-
-
Notifications
You must be signed in to change notification settings - Fork 15
/
Copy pathw2kundoc.inc
1027 lines (937 loc) · 33.4 KB
/
w2kundoc.inc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
comment ^
Module Name:
w2kundoc.inc
Abstract:
This module defines some undocumented W2000 structures and constants.
Author:
Four-F (four-f@mail.ru)
Last Update:
03-October-2003
IMPORTANT:
Hand made -> Bugs are very possible :(
Your bug report is very welcome.
Comments:
Some fields name have been changed because of collision with masm reserved words.
All such words are prefixed with underscore ('_') symbol.
^
include native.inc
IFNDEF KAFFINITY
include ntddk.inc
ENDIF
;IFNDEF KPROCESSOR_MODE
; KPROCESSOR_MODE typedef BYTE
;ENDIF
;IFNDEF ULARGE_INTEGER
; include ntdef.inc
;ENDIF
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
KAPC_STATE STRUCT ; sizeof = 18h
ApcListHead LIST_ENTRY 2 dup(<?>)
Process PVOID ? ; 10h PTR KPROCESS
KernelApcInProgress BYTE ? ; 14h
KernelApcPending BYTE ? ; 15h
UserApcPending BYTE ? ; 16h
db ?
KAPC_STATE ENDS
PKAPC_STATE typedef PTR KAPC_STATE
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
KGDTENTRY STRUCT ; sizeof = 8
LimitLow WORD ?
BaseLow WORD ?
union _HighWord ; original HighWord
struct Bytes
BaseMid BYTE ?
Flags1 BYTE ?
Flags2 BYTE ?
BaseHi BYTE ?
ends
; Damn! ...record field names must be unique...
; kd displays it as __unnamed11, so i prepend each field name with 'u11'
Bits RECORD \
u11BaseHi:8, ; bits24-31 BaseHi
u11Granularity:1, ; bits23-23 Granularity
u11Default_Big:1, ; bits22-22 Default_Big
u11Reserved_0:1, ; bits21-21 Reserved_0
u11Sys:1, ; bits20-20 Sys
u11LimitHi:4, ; bits16-19 LimitHi
u11Pres:1, ; bits15-15 Pres
u11Dpl:2, ; bits13-14 Dpl
u11Type:5, ; bits8-12 Type
u11BaseMid:8 ; bits0-7 BaseMid
ends ; HighWord
KGDTENTRY ENDS
PKGDTENTRY typedef PTR KGDTENTRY
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
KIDTENTRY STRUCT ; sizeof = 8
_Offset WORD ? ; original name Offset
Selector WORD ?
Access WORD ?
ExtendedOffset WORD ?
KIDTENTRY ENDS
PKIDTENTRY typedef PTR KIDTENTRY
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PS_IMPERSONATION_INFORMATION STRUCT ; sizeof = 0Ch
Token PVOID ?
CopyOnOpen BYTE ? ; 4h
EffectiveOnly BYTE ? ; 5h
db 2 dup(?) ; padding
ImpersonationLevel UINT ? ; 8h
PS_IMPERSONATION_INFORMATION ENDS
PPS_IMPERSONATION_INFORMATION typedef PTR PS_IMPERSONATION_INFORMATION
WOW64_PROCESS STRUCT
Wow64 PVOID ?
WOW64_PROCESS ENDS
PWOW64_PROCESS typedef PTR WOW64_PROCESS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
MMSUPPORT_FLAGS RECORD \
Filler:25, ; bits7-31 Filler
WriteWatch:1, ; bits6-6 WriteWatch
WorkingSetHard:1, ; bits5-5 WorkingSetHard
TrimHard:1, ; bits4-4 TrimHard
SessionLeader:1, ; bits3-3 SessionLeader
ProcessInSession:1, ; bits2-2 ProcessInSession
BeingTrimmed:1, ; bits1-1 BeingTrimmed
SessionSpace:1 ; bits0-0 SessionSpace
MMSUPPORT STRUCT ; sizeof = 48h
LastTrimTime LARGE_INTEGER <>
LastTrimFaultCount DWORD ? ; 08h
PageFaultCount DWORD ? ; 0Ch
PeakWorkingSetSize DWORD ? ; 10h
WorkingSetSize DWORD ? ; 14h
MinimumWorkingSetSize DWORD ? ; 18h
MaximumWorkingSetSize DWORD ? ; 1Ch
VmWorkingSetList PVOID ? ; 20h
WorkingSetExpansionLinks LIST_ENTRY <> ; 24h
AllowWorkingSetAdjustment BOOLEAN ? ; 2Ch
AddressSpaceBeingDeleted BOOLEAN ? ; 2Dh
ForegroundSwitchCount BYTE ? ; 2Eh
MemoryPriority BYTE ? ; 2Fh
union ; 30h
LongFlags DWORD ?
Flags MMSUPPORT_FLAGS <>
ends
Claim DWORD ? ; 34h
NextEstimationSlot DWORD ? ; 38h
NextAgingSlot DWORD ? ; 3Ch
EstimatedAvailable DWORD ? ; 40h
GrowthSinceLastEstimate DWORD ? ; 44h
MMSUPPORT ENDS
PMMSUPPORT typedef PTR MMSUPPORT
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
comment ^
PDE_4M STRUCT ; page-directory entry (4-mB page)
union
dwPDE4k DWORD ? ; packed
btPDE4k RECORD \
pde4kPFN:20, ; bits12-31
pde4kReserved:3, ; bit9-11
pde4kGlobal:1, ; bit8
pde4kLargePage:1, ; bit7
pde4kDirty:1, ; bit6 Reserved ???
pde4kAccessed:1, ; bit5
pde4kCacheDisabled:1, ; bit4
pde4kWriteThrough:1, ; bit3
pde4kOwner:1, ; bit2
pde4kWrite:1, ; bit1
pde4kValid:1 ; bit0
ends
PDE_4M ENDS
PDE_4K STRUCT ; page-directory entry (4-kB page)
union
dwPDE4k DWORD ? ; packed
btPDE4k RECORD \
pde4kPFN:20, ; bits12-31
pde4kReserved:3, ; bit9-11
pde4kGlobal:1, ; bit8
pde4kLargePage:1, ; bit7
pde4kDirty:1, ; bit6 Reserved ???
pde4kAccessed:1, ; bit5
pde4kCacheDisabled:1, ; bit4
pde4kWriteThrough:1, ; bit3
pde4kOwner:1, ; bit2
pde4kWrite:1, ; bit1
pde4kValid:1 ; bit0
ends
PDE_4K ENDS
PTE_4K STRUCT
union
dwPTE4k DWORD ? ; packed
btPTE4k RECORD \
pte4kPFN:20, ; bits12-31
pte4kReserved2:3, ; bit9-11
pte4kGlobal:1, ; bit8
pte4kReserved:1, ; bit7
pte4kDirty:1, ; bit6
pte4kAccessed:1, ; bit5
pte4kCacheDisabled:1, ; bit4
pte4kWriteThrough:1, ; bit3
pte4kOwner:1, ; bit2
pte4kWrite:1, ; bit1
pte4kValid:1 ; bit0
ends
PTE_4K ENDS
^
; page directory entry (4-mB page)
; I've prefixed all fields with "pde4m"
HARDWARE_PDE4M RECORD \
pde4mPageFrameNumber:10, ; bits22-31 PageFrameNumber
pde4m_reserved:13, ; bits9-21 reserved
pde4mGlobal:1, ; bit8 Global
pde4mLargePage:1, ; bit7 LargePage
pde4mDirty:1, ; bit6 Dirty
pde4mAccessed:1, ; bit5 Accessed
pde4mCacheDisable:1, ; bit4 CacheDisable
pde4mWriteThrough:1, ; bit3 WriteThrough
pde4mOwner:1, ; bit2 Owner
pde4mWrite:1, ; bit1 Write
pde4mValid:1 ; bit0 Valid
; page directory entry (4-kB page)
; I've prefixed all fields with "pde4k"
HARDWARE_PDE4K RECORD \
pde4kPageFrameNumber:20,; bits12-31
pde4k_reserved:3, ; bit9-11
pde4kGlobal:1, ; bit8
pde4kLargePage:1, ; bit7
pde4kDirty:1, ; bit6 Reserved ???
pde4kAccessed:1, ; bit5
pde4kCacheDisable:1, ; bit4
pde4kWriteThrough:1, ; bit3
pde4kOwner:1, ; bit2
pde4kWrite:1, ; bit1
pde4kValid:1 ; bit0
; page table entry
; I've prefixed all fields with "pte"
HARDWARE_PTE RECORD \
ptePageFrameNumber:20, ; bits12-31 PageFrameNumber
pte_reserved:1, ; bit11 reserved
ptePrototype:1, ; bit10 Prototype
pteCopyOnWrite:1, ; bit9 CopyOnWrite
pteGlobal:1, ; bit8 Global
pteLargePage:1, ; bit7 LargePage
pteDirty:1, ; bit6 Dirty
pteAccessed:1, ; bit5 Accessed
pteCacheDisable:1, ; bit4 CacheDisable
pteWriteThrough:1, ; bit3 WriteThrough
pteOwner:1, ; bit2 Owner
pteWrite:1, ; bit1 Write
pteValid:1 ; bit0 Valid
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;HANDLE_TABLE_ENTRY STRUCT ; sizeof = 8
; Object PVOID ?
; ObAttributes DWORD ?
; GrantedAccess DWORD ?
; GrantedAccessIndex DWORD ?
; CreatorBackTraceIndex DWORD ?
; NextFreeTableEntry DWORD ?
HANDLE_TABLE STRUCT ; sizeof = 6Ch
Flags DWORD ?
HandleCount SDWORD ? ; 04h
Table PVOID ? ; 08h PTR PTR PTR HANDLE_TABLE_ENTRY
QuotaProcess PVOID ? ; 0Ch PTR EPROCESS
UniqueProcessId PVOID ? ; 10h
FirstFreeTableEntry SDWORD ? ; 14h
NextIndexNeedingPool SDWORD ? ; 18h
HandleTableLock ERESOURCE <> ; 1Ch
HandleTableList LIST_ENTRY <> ; 54h
HandleContentionEvent KEVENT <> ; 5Ch
HANDLE_TABLE ENDS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PAGEFAULT_HISTORY STRUCT ; sizeof = 18h
CurrentIndex DWORD ?
MaxIndex DWORD ? ; 04h
SpinLock DWORD ? ; 08h
Reserved PVOID ? ; 0Ch
WatchInfo PROCESS_WS_WATCH_INFORMATION <> ; 10h
PAGEFAULT_HISTORY ENDS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
EPROCESS_QUOTA_BLOCK STRUCT ; sizeof = 2Ch
QuotaLock DWORD ?
ReferenceCount DWORD ? ; 04h
QuotaPeakPoolUsage DWORD 2 dup(?) ; 08h
QuotaPoolUsage DWORD 2 dup(?) ; 10h
QuotaPoolLimit DWORD 2 dup(?) ; 18h
PeakPagefileUsage DWORD ? ; 20h
PagefileUsage DWORD ? ; 24h
PagefileLimit DWORD ? ; 28h
EPROCESS_QUOTA_BLOCK ENDS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
EJOB STRUCT ; sizeof = 170h
Event KEVENT <>
JobLinks LIST_ENTRY <> ; 010h
ProcessListHead LIST_ENTRY <> ; 018h
JobLock ERESOURCE <> ; 020h
TotalUserTime LARGE_INTEGER <> ; 058h
TotalKernelTime LARGE_INTEGER <> ; 060h
ThisPeriodTotalUserTime LARGE_INTEGER <> ; 068h
ThisPeriodTotalKernelTime LARGE_INTEGER <> ; 070h
TotalPageFaultCount DWORD ? ; 078h
TotalProcesses DWORD ? ; 07Ch
ActiveProcesses DWORD ? ; 080h
TotalTerminatedProcesses DWORD ? ; 084h
PerProcessUserTimeLimit LARGE_INTEGER <> ; 088h
PerJobUserTimeLimit LARGE_INTEGER <> ; 090h
LimitFlags DWORD ? ; 098h
MinimumWorkingSetSize DWORD ? ; 09Ch
MaximumWorkingSetSize DWORD ? ; 0A0h
ActiveProcessLimit DWORD ? ; 0A4h
Affinity DWORD ? ; 0A8h
PriorityClass BYTE ? ; 0ACh
db 3 dup(?) ; padding
UIRestrictionsClass DWORD ? ; 0B0h
SecurityLimitFlags DWORD ? ; 0B4h
Token PVOID ? ; 0B8h
Filter PVOID ? ; 0BCh PTR PS_JOB_TOKEN_FILTER
EndOfJobTimeAction DWORD ? ; 0C0h
CompletionPort PVOID ? ; 0C4h
CompletionKey PVOID ? ; 0C8h
SessionId DWORD ? ; 0CCh
SchedulingClass DWORD ? ; 0D0h
dd ? ; padding
ReadOperationCount QWORD ? ; 0D8h
WriteOperationCount QWORD ? ; 0E0h
OtherOperationCount QWORD ? ; 0E8h
ReadTransferCount QWORD ? ; 0F0h
WriteTransferCount QWORD ? ; 0F8h
OtherTransferCount QWORD ? ; 100h
IoInfo IO_COUNTERS <> ; 108h
ProcessMemoryLimit DWORD ? ; 138h
JobMemoryLimit DWORD ? ; 13Ch
PeakProcessMemoryUsed DWORD ? ; 140h
PeakJobMemoryUsed DWORD ? ; 144h
CurrentJobMemoryUsed DWORD ? ; 148h
MemoryLimitsLock FAST_MUTEX <> ; 14Ch
DWORD ? ; padding ???
EJOB ENDS
PEJOB typedef PTR EJOB
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; a part of EPROCESS structure (first member)
; also known as Process Control Block, PCB
KPROCESS STRUCT ; sizeof = 06Ch
Header DISPATCHER_HEADER <> ; 000h DO_TYPE_PROCESS (0x1B)
ProfileListHead LIST_ENTRY <> ; 010h
DirectoryTableBase DWORD ? ; 018h
PageTableBase DWORD ? ; 01Ch
LdtDescriptor KGDTENTRY <> ; 020h
Int21Descriptor KIDTENTRY <> ; 028h
IopmOffset WORD ? ; 030h
Iopl BYTE ? ; 032h
VdmFlag BOOLEAN ? ; 033h
ActiveProcessors DWORD ? ; 034h
KernelTime DWORD ? ; 038h ticks
UserTime DWORD ? ; 03Ch ticks
ReadyListHead LIST_ENTRY <> ; 040h
SwapListEntry LIST_ENTRY <> ; 048h
ThreadListHead LIST_ENTRY <> ; 050h KTHREAD.ThreadListEntry
ProcessLock PVOID ? ; 058h
Affinity KAFFINITY ? ; 05Ch
StackCount WORD ? ; 060h
BasePriority BYTE ? ; 062h
ThreadQuantum BYTE ? ; 063h
AutoAlignment BOOLEAN ? ; 064h
State BYTE ? ; 065h
ThreadSeed BYTE ? ; 066h
DisableBoost BOOLEAN ? ; 067h
PowerState BYTE ? ; 068h
DisableQuantum BOOLEAN ? ; 069h
Spare BYTE 2 dup(?) ; 06Ah
KPROCESS ENDS
PKPROCESS typedef PTR KPROCESS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
EPROCESS STRUCT ; sizeof = 288h
Pcb KPROCESS <>
ExitStatus DWORD ? ; 06Ch
LockEvent KEVENT <> ; 070h
LockCount DWORD ? ; 080h
DWORD ? ; 084h padding
CreateTime LARGE_INTEGER <> ; 088h
ExitTime LARGE_INTEGER <> ; 090h
LockOwner PVOID ? ; 098h PTR KTHREAD
UniqueProcessId DWORD ? ; 09Ch
ActiveProcessLinks LIST_ENTRY <> ; 0A0h
QuotaPeakPoolUsage DWORD 2 dup(?) ; 0A8h NP, P
QuotaPoolUsage DWORD 2 dup(?) ; 0B0h NP, P
PagefileUsage DWORD ? ; 0B8h
CommitCharge DWORD ? ; 0BCh
PeakPagefileUsage DWORD ? ; 0C0h
PeakVirtualSize DWORD ? ; 0C4h
VirtualSize LARGE_INTEGER <> ; 0C8h
Vm MMSUPPORT <> ; 0D0h
SessionProcessLinks LIST_ENTRY <> ; 118h
DebugPort PVOID ? ; 120h
ExceptionPort PVOID ? ; 124h
ObjectTable PVOID ? ; 128h PTR HANDLE_TABLE
Token PVOID ? ; 12Ch
WorkingSetLock FAST_MUTEX <> ; 130h
WorkingSetPage DWORD ? ; 150h
ProcessOutswapEnabled BYTE ? ; 154h
ProcessOutswapped BYTE ? ; 155h
AddressSpaceInitialized BYTE ? ; 156h
AddressSpaceDeleted BYTE ? ; 157h
AddressCreationLock FAST_MUTEX <> ; 158h
HyperSpaceLock DWORD ? ; 178h
ForkInProgress PVOID ? ; 17Ch PTR ETHREAD
VmOperation WORD ? ; 180h
ForkWasSuccessful BYTE ? ; 182h
MmAgressiveWsTrimMask BYTE ? ; 183h
VmOperationEvent PVOID ? ; 184h PTR KEVENT
PaeTop PVOID ? ; 188h
LastFaultCount DWORD ? ; 18Ch
ModifiedPageCount DWORD ? ; 190h
VadRoot PVOID ? ; 194h
VadHint PVOID ? ; 198h
CloneRoot PVOID ? ; 19Ch
NumberOfPrivatePages DWORD ? ; 1A0h
NumberOfLockedPages DWORD ? ; 1A4h
NextPageColor WORD ? ; 1A8h
ExitProcessCalled BYTE ? ; 1AAh
CreateProcessReported BYTE ? ; 1ABh
SectionHandle PVOID ? ; 1ACh
Peb PVOID ? ; 1B0h PTR PEB
SectionBaseAddress PVOID ? ; 1B4h
QuotaBlock PVOID ? ; 1B8h PTR EPROCESS_QUOTA_BLOCK
LastThreadExitStatus DWORD ? ; 1BCh
WorkingSetWatch PVOID ? ; 1C0h PTR PAGEFAULT_HISTORY
Win32WindowStation PVOID ? ; 1C4h
InheritedFromUniqueProcessId PVOID ? ; 1C8h
GrantedAccess DWORD ? ; 1CCh
DefaultHardErrorProcessing DWORD ? ; 1D0h
LdtInformation PVOID ? ; 1D4h
VadFreeHint PVOID ? ; 1D8h
VdmObjects PVOID ? ; 1DCh
DeviceMap PVOID ? ; 1E0h
SessionId DWORD ? ; 1E4h
PhysicalVadList LIST_ENTRY <> ; 1E8h
union
PageDirectoryPte HARDWARE_PTE <> ; 1F0h
Filler QWORD ? ; 1F0h
ends
PaePageDirectoryPage DWORD ? ; 1F8h
ImageFileName BYTE 16 dup(?) ; 1FCh
VmTrimFaultValue DWORD ? ; 20Ch
SetTimerResolution BYTE ? ; 210h
PriorityClass BYTE ? ; 211h
union
struct
SubSystemMinorVersion BYTE ? ; 212h
SubSystemMajorVersion BYTE ? ; 213h
ends
SubSystemVersion WORD ? ; 212h
ends
Win32Process PVOID ? ; 214h
Job PVOID ? ; 218h PTR EJOB
JobStatus DWORD ? ; 21Ch
JobLinks LIST_ENTRY <> ; 220h
LockedPagesList PVOID ? ; 228h
SecurityPort PVOID ? ; 22Ch
Wow64Process PVOID ? ; 230h PTR WOW64_PROCESS
DWORD ? ; 234h ???
ReadOperationCount LARGE_INTEGER <> ; 238h
WriteOperationCount LARGE_INTEGER <> ; 240h
OtherOperationCount LARGE_INTEGER <> ; 248h
ReadTransferCount LARGE_INTEGER <> ; 250h
WriteTransferCount LARGE_INTEGER <> ; 258h
OtherTransferCount LARGE_INTEGER <> ; 260h
CommitChargeLimit DWORD ? ; 268h
CommitChargePeak DWORD ? ; 26Ch
ThreadListHead LIST_ENTRY <> ; 270h
VadPhysicalPagesBitMap PVOID ? ; 278h PTR RTL_BITMAP
VadPhysicalPages DWORD ? ; 27Ch
AweLock DWORD ? ; 280h
DWORD ? ; 284h padding
EPROCESS ENDS
PEPROCESS typedef PTR EPROCESS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; a part of ETHREAD structure (first member)
; also known as Thread Control Block, TCB
KTHREAD STRUCT ; sizeof = 1B0h
Header DISPATCHER_HEADER <> ; 000h DO_TYPE_THREAD (0x6C)
MutantListHead LIST_ENTRY <> ; 010h
InitialStack PVOID ? ; 018h
StackLimit PVOID ? ; 01Ch
Teb PVOID ? ; 020h PTR TEB
TlsArray PVOID ? ; 024h
KernelStack PVOID ? ; 028h
DebugActive BYTE ? ; 02Ch
State BYTE ? ; 02Dh THREAD_STATE_*
Alerted BYTE 2 dup(?) ; 02Eh
Iopl BYTE ? ; 030h
NpxState BYTE ? ; 031h
Saturation BYTE ? ; 032h
Priority BYTE ? ; 033h
ApcState KAPC_STATE <> ; 034h
ContextSwitches DWORD ? ; 04Ch
WaitStatus DWORD ? ; 050h
WaitIrql BYTE ? ; 054h
WaitMode BYTE ? ; 055h
WaitNext BYTE ? ; 056h
WaitReason BYTE ? ; 057h
WaitBlockList PVOID ? ; 058h PTR KWAIT_BLOCK
WaitListEntry LIST_ENTRY <> ; 05Ch
WaitTime DWORD ? ; 064h
BasePriority BYTE ? ; 068h
DecrementCount BYTE ? ; 069h
PriorityDecrement BYTE ? ; 06Ah
Quantum BYTE ? ; 06Bh
WaitBlock KWAIT_BLOCK 4 dup(<>) ; 06Ch
LegoData DWORD ? ; 0CCh
KernelApcDisable DWORD ? ; 0D0h
UserAffinity KAFFINITY ? ; 0D4h
SystemAffinityActive BYTE ? ; 0D8h
PowerState BYTE ? ; 0D9h
NpxIrql BYTE ? ; 0DAh
Pad BYTE ? ; 0DBh
ServiceTable PVOID ? ; 0DCh PTR SERVICE_DESCRIPTOR_TABLE
Queue PVOID ? ; 0E0h PTR KQUEUE
ApcQueueLock DWORD ? ; 0E4h
Timer KTIMER <> ; 0E8h
QueueListEntry LIST_ENTRY <> ; 110h
Affinity KAFFINITY ? ; 118h
Preempted BYTE ? ; 11Ch
ProcessReadyQueue BYTE ? ; 11Dh
KernelStackResident BYTE ? ; 11Eh
NextProcessor BYTE ? ; 11Fh
CallbackStack PVOID ? ; 120h
Win32Thread PVOID ? ; 124h PTR WIN32_THREAD ???
TrapFrame PVOID ? ; 128h PTR KTRAP_FRAME
ApcStatePointer PVOID 2 dup(?) ; 12Ch PTR KAPC_STATE
PreviousMode KPROCESSOR_MODE ? ; 134h
EnableStackSwap BOOLEAN ? ; 135h
LargeStack BOOLEAN ? ; 136h
ResourceIndex BYTE ? ; 137h
KernelTime DWORD ? ; 138h ticks
UserTime DWORD ? ; 13Ch ticks
SavedApcState KAPC_STATE <> ; 140h
Alertable BOOLEAN ? ; 158h
ApcStateIndex BYTE ? ; 159h
ApcQueueable BOOLEAN ? ; 15Ah
AutoAlignment BOOLEAN ? ; 15Bh
StackBase PVOID ? ; 15Ch
SuspendApc KAPC <> ; 160h
SuspendSemaphore KSEMAPHORE <> ; 190h
ThreadListEntry LIST_ENTRY <> ; 1A4h see KPROCESS
FreezeCount BYTE ? ; 1ACh
SuspendCount BYTE ? ; 1ADh
IdealProcessor BYTE ? ; 1AEh
DisableBoost BYTE ? ; 1AFh
KTHREAD ENDS
PKTHREAD typedef PTR KTHREAD
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; ...record field names must be unique...
; I named it as ETHREAD_BITS
ETHREAD_BITS RECORD \
EthreadBitsReserved:29, ; bits 3-31
ApcNeeded:1, ; bits 2-2
NestedFaultCount:2 ; bits 0-1
ETHREAD STRUCT ; sizeof = 248h
Tcb KTHREAD <> ; 000h
union
CreateTime LARGE_INTEGER <> ; 1B0h
EthreadBits ETHREAD_BITS <> ; 1B0h
ends
union
ExitTime LARGE_INTEGER <> ; 1B8h
LpcReplyChain LIST_ENTRY <> ; 1B8h
ends
union
ExitStatus DWORD ? ; 1C0h
OfsChain PVOID ? ; 1C0h
ends
PostBlockList LIST_ENTRY <> ; 1C4h
TerminationPortList LIST_ENTRY <> ; 1CCh
ActiveTimerListLock DWORD ? ; 1D4h
ActiveTimerListHead LIST_ENTRY <> ; 1D8h
Cid CLIENT_ID <> ; 1E0h
LpcReplySemaphore KSEMAPHORE <> ; 1E8h
LpcReplyMessage PVOID ? ; 1FCh
LpcReplyMessageId DWORD ? ; 200h
PerformanceCountLow DWORD ? ; 204h
ImpersonationInfo PVOID ? ; 208h PTR PS_IMPERSONATION_INFORMATION
IrpList LIST_ENTRY <> ; 20Ch
TopLevelIrp DWORD ? ; 214h
DeviceToVerify PVOID ? ; 218h PTR DEVICE_OBJECT
ReadClusterSize UINT ? ; 21Ch
ForwardClusterOnly BYTE ? ; 220h
DisablePageFaultClustering BYTE ? ; 221h
DeadThread BYTE ? ; 222h
HideFromDebugger BYTE ? ; 223h
HasTerminated DWORD ? ; 224h
GrantedAccess DWORD ? ; 228h
ThreadsProcess PVOID ? ; 22Ch PTR EPROCESS
StartAddress PVOID ? ; 230h
union
Win32StartAddress PVOID ? ; 234h
LpcReceivedMessageId DWORD ? ; 234h
ends
LpcExitThreadCalled BYTE ? ; 238h
HardErrorsAreDisabled BYTE ? ; 239h
LpcReceivedMsgIdValid BYTE ? ; 23Ah
ActiveImpersonationInfo BYTE ? ; 23Bh
PerformanceCountHigh SDWORD ? ; 23Ch
ThreadListEntry LIST_ENTRY <> ; 240h
ETHREAD ENDS
PETHREAD typedef PTR ETHREAD
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
KQUEUE STRUCT ;sizeof = 28h
Header DISPATCHER_HEADER <>
EntryListHead LIST_ENTRY <> ; 10h
CurrentCount DWORD ? ; 18h
MaximumCount DWORD ? ; 1Ch
ThreadListHead LIST_ENTRY <> ; 20h
KQUEUE ENDS
PKQUEUE typedef PTR KQUEUE
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PEB_LDR_DATA STRUCT ; sizeof = 24h
_Length DWORD ? ; original name Length
Initialized BYTE ? ; 04h
db 3 dup(?) ; padding
SsHandle PVOID ? ; 08h
InLoadOrderModuleList LIST_ENTRY <> ; 0Ch
InMemoryOrderModuleList LIST_ENTRY <> ; 14h
InInitializationOrderModuleList LIST_ENTRY <> ; 1Ch
PEB_LDR_DATA ENDS
PPEB_LDR_DATA typedef PTR PEB_LDR_DATA
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
RTL_DRIVE_LETTER_CURDIR STRUCT ; sizeof = 10h
Flags WORD ? ; 00h
_Length WORD ? ; 02h original name Length
TimeStamp DWORD ? ; 04h
DosPath _STRING <> ; 08h
RTL_DRIVE_LETTER_CURDIR ENDS
PRTL_DRIVE_LETTER_CURDIR typedef PTR RTL_DRIVE_LETTER_CURDIR
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CURDIR STRUCT ; sizeof = 0Ch
DosPath UNICODE_STRING <> ; 0
Handle PVOID ? ; 8
CURDIR ENDS
PCURDIR typedef ptr CURDIR
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PEB_FREE_BLOCK STRUCT ; sizeof = 8
Next PVOID ? ; PTR PEB_FREE_BLOCK
_Size DWORD ? ; original name Size
PEB_FREE_BLOCK ENDS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
RTL_USER_PROCESS_PARAMETERS STRUCT ; sizeof = 290h
MaximumLength DWORD ? ; 000h
_Length DWORD ? ; 004h original name Length
Flags DWORD ? ; 008h
DebugFlags DWORD ? ; 00Ch
ConsoleHandle PVOID ? ; 010h
ConsoleFlags DWORD ? ; 014h
StandardInput PVOID ? ; 018h
StandardOutput PVOID ? ; 01Ch
StandardError PVOID ? ; 020h
CurrentDirectory CURDIR <> ; 024h
DllPath UNICODE_STRING <> ; 030h
ImagePathName UNICODE_STRING <> ; 038h
CommandLine UNICODE_STRING <> ; 040h
Environment PVOID ? ; 048h
StartingX DWORD ? ; 04Ch
StartingY DWORD ? ; 050h
CountX DWORD ? ; 054h
CountY DWORD ? ; 058h
CountCharsX DWORD ? ; 05Ch
CountCharsY DWORD ? ; 060h
FillAttribute DWORD ? ; 064h
WindowFlags DWORD ? ; 068h
ShowWindowFlags DWORD ? ; 06Ch
WindowTitle UNICODE_STRING <> ; 070h
DesktopInfo UNICODE_STRING <> ; 078h
ShellInfo UNICODE_STRING <> ; 080h
RuntimeData UNICODE_STRING <> ; 088h
CurrentDirectores RTL_DRIVE_LETTER_CURDIR 32 dup(<>) ; 090h
RTL_USER_PROCESS_PARAMETERS ENDS
PRTL_USER_PROCESS_PARAMETERS typedef ptr RTL_USER_PROCESS_PARAMETERS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; Process Environment Block (PEB)
; located at 7FFDF000h (pointed by fs:[30] in user mode)
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PEB STRUCT ; sizeof = 1E8h
InheritedAddressSpace BYTE ? ; 0000h
ReadImageFileExecOptions BYTE ? ; 0001h
BeingDebugged BYTE ? ; 0002h
SpareBool BYTE ? ; 0003h
Mutant PVOID ? ; 0004h
ImageBaseAddress PVOID ? ; 0008h
Ldr PVOID ? ; 000Ch PTR PEB_LDR_DATA
ProcessParameters PVOID ? ; 0010h PTR RTL_USER_PROCESS_PARAMETERS
SubSystemData PVOID ? ; 0014h
ProcessHeap PVOID ? ; 0018h
FastPebLock PVOID ? ; 001Ch
FastPebLockRoutine PVOID ? ; 0020h
FastPebUnlockRoutine PVOID ? ; 0024h
EnvironmentUpdateCount DWORD ? ; 0028h
KernelCallbackTable PVOID ? ; 002Ch
SystemReserved DWORD 2 dup(?) ; 0030h
FreeList PVOID ? ; 0038h PTR PEB_FREE_BLOCK
TlsExpansionCounter DWORD ? ; 003Ch
TlsBitmap PVOID ? ; 0040h
TlsBitmapBits DWORD 2 dup(?) ; 0044h
ReadOnlySharedMemoryBase PVOID ? ; 004Ch
ReadOnlySharedMemoryHeap PVOID ? ; 0050h
ReadOnlyStaticServerData PVOID ? ; 0054h
AnsiCodePageData PVOID ? ; 0058h
OemCodePageData PVOID ? ; 005Ch
UnicodeCaseTableData PVOID ? ; 0060h
NumberOfProcessors DWORD ? ; 0064h
NtGlobalFlag DWORD ? ; 0068h
DWORD ? ; 006Ch
CriticalSectionTimeout LARGE_INTEGER <> ; 0070h
HeapSegmentReserve DWORD ? ; 0078h
HeapSegmentCommit DWORD ? ; 007Ch
HeapDeCommitTotalFreeThreshold DWORD ? ; 0080h
HeapDeCommitFreeBlockThreshold DWORD ? ; 0084h
NumberOfHeaps DWORD ? ; 0088h
MaximumNumberOfHeaps DWORD ? ; 008Ch
ProcessHeaps PVOID ? ; 0090h
GdiSharedHandleTable PVOID ? ; 0094h
ProcessStarterHelper PVOID ? ; 0098h
GdiDCAttributeList DWORD ? ; 009Ch
LoaderLock PVOID ? ; 00A0h
OSMajorVersion DWORD ? ; 00A4h
OSMinorVersion DWORD ? ; 00A8h
OSBuildNumber WORD ? ; 00ACh
OSCSDVersion WORD ? ; 00AEh
OSPlatformId DWORD ? ; 00B0h
ImageSubsystem DWORD ? ; 00B4h
ImageSubsystemMajorVersion DWORD ? ; 00B8h
ImageSubsystemMinorVersion DWORD ? ; 00BCh
ImageProcessAffinityMask DWORD ? ; 00C0h
GdiHandleBuffer DWORD 34 dup(?) ; 00C4h
PostProcessInitRoutine DWORD ? ; 014Ch
TlsExpansionBitmap PVOID ? ; 0150h
TlsExpansionBitmapBits DWORD 32 dup(?) ; 0154h
SessionId DWORD ? ; 01D4h
AppCompatInfo PVOID ? ; 01D8h
CSDVersion UNICODE_STRING <> ; 01DCh
DWORD ? ; 01E4h
PEB ENDS
PPEB typedef PTR PEB
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; Thread Environment Block (TEB)
; First Teb located at 7FFDE000h (pointed by fs:[18] in user mode)
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; This structure is not present even in PDB files. I found it somewhere.
TEB STRUCT
Tib NT_TIB <> ; 000h
EnvironmentPointer PVOID ? ; 01Ch
Cid CLIENT_ID <> ; 020h
ActiveRpcInfo PVOID ? ; 028h
ThreadLocalStoragePointer PVOID ? ; 02Ch
Peb PVOID ? ; 030h PTR PEB
LastErrorValue DWORD ? ; 034h
CountOfOwnedCriticalSections DWORD ? ; 038h
CsrClientThread PVOID ? ; 03Ch
Win32ThreadInfo PVOID ? ; 040h
Win32ClientInfo DWORD 1Fh dup(?) ; 044h
WOW32Reserved PVOID ? ; 0C0h
CurrentLocale DWORD ? ; 0C4
FpSoftwareStatusRegister DWORD ? ; 0C8
SystemReserved1 PVOID 36h dup(?) ; 0CC
Spare1 PVOID ? ; 1A4
ExceptionCode DWORD ? ; 1A8
SpareBytes1 DWORD 28h dup(?) ; 1AC
SystemReserved2 PVOID 0Ah dup(?) ; 24C
GdiRgn DWORD ? ; 274
GdiPen DWORD ? ; 278
GdiBrush DWORD ? ; 27C
RealClientId CLIENT_ID <> ; 6B4h
GdiCachedProcessHandle PVOID ? ;
GdiClientPID DWORD ? ;
GdiClientTID DWORD ? ;
GdiThreadLocaleInfo PVOID ? ;
UserReserved PVOID 5 dup(?) ;
GlDispatchTable PVOID 118h dup(?) ;
GlReserved1 DWORD 1Ah dup(?) ;
GlReserved2 PVOID ? ;
GlSectionInfo PVOID ? ;
GlSection PVOID ? ;
GlTable PVOID ? ;
GlCurrentRC PVOID ? ;
GlContext PVOID ? ;
LastStatusValue DWORD ? ; BF4h NTSTATUS !!! 100%
StaticUnicodeString UNICODE_STRING <> ;
StaticUnicodeBuffer WORD 105h dup(?) ; WCHAR
DeallocationStack PVOID ? ;
TlsSlots PVOID 40h dup(?) ;
TlsLinks LIST_ENTRY <> ; 0
Vdm PVOID ? ;
ReservedForNtRpc PVOID ? ;
DbgSsReserved PVOID 2 dup(?) ;
HardErrorDisabled DWORD ? ; F28h HardErrorsMode 100%
Instrumentation PVOID 10h dup(?) ;
WinSockData PVOID ? ;
GdiBatchCount DWORD ? ;
Spare2 DWORD ? ;
Spare3 DWORD ? ;
Spare4 DWORD ? ;
ReservedForOle PVOID ? ;
WaitingOnLoaderLock DWORD ? ;
StackCommit PVOID ? ;
StackCommitMax PVOID ? ;
StackReserved PVOID ? ;
TEB ENDS
PTEB typedef PTR TEB
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; Task Segment State
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
KiIoAccessMap STRUCT ; sizeof= 2024h
DirectionMap BYTE 32 dup(?)
IoMap BYTE 8196 dup(?) ; 020h
KiIoAccessMap ENDS
KTSS STRUCT ; sizeof = 20ACh
Backlink WORD ? ; 0000
Reserved0 WORD ? ; 0000
Esp0 DWORD ? ; 0004h
Ss0 WORD ? ; 0008h
Reserved1 WORD ? ; 000Ah
NotUsed1 DWORD 4 dup(?) ; 000Ch
rCR3 DWORD ? ; 001Ch original field name CR3
Eip DWORD ? ; 0020h
NotUsed2 DWORD 9 dup(?) ; 0024h
rEs WORD ? ; 0048h original field name Es
Reserved2 WORD ? ; 004Ah
rCs WORD ? ; 004Ch original field name Cs
Reserved3 WORD ? ; 004Eh
rSs WORD ? ; 0050h original field name Ss
Reserved4 WORD ? ; 0052h
rDs WORD ? ; 0054h original field name Ds
Reserved5 WORD ? ; 0056h
rFs WORD ? ; 0058h original field name Fs
Reserved6 WORD ? ; 005Ah
rGs WORD ? ; 005Ch original field name Gs
Reserved7 WORD ? ; 005Eh
LDT WORD ? ; 0060h
Reserved8 WORD ? ; 0062h
Flags WORD ? ; 0064h
IoMapBase WORD ? ; 0066h
IoMaps KiIoAccessMap <> ; 0068h
IntDirectionMap BYTE 32 dup(?) ; 208Ch
KTSS ENDS
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
OBJECT_NAME STRUCT ; sizeof = 10h (by Nebbett)
Directory PVOID ? ; 0000h PTR OBJECT_DIRECTORY
_Name UNICODE_STRING <> ; 0004h
DWORD ? ; 000Ch Reserved
OBJECT_NAME ENDS
OBJECT_TYPE_INITIALIZER STRUCT ; sizeof = 04Ch
_Length WORD ? ; 0000h (org name Length)
UseDefaultObject BYTE ? ; 0002h
Reserved BYTE ? ; 0003h
InvalidAttributes DWORD ? ; 0004h
GenericMapping GENERIC_MAPPING <> ; 0008h
ValidAccessMask DWORD ? ; 0018h
SecurityRequired BYTE ? ; 001Ch
MaintainHandleCount BYTE ? ; 001Dh
MaintainTypeList BYTE ? ; 001Eh
db 1 dup(?) ; padding
PoolType SDWORD ? ; 0020h
DefaultPagedPoolCharge DWORD ? ; 0024h
DefaultNonPagedPoolCharge DWORD ? ; 0028h
DumpProcedure PVOID ? ; 002Ch
OpenProcedure PVOID ? ; 0030h
CloseProcedure PVOID ? ; 0034h
DeleteProcedure PVOID ? ; 0038h
ParseProcedure PVOID ? ; 003Ch
SecurityProcedure PVOID ? ; 0040h
QueryNameProcedure PVOID ? ; 0044h
OkayToCloseProcedure PVOID ? ; 0048h
OBJECT_TYPE_INITIALIZER ENDS
OBJECT_TYPE STRUCT ; sizeof = 0B0h
Mutex ERESOURCE <> ; 0000h
TypeList LIST_ENTRY <> ; 0038h
_Name UNICODE_STRING <> ; 0040h (org name Name)
DefaultObject PVOID ? ; 0048h
Index DWORD ? ; 004Ch
TotalNumberOfObjects DWORD ? ; 0050h
TotalNumberOfHandles DWORD ? ; 0054h
HighWaterNumberOfObjects DWORD ? ; 0058h
HighWaterNumberOfHandles DWORD ? ; 005Ch
TypeInfo OBJECT_TYPE_INITIALIZER <> ; 0060h
Key DWORD ? ; 00ACh
OBJECT_TYPE ENDS
OBJECT_CREATE_INFORMATION STRUCT ; sizeof = 030h
Attributes DWORD ? ; 0000h
RootDirectory PVOID ? ; 0004h
ParseContext PVOID ? ; 0008h
ProbeMode BYTE ? ; 000Ch
db 3 dup(?) ; padding
PagedPoolCharge DWORD ? ; 0010h
NonPagedPoolCharge DWORD ? ; 0014h
SecurityDescriptorCharge DWORD ? ; 0018h
SecurityDescriptor PVOID ? ; 001Ch
SecurityQos PVOID ? ; 0020h PTR SECURITY_QUALITY_OF_SERVICE
SecurityQualityOfService SECURITY_QUALITY_OF_SERVICE <> ; 0024h
OBJECT_CREATE_INFORMATION ENDS
OBJECT_HEADER STRUCT ; sizeof = 018h
PointerCount SDWORD ? ; 0000h
union
HandleCount SDWORD ? ; 0004h
SEntry PVOID ? ; 0004h PTR SINGLE_LIST_ENTRY
ends
_Type PVOID ? ; 0008h PTR OBJECT_TYPE (original name Type)
NameInfoOffset BYTE ? ; 000Ch
HandleInfoOffset BYTE ? ; 000Dh
QuotaInfoOffset BYTE ? ; 000Eh
Flags BYTE ? ; 000Fh
union
ObjectCreateInfo PVOID ? ; 0010h PTR OBJECT_CREATE_INFORMATION
QuotaBlockCharged PVOID ? ; 0010h
ends
SecurityDescriptor PVOID ? ; 0014h
; Body QUAD <> ; 0018h
OBJECT_HEADER ENDS
; Processor Control Block (PRCB)
PRCB_MINOR_VERSION equ 1
PRCB_MAJOR_VERSION equ 1
PRCB_BUILD_DEBUG equ 1
PRCB_BUILD_UNIPROCESSOR equ 2
; KPRCB base address is 0FFDFF120h
KPRCB STRUCT ; sizeof = XXX
; Major and minor version numbers of the PCR.
MinorVersion WORD ?
MajorVersion WORD ?
; Start of the architecturally defined section of the PRCB. This section
; may be directly addressed by vendor/platform specific HAL code and will
; not change from version to version of NT.
CurrentThread PVOID ? ; 04h PTR KTHREAD
NextThread PVOID ? ; 08h PTR KTHREAD
IdleThread PVOID ? ; 0Ch PTR KTHREAD
Number CHAR ? ; 10h
Reserved CHAR ? ; 11h
BuildType WORD ? ; 12h
SetMember KAFFINITY ? ; 14h
; End of the architecturally defined section of the PRCB. This section
; may be directly addressed by vendor/platform specific HAL code and will
; not change from version to version of NT.
; To be continued...
KPRCB ENDS
PKPRCB typedef PTR KPRCB
VAD STRUCT
StartingPageAddress PVOID ? ; 0000h in pages
EndingPageAddress PVOID ? ; 0004h in pages
ParentLink PVOID ? ; 0008h PTR VAD