenceCount;
/*0x01C*/ ULONG32 Flags;
/*0x020*/ struct _DEVICE_MAP* pDeviceMap;
/*0x028*/ VOID* Token;
/*0x030*/ struct _UNICODE_STRING AccountName; // 3 elements, 0x10 bytes (sizeof)
/*0x040*/ struct _UNICODE_STRING AuthorityName; // 3 elements, 0x10 bytes (sizeof)
} SEP_LOGON_SESSION_REFERENCES, *PSEP_LOGON_SESSION_REFERENCES;
struct _SEP_TOKEN_PRIVILEGES
Referred from:
typedef struct _SEP_TOKEN_PRIVILEGES { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ UINT64 Present;
/*0x008*/ UINT64 Enabled;
/*0x010*/ UINT64 EnabledByDefault;
} SEP_TOKEN_PRIVILEGES, *PSEP_TOKEN_PRIVILEGES;
struct _SETUP_LOADER_BLOCK
Referred from:
typedef struct _SETUP_LOADER_BLOCK { // 0 elements, 0x0 bytes (sizeof)
} SETUP_LOADER_BLOCK, *PSETUP_LOADER_BLOCK;
struct _SE_AUDIT_PROCESS_CREATION_INFO
Referred from:
typedef struct _SE_AUDIT_PROCESS_CREATION_INFO { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _OBJECT_NAME_INFORMATION* ImageFileName;
} SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;
struct _SHARED_CACHE_MAP
Referred from:
typedef struct _SHARED_CACHE_MAP { // 45 elements, 0x1C8 bytes (sizeof)
/*0x000*/ INT16 NodeTypeCode;
/*0x002*/ INT16 NodeByteSize;
/*0x004*/ ULONG32 OpenCount;
/*0x008*/ union _LARGE_INTEGER FileSize; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY BcbList; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ union _LARGE_INTEGER SectionSize; // 4 elements, 0x8 bytes (sizeof)
/*0x028*/ union _LARGE_INTEGER ValidDataLength; // 4 elements, 0x8 bytes (sizeof)
/*0x030*/ union _LARGE_INTEGER ValidDataGoal; // 4 elements, 0x8 bytes (sizeof)
/*0x038*/ struct _VACB* InitialVacbs[4];
/*0x058*/ struct _VACB** Vacbs;
/*0x060*/ struct _EX_FAST_REF FileObjectFastRef; // 3 elements, 0x8 bytes (sizeof)
/*0x068*/ struct _VACB* ActiveVacb;
/*0x070*/ VOID* NeedToZero;
/*0x078*/ ULONG32 ActivePage;
/*0x07C*/ ULONG32 NeedToZeroPage;
/*0x080*/ UINT64 ActiveVacbSpinLock;
/*0x088*/ ULONG32 VacbActiveCount;
/*0x08C*/ ULONG32 DirtyPages;
/*0x090*/ struct _LIST_ENTRY SharedCacheMapLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x0A0*/ ULONG32 Flags;
/*0x0A4*/ LONG32 Status;
/*0x0A8*/ struct _MBCB* Mbcb;
/*0x0B0*/ VOID* Section;
/*0x0B8*/ struct _KEVENT* CreateEvent;
/*0x0C0*/ struct _KEVENT* WaitOnActiveCount;
/*0x0C8*/ ULONG32 PagesToWrite;
/*0x0CC*/ UINT8 _PADDING0_[0x4];
/*0x0D0*/ INT64 BeyondLastFlush;
/*0x0D8*/ struct _CACHE_MANAGER_CALLBACKS* Callbacks;
/*0x0E0*/ VOID* LazyWriteContext;
/*0x0E8*/ struct _LIST_ENTRY PrivateList; // 2 elements, 0x10 bytes (sizeof)
/*0x0F8*/ VOID* LogHandle;
/*0x100*/ PVOID FlushToLsnRoutine;
/*0x108*/ ULONG32 DirtyPageThreshold;
/*0x10C*/ ULONG32 LazyWritePassCount;
/*0x110*/ struct _CACHE_UNINITIALIZE_EVENT* UninitializeEvent;
/*0x118*/ struct _VACB* NeedToZeroVacb;
/*0x120*/ UINT64 BcbSpinLock;
/*0x128*/ VOID* Reserved;
/*0x130*/ struct _KEVENT Event; // 1 elements, 0x18 bytes (sizeof)
/*0x148*/ union _LARGE_INTEGER HighWaterMappingOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x150*/ struct _PRIVATE_CACHE_MAP PrivateCacheMap; // 13 elements, 0x60 bytes (sizeof)
/*0x1B0*/ VOID* WriteBehindWorkQueueEntry;
/*0x1B8*/ struct _VOLUME_CACHE_MAP* VolumeCacheMap;
/*0x1C0*/ ULONG32 ProcImagePathHash;
/*0x1C4*/ ULONG32 MappedWritesInProgress;
} SHARED_CACHE_MAP, *PSHARED_CACHE_MAP;
struct _SHARED_CACHE_MAP_LIST_CURSOR
typedef struct _SHARED_CACHE_MAP_LIST_CURSOR { // 2 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY SharedCacheMapLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 Flags;
/*0x014*/ UINT8 _PADDING0_[0x4];
} SHARED_CACHE_MAP_LIST_CURSOR, *PSHARED_CACHE_MAP_LIST_CURSOR;
struct _SID
Referred from:
typedef struct _SID { // 4 elements, 0xC bytes (sizeof)
/*0x000*/ UINT8 Revision;
/*0x001*/ UINT8 SubAuthorityCount;
/*0x002*/ struct _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; // 1 elements, 0x6 bytes (sizeof)
/*0x008*/ ULONG32 SubAuthority[1];
} SID, *PSID;
struct _SID_AND_ATTRIBUTES
Referred from:
typedef struct _SID_AND_ATTRIBUTES { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Sid;
/*0x008*/ ULONG32 Attributes;
/*0x00C*/ UINT8 _PADDING0_[0x4];
} SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES;
struct _SID_AND_ATTRIBUTES_HASH
Referred from:
typedef struct _SID_AND_ATTRIBUTES_HASH {// 3 elements, 0x110 bytes (sizeof)
/*0x000*/ ULONG32 SidCount;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _SID_AND_ATTRIBUTES* SidAttr;
/*0x010*/ UINT64 Hash[32];
} SID_AND_ATTRIBUTES_HASH, *PSID_AND_ATTRIBUTES_HASH;
struct _SID_IDENTIFIER_AUTHORITY
Referred from:
typedef struct _SID_IDENTIFIER_AUTHORITY { // 1 elements, 0x6 bytes (sizeof)
/*0x000*/ UINT8 Value[6];
} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;
struct _SINGLE_LIST_ENTRY
Referred from:
typedef struct _SINGLE_LIST_ENTRY { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _SINGLE_LIST_ENTRY* Next;
} SINGLE_LIST_ENTRY, *PSINGLE_LIST_ENTRY;
struct _SLIST_ENTRY
Referred from:
typedef struct _SLIST_ENTRY { // 1 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _SLIST_ENTRY* Next;
/*0x008*/ UINT8 _PADDING0_[0x8];
} SLIST_ENTRY, *PSLIST_ENTRY;
Referred from:
typedef struct _SMBIOS_TABLE_HEADER { // 0 elements, 0x0 bytes (sizeof)
} SMBIOS_TABLE_HEADER, *PSMBIOS_TABLE_HEADER;
struct _STRING
Referred from:
typedef struct _STRING { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Length;
/*0x002*/ UINT16 MaximumLength;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ CHAR* Buffer;
} STRING, *PSTRING;
struct _STRING32
Referred from:
typedef struct _STRING32 { // 3 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT16 Length;
/*0x002*/ UINT16 MaximumLength;
/*0x004*/ ULONG32 Buffer;
} STRING32, *PSTRING32;
struct _STRING64
Referred from:
typedef struct _STRING64 { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Length;
/*0x002*/ UINT16 MaximumLength;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT64 Buffer;
} STRING64, *PSTRING64;
struct _SUBSECTION
Referred from:
typedef struct _SUBSECTION { // 9 elements, 0x38 bytes (sizeof)
/*0x000*/ struct _CONTROL_AREA* ControlArea;
/*0x008*/ struct _MMPTE* SubsectionBase;
/*0x010*/ struct _SUBSECTION* NextSubsection;
/*0x018*/ ULONG32 PtesInSubsection;
/*0x01C*/ UINT8 _PADDING0_[0x4];
union { // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ ULONG32 UnusedPtes;
/*0x020*/ struct _MM_AVL_TABLE* GlobalPerSessionHead;
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x028*/ ULONG32 LongFlags;
/*0x028*/ struct _MMSUBSECTION_FLAGS SubsectionFlags; // 8 elements, 0x4 bytes (sizeof)
} u;
/*0x02C*/ ULONG32 StartingSector;
/*0x030*/ ULONG32 NumberOfFullSectors;
/*0x034*/ UINT8 _PADDING1_[0x4];
} SUBSECTION, *PSUBSECTION;
typedef struct _SYSPTES_HEADER { // 4 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY ListHead; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ UINT64 Count;
/*0x018*/ UINT64 NumberOfEntries;
/*0x020*/ UINT64 NumberOfEntriesPeak;
} SYSPTES_HEADER, *PSYSPTES_HEADER;
struct _SYSTEM_POWER_CAPABILITIES
Referred from:
typedef struct _SYSTEM_POWER_CAPABILITIES { // 29 elements, 0x4C bytes (sizeof)
/*0x000*/ UINT8 PowerButtonPresent;
/*0x001*/ UINT8 SleepButtonPresent;
/*0x002*/ UINT8 LidPresent;
/*0x003*/ UINT8 SystemS1;
/*0x004*/ UINT8 SystemS2;
/*0x005*/ UINT8 SystemS3;
/*0x006*/ UINT8 SystemS4;
/*0x007*/ UINT8 SystemS5;
/*0x008*/ UINT8 HiberFilePresent;
/*0x009*/ UINT8 FullWake;
/*0x00A*/ UINT8 VideoDimPresent;
/*0x00B*/ UINT8 ApmPresent;
/*0x00C*/ UINT8 UpsPresent;
/*0x00D*/ UINT8 ThermalControl;
/*0x00E*/ UINT8 ProcessorThrottle;
/*0x00F*/ UINT8 ProcessorMinThrottle;
/*0x010*/ UINT8 ProcessorMaxThrottle;
/*0x011*/ UINT8 FastSystemS4;
/*0x012*/ UINT8 spare2[3];
/*0x015*/ UINT8 DiskSpinDown;
/*0x016*/ UINT8 spare3[8];
/*0x01E*/ UINT8 SystemBatteriesPresent;
/*0x01F*/ UINT8 BatteriesAreShortTerm;
/*0x020*/ struct _BATTERY_REPORTING_SCALE BatteryScale[3];
/*0x038*/ enum _SYSTEM_POWER_STATE AcOnLineWake;
/*0x03C*/ enum _SYSTEM_POWER_STATE SoftLidWake;
/*0x040*/ enum _SYSTEM_POWER_STATE RtcWake;
/*0x044*/ enum _SYSTEM_POWER_STATE MinDeviceWakeState;
/*0x048*/ enum _SYSTEM_POWER_STATE DefaultLowLatencyWake;
} SYSTEM_POWER_CAPABILITIES, *PSYSTEM_POWER_CAPABILITIES;
struct _SYSTEM_POWER_LEVEL
Referred from:
typedef struct _SYSTEM_POWER_LEVEL { // 5 elements, 0x18 bytes (sizeof)
/*0x000*/ UINT8 Enable;
/*0x001*/ UINT8 Spare[3];
/*0x004*/ ULONG32 BatteryLevel;
/*0x008*/ struct _POWER_ACTION_POLICY PowerPolicy; // 3 elements, 0xC bytes (sizeof)
/*0x014*/ enum _SYSTEM_POWER_STATE MinSystemState;
} SYSTEM_POWER_LEVEL, *PSYSTEM_POWER_LEVEL;
struct _SYSTEM_POWER_POLICY
typedef struct _SYSTEM_POWER_POLICY { // 28 elements, 0xE8 bytes (sizeof)
/*0x000*/ ULONG32 Revision;
/*0x004*/ struct _POWER_ACTION_POLICY PowerButton; // 3 elements, 0xC bytes (sizeof)
/*0x010*/ struct _POWER_ACTION_POLICY SleepButton; // 3 elements, 0xC bytes (sizeof)
/*0x01C*/ struct _POWER_ACTION_POLICY LidClose; // 3 elements, 0xC bytes (sizeof)
/*0x028*/ enum _SYSTEM_POWER_STATE LidOpenWake;
/*0x02C*/ ULONG32 Reserved;
/*0x030*/ struct _POWER_ACTION_POLICY Idle; // 3 elements, 0xC bytes (sizeof)
/*0x03C*/ ULONG32 IdleTimeout;
/*0x040*/ UINT8 IdleSensitivity;
/*0x041*/ UINT8 DynamicThrottle;
/*0x042*/ UINT8 Spare2[2];
/*0x044*/ enum _SYSTEM_POWER_STATE MinSleep;
/*0x048*/ enum _SYSTEM_POWER_STATE MaxSleep;
/*0x04C*/ enum _SYSTEM_POWER_STATE ReducedLatencySleep;
/*0x050*/ ULONG32 WinLogonFlags;
/*0x054*/ ULONG32 Spare3;
/*0x058*/ ULONG32 DozeS4Timeout;
/*0x05C*/ ULONG32 BroadcastCapacityResolution;
/*0x060*/ struct _SYSTEM_POWER_LEVEL DischargePolicy[4];
/*0x0C0*/ ULONG32 VideoTimeout;
/*0x0C4*/ UINT8 VideoDimDisplay;
/*0x0C5*/ UINT8 _PADDING0_[0x3];
/*0x0C8*/ ULONG32 VideoReserved[3];
/*0x0D4*/ ULONG32 SpindownTimeout;
/*0x0D8*/ UINT8 OptimizeForPower;
/*0x0D9*/ UINT8 FanThrottleTolerance;
/*0x0DA*/ UINT8 ForcedThrottle;
/*0x0DB*/ UINT8 MinThrottle;
/*0x0DC*/ struct _POWER_ACTION_POLICY OverThrottled; // 3 elements, 0xC bytes (sizeof)
} SYSTEM_POWER_POLICY, *PSYSTEM_POWER_POLICY;
struct _SYSTEM_POWER_STATE_CONTEXT
Referred from:
typedef struct _SYSTEM_POWER_STATE_CONTEXT { // 7 elements, 0x4 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
struct { // 6 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Reserved1 : 8; // 0 BitPosition
/*0x000*/ ULONG32 TargetSystemState : 4; // 8 BitPosition
/*0x000*/ ULONG32 EffectiveSystemState : 4; // 12 BitPosition
/*0x000*/ ULONG32 CurrentSystemState : 4; // 16 BitPosition
/*0x000*/ ULONG32 IgnoreHibernationPath : 1; // 20 BitPosition
/*0x000*/ ULONG32 Reserved2 : 11; // 21 BitPosition
};
/*0x000*/ ULONG32 ContextAsUlong;
};
} SYSTEM_POWER_STATE_CONTEXT, *PSYSTEM_POWER_STATE_CONTEXT;
typedef struct _SYSTEM_TRACE_HEADER { // 11 elements, 0x20 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x000*/ ULONG32 Marker;
struct { // 3 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT16 Version;
/*0x002*/ UINT8 HeaderType;
/*0x003*/ UINT8 Flags;
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 Header;
/*0x004*/ struct _WMI_TRACE_PACKET Packet; // 4 elements, 0x4 bytes (sizeof)
};
/*0x008*/ ULONG32 ThreadId;
/*0x00C*/ ULONG32 ProcessId;
/*0x010*/ union _LARGE_INTEGER SystemTime; // 4 elements, 0x8 bytes (sizeof)
/*0x018*/ ULONG32 KernelTime;
/*0x01C*/ ULONG32 UserTime;
} SYSTEM_TRACE_HEADER, *PSYSTEM_TRACE_HEADER;
struct _TEB
typedef struct _TEB { // 98 elements, 0x1828 bytes (sizeof)
/*0x000*/ struct _NT_TIB NtTib; // 8 elements, 0x38 bytes (sizeof)
/*0x038*/ VOID* EnvironmentPointer;
/*0x040*/ struct _CLIENT_ID ClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ VOID* ActiveRpcHandle;
/*0x058*/ VOID* ThreadLocalStoragePointer;
/*0x060*/ struct _PEB* ProcessEnvironmentBlock;
/*0x068*/ ULONG32 LastErrorValue;
/*0x06C*/ ULONG32 CountOfOwnedCriticalSections;
/*0x070*/ VOID* CsrClientThread;
/*0x078*/ VOID* Win32ThreadInfo;
/*0x080*/ ULONG32 User32Reserved[26];
/*0x0E8*/ ULONG32 UserReserved[5];
/*0x0FC*/ UINT8 _PADDING0_[0x4];
/*0x100*/ VOID* WOW32Reserved;
/*0x108*/ ULONG32 CurrentLocale;
/*0x10C*/ ULONG32 FpSoftwareStatusRegister;
/*0x110*/ VOID* SystemReserved1[54];
/*0x2C0*/ LONG32 ExceptionCode;
/*0x2C4*/ UINT8 _PADDING1_[0x4];
/*0x2C8*/ struct _ACTIVATION_CONTEXT_STACK* ActivationContextStackPointer;
/*0x2D0*/ UINT8 SpareBytes1[24];
/*0x2E8*/ ULONG32 TxFsContext;
/*0x2EC*/ UINT8 _PADDING2_[0x4];
/*0x2F0*/ struct _GDI_TEB_BATCH GdiTebBatch; // 3 elements, 0x4E8 bytes (sizeof)
/*0x7D8*/ struct _CLIENT_ID RealClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x7E8*/ VOID* GdiCachedProcessHandle;
/*0x7F0*/ ULONG32 GdiClientPID;
/*0x7F4*/ ULONG32 GdiClientTID;
/*0x7F8*/ VOID* GdiThreadLocalInfo;
/*0x800*/ UINT64 Win32ClientInfo[62];
/*0x9F0*/ VOID* glDispatchTable[233];
/*0x1138*/ UINT64 glReserved1[29];
/*0x1220*/ VOID* glReserved2;
/*0x1228*/ VOID* glSectionInfo;
/*0x1230*/ VOID* glSection;
/*0x1238*/ VOID* glTable;
/*0x1240*/ VOID* glCurrentRC;
/*0x1248*/ VOID* glContext;
/*0x1250*/ ULONG32 LastStatusValue;
/*0x1254*/ UINT8 _PADDING3_[0x4];
/*0x1258*/ struct _UNICODE_STRING StaticUnicodeString; // 3 elements, 0x10 bytes (sizeof)
/*0x1268*/ WCHAR StaticUnicodeBuffer[261];
/*0x1472*/ UINT8 _PADDING4_[0x6];
/*0x1478*/ VOID* DeallocationStack;
/*0x1480*/ VOID* TlsSlots[64];
/*0x1680*/ struct _LIST_ENTRY TlsLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x1690*/ VOID* Vdm;
/*0x1698*/ VOID* ReservedForNtRpc;
/*0x16A0*/ VOID* DbgSsReserved[2];
/*0x16B0*/ ULONG32 HardErrorMode;
/*0x16B4*/ UINT8 _PADDING5_[0x4];
/*0x16B8*/ VOID* Instrumentation[11];
/*0x1710*/ struct _GUID ActivityId; // 4 elements, 0x10 bytes (sizeof)
/*0x1720*/ VOID* SubProcessTag;
/*0x1728*/ VOID* EtwLocalData;
/*0x1730*/ VOID* EtwTraceData;
/*0x1738*/ VOID* WinSockData;
/*0x1740*/ ULONG32 GdiBatchCount;
/*0x1744*/ UINT8 SpareBool0;
/*0x1745*/ UINT8 SpareBool1;
/*0x1746*/ UINT8 SpareBool2;
/*0x1747*/ UINT8 IdealProcessor;
/*0x1748*/ ULONG32 GuaranteedStackBytes;
/*0x174C*/ UINT8 _PADDING6_[0x4];
/*0x1750*/ VOID* ReservedForPerf;
/*0x1758*/ VOID* ReservedForOle;
/*0x1760*/ ULONG32 WaitingOnLoaderLock;
/*0x1764*/ UINT8 _PADDING7_[0x4];
/*0x1768*/ VOID* SavedPriorityState;
/*0x1770*/ UINT64 SoftPatchPtr1;
/*0x1778*/ VOID* ThreadPoolData;
/*0x1780*/ VOID** TlsExpansionSlots;
/*0x1788*/ VOID* DeallocationBStore;
/*0x1790*/ VOID* BStoreLimit;
/*0x1798*/ ULONG32 ImpersonationLocale;
/*0x179C*/ ULONG32 IsImpersonating;
/*0x17A0*/ VOID* NlsCache;
/*0x17A8*/ VOID* pShimData;
/*0x17B0*/ ULONG32 HeapVirtualAffinity;
/*0x17B4*/ UINT8 _PADDING8_[0x4];
/*0x17B8*/ VOID* CurrentTransactionHandle;
/*0x17C0*/ struct _TEB_ACTIVE_FRAME* ActiveFrame;
/*0x17C8*/ VOID* FlsData;
/*0x17D0*/ VOID* PreferredLanguages;
/*0x17D8*/ VOID* UserPrefLanguages;
/*0x17E0*/ VOID* MergedPrefLanguages;
/*0x17E8*/ ULONG32 MuiImpersonation;
union { // 2 elements, 0x2 bytes (sizeof)
/*0x17EC*/ UINT16 CrossTebFlags;
/*0x17EC*/ UINT16 SpareCrossTebBits : 16; // 0 BitPosition
};
union { // 2 elements, 0x2 bytes (sizeof)
/*0x17EE*/ UINT16 SameTebFlags;
struct { // 9 elements, 0x2 bytes (sizeof)
/*0x17EE*/ UINT16 DbgSafeThunkCall : 1; // 0 BitPosition
/*0x17EE*/ UINT16 DbgInDebugPrint : 1; // 1 BitPosition
/*0x17EE*/ UINT16 DbgHasFiberData : 1; // 2 BitPosition
/*0x17EE*/ UINT16 DbgSkipThreadAttach : 1; // 3 BitPosition
/*0x17EE*/ UINT16 DbgWerInShipAssertCode : 1; // 4 BitPosition
/*0x17EE*/ UINT16 DbgRanProcessInit : 1; // 5 BitPosition
/*0x17EE*/ UINT16 DbgClonedThread : 1; // 6 BitPosition
/*0x17EE*/ UINT16 DbgSuppressDebugMsg : 1; // 7 BitPosition
/*0x17EE*/ UINT16 SpareSameTebBits : 8; // 8 BitPosition
};
};
/*0x17F0*/ VOID* TxnScopeEnterCallback;
/*0x17F8*/ VOID* TxnScopeExitCallback;
/*0x1800*/ VOID* TxnScopeContext;
/*0x1808*/ ULONG32 LockCount;
/*0x180C*/ ULONG32 ProcessRundown;
/*0x1810*/ UINT64 LastSwitchTime;
/*0x1818*/ UINT64 TotalSwitchOutTime;
/*0x1820*/ union _LARGE_INTEGER WaitReasonBitMap; // 4 elements, 0x8 bytes (sizeof)
} TEB, *PTEB;
struct _TEB32
typedef struct _TEB32 { // 96 elements, 0xFF8 bytes (sizeof)
/*0x000*/ struct _NT_TIB32 NtTib; // 8 elements, 0x1C bytes (sizeof)
/*0x01C*/ ULONG32 EnvironmentPointer;
/*0x020*/ struct _CLIENT_ID32 ClientId; // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ ULONG32 ActiveRpcHandle;
/*0x02C*/ ULONG32 ThreadLocalStoragePointer;
/*0x030*/ ULONG32 ProcessEnvironmentBlock;
/*0x034*/ ULONG32 LastErrorValue;
/*0x038*/ ULONG32 CountOfOwnedCriticalSections;
/*0x03C*/ ULONG32 CsrClientThread;
/*0x040*/ ULONG32 Win32ThreadInfo;
/*0x044*/ ULONG32 User32Reserved[26];
/*0x0AC*/ ULONG32 UserReserved[5];
/*0x0C0*/ ULONG32 WOW32Reserved;
/*0x0C4*/ ULONG32 CurrentLocale;
/*0x0C8*/ ULONG32 FpSoftwareStatusRegister;
/*0x0CC*/ ULONG32 SystemReserved1[54];
/*0x1A4*/ LONG32 ExceptionCode;
/*0x1A8*/ ULONG32 ActivationContextStackPointer;
/*0x1AC*/ UINT8 SpareBytes1[36];
/*0x1D0*/ ULONG32 TxFsContext;
/*0x1D4*/ struct _GDI_TEB_BATCH32 GdiTebBatch; // 3 elements, 0x4E0 bytes (sizeof)
/*0x6B4*/ struct _CLIENT_ID32 RealClientId; // 2 elements, 0x8 bytes (sizeof)
/*0x6BC*/ ULONG32 GdiCachedProcessHandle;
/*0x6C0*/ ULONG32 GdiClientPID;
/*0x6C4*/ ULONG32 GdiClientTID;
/*0x6C8*/ ULONG32 GdiThreadLocalInfo;
/*0x6CC*/ ULONG32 Win32ClientInfo[62];
/*0x7C4*/ ULONG32 glDispatchTable[233];
/*0xB68*/ ULONG32 glReserved1[29];
/*0xBDC*/ ULONG32 glReserved2;
/*0xBE0*/ ULONG32 glSectionInfo;
/*0xBE4*/ ULONG32 glSection;
/*0xBE8*/ ULONG32 glTable;
/*0xBEC*/ ULONG32 glCurrentRC;
/*0xBF0*/ ULONG32 glContext;
/*0xBF4*/ ULONG32 LastStatusValue;
/*0xBF8*/ struct _STRING32 StaticUnicodeString; // 3 elements, 0x8 bytes (sizeof)
/*0xC00*/ WCHAR StaticUnicodeBuffer[261];
/*0xE0A*/ UINT8 _PADDING0_[0x2];
/*0xE0C*/ ULONG32 DeallocationStack;
/*0xE10*/ ULONG32 TlsSlots[64];
/*0xF10*/ struct _LIST_ENTRY32 TlsLinks; // 2 elements, 0x8 bytes (sizeof)
/*0xF18*/ ULONG32 Vdm;
/*0xF1C*/ ULONG32 ReservedForNtRpc;
/*0xF20*/ ULONG32 DbgSsReserved[2];
/*0xF28*/ ULONG32 HardErrorMode;
/*0xF2C*/ ULONG32 Instrumentation[9];
/*0xF50*/ struct _GUID ActivityId; // 4 elements, 0x10 bytes (sizeof)
/*0xF60*/ ULONG32 SubProcessTag;
/*0xF64*/ ULONG32 EtwLocalData;
/*0xF68*/ ULONG32 EtwTraceData;
/*0xF6C*/ ULONG32 WinSockData;
/*0xF70*/ ULONG32 GdiBatchCount;
/*0xF74*/ UINT8 SpareBool0;
/*0xF75*/ UINT8 SpareBool1;
/*0xF76*/ UINT8 SpareBool2;
/*0xF77*/ UINT8 IdealProcessor;
/*0xF78*/ ULONG32 GuaranteedStackBytes;
/*0xF7C*/ ULONG32 ReservedForPerf;
/*0xF80*/ ULONG32 ReservedForOle;
/*0xF84*/ ULONG32 WaitingOnLoaderLock;
/*0xF88*/ ULONG32 SavedPriorityState;
/*0xF8C*/ ULONG32 SoftPatchPtr1;
/*0xF90*/ ULONG32 ThreadPoolData;
/*0xF94*/ ULONG32 TlsExpansionSlots;
/*0xF98*/ ULONG32 ImpersonationLocale;
/*0xF9C*/ ULONG32 IsImpersonating;
/*0xFA0*/ ULONG32 NlsCache;
/*0xFA4*/ ULONG32 pShimData;
/*0xFA8*/ ULONG32 HeapVirtualAffinity;
/*0xFAC*/ ULONG32 CurrentTransactionHandle;
/*0xFB0*/ ULONG32 ActiveFrame;
/*0xFB4*/ ULONG32 FlsData;
/*0xFB8*/ ULONG32 PreferredLanguages;
/*0xFBC*/ ULONG32 UserPrefLanguages;
/*0xFC0*/ ULONG32 MergedPrefLanguages;
/*0xFC4*/ ULONG32 MuiImpersonation;
union { // 2 elements, 0x2 bytes (sizeof)
/*0xFC8*/ UINT16 CrossTebFlags;
/*0xFC8*/ UINT16 SpareCrossTebBits : 16; // 0 BitPosition
};
union { // 2 elements, 0x2 bytes (sizeof)
/*0xFCA*/ UINT16 SameTebFlags;
struct { // 9 elements, 0x2 bytes (sizeof)
/*0xFCA*/ UINT16 DbgSafeThunkCall : 1; // 0 BitPosition
/*0xFCA*/ UINT16 DbgInDebugPrint : 1; // 1 BitPosition
/*0xFCA*/ UINT16 DbgHasFiberData : 1; // 2 BitPosition
/*0xFCA*/ UINT16 DbgSkipThreadAttach : 1; // 3 BitPosition
/*0xFCA*/ UINT16 DbgWerInShipAssertCode : 1; // 4 BitPosition
/*0xFCA*/ UINT16 DbgRanProcessInit : 1; // 5 BitPosition
/*0xFCA*/ UINT16 DbgClonedThread : 1; // 6 BitPosition
/*0xFCA*/ UINT16 DbgSuppressDebugMsg : 1; // 7 BitPosition
/*0xFCA*/ UINT16 SpareSameTebBits : 8; // 8 BitPosition
};
};
/*0xFCC*/ ULONG32 TxnScopeEnterCallback;
/*0xFD0*/ ULONG32 TxnScopeExitCallback;
/*0xFD4*/ ULONG32 TxnScopeContext;
/*0xFD8*/ ULONG32 LockCount;
/*0xFDC*/ ULONG32 ProcessRundown;
/*0xFE0*/ UINT64 LastSwitchTime;
/*0xFE8*/ UINT64 TotalSwitchOutTime;
/*0xFF0*/ union _LARGE_INTEGER WaitReasonBitMap; // 4 elements, 0x8 bytes (sizeof)
} TEB32, *PTEB32;
struct _TEB64
typedef struct _TEB64 { // 98 elements, 0x1828 bytes (sizeof)
/*0x000*/ struct _NT_TIB64 NtTib; // 8 elements, 0x38 bytes (sizeof)
/*0x038*/ UINT64 EnvironmentPointer;
/*0x040*/ struct _CLIENT_ID64 ClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x050*/ UINT64 ActiveRpcHandle;
/*0x058*/ UINT64 ThreadLocalStoragePointer;
/*0x060*/ UINT64 ProcessEnvironmentBlock;
/*0x068*/ ULONG32 LastErrorValue;
/*0x06C*/ ULONG32 CountOfOwnedCriticalSections;
/*0x070*/ UINT64 CsrClientThread;
/*0x078*/ UINT64 Win32ThreadInfo;
/*0x080*/ ULONG32 User32Reserved[26];
/*0x0E8*/ ULONG32 UserReserved[5];
/*0x0FC*/ UINT8 _PADDING0_[0x4];
/*0x100*/ UINT64 WOW32Reserved;
/*0x108*/ ULONG32 CurrentLocale;
/*0x10C*/ ULONG32 FpSoftwareStatusRegister;
/*0x110*/ UINT64 SystemReserved1[54];
/*0x2C0*/ LONG32 ExceptionCode;
/*0x2C4*/ UINT8 _PADDING1_[0x4];
/*0x2C8*/ UINT64 ActivationContextStackPointer;
/*0x2D0*/ UINT8 SpareBytes1[24];
/*0x2E8*/ ULONG32 TxFsContext;
/*0x2EC*/ UINT8 _PADDING2_[0x4];
/*0x2F0*/ struct _GDI_TEB_BATCH64 GdiTebBatch; // 3 elements, 0x4E8 bytes (sizeof)
/*0x7D8*/ struct _CLIENT_ID64 RealClientId; // 2 elements, 0x10 bytes (sizeof)
/*0x7E8*/ UINT64 GdiCachedProcessHandle;
/*0x7F0*/ ULONG32 GdiClientPID;
/*0x7F4*/ ULONG32 GdiClientTID;
/*0x7F8*/ UINT64 GdiThreadLocalInfo;
/*0x800*/ UINT64 Win32ClientInfo[62];
/*0x9F0*/ UINT64 glDispatchTable[233];
/*0x1138*/ UINT64 glReserved1[29];
/*0x1220*/ UINT64 glReserved2;
/*0x1228*/ UINT64 glSectionInfo;
/*0x1230*/ UINT64 glSection;
/*0x1238*/ UINT64 glTable;
/*0x1240*/ UINT64 glCurrentRC;
/*0x1248*/ UINT64 glContext;
/*0x1250*/ ULONG32 LastStatusValue;
/*0x1254*/ UINT8 _PADDING3_[0x4];
/*0x1258*/ struct _STRING64 StaticUnicodeString; // 3 elements, 0x10 bytes (sizeof)
/*0x1268*/ WCHAR StaticUnicodeBuffer[261];
/*0x1472*/ UINT8 _PADDING4_[0x6];
/*0x1478*/ UINT64 DeallocationStack;
/*0x1480*/ UINT64 TlsSlots[64];
/*0x1680*/ struct _LIST_ENTRY64 TlsLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x1690*/ UINT64 Vdm;
/*0x1698*/ UINT64 ReservedForNtRpc;
/*0x16A0*/ UINT64 DbgSsReserved[2];
/*0x16B0*/ ULONG32 HardErrorMode;
/*0x16B4*/ UINT8 _PADDING5_[0x4];
/*0x16B8*/ UINT64 Instrumentation[11];
/*0x1710*/ struct _GUID ActivityId; // 4 elements, 0x10 bytes (sizeof)
/*0x1720*/ UINT64 SubProcessTag;
/*0x1728*/ UINT64 EtwLocalData;
/*0x1730*/ UINT64 EtwTraceData;
/*0x1738*/ UINT64 WinSockData;
/*0x1740*/ ULONG32 GdiBatchCount;
/*0x1744*/ UINT8 SpareBool0;
/*0x1745*/ UINT8 SpareBool1;
/*0x1746*/ UINT8 SpareBool2;
/*0x1747*/ UINT8 IdealProcessor;
/*0x1748*/ ULONG32 GuaranteedStackBytes;
/*0x174C*/ UINT8 _PADDING6_[0x4];
/*0x1750*/ UINT64 ReservedForPerf;
/*0x1758*/ UINT64 ReservedForOle;
/*0x1760*/ ULONG32 WaitingOnLoaderLock;
/*0x1764*/ UINT8 _PADDING7_[0x4];
/*0x1768*/ UINT64 SavedPriorityState;
/*0x1770*/ UINT64 SoftPatchPtr1;
/*0x1778*/ UINT64 ThreadPoolData;
/*0x1780*/ UINT64 TlsExpansionSlots;
/*0x1788*/ UINT64 DeallocationBStore;
/*0x1790*/ UINT64 BStoreLimit;
/*0x1798*/ ULONG32 ImpersonationLocale;
/*0x179C*/ ULONG32 IsImpersonating;
/*0x17A0*/ UINT64 NlsCache;
/*0x17A8*/ UINT64 pShimData;
/*0x17B0*/ ULONG32 HeapVirtualAffinity;
/*0x17B4*/ UINT8 _PADDING8_[0x4];
/*0x17B8*/ UINT64 CurrentTransactionHandle;
/*0x17C0*/ UINT64 ActiveFrame;
/*0x17C8*/ UINT64 FlsData;
/*0x17D0*/ UINT64 PreferredLanguages;
/*0x17D8*/ UINT64 UserPrefLanguages;
/*0x17E0*/ UINT64 MergedPrefLanguages;
/*0x17E8*/ ULONG32 MuiImpersonation;
union { // 2 elements, 0x2 bytes (sizeof)
/*0x17EC*/ UINT16 CrossTebFlags;
/*0x17EC*/ UINT16 SpareCrossTebBits : 16; // 0 BitPosition
};
union { // 2 elements, 0x2 bytes (sizeof)
/*0x17EE*/ UINT16 SameTebFlags;
struct { // 9 elements, 0x2 bytes (sizeof)
/*0x17EE*/ UINT16 DbgSafeThunkCall : 1; // 0 BitPosition
/*0x17EE*/ UINT16 DbgInDebugPrint : 1; // 1 BitPosition
/*0x17EE*/ UINT16 DbgHasFiberData : 1; // 2 BitPosition
/*0x17EE*/ UINT16 DbgSkipThreadAttach : 1; // 3 BitPosition
/*0x17EE*/ UINT16 DbgWerInShipAssertCode : 1; // 4 BitPosition
/*0x17EE*/ UINT16 DbgRanProcessInit : 1; // 5 BitPosition
/*0x17EE*/ UINT16 DbgClonedThread : 1; // 6 BitPosition
/*0x17EE*/ UINT16 DbgSuppressDebugMsg : 1; // 7 BitPosition
/*0x17EE*/ UINT16 SpareSameTebBits : 8; // 8 BitPosition
};
};
/*0x17F0*/ UINT64 TxnScopeEnterCallback;
/*0x17F8*/ UINT64 TxnScopeExitCallback;
/*0x1800*/ UINT64 TxnScopeContext;
/*0x1808*/ ULONG32 LockCount;
/*0x180C*/ ULONG32 ProcessRundown;
/*0x1810*/ UINT64 LastSwitchTime;
/*0x1818*/ UINT64 TotalSwitchOutTime;
/*0x1820*/ union _LARGE_INTEGER WaitReasonBitMap; // 4 elements, 0x8 bytes (sizeof)
} TEB64, *PTEB64;
struct _TEB_ACTIVE_FRAME
Referred from:
typedef struct _TEB_ACTIVE_FRAME { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ ULONG32 Flags;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _TEB_ACTIVE_FRAME* Previous;
/*0x010*/ struct _TEB_ACTIVE_FRAME_CONTEXT* Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
struct _TEB_ACTIVE_FRAME_CONTEXT
Referred from:
typedef struct _TEB_ACTIVE_FRAME_CONTEXT { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 Flags;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ CHAR* FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
struct _TERMINATION_PORT
Referred from:
typedef struct _TERMINATION_PORT { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ struct _TERMINATION_PORT* Next;
/*0x008*/ VOID* Port;
} TERMINATION_PORT, *PTERMINATION_PORT;
typedef struct _THERMAL_INFORMATION { // 10 elements, 0x58 bytes (sizeof)
/*0x000*/ ULONG32 ThermalStamp;
/*0x004*/ ULONG32 ThermalConstant1;
/*0x008*/ ULONG32 ThermalConstant2;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 Processors;
/*0x018*/ ULONG32 SamplingPeriod;
/*0x01C*/ ULONG32 CurrentTemperature;
/*0x020*/ ULONG32 PassiveTripPoint;
/*0x024*/ ULONG32 CriticalTripPoint;
/*0x028*/ UINT8 ActiveTripPointCount;
/*0x029*/ UINT8 _PADDING1_[0x3];
/*0x02C*/ ULONG32 ActiveTripPoint[10];
/*0x054*/ UINT8 _PADDING2_[0x4];
} THERMAL_INFORMATION, *PTHERMAL_INFORMATION;
Referred from:
typedef struct _THERMAL_INFORMATION_EX {// 11 elements, 0x58 bytes (sizeof)
/*0x000*/ ULONG32 ThermalStamp;
/*0x004*/ ULONG32 ThermalConstant1;
/*0x008*/ ULONG32 ThermalConstant2;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ UINT64 Processors;
/*0x018*/ ULONG32 SamplingPeriod;
/*0x01C*/ ULONG32 CurrentTemperature;
/*0x020*/ ULONG32 PassiveTripPoint;
/*0x024*/ ULONG32 CriticalTripPoint;
/*0x028*/ UINT8 ActiveTripPointCount;
/*0x029*/ UINT8 _PADDING1_[0x3];
/*0x02C*/ ULONG32 ActiveTripPoint[10];
/*0x054*/ ULONG32 S4TransitionTripPoint;
} THERMAL_INFORMATION_EX, *PTHERMAL_INFORMATION_EX;
struct _TIME_FIELDS
typedef struct _TIME_FIELDS { // 8 elements, 0x10 bytes (sizeof)
/*0x000*/ INT16 Year;
/*0x002*/ INT16 Month;
/*0x004*/ INT16 Day;
/*0x006*/ INT16 Hour;
/*0x008*/ INT16 Minute;
/*0x00A*/ INT16 Second;
/*0x00C*/ INT16 Milliseconds;
/*0x00E*/ INT16 Weekday;
} TIME_FIELDS, *PTIME_FIELDS;
struct _TOKEN
typedef struct _TOKEN { // 34 elements, 0x318 bytes (sizeof)
/*0x000*/ struct _TOKEN_SOURCE TokenSource; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LUID TokenId; // 2 elements, 0x8 bytes (sizeof)
/*0x018*/ struct _LUID AuthenticationId; // 2 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _LUID ParentTokenId; // 2 elements, 0x8 bytes (sizeof)
/*0x028*/ union _LARGE_INTEGER ExpirationTime; // 4 elements, 0x8 bytes (sizeof)
/*0x030*/ struct _ERESOURCE* TokenLock;
/*0x038*/ struct _LUID ModifiedId; // 2 elements, 0x8 bytes (sizeof)
/*0x040*/ struct _SEP_TOKEN_PRIVILEGES Privileges; // 3 elements, 0x18 bytes (sizeof)
/*0x058*/ struct _SEP_AUDIT_POLICY AuditPolicy; // 2 elements, 0x1B bytes (sizeof)
/*0x073*/ UINT8 _PADDING0_[0x1];
/*0x074*/ ULONG32 SessionId;
/*0x078*/ ULONG32 UserAndGroupCount;
/*0x07C*/ ULONG32 RestrictedSidCount;
/*0x080*/ ULONG32 VariableLength;
/*0x084*/ ULONG32 DynamicCharged;
/*0x088*/ ULONG32 DynamicAvailable;
/*0x08C*/ ULONG32 DefaultOwnerIndex;
/*0x090*/ struct _SID_AND_ATTRIBUTES* UserAndGroups;
/*0x098*/ struct _SID_AND_ATTRIBUTES* RestrictedSids;
/*0x0A0*/ VOID* PrimaryGroup;
/*0x0A8*/ ULONG32* DynamicPart;
/*0x0B0*/ struct _ACL* DefaultDacl;
/*0x0B8*/ enum _TOKEN_TYPE TokenType;
/*0x0BC*/ enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
/*0x0C0*/ ULONG32 TokenFlags;
/*0x0C4*/ UINT8 TokenInUse;
/*0x0C5*/ UINT8 _PADDING1_[0x3];
/*0x0C8*/ ULONG32 IntegrityLevelIndex;
/*0x0CC*/ ULONG32 MandatoryPolicy;
/*0x0D0*/ struct _SECURITY_TOKEN_PROXY_DATA* ProxyData;
/*0x0D8*/ struct _SECURITY_TOKEN_AUDIT_DATA* AuditData;
/*0x0E0*/ struct _SEP_LOGON_SESSION_REFERENCES* LogonSession;
/*0x0E8*/ struct _LUID OriginatingLogonSession; // 2 elements, 0x8 bytes (sizeof)
/*0x0F0*/ struct _SID_AND_ATTRIBUTES_HASH SidHash; // 3 elements, 0x110 bytes (sizeof)
/*0x200*/ struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash; // 3 elements, 0x110 bytes (sizeof)
/*0x310*/ UINT64 VariablePart;
} TOKEN, *PTOKEN;
struct _TOKEN_AUDIT_POLICY
Referred from:
typedef struct _TOKEN_AUDIT_POLICY {// 1 elements, 0x1A bytes (sizeof)
/*0x000*/ UINT8 PerUserPolicy[26];
} TOKEN_AUDIT_POLICY, *PTOKEN_AUDIT_POLICY;
struct _TOKEN_CONTROL
Referred from:
typedef struct _TOKEN_CONTROL { // 4 elements, 0x28 bytes (sizeof)
/*0x000*/ struct _LUID TokenId; // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _LUID AuthenticationId; // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ struct _LUID ModifiedId; // 2 elements, 0x8 bytes (sizeof)
/*0x018*/ struct _TOKEN_SOURCE TokenSource; // 2 elements, 0x10 bytes (sizeof)
} TOKEN_CONTROL, *PTOKEN_CONTROL;
struct _TOKEN_SOURCE
Referred from:
typedef struct _TOKEN_SOURCE { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ CHAR SourceName[8];
/*0x008*/ struct _LUID SourceIdentifier; // 2 elements, 0x8 bytes (sizeof)
} TOKEN_SOURCE, *PTOKEN_SOURCE;
struct _TP_CALLBACK_ENVIRON
typedef struct _TP_CALLBACK_ENVIRON { // 8 elements, 0x40 bytes (sizeof)
/*0x000*/ ULONG32 Version;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ struct _TP_POOL* Pool;
/*0x010*/ struct _TP_CLEANUP_GROUP* CleanupGroup;
/*0x018*/ PVOID CleanupGroupCancelCallback;
/*0x020*/ VOID* RaceDll;
/*0x028*/ struct _ACTIVATION_CONTEXT* ActivationContext;
/*0x030*/ PVOID FinalizationCallback;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x038*/ ULONG32 Flags;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x038*/ ULONG32 LongFunction : 1; // 0 BitPosition
/*0x038*/ ULONG32 Private : 31; // 1 BitPosition
} s;
} u;
} TP_CALLBACK_ENVIRON, *PTP_CALLBACK_ENVIRON;
struct _TP_CALLBACK_INSTANCE
typedef struct _TP_CALLBACK_INSTANCE { // 0 elements, 0x0 bytes (sizeof)
} TP_CALLBACK_INSTANCE, *PTP_CALLBACK_INSTANCE;
struct _TP_CLEANUP_GROUP
Referred from:
typedef struct _TP_CLEANUP_GROUP { // 0 elements, 0x0 bytes (sizeof)
} TP_CLEANUP_GROUP, *PTP_CLEANUP_GROUP;
struct _TP_DIRECT
typedef struct _TP_DIRECT { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ PVOID Callback;
} TP_DIRECT, *PTP_DIRECT;
struct _TP_POOL
Referred from:
typedef struct _TP_POOL { // 0 elements, 0x0 bytes (sizeof)
} TP_POOL, *PTP_POOL;
struct _TP_TASK
typedef struct _TP_TASK { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ struct _TP_TASK_CALLBACKS* Callbacks;
} TP_TASK, *PTP_TASK;
struct _TP_TASK_CALLBACKS
Referred from:
typedef struct _TP_TASK_CALLBACKS { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ PVOID ExecuteCallback;
/*0x008*/ PVOID Unposted;
} TP_TASK_CALLBACKS, *PTP_TASK_CALLBACKS;
struct _TRACE_ENABLE_CONTEXT
Referred from:
typedef struct _TRACE_ENABLE_CONTEXT { // 4 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT16 LoggerId;
/*0x002*/ UINT8 Level;
/*0x003*/ UINT8 InternalFlag;
/*0x004*/ ULONG32 EnableFlags;
} TRACE_ENABLE_CONTEXT, *PTRACE_ENABLE_CONTEXT;
struct _TRACE_ENABLE_INFO
Referred from:
typedef struct _TRACE_ENABLE_INFO { // 8 elements, 0x20 bytes (sizeof)
/*0x000*/ ULONG32 IsEnabled;
/*0x004*/ UINT8 Level;
/*0x005*/ UINT8 Reserved1;
/*0x006*/ UINT16 LoggerId;
/*0x008*/ ULONG32 EnableProperty;
/*0x00C*/ ULONG32 Reserved2;
/*0x010*/ UINT64 MatchAnyKeyword;
/*0x018*/ UINT64 MatchAllKeyword;
} TRACE_ENABLE_INFO, *PTRACE_ENABLE_INFO;
struct _TXN_PARAMETER_BLOCK
Referred from:
typedef struct _TXN_PARAMETER_BLOCK { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Length;
/*0x002*/ UINT16 TxFsContext;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ VOID* TransactionObject;
} TXN_PARAMETER_BLOCK, *PTXN_PARAMETER_BLOCK;
struct _UNEXPECTED_INTERRUPT
typedef struct _UNEXPECTED_INTERRUPT { // 5 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT8 PushImmOp;
/*0x001*/ ULONG32 PushImm;
/*0x005*/ UINT8 PushRbp;
/*0x006*/ UINT8 JmpOp;
/*0x007*/ LONG32 JmpOffset;
/*0x00B*/ UINT8 _PADDING0_[0x5];
} UNEXPECTED_INTERRUPT, *PUNEXPECTED_INTERRUPT;
struct _UNICODE_STRING
Referred from:
typedef struct _UNICODE_STRING { // 3 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT16 Length;
/*0x002*/ UINT16 MaximumLength;
/*0x004*/ UINT8 _PADDING0_[0x4];
/*0x008*/ UINT16* Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
struct _VACB
Referred from:
typedef struct _VACB { // 5 elements, 0x30 bytes (sizeof)
/*0x000*/ VOID* BaseAddress;
/*0x008*/ struct _SHARED_CACHE_MAP* SharedCacheMap;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ union _LARGE_INTEGER FileOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT16 ActiveCount;
} Overlay;
/*0x018*/ struct _LIST_ENTRY LruList; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _VACB_ARRAY_HEADER* ArrayHead;
} VACB, *PVACB;
Referred from:
typedef struct _VACB_ARRAY_HEADER { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY Links; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ ULONG32 MappingCount;
/*0x014*/ ULONG32 Reserved;
} VACB_ARRAY_HEADER, *PVACB_ARRAY_HEADER;
struct _VACB_LEVEL_REFERENCE
typedef struct _VACB_LEVEL_REFERENCE { // 2 elements, 0x8 bytes (sizeof)
/*0x000*/ LONG32 Reference;
/*0x004*/ LONG32 SpecialReference;
} VACB_LEVEL_REFERENCE, *PVACB_LEVEL_REFERENCE;
struct _VF_POOL_TRACE
typedef struct _VF_POOL_TRACE { // 4 elements, 0x80 bytes (sizeof)
/*0x000*/ VOID* Address;
/*0x008*/ UINT64 Size;
/*0x010*/ struct _ETHREAD* Thread;
/*0x018*/ VOID* StackTrace[13];
} VF_POOL_TRACE, *PVF_POOL_TRACE;
struct _VF_TRACKER
typedef struct _VF_TRACKER { // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 TrackerFlags;
/*0x004*/ ULONG32 TrackerSize;
/*0x008*/ ULONG32 TrackerIndex;
/*0x00C*/ ULONG32 TraceDepth;
} VF_TRACKER, *PVF_TRACKER;
struct _VF_TRACKER_STAMP
typedef struct _VF_TRACKER_STAMP {// 5 elements, 0x10 bytes (sizeof)
/*0x000*/ VOID* Thread;
/*0x008*/ UINT8 Flags : 8; // 0 BitPosition
/*0x009*/ UINT8 OldIrql : 8; // 0 BitPosition
/*0x00A*/ UINT8 NewIrql : 8; // 0 BitPosition
/*0x00B*/ UINT8 Processor : 8; // 0 BitPosition
/*0x00C*/ UINT8 _PADDING0_[0x4];
} VF_TRACKER_STAMP, *PVF_TRACKER_STAMP;
struct _VIRTUAL_EFI_RUNTIME_SERVICES
Referred from:
typedef struct _VIRTUAL_EFI_RUNTIME_SERVICES { // 11 elements, 0x58 bytes (sizeof)
/*0x000*/ UINT64 GetTime;
/*0x008*/ UINT64 SetTime;
/*0x010*/ UINT64 GetWakeupTime;
/*0x018*/ UINT64 SetWakeupTime;
/*0x020*/ UINT64 SetVirtualAddressMap;
/*0x028*/ UINT64 ConvertPointer;
/*0x030*/ UINT64 GetVariable;
/*0x038*/ UINT64 GetNextVariableName;
/*0x040*/ UINT64 SetVariable;
/*0x048*/ UINT64 GetNextHighMonotonicCount;
/*0x050*/ UINT64 ResetSystem;
} VIRTUAL_EFI_RUNTIME_SERVICES, *PVIRTUAL_EFI_RUNTIME_SERVICES;
struct _VI_CANCEL_GLOBALS
typedef struct _VI_CANCEL_GLOBALS { // 3 elements, 0x78 bytes (sizeof)
/*0x000*/ UINT64 CancelLock;
/*0x008*/ UINT64 IssueLock;
/*0x010*/ LONG32 Counters[25];
/*0x074*/ UINT8 _PADDING0_[0x4];
} VI_CANCEL_GLOBALS, *PVI_CANCEL_GLOBALS;
struct _VI_DEADLOCK_ADDRESS_RANGE
Referred from:
typedef struct _VI_DEADLOCK_ADDRESS_RANGE { // 2 elements, 0x10 bytes (sizeof)
/*0x000*/ UINT8* Start;
/*0x008*/ UINT8* End;
} VI_DEADLOCK_ADDRESS_RANGE, *PVI_DEADLOCK_ADDRESS_RANGE;
struct _VI_DEADLOCK_GLOBALS
typedef struct _VI_DEADLOCK_GLOBALS { // 28 elements, 0x8168 bytes (sizeof)
/*0x000*/ INT64 TimeAcquire;
/*0x008*/ INT64 TimeRelease;
/*0x010*/ struct _LIST_ENTRY* ResourceDatabase;
/*0x018*/ UINT64 ResourceDatabaseCount;
/*0x020*/ struct _VI_DEADLOCK_ADDRESS_RANGE ResourceAddressRange[1023];
/*0x4010*/ struct _LIST_ENTRY* ThreadDatabase;
/*0x4018*/ UINT64 ThreadDatabaseCount;
/*0x4020*/ struct _VI_DEADLOCK_ADDRESS_RANGE ThreadAddressRange[1023];
/*0x8010*/ ULONG32 AllocationFailures;
/*0x8014*/ ULONG32 NodesTrimmedBasedOnAge;
/*0x8018*/ ULONG32 NodesTrimmedBasedOnCount;
/*0x801C*/ ULONG32 NodesSearched;
/*0x8020*/ ULONG32 MaxNodesSearched;
/*0x8024*/ ULONG32 SequenceNumber;
/*0x8028*/ ULONG32 RecursionDepthLimit;
/*0x802C*/ ULONG32 SearchedNodesLimit;
/*0x8030*/ ULONG32 DepthLimitHits;
/*0x8034*/ ULONG32 SearchLimitHits;
/*0x8038*/ ULONG32 ABC_ACB_Skipped;
/*0x803C*/ ULONG32 OutOfOrderReleases;
/*0x8040*/ ULONG32 NodesReleasedOutOfOrder;
/*0x8044*/ ULONG32 TotalReleases;
/*0x8048*/ ULONG32 RootNodesDeleted;
/*0x804C*/ ULONG32 ForgetHistoryCounter;
/*0x8050*/ VOID* Instigator;
/*0x8058*/ ULONG32 NumberOfParticipants;
/*0x805C*/ UINT8 _PADDING0_[0x4];
/*0x8060*/ struct _VI_DEADLOCK_NODE* Participant[32];
/*0x8160*/ ULONG32 CacheReductionInProgress;
/*0x8164*/ UINT8 _PADDING1_[0x4];
} VI_DEADLOCK_GLOBALS, *PVI_DEADLOCK_GLOBALS;
struct _VI_DEADLOCK_NODE
Referred from:
typedef struct _VI_DEADLOCK_NODE { // 10 elements, 0xD0 bytes (sizeof)
/*0x000*/ struct _VI_DEADLOCK_NODE* Parent;
/*0x008*/ struct _LIST_ENTRY ChildrenList; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY SiblingsList; // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY ResourceList; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY FreeListEntry; // 2 elements, 0x10 bytes (sizeof)
};
/*0x038*/ struct _VI_DEADLOCK_RESOURCE* Root;
/*0x040*/ struct _VI_DEADLOCK_THREAD* ThreadEntry;
union { // 5 elements, 0x4 bytes (sizeof)
struct { // 4 elements, 0x4 bytes (sizeof)
/*0x048*/ ULONG32 Active : 1; // 0 BitPosition
/*0x048*/ ULONG32 OnlyTryAcquireUsed : 1; // 1 BitPosition
/*0x048*/ ULONG32 ReleasedOutOfOrder : 1; // 2 BitPosition
/*0x048*/ ULONG32 SequenceNumber : 29; // 3 BitPosition
};
/*0x048*/ ULONG32 Whole;
} u1;
/*0x050*/ VOID* StackTrace[8];
/*0x090*/ VOID* ParentStackTrace[8];
} VI_DEADLOCK_NODE, *PVI_DEADLOCK_NODE;
struct _VI_DEADLOCK_RESOURCE
Referred from:
typedef struct _VI_DEADLOCK_RESOURCE { // 11 elements, 0xF8 bytes (sizeof)
/*0x000*/ enum _VI_DEADLOCK_RESOURCE_TYPE Type;
struct { // 2 elements, 0x4 bytes (sizeof)
/*0x004*/ ULONG32 NodeCount : 16; // 0 BitPosition
/*0x004*/ ULONG32 RecursionCount : 16; // 16 BitPosition
};
/*0x008*/ VOID* ResourceAddress;
/*0x010*/ struct _VI_DEADLOCK_THREAD* ThreadOwner;
/*0x018*/ struct _LIST_ENTRY ResourceList; // 2 elements, 0x10 bytes (sizeof)
union { // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY HashChainList; // 2 elements, 0x10 bytes (sizeof)
/*0x028*/ struct _LIST_ENTRY FreeListEntry; // 2 elements, 0x10 bytes (sizeof)
};
/*0x038*/ VOID* StackTrace[8];
/*0x078*/ VOID* LastAcquireTrace[8];
/*0x0B8*/ VOID* LastReleaseTrace[8];
} VI_DEADLOCK_RESOURCE, *PVI_DEADLOCK_RESOURCE;
struct _VI_DEADLOCK_THREAD
Referred from:
typedef struct _VI_DEADLOCK_THREAD { // 7 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _KTHREAD* Thread;
/*0x008*/ struct _VI_DEADLOCK_NODE* CurrentSpinNode;
/*0x010*/ struct _VI_DEADLOCK_NODE* CurrentOtherNode;
union { // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY ListEntry; // 2 elements, 0x10 bytes (sizeof)
/*0x018*/ struct _LIST_ENTRY FreeListEntry; // 2 elements, 0x10 bytes (sizeof)
};
/*0x028*/ ULONG32 NodeCount;
/*0x02C*/ ULONG32 PagingCount;
} VI_DEADLOCK_THREAD, *PVI_DEADLOCK_THREAD;
struct _VI_POOL_ENTRY
Referred from:
typedef struct _VI_POOL_ENTRY { // 3 elements, 0x20 bytes (sizeof)
union { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _VI_POOL_PAGE_HEADER PageHeader; // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _VI_POOL_ENTRY_INUSE InUse; // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _SLIST_ENTRY* NextFree;
};
} VI_POOL_ENTRY, *PVI_POOL_ENTRY;
struct _VI_POOL_ENTRY_INUSE
Referred from:
typedef struct _VI_POOL_ENTRY_INUSE { // 4 elements, 0x20 bytes (sizeof)
/*0x000*/ VOID* VirtualAddress;
/*0x008*/ VOID* CallingAddress;
/*0x010*/ UINT64 NumberOfBytes;
/*0x018*/ UINT64 Tag;
} VI_POOL_ENTRY_INUSE, *PVI_POOL_ENTRY_INUSE;
Referred from:
typedef struct _VI_POOL_PAGE_HEADER { // 3 elements, 0x18 bytes (sizeof)
/*0x000*/ struct _SLIST_ENTRY* NextPage;
/*0x008*/ VOID* VerifierEntry;
/*0x010*/ UINT64 Signature;
} VI_POOL_PAGE_HEADER, *PVI_POOL_PAGE_HEADER;
struct _VI_TRACK_IRQL
typedef struct _VI_TRACK_IRQL { // 6 elements, 0x38 bytes (sizeof)
/*0x000*/ VOID* Thread;
/*0x008*/ UINT8 OldIrql;
/*0x009*/ UINT8 NewIrql;
/*0x00A*/ UINT8 Processor;
/*0x00B*/ UINT8 _PADDING0_[0x1];
/*0x00C*/ ULONG32 TickCount;
/*0x010*/ VOID* StackTrace[5];
} VI_TRACK_IRQL, *PVI_TRACK_IRQL;
struct _VI_VERIFIER_ISSUE
typedef struct _VI_VERIFIER_ISSUE { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ UINT64 IssueType;
/*0x008*/ VOID* Address;
/*0x010*/ UINT64 Parameters[2];
} VI_VERIFIER_ISSUE, *PVI_VERIFIER_ISSUE;
struct _VOLUME_CACHE_MAP
Referred from:
typedef struct _VOLUME_CACHE_MAP { // 6 elements, 0x28 bytes (sizeof)
/*0x000*/ INT16 NodeTypeCode;
/*0x002*/ INT16 NodeByteCode;
/*0x004*/ ULONG32 UseCount;
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ struct _LIST_ENTRY VolumeCacheMapLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x020*/ ULONG32 Flags;
/*0x024*/ UINT8 _PADDING0_[0x4];
} VOLUME_CACHE_MAP, *PVOLUME_CACHE_MAP;
struct _VPB
Referred from:
typedef struct _VPB { // 9 elements, 0x60 bytes (sizeof)
/*0x000*/ INT16 Type;
/*0x002*/ INT16 Size;
/*0x004*/ UINT16 Flags;
/*0x006*/ UINT16 VolumeLabelLength;
/*0x008*/ struct _DEVICE_OBJECT* DeviceObject;
/*0x010*/ struct _DEVICE_OBJECT* RealDevice;
/*0x018*/ ULONG32 SerialNumber;
/*0x01C*/ ULONG32 ReferenceCount;
/*0x020*/ WCHAR VolumeLabel[32];
} VPB, *PVPB;
struct _WAIT_CONTEXT_BLOCK
Referred from:
typedef struct _WAIT_CONTEXT_BLOCK { // 7 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _KDEVICE_QUEUE_ENTRY WaitQueueEntry; // 3 elements, 0x18 bytes (sizeof)
/*0x018*/ PVOID DeviceRoutine;
/*0x020*/ VOID* DeviceContext;
/*0x028*/ ULONG32 NumberOfMapRegisters;
/*0x02C*/ UINT8 _PADDING0_[0x4];
/*0x030*/ VOID* DeviceObject;
/*0x038*/ VOID* CurrentIrp;
/*0x040*/ struct _KDPC* BufferChainingDpc;
} WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
struct _WHEA_ERROR_PACKET
typedef struct _WHEA_ERROR_PACKET { // 16 elements, 0x119 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ ULONG32 Flags;
/*0x008*/ UINT64 Size;
/*0x010*/ UINT64 RawDataLength;
/*0x018*/ UINT64 Context;
/*0x020*/ enum _WHEA_ERROR_TYPE ErrorType;
/*0x024*/ enum _WHEA_ERROR_SEVERITY ErrorSeverity;
/*0x028*/ ULONG32 ErrorSourceId;
/*0x02C*/ enum _WHEA_ERROR_SOURCE_TYPE ErrorSourceType;
/*0x030*/ ULONG32 Reserved1;
/*0x034*/ ULONG32 Version;
/*0x038*/ UINT64 Cpu;
union { // 6 elements, 0xD0 bytes (sizeof)
/*0x040*/ struct _WHEA_GENERIC_PROCESSOR_ERROR ProcessorError; // 15 elements, 0xC0 bytes (sizeof)
/*0x040*/ struct _WHEA_MEMORY_ERROR MemoryError; // 16 elements, 0x50 bytes (sizeof)
/*0x040*/ struct _WHEA_NMI_ERROR NmiError; // 1 elements, 0x8 bytes (sizeof)
/*0x040*/ struct _WHEA_PCIEXPRESS_ERROR PciExpressError; // 10 elements, 0xD0 bytes (sizeof)
/*0x040*/ struct _WHEA_PCIX_BUS_ERROR PciXBusError; // 11 elements, 0x48 bytes (sizeof)
/*0x040*/ struct _WHEA_PCIX_DEVICE_ERROR PciXDeviceError; // 6 elements, 0x68 bytes (sizeof)
} u;
/*0x110*/ enum _WHEA_ERROR_STATUS_FORMAT RawDataFormat;
/*0x114*/ ULONG32 Reserved2;
/*0x118*/ UINT8 RawData[1];
} WHEA_ERROR_PACKET, *PWHEA_ERROR_PACKET;
struct _WHEA_ERROR_RECORD
typedef struct _WHEA_ERROR_RECORD { // 2 elements, 0xD0 bytes (sizeof)
/*0x000*/ struct _WHEA_ERROR_RECORD_HEADER Header; // 17 elements, 0x88 bytes (sizeof)
/*0x088*/ struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR SectionDescriptor[1];
} WHEA_ERROR_RECORD, *PWHEA_ERROR_RECORD;
Referred from:
typedef struct _WHEA_ERROR_RECORD_HEADER { // 17 elements, 0x88 bytes (sizeof)
/*0x000*/ ULONG32 Signature;
/*0x004*/ UINT16 Revision;
/*0x006*/ UINT16 Reserved1;
/*0x008*/ UINT16 Reserved2;
/*0x00A*/ UINT16 SectionCount;
/*0x00C*/ enum _WHEA_ERROR_SEVERITY Severity;
/*0x010*/ ULONG32 ValidationBits;
/*0x014*/ ULONG32 Length;
/*0x018*/ union _LARGE_INTEGER Timestamp; // 4 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _GUID PlatformId; // 4 elements, 0x10 bytes (sizeof)
/*0x030*/ struct _GUID PartitionId; // 4 elements, 0x10 bytes (sizeof)
/*0x040*/ struct _GUID CreatorId; // 4 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _GUID NotifyType; // 4 elements, 0x10 bytes (sizeof)
/*0x060*/ UINT64 RecordId;
/*0x068*/ ULONG32 Flags;
/*0x06C*/ UINT8 _PADDING0_[0x4];
/*0x070*/ struct _WHEA_PERSISTENCE_INFO PersistenceInfo; // 5 elements, 0x8 bytes (sizeof)
/*0x078*/ UINT8 Reserved3[12];
/*0x084*/ UINT8 _PADDING1_[0x4];
} WHEA_ERROR_RECORD_HEADER, *PWHEA_ERROR_RECORD_HEADER;
struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR
Referred from:
typedef struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR { // 10 elements, 0x48 bytes (sizeof)
/*0x000*/ ULONG32 SectionOffset;
/*0x004*/ ULONG32 SectionLength;
/*0x008*/ UINT16 Revision;
/*0x00A*/ UINT8 ValidationBits;
/*0x00B*/ UINT8 Reserved;
/*0x00C*/ ULONG32 Flags;
/*0x010*/ struct _GUID SectionType; // 4 elements, 0x10 bytes (sizeof)
/*0x020*/ struct _GUID FRUId; // 4 elements, 0x10 bytes (sizeof)
/*0x030*/ enum _WHEA_ERROR_SEVERITY SectionSeverity;
/*0x034*/ CHAR FRUText[20];
} WHEA_ERROR_RECORD_SECTION_DESCRIPTOR, *PWHEA_ERROR_RECORD_SECTION_DESCRIPTOR;
struct _WHEA_ERROR_STATUS
Referred from:
typedef struct _WHEA_ERROR_STATUS { // 10 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Reserved1 : 8; // 0 BitPosition
/*0x000*/ UINT64 ErrorType : 8; // 8 BitPosition
/*0x000*/ UINT64 Address : 1; // 16 BitPosition
/*0x000*/ UINT64 Control : 1; // 17 BitPosition
/*0x000*/ UINT64 Data : 1; // 18 BitPosition
/*0x000*/ UINT64 Responder : 1; // 19 BitPosition
/*0x000*/ UINT64 Requester : 1; // 20 BitPosition
/*0x000*/ UINT64 FirstError : 1; // 21 BitPosition
/*0x000*/ UINT64 Overflow : 1; // 22 BitPosition
/*0x000*/ UINT64 Reserved2 : 41; // 23 BitPosition
} WHEA_ERROR_STATUS, *PWHEA_ERROR_STATUS;
struct _WHEA_GENERIC_PROCESSOR_ERROR
Referred from:
typedef struct _WHEA_GENERIC_PROCESSOR_ERROR { // 15 elements, 0xC0 bytes (sizeof)
/*0x000*/ UINT64 ValidBits;
/*0x008*/ UINT8 ProcessorType;
/*0x009*/ UINT8 InstructionSet;
/*0x00A*/ UINT8 ErrorType;
/*0x00B*/ UINT8 Operation;
/*0x00C*/ UINT8 Flags;
/*0x00D*/ UINT8 Level;
/*0x00E*/ UINT16 Reserved;
/*0x010*/ UINT64 CPUVersion;
/*0x018*/ UINT8 CPUBrandString[128];
/*0x098*/ UINT64 ProcessorId;
/*0x0A0*/ UINT64 TargetAddress;
/*0x0A8*/ UINT64 RequestorId;
/*0x0B0*/ UINT64 ResponderId;
/*0x0B8*/ UINT64 InstructionPointer;
} WHEA_GENERIC_PROCESSOR_ERROR, *PWHEA_GENERIC_PROCESSOR_ERROR;
struct _WHEA_MEMORY_ERROR
Referred from:
typedef struct _WHEA_MEMORY_ERROR { // 16 elements, 0x50 bytes (sizeof)
/*0x000*/ UINT64 ValidationBits;
/*0x008*/ struct _WHEA_ERROR_STATUS ErrorStatus; // 10 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT64 PhysicalAddress;
/*0x018*/ UINT64 PhysicalAddressMask;
/*0x020*/ UINT16 Node;
/*0x022*/ UINT16 Card;
/*0x024*/ UINT16 Module;
/*0x026*/ UINT16 Bank;
/*0x028*/ UINT16 Device;
/*0x02A*/ UINT16 Row;
/*0x02C*/ UINT16 Column;
/*0x02E*/ UINT16 BitPosition;
/*0x030*/ UINT64 RequestorId;
/*0x038*/ UINT64 ResponderId;
/*0x040*/ UINT64 TargetId;
/*0x048*/ UINT8 ErrorType;
/*0x049*/ UINT8 _PADDING0_[0x7];
} WHEA_MEMORY_ERROR, *PWHEA_MEMORY_ERROR;
struct _WHEA_NMI_ERROR
Referred from:
typedef struct _WHEA_NMI_ERROR { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT8 Data[8];
} WHEA_NMI_ERROR, *PWHEA_NMI_ERROR;
struct _WHEA_PCIEXPRESS_ERROR
Referred from:
typedef struct _WHEA_PCIEXPRESS_ERROR { // 10 elements, 0xD0 bytes (sizeof)
/*0x000*/ UINT64 ValidationBits;
/*0x008*/ enum _PCI_EXPRESS_DEVICE_TYPE PortType;
/*0x00C*/ ULONG32 Version;
/*0x010*/ ULONG32 CommandStatus;
/*0x014*/ ULONG32 Reserved;
/*0x018*/ struct _PCIE_DEVICE_ID DeviceId; // 11 elements, 0x10 bytes (sizeof)
/*0x028*/ UINT64 DeviceSN;
/*0x030*/ ULONG32 BridgeCtrlSts;
/*0x034*/ UINT8 ExpressCapability[60];
/*0x070*/ UINT8 AerInfo[96];
} WHEA_PCIEXPRESS_ERROR, *PWHEA_PCIEXPRESS_ERROR;
struct _WHEA_PCIX_BUS_ERROR
Referred from:
typedef struct _WHEA_PCIX_BUS_ERROR { // 11 elements, 0x48 bytes (sizeof)
/*0x000*/ struct _WHEA_PCIX_BUS_VALIDATION_BITS ValidationBits; // 10 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _WHEA_ERROR_STATUS ErrorStatus; // 10 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT16 ErrorType;
/*0x012*/ UINT16 BusId;
/*0x014*/ ULONG32 Reserved;
/*0x018*/ UINT64 BusAddress;
/*0x020*/ UINT64 BusData;
/*0x028*/ UINT64 BusCommand;
/*0x030*/ UINT64 BusRequestorId;
/*0x038*/ UINT64 BusCompleterId;
/*0x040*/ UINT64 TargetId;
} WHEA_PCIX_BUS_ERROR, *PWHEA_PCIX_BUS_ERROR;
struct _WHEA_PCIX_BUS_VALIDATION_BITS
Referred from:
typedef struct _WHEA_PCIX_BUS_VALIDATION_BITS { // 10 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 ErrorStatusValid : 1; // 0 BitPosition
/*0x000*/ UINT64 ErrorTypeValid : 1; // 1 BitPosition
/*0x000*/ UINT64 BusIdValid : 1; // 2 BitPosition
/*0x000*/ UINT64 BusAddressValid : 1; // 3 BitPosition
/*0x000*/ UINT64 BusDataValid : 1; // 4 BitPosition
/*0x000*/ UINT64 CommandValid : 1; // 5 BitPosition
/*0x000*/ UINT64 RequestorIdValid : 1; // 6 BitPosition
/*0x000*/ UINT64 CompleterIdValid : 1; // 7 BitPosition
/*0x000*/ UINT64 TargetIdValid : 1; // 8 BitPosition
/*0x000*/ UINT64 Reserved : 55; // 9 BitPosition
} WHEA_PCIX_BUS_VALIDATION_BITS, *PWHEA_PCIX_BUS_VALIDATION_BITS;
struct _WHEA_PCIX_DEVICE_ERROR
Referred from:
typedef struct _WHEA_PCIX_DEVICE_ERROR { // 6 elements, 0x68 bytes (sizeof)
/*0x000*/ struct _WHEA_PCIX_DEV_VALIDATION_BITS ValidationBits; // 6 elements, 0x8 bytes (sizeof)
/*0x008*/ struct _WHEA_ERROR_STATUS ErrorStatus; // 10 elements, 0x8 bytes (sizeof)
/*0x010*/ UINT8 IdInfo[16];
/*0x020*/ ULONG32 MemoryNumber;
/*0x024*/ ULONG32 IoNumber;
/*0x028*/ UINT8 RegisterDataPairs[64];
} WHEA_PCIX_DEVICE_ERROR, *PWHEA_PCIX_DEVICE_ERROR;
struct _WHEA_PCIX_DEV_VALIDATION_BITS
Referred from:
typedef struct _WHEA_PCIX_DEV_VALIDATION_BITS { // 6 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 ErrorStatusValid : 1; // 0 BitPosition
/*0x000*/ UINT64 IdInfoValid : 1; // 1 BitPosition
/*0x000*/ UINT64 MemoryNumberValid : 1; // 2 BitPosition
/*0x000*/ UINT64 IoNumberValid : 1; // 3 BitPosition
/*0x000*/ UINT64 RegisterDataPairValid : 1; // 4 BitPosition
/*0x000*/ UINT64 Reserved : 59; // 5 BitPosition
} WHEA_PCIX_DEV_VALIDATION_BITS, *PWHEA_PCIX_DEV_VALIDATION_BITS;
struct _WHEA_PERSISTENCE_INFO
Referred from:
typedef struct _WHEA_PERSISTENCE_INFO { // 5 elements, 0x8 bytes (sizeof)
/*0x000*/ UINT64 Identifier : 16; // 0 BitPosition
/*0x000*/ UINT64 Length : 24; // 16 BitPosition
/*0x000*/ UINT64 Reserved : 6; // 40 BitPosition
/*0x000*/ UINT64 Attributes : 2; // 46 BitPosition
/*0x000*/ UINT64 Signature : 16; // 48 BitPosition
} WHEA_PERSISTENCE_INFO, *PWHEA_PERSISTENCE_INFO;
Referred from:
typedef struct _WMI_BUFFER_HEADER { // 22 elements, 0x48 bytes (sizeof)
union { // 2 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _WNODE_HEADER Wnode; // 11 elements, 0x30 bytes (sizeof)
struct { // 10 elements, 0x30 bytes (sizeof)
/*0x000*/ ULONG32 BufferSize;
/*0x004*/ ULONG32 SavedOffset;
/*0x008*/ ULONG32 CurrentOffset;
/*0x00C*/ LONG32 ReferenceCount;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x010*/ union _LARGE_INTEGER TimeStamp; // 4 elements, 0x8 bytes (sizeof)
/*0x010*/ union _LARGE_INTEGER StartPerfClock; // 4 elements, 0x8 bytes (sizeof)
};
/*0x018*/ INT64 SequenceNumber;
/*0x020*/ ULONG32 Spare0;
/*0x024*/ ULONG32 Spare1;
/*0x028*/ struct _ETW_BUFFER_CONTEXT ClientContext; // 3 elements, 0x4 bytes (sizeof)
union { // 2 elements, 0x4 bytes (sizeof)
/*0x02C*/ enum _ETW_BUFFER_STATE State;
/*0x02C*/ ULONG32 Flags;
};
};
};
/*0x030*/ ULONG32 Offset;
/*0x034*/ UINT16 BufferFlag;
/*0x036*/ UINT16 BufferType;
union { // 5 elements, 0x10 bytes (sizeof)
/*0x038*/ ULONG32 Padding1[4];
/*0x038*/ union _LARGE_INTEGER StartTime; // 4 elements, 0x8 bytes (sizeof)
/*0x038*/ struct _LIST_ENTRY Entry; // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _SINGLE_LIST_ENTRY SlistEntry; // 1 elements, 0x8 bytes (sizeof)
struct { // 2 elements, 0x10 bytes (sizeof)
/*0x038*/ struct _WMI_BUFFER_HEADER* NextBuffer;
/*0x040*/ struct _SINGLE_LIST_ENTRY GlobalEntry; // 1 elements, 0x8 bytes (sizeof)
};
};
} WMI_BUFFER_HEADER, *PWMI_BUFFER_HEADER;
struct _WMI_LOGGER_CONTEXT
typedef struct _WMI_LOGGER_CONTEXT { // 81 elements, 0x350 bytes (sizeof)
/*0x000*/ union _LARGE_INTEGER StartTime; // 4 elements, 0x8 bytes (sizeof)
/*0x008*/ VOID* LogFileHandle;
/*0x010*/ struct _ETHREAD* LoggerThread;
/*0x018*/ LONG32 LoggerStatus;
/*0x01C*/ ULONG32 LoggerId;
/*0x020*/ VOID* NBQHead;
/*0x028*/ VOID* OverflowNBQHead;
/*0x030*/ union _SLIST_HEADER QueueBlockFreeList; // 4 elements, 0x10 bytes (sizeof)
/*0x040*/ union _SLIST_HEADER GlobalList; // 4 elements, 0x10 bytes (sizeof)
/*0x050*/ struct _UNICODE_STRING LoggerName; // 3 elements, 0x10 bytes (sizeof)
/*0x060*/ struct _UNICODE_STRING LogFileName; // 3 elements, 0x10 bytes (sizeof)
/*0x070*/ struct _UNICODE_STRING LogFilePattern; // 3 elements, 0x10 bytes (sizeof)
/*0x080*/ struct _UNICODE_STRING NewLogFileName; // 3 elements, 0x10 bytes (sizeof)
/*0x090*/ ULONG32 ClockType;
/*0x094*/ LONG32 CollectionOn;
/*0x098*/ ULONG32 MaximumFileSize;
/*0x09C*/ ULONG32 LoggerMode;
/*0x0A0*/ ULONG32 LastFlushedBuffer;
/*0x0A4*/ ULONG32 FlushTimer;
/*0x0A8*/ union _LARGE_INTEGER ByteOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x0B0*/ union _LARGE_INTEGER FlushTimeStamp; // 4 elements, 0x8 bytes (sizeof)
/*0x0B8*/ ULONG32 MinimumBuffers;
/*0x0BC*/ LONG32 BuffersAvailable;
/*0x0C0*/ LONG32 NumberOfBuffers;
/*0x0C4*/ ULONG32 MaximumBuffers;
/*0x0C8*/ ULONG32 EventsLost;
/*0x0CC*/ ULONG32 BuffersWritten;
/*0x0D0*/ ULONG32 LogBuffersLost;
/*0x0D4*/ ULONG32 RealTimeBuffersDelivered;
/*0x0D8*/ ULONG32 RealTimeBuffersLost;
/*0x0DC*/ ULONG32 BufferSize;
/*0x0E0*/ ULONG32 MaximumEventSize;
/*0x0E4*/ UINT8 _PADDING0_[0x4];
/*0x0E8*/ LONG32* SequencePtr;
/*0x0F0*/ ULONG32 LocalSequence;
/*0x0F4*/ struct _GUID InstanceGuid; // 4 elements, 0x10 bytes (sizeof)
/*0x104*/ UINT8 _PADDING1_[0x4];
/*0x108*/ PVOID GetCpuClock;
/*0x110*/ LONG32 FileCounter;
/*0x114*/ UINT8 _PADDING2_[0x4];
/*0x118*/ PVOID BufferCallback;
/*0x120*/ enum _POOL_TYPE PoolType;
/*0x124*/ UINT8 _PADDING3_[0x4];
/*0x128*/ struct _ETW_REF_CLOCK ReferenceTime; // 2 elements, 0x10 bytes (sizeof)
/*0x138*/ UINT8 RealtimeLoggerContextFreed;
/*0x139*/ UINT8 _PADDING4_[0x7];
/*0x140*/ struct _LIST_ENTRY Consumers; // 2 elements, 0x10 bytes (sizeof)
/*0x150*/ ULONG32 NumConsumers;
/*0x154*/ UINT8 _PADDING5_[0x4];
/*0x158*/ struct _LIST_ENTRY Connecting; // 2 elements, 0x10 bytes (sizeof)
/*0x168*/ UINT8 NewConsumer;
/*0x169*/ UINT8 _PADDING6_[0x7];
/*0x170*/ VOID* RealtimeLogfileHandle;
/*0x178*/ struct _UNICODE_STRING RealtimeLogfileName; // 3 elements, 0x10 bytes (sizeof)
/*0x188*/ union _LARGE_INTEGER RealtimeWriteOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x190*/ union _LARGE_INTEGER RealtimeReadOffset; // 4 elements, 0x8 bytes (sizeof)
/*0x198*/ union _LARGE_INTEGER RealtimeLogfileSize; // 4 elements, 0x8 bytes (sizeof)
/*0x1A0*/ UINT64 RealtimeLogfileUsage;
/*0x1A8*/ ULONG32 RealtimeBuffersSaved;
/*0x1AC*/ UINT8 _PADDING7_[0x4];
/*0x1B0*/ struct _ETW_REF_CLOCK RealtimeReferenceTime; // 2 elements, 0x10 bytes (sizeof)
/*0x1C0*/ ULONG32 RealtimeDisconnectProcessId;
/*0x1C4*/ ULONG32 RealtimeDisconnectConsumerId;
/*0x1C8*/ enum _ETW_RT_EVENT_LOSS NewRTEventsLost;
/*0x1CC*/ UINT8 _PADDING8_[0x4];
/*0x1D0*/ struct _KEVENT LoggerEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x1E8*/ struct _KEVENT FlushEvent; // 1 elements, 0x18 bytes (sizeof)
/*0x200*/ struct _KDPC FlushDpc; // 9 elements, 0x40 bytes (sizeof)
/*0x240*/ struct _KMUTANT LoggerMutex; // 5 elements, 0x38 bytes (sizeof)
/*0x278*/ struct _SECURITY_CLIENT_CONTEXT ClientSecurityContext; // 6 elements, 0x48 bytes (sizeof)
/*0x2C0*/ struct _EX_FAST_REF SecurityDescriptor; // 3 elements, 0x8 bytes (sizeof)
/*0x2C8*/ struct _WMI_BUFFER_HEADER DummyBufferForMarker; // 22 elements, 0x48 bytes (sizeof)
/*0x310*/ INT64 BufferSequenceNumber;
/*0x318*/ LONG32 AcceptNewEvents;
union { // 2 elements, 0x4 bytes (sizeof)
/*0x31C*/ ULONG32 Flags;
struct { // 7 elements, 0x4 bytes (sizeof)
/*0x31C*/ ULONG32 Persistent : 1; // 0 BitPosition
/*0x31C*/ ULONG32 AutoLogger : 1; // 1 BitPosition
/*0x31C*/ ULONG32 FsReady : 1; // 2 BitPosition
/*0x31C*/ ULONG32 RealTime : 1; // 3 BitPosition
/*0x31C*/ ULONG32 Wow : 1; // 4 BitPosition
/*0x31C*/ ULONG32 KernelTrace : 1; // 5 BitPosition
/*0x31C*/ ULONG32 NoMoreEnable : 1; // 6 BitPosition
};
};
union { // 2 elements, 0x4 bytes (sizeof)
/*0x320*/ ULONG32 RequestFlag;
struct { // 5 elements, 0x4 bytes (sizeof)
/*0x320*/ ULONG32 RequestNewFie : 1; // 0 BitPosition
/*0x320*/ ULONG32 RequestUpdateFile : 1; // 1 BitPosition
/*0x320*/ ULONG32 RequestFlush : 1; // 2 BitPosition
/*0x320*/ ULONG32 RequestDisableRealtime : 1; // 3 BitPosition
/*0x320*/ ULONG32 RequestDisconnectConsumer : 1; // 4 BitPosition
};
};
/*0x324*/ UINT16 StackTraceFilterHookCount;
/*0x326*/ UINT16 StackTraceFilter[16];
/*0x346*/ UINT8 _PADDING9_[0xA];
} WMI_LOGGER_CONTEXT, *PWMI_LOGGER_CONTEXT;
struct _WMI_TRACE_PACKET
Referred from:
typedef struct _WMI_TRACE_PACKET { // 4 elements, 0x4 bytes (sizeof)
/*0x000*/ UINT16 Size;
union { // 2 elements, 0x2 bytes (sizeof)
/*0x002*/ UINT16 HookId;
struct { // 2 elements, 0x2 bytes (sizeof)
/*0x002*/ UINT8 Type;
/*0x003*/ UINT8 Group;
};
};
} WMI_TRACE_PACKET, *PWMI_TRACE_PACKET;
Referred from:
typedef struct _WNODE_HEADER { // 11 elements, 0x30 bytes (sizeof)
/*0x000*/ ULONG32 BufferSize;
/*0x004*/ ULONG32 ProviderId;
union { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ UINT64 HistoricalContext;
struct { // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ ULONG32 Version;
/*0x00C*/ ULONG32 Linkage;
};
};
union { // 3 elements, 0x8 bytes (sizeof)
/*0x010*/ ULONG32 CountLost;
/*0x010*/ VOID* KernelHandle;
/*0x010*/ union _LARGE_INTEGER TimeStamp; // 4 elements, 0x8 bytes (sizeof)
};
/*0x018*/ struct _GUID Guid; // 4 elements, 0x10 bytes (sizeof)
/*0x028*/ ULONG32 ClientContext;
/*0x02C*/ ULONG32 Flags;
} WNODE_HEADER, *PWNODE_HEADER;
struct _WORK_QUEUE_ENTRY
typedef struct _WORK_QUEUE_ENTRY { // 4 elements, 0x30 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY WorkQueueLinks; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ struct _LIST_ENTRY CoalescedWorkQueueLinks; // 2 elements, 0x10 bytes (sizeof)
union { // 4 elements, 0x8 bytes (sizeof)
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _FILE_OBJECT* FileObject;
} Read;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _SHARED_CACHE_MAP* SharedCacheMap;
} Write;
struct { // 1 elements, 0x8 bytes (sizeof)
/*0x020*/ struct _KEVENT* Event;
} Event;
struct { // 1 elements, 0x4 bytes (sizeof)
/*0x020*/ ULONG32 Reason;
} Notification;
} Parameters;
/*0x028*/ UINT8 Function;
/*0x029*/ UINT8 _PADDING0_[0x7];
} WORK_QUEUE_ENTRY, *PWORK_QUEUE_ENTRY;
struct _WORK_QUEUE_ITEM
Referred from:
typedef struct _WORK_QUEUE_ITEM { // 3 elements, 0x20 bytes (sizeof)
/*0x000*/ struct _LIST_ENTRY List; // 2 elements, 0x10 bytes (sizeof)
/*0x010*/ PVOID WorkerRoutine;
/*0x018*/ VOID* Parameter;
} WORK_QUEUE_ITEM, *PWORK_QUEUE_ITEM;
struct _WOW64_PROCESS
Referred from:
typedef struct _WOW64_PROCESS { // 1 elements, 0x8 bytes (sizeof)
/*0x000*/ VOID* Wow64;
} WOW64_PROCESS, *PWOW64_PROCESS;
struct _X86_DBGKD_CONTROL_SET
Referred from:
typedef struct _X86_DBGKD_CONTROL_SET { // 4 elements, 0x10 bytes (sizeof)
/*0x000*/ ULONG32 TraceFlag;
/*0x004*/ ULONG32 Dr7;
/*0x008*/ ULONG32 CurrentSymbolStart;
/*0x00C*/ ULONG32 CurrentSymbolEnd;
} X86_DBGKD_CONTROL_SET, *PX86_DBGKD_CONTROL_SET;
struct _XMM_SAVE_AREA32
Referred from:
typedef struct _XMM_SAVE_AREA32 { // 16 elements, 0x200 bytes (sizeof)
/*0x000*/ UINT16 ControlWord;
/*0x002*/ UINT16 StatusWord;
/*0x004*/ UINT8 TagWord;
/*0x005*/ UINT8 Reserved1;
/*0x006*/ UINT16 ErrorOpcode;
/*0x008*/ ULONG32 ErrorOffset;
/*0x00C*/ UINT16 ErrorSelector;
/*0x00E*/ UINT16 Reserved2;
/*0x010*/ ULONG32 DataOffset;
/*0x014*/ UINT16 DataSelector;
/*0x016*/ UINT16 Reserved3;
/*0x018*/ ULONG32 MxCsr;
/*0x01C*/ ULONG32 MxCsr_Mask;
/*0x020*/ struct _M128A FloatRegisters[8];
/*0x0A0*/ struct _M128A XmmRegisters[16];
/*0x1A0*/ UINT8 Reserved4[96];
} XMM_SAVE_AREA32, *PXMM_SAVE_AREA32;
struct _flags
Referred from:
typedef struct _flags { // 2 elements, 0x1 bytes (sizeof)
/*0x000*/ UINT8 Removable : 1; // 0 BitPosition
/*0x000*/ UINT8 Fill : 7; // 1 BitPosition
} flags, *Pflags;
struct _iobuf
typedef struct _iobuf { // 8 elements, 0x30 bytes (sizeof)
/*0x000*/ CHAR* _ptr;
/*0x008*/ INT32 _cnt;
/*0x00C*/ UINT8 _PADDING0_[0x4];
/*0x010*/ CHAR* _base;
/*0x018*/ INT32 _flag;
/*0x01C*/ INT32 _file;
/*0x020*/ INT32 _charbuf;
/*0x024*/ INT32 _bufsiz;
/*0x028*/ CHAR* _tmpfname;
} iobuf, *Piobuf;