|
| HEADER ("Pointer size") |
|
| SIZE (SizeofPointer, PVOID) |
|
| HEADER ("Bug Check Codes") |
|
| CONSTANT (APC_INDEX_MISMATCH) |
|
| CONSTANT (INVALID_AFFINITY_SET) |
|
| CONSTANT (INVALID_DATA_ACCESS_TRAP) |
|
| CONSTANT (IRQL_NOT_GREATER_OR_EQUAL) |
|
| CONSTANT (IRQL_NOT_LESS_OR_EQUAL) |
|
| CONSTANT (NO_USER_MODE_CONTEXT) |
|
| CONSTANT (SPIN_LOCK_ALREADY_OWNED) |
|
| CONSTANT (SPIN_LOCK_NOT_OWNED) |
|
| CONSTANT (THREAD_NOT_MUTEX_OWNER) |
|
| CONSTANT (TRAP_CAUSE_UNKNOWN) |
|
| CONSTANT (KMODE_EXCEPTION_NOT_HANDLED) |
|
| CONSTANT (KERNEL_APC_PENDING_DURING_EXIT) |
|
| CONSTANT (PANIC_STACK_SWITCH) |
|
| CONSTANT (DATA_BUS_ERROR) |
|
| CONSTANT (INSTRUCTION_BUS_ERROR) |
|
| CONSTANT (SYSTEM_EXIT_OWNED_MUTEX) |
|
| CONSTANT (PAGE_FAULT_WITH_INTERRUPTS_OFF) |
|
| CONSTANT (IRQL_GT_ZERO_AT_SYSTEM_SERVICE) |
|
| CONSTANT (DATA_COHERENCY_EXCEPTION) |
|
| CONSTANT (INSTRUCTION_COHERENCY_EXCEPTION) |
|
| CONSTANT (HAL1_INITIALIZATION_FAILED) |
|
| CONSTANT (UNEXPECTED_KERNEL_MODE_TRAP) |
|
| CONSTANT (NMI_HARDWARE_FAILURE) |
|
| CONSTANT (SPIN_LOCK_INIT_FAILURE) |
|
| CONSTANT (ATTEMPTED_SWITCH_FROM_DPC) |
|
| CONSTANT (KERNEL_SECURITY_CHECK_FAILURE) |
|
| HEADER ("Breakpoints") |
|
| CONSTANT (BREAKPOINT_BREAK) |
|
| CONSTANT (BREAKPOINT_PRINT) |
|
| CONSTANT (BREAKPOINT_PROMPT) |
|
| CONSTANT (BREAKPOINT_LOAD_SYMBOLS) |
|
| CONSTANT (BREAKPOINT_UNLOAD_SYMBOLS) |
|
| CONSTANT (BREAKPOINT_COMMAND_STRING) |
|
| HEADER ("Context Frame Flags") |
|
| CONSTANT (CONTEXT_FULL) |
|
| CONSTANT (CONTEXT_CONTROL) |
|
| CONSTANT (CONTEXT_INTEGER) |
|
| CONSTANT (CONTEXT_FLOATING_POINT) |
|
| CONSTANT (CONTEXT_DEBUG_REGISTERS) |
|
| HEADER ("Exception flags") |
|
| CONSTANT (EXCEPTION_NONCONTINUABLE) |
|
| CONSTANT (EXCEPTION_UNWINDING) |
|
| CONSTANT (EXCEPTION_EXIT_UNWIND) |
|
| CONSTANT (EXCEPTION_STACK_INVALID) |
|
| CONSTANT (EXCEPTION_NESTED_CALL) |
|
| CONSTANT (EXCEPTION_TARGET_UNWIND) |
|
| CONSTANT (EXCEPTION_COLLIDED_UNWIND) |
|
| CONSTANT (EXCEPTION_UNWIND) |
|
| CONSTANT (EXCEPTION_EXECUTE_HANDLER) |
|
| CONSTANT (EXCEPTION_CONTINUE_SEARCH) |
|
| CONSTANT (EXCEPTION_CONTINUE_EXECUTION) |
|
| HEADER ("Exception types") |
|
| CONSTANT (ExceptionContinueExecution) |
|
| CONSTANT (ExceptionContinueSearch) |
|
| CONSTANT (ExceptionNestedException) |
|
| CONSTANT (ExceptionCollidedUnwind) |
|
| HEADER ("Fast Fail Constants") |
|
| CONSTANT (FAST_FAIL_GUARD_ICALL_CHECK_FAILURE) |
|
| HEADER ("Interrupt object types") |
|
| CONSTANTX (InLevelSensitive, LevelSensitive) |
|
| CONSTANTX (InLatched, Latched) |
|
| HEADER ("IPI") |
|
| CONSTANT (IPI_APC) |
|
| CONSTANT (IPI_DPC) |
|
| CONSTANT (IPI_FREEZE) |
|
| CONSTANT (IPI_PACKET_READY) |
|
| HEADER ("IRQL") |
|
| CONSTANT (PASSIVE_LEVEL) |
|
| CONSTANT (APC_LEVEL) |
|
| CONSTANT (DISPATCH_LEVEL) |
|
| CONSTANT (IPI_LEVEL) |
|
| CONSTANT (POWER_LEVEL) |
|
| CONSTANT (PROFILE_LEVEL) |
|
| CONSTANT (HIGH_LEVEL) |
|
| RAW ("#ifndef CONFIG_SMP") |
|
| CONSTANTX (SYNCH_LEVEL, DISPATCH_LEVEL) |
|
| RAW ("#else") |
|
| CONSTANTX (SYNCH_LEVEL,(IPI_LEVEL - 2)) |
|
| RAW ("#endif") |
|
| HEADER ("Entropy Timing Constants") |
|
| CONSTANT (KENTROPY_TIMING_INTERRUPTS_PER_BUFFER) |
|
| CONSTANT (KENTROPY_TIMING_BUFFER_MASK) |
|
| CONSTANT (KENTROPY_TIMING_ANALYSIS) |
|
| HEADER ("Lock Queue") |
|
| CONSTANT (LOCK_QUEUE_WAIT) |
|
| CONSTANT (LOCK_QUEUE_OWNER) |
|
| CONSTANT (LockQueueDispatcherLock) |
|
| HEADER ("Process states") |
| FIXE: obsolete.
|
|
| CONSTANT (ProcessInMemory) |
|
| CONSTANT (ProcessOutOfMemory) |
|
| CONSTANT (ProcessInTransition) |
|
| HEADER ("Processor mode") |
|
| CONSTANT (KernelMode) |
|
| CONSTANT (UserMode) |
|
| HEADER ("Service Table Constants") |
|
| CONSTANT (NUMBER_SERVICE_TABLES) |
|
| CONSTANT (SERVICE_NUMBER_MASK) |
|
| CONSTANT (SERVICE_TABLE_SHIFT) |
|
| CONSTANT (SERVICE_TABLE_MASK) |
|
| CONSTANT (SERVICE_TABLE_TEST) |
|
| HEADER ("Status codes") |
|
| CONSTANT (STATUS_ACCESS_VIOLATION) |
|
| CONSTANT (STATUS_ASSERTION_FAILURE) |
|
| CONSTANT (STATUS_ARRAY_BOUNDS_EXCEEDED) |
|
| CONSTANT (STATUS_BAD_COMPRESSION_BUFFER) |
|
| CONSTANT (STATUS_BREAKPOINT) |
|
| CONSTANT (STATUS_CALLBACK_POP_STACK) |
|
| CONSTANT (STATUS_DATATYPE_MISALIGNMENT) |
|
| CONSTANT (STATUS_FLOAT_DENORMAL_OPERAND) |
|
| CONSTANT (STATUS_FLOAT_DIVIDE_BY_ZERO) |
|
| CONSTANT (STATUS_FLOAT_INEXACT_RESULT) |
|
| CONSTANT (STATUS_FLOAT_INVALID_OPERATION) |
|
| CONSTANT (STATUS_FLOAT_OVERFLOW) |
|
| CONSTANT (STATUS_FLOAT_STACK_CHECK) |
|
| CONSTANT (STATUS_FLOAT_UNDERFLOW) |
|
| CONSTANT (STATUS_FLOAT_MULTIPLE_FAULTS) |
|
| CONSTANT (STATUS_FLOAT_MULTIPLE_TRAPS) |
|
| CONSTANT (STATUS_GUARD_PAGE_VIOLATION) |
|
| CONSTANT (STATUS_ILLEGAL_FLOAT_CONTEXT) |
|
| CONSTANT (STATUS_ILLEGAL_INSTRUCTION) |
|
| CONSTANT (STATUS_INSTRUCTION_MISALIGNMENT) |
|
| CONSTANT (STATUS_INVALID_HANDLE) |
|
| CONSTANT (STATUS_INVALID_LOCK_SEQUENCE) |
|
| CONSTANT (STATUS_INVALID_OWNER) |
|
| CONSTANT (STATUS_INVALID_PARAMETER) |
|
| CONSTANT (STATUS_INVALID_PARAMETER_1) |
|
| CONSTANT (STATUS_INVALID_SYSTEM_SERVICE) |
|
| CONSTANT (STATUS_INTEGER_DIVIDE_BY_ZERO) |
|
| CONSTANT (STATUS_INTEGER_OVERFLOW) |
|
| CONSTANT (STATUS_IN_PAGE_ERROR) |
|
| CONSTANT (STATUS_KERNEL_APC) |
|
| CONSTANT (STATUS_LONGJUMP) |
|
| CONSTANT (STATUS_NO_CALLBACK_ACTIVE) |
|
| CONSTANT (STATUS_NO_EVENT_PAIR) |
|
| CONSTANT (STATUS_PRIVILEGED_INSTRUCTION) |
| FIXME: obsolete.
|
|
| CONSTANT (STATUS_SINGLE_STEP) |
|
| CONSTANT (STATUS_STACK_BUFFER_OVERRUN) |
|
| CONSTANT (STATUS_STACK_OVERFLOW) |
|
| CONSTANT (STATUS_SUCCESS) |
|
| CONSTANT (STATUS_THREAD_IS_TERMINATING) |
|
| CONSTANT (STATUS_TIMEOUT) |
|
| CONSTANT (STATUS_UNWIND) |
|
| CONSTANT (STATUS_UNWIND_CONSOLIDATE) |
|
| CONSTANT (STATUS_USER_APC) |
|
| CONSTANT (STATUS_WAKE_SYSTEM) |
|
| CONSTANT (STATUS_WAKE_SYSTEM_DEBUGGER) |
|
| HEADER ("TLS defines") |
|
| CONSTANT (TLS_MINIMUM_AVAILABLE) |
|
| CONSTANT (TLS_EXPANSION_SLOTS) |
|
| HEADER ("Thread states") |
|
| CONSTANT (Initialized) |
|
| CONSTANT (Ready) |
|
| CONSTANT (Running) |
|
| CONSTANT (Standby) |
|
| CONSTANT (Terminated) |
|
| CONSTANT (Waiting) |
|
| HEADER ("Wait type / reason") |
|
| CONSTANT (WrExecutive) |
|
| CONSTANT (WrMutex) |
|
| CONSTANT (WrDispatchInt) |
| FIXME: Obsolete.
|
|
| CONSTANT (WrQuantumEnd) |
|
| CONSTANT (WrEventPair) |
| FIXME: Obsolete.
|
|
| CONSTANT (WaitAny) |
| FIXME: Obsolete.
|
|
| CONSTANT (WaitAll) |
|
| HEADER ("Stack sizes") |
|
| CONSTANT (KERNEL_STACK_SIZE) |
|
| CONSTANT (KERNEL_LARGE_STACK_SIZE) |
| FIXME: Obsolete.
|
|
| CONSTANT (KERNEL_LARGE_STACK_COMMIT) |
|
| CONSTANT (DOUBLE_FAULT_STACK_SIZE) |
|
| HEADER ("Miscellaneous Definitions") |
|
| CONSTANT (TRUE) |
|
| CONSTANT (FALSE) |
|
| CONSTANT (PAGE_SIZE) |
|
| CONSTANT (Executive) |
|
| CONSTANT (LOW_REALTIME_PRIORITY) |
|
| CONSTANT (CLOCK_QUANTUM_DECREMENT) |
|
| CONSTANT (WAIT_QUANTUM_DECREMENT) |
|
| CONSTANT (MAXIMUM_PROCESSORS) |
|
| CONSTANT (INITIAL_STALL_COUNT) |
|
| CONSTANT (KI_EXCEPTION_ACCESS_VIOLATION) |
|
| CONSTANT (DBG_STATUS_CONTROL_C) |
|
| CONSTANT (MAXIMUM_IDTVECTOR) |
|
| CONSTANT (PRIMARY_VECTOR_BASE) |
|
| CONSTANT (RPL_MASK) |
|
| CONSTANT (MODE_MASK) |
|
| HEADER ("KAPC") |
|
| OFFSET (ApType, KAPC, Type) |
|
| OFFSET (ApSize, KAPC, Size) |
|
| OFFSET (ApThread, KAPC, Thread) |
|
| OFFSET (ApApcListEntry, KAPC, ApcListEntry) |
|
| OFFSET (ApKernelRoutine, KAPC, KernelRoutine) |
|
| OFFSET (ApRundownRoutine, KAPC, RundownRoutine) |
|
| OFFSET (ApNormalRoutine, KAPC, NormalRoutine) |
|
| OFFSET (ApNormalContext, KAPC, NormalContext) |
|
| OFFSET (ApSystemArgument1, KAPC, SystemArgument1) |
|
| OFFSET (ApSystemArgument2, KAPC, SystemArgument2) |
|
| OFFSET (ApApcStateIndex, KAPC, ApcStateIndex) |
|
| OFFSET (ApApcMode, KAPC, ApcMode) |
|
| OFFSET (ApInserted, KAPC, Inserted) |
|
| SIZE (ApcObjectLength, KAPC) |
|
| HEADER ("KAPC offsets (relative to NormalRoutine)") |
|
| RELOFFSET (ArNormalRoutine, KAPC, NormalRoutine, NormalRoutine) |
|
| RELOFFSET (ArNormalContext, KAPC, NormalContext, NormalRoutine) |
|
| RELOFFSET (ArSystemArgument1, KAPC, SystemArgument1, NormalRoutine) |
|
| RELOFFSET (ArSystemArgument2, KAPC, SystemArgument2, NormalRoutine) |
|
| CONSTANTX (ApcRecordLength, 4 *sizeof(PVOID)) |
|
| HEADER ("KAPC_STATE") |
|
| OFFSET (AsApcListHead, KAPC_STATE, ApcListHead) |
|
| OFFSET (AsProcess, KAPC_STATE, Process) |
|
| OFFSET (AsKernelApcInProgress, KAPC_STATE, KernelApcInProgress) |
|
| OFFSET (AsKernelApcPending, KAPC_STATE, KernelApcPending) |
|
| OFFSET (AsUserApcPending, KAPC_STATE, UserApcPending) |
|
| HEADER ("CLIENT_ID") |
|
| OFFSET (CidUniqueProcess, CLIENT_ID, UniqueProcess) |
|
| OFFSET (CidUniqueThread, CLIENT_ID, UniqueThread) |
|
| HEADER ("RTL_CRITICAL_SECTION") |
|
| OFFSET (CsDebugInfo, RTL_CRITICAL_SECTION, DebugInfo) |
|
| OFFSET (CsLockCount, RTL_CRITICAL_SECTION, LockCount) |
|
| OFFSET (CsRecursionCount, RTL_CRITICAL_SECTION, RecursionCount) |
|
| OFFSET (CsOwningThread, RTL_CRITICAL_SECTION, OwningThread) |
|
| OFFSET (CsLockSemaphore, RTL_CRITICAL_SECTION, LockSemaphore) |
|
| OFFSET (CsSpinCount, RTL_CRITICAL_SECTION, SpinCount) |
|
| HEADER ("RTL_CRITICAL_SECTION_DEBUG") |
|
| OFFSET (CsType, RTL_CRITICAL_SECTION_DEBUG, Type) |
|
| OFFSET (CsCreatorBackTraceIndex, RTL_CRITICAL_SECTION_DEBUG, CreatorBackTraceIndex) |
|
| OFFSET (CsCriticalSection, RTL_CRITICAL_SECTION_DEBUG, CriticalSection) |
|
| OFFSET (CsProcessLocksList, RTL_CRITICAL_SECTION_DEBUG, ProcessLocksList) |
|
| OFFSET (CsEntryCount, RTL_CRITICAL_SECTION_DEBUG, EntryCount) |
|
| OFFSET (CsContentionCount, RTL_CRITICAL_SECTION_DEBUG, ContentionCount) |
|
| HEADER ("KDEVICE_QUEUE_ENTRY") |
|
| OFFSET (DeDeviceListEntry, KDEVICE_QUEUE_ENTRY, DeviceListEntry) |
|
| OFFSET (DeSortKey, KDEVICE_QUEUE_ENTRY, SortKey) |
|
| OFFSET (DeInserted, KDEVICE_QUEUE_ENTRY, Inserted) |
|
| SIZE (DeviceQueueEntryLength, KDEVICE_QUEUE_ENTRY) |
|
| HEADER ("KDPC") |
|
| OFFSET (DpType, KDPC, Type) |
|
| OFFSET (DpImportance, KDPC, Importance) |
|
| OFFSET (DpNumber, KDPC, Number) |
|
| OFFSET (DpDpcListEntry, KDPC, DpcListEntry) |
|
| OFFSET (DpDeferredRoutine, KDPC, DeferredRoutine) |
|
| OFFSET (DpDeferredContext, KDPC, DeferredContext) |
|
| OFFSET (DpSystemArgument1, KDPC, SystemArgument1) |
|
| OFFSET (DpSystemArgument2, KDPC, SystemArgument2) |
|
| OFFSET (DpDpcData, KDPC, DpcData) |
|
| SIZE (DpcObjectLength, KDPC) |
|
| HEADER ("KDEVICE_QUEUE") |
|
| OFFSET (DvType, KDEVICE_QUEUE, Type) |
|
| OFFSET (DvSize, KDEVICE_QUEUE, Size) |
|
| OFFSET (DvDeviceListHead, KDEVICE_QUEUE, DeviceListHead) |
|
| OFFSET (DvSpinLock, KDEVICE_QUEUE, Lock) |
|
| OFFSET (DvBusy, KDEVICE_QUEUE, Busy) |
|
| SIZE (DeviceQueueObjectLength, KDEVICE_QUEUE) |
|
| HEADER ("EXCEPTION_RECORD") |
|
| OFFSET (ErExceptionCode, EXCEPTION_RECORD, ExceptionCode) |
|
| OFFSET (ErExceptionFlags, EXCEPTION_RECORD, ExceptionFlags) |
|
| OFFSET (ErExceptionRecord, EXCEPTION_RECORD, ExceptionRecord) |
|
| OFFSET (ErExceptionAddress, EXCEPTION_RECORD, ExceptionAddress) |
|
| OFFSET (ErNumberParameters, EXCEPTION_RECORD, NumberParameters) |
|
| OFFSET (ErExceptionInformation, EXCEPTION_RECORD, ExceptionInformation) |
|
| SIZE (ExceptionRecordLength, EXCEPTION_RECORD) |
|
| SIZE (EXCEPTION_RECORD_LENGTH, EXCEPTION_RECORD) |
|
| HEADER ("EPROCESS") |
|
| OFFSET (EpDebugPort, EPROCESS, DebugPort) |
|
| SIZE (ExecutiveProcessObjectLength, EPROCESS) |
|
| HEADER ("ETHREAD offsets") |
|
| OFFSET (EtCid, ETHREAD, Cid) |
|
| SIZE (ExecutiveThreadObjectLength, ETHREAD) |
|
| HEADER ("KEVENT") |
|
| OFFSET (EvType, KEVENT, Header.Type) |
|
| OFFSET (EvSize, KEVENT, Header.Size) |
|
| OFFSET (EvSignalState, KEVENT, Header.SignalState) |
|
| OFFSET (EvWaitListHead, KEVENT, Header.WaitListHead) |
|
| SIZE (EventObjectLength, KEVENT) |
|
| HEADER ("FIBER") |
|
| OFFSET (FbFiberData, FIBER, FiberData) |
|
| OFFSET (FbExceptionList, FIBER, ExceptionList) |
|
| OFFSET (FbStackBase, FIBER, StackBase) |
|
| OFFSET (FbStackLimit, FIBER, StackLimit) |
|
| OFFSET (FbDeallocationStack, FIBER, DeallocationStack) |
|
| OFFSET (FbFiberContext, FIBER, FiberContext) |
|
| OFFSET (FbFlsData, FIBER, FlsData) |
|
| OFFSET (FbGuaranteedStackBytes, FIBER, GuaranteedStackBytes) |
|
| HEADER ("FAST_MUTEX") |
|
| OFFSET (FmCount, FAST_MUTEX, Count) |
|
| OFFSET (FmOwner, FAST_MUTEX, Owner) |
|
| OFFSET (FmContention, FAST_MUTEX, Contention) |
|
| OFFSET (FmOldIrql, FAST_MUTEX, OldIrql) |
|
| HEADER ("GETSETCONTEXT offsets") |
|
| OFFSET (GetSetCtxContextPtr, GETSETCONTEXT, Context) |
|
| HEADER ("KINTERRUPT") |
|
| OFFSET (InType, KINTERRUPT, Type) |
|
| OFFSET (InSize, KINTERRUPT, Size) |
|
| OFFSET (InInterruptListEntry, KINTERRUPT, InterruptListEntry) |
|
| OFFSET (InServiceRoutine, KINTERRUPT, ServiceRoutine) |
|
| OFFSET (InServiceContext, KINTERRUPT, ServiceContext) |
|
| OFFSET (InSpinLock, KINTERRUPT, SpinLock) |
|
| OFFSET (InTickCount, KINTERRUPT, TickCount) |
|
| OFFSET (InActualLock, KINTERRUPT, ActualLock) |
|
| OFFSET (InDispatchAddress, KINTERRUPT, DispatchAddress) |
|
| OFFSET (InVector, KINTERRUPT, Vector) |
|
| OFFSET (InIrql, KINTERRUPT, Irql) |
|
| OFFSET (InSynchronizeIrql, KINTERRUPT, SynchronizeIrql) |
|
| OFFSET (InFloatingSave, KINTERRUPT, FloatingSave) |
|
| OFFSET (InConnected, KINTERRUPT, Connected) |
|
| OFFSET (InNumber, KINTERRUPT, Number) |
|
| OFFSET (InShareVector, KINTERRUPT, ShareVector) |
|
| OFFSET (InMode, KINTERRUPT, Mode) |
|
| OFFSET (InServiceCount, KINTERRUPT, ServiceCount) |
|
| OFFSET (InDispatchCount, KINTERRUPT, DispatchCount) |
|
| OFFSET (InDispatchCode, KINTERRUPT, DispatchCode) |
|
| SIZE (InterruptObjectLength, KINTERRUPT) |
|
| HEADER ("KSTACK_CONTROL") |
|
| OFFSET (KcCurrentBase, KSTACK_CONTROL, StackBase) |
|
| OFFSET (KcActualLimit, KSTACK_CONTROL, ActualLimit) |
|
| OFFSET (KcPreviousBase, KSTACK_CONTROL, Previous.StackBase) |
|
| OFFSET (KcPreviousLimit, KSTACK_CONTROL, Previous.StackLimit) |
|
| OFFSET (KcPreviousKernel, KSTACK_CONTROL, Previous.KernelStack) |
|
| OFFSET (KcPreviousInitial, KSTACK_CONTROL, Previous.InitialStack) |
|
| SIZE (KSTACK_CONTROL_LENGTH, KSTACK_CONTROL) |
|
| CONSTANT (KSTACK_ACTUAL_LIMIT_EXPANDED) |
|
| HEADER ("KSPIN_LOCK_QUEUE") |
|
| OFFSET (LqNext, KSPIN_LOCK_QUEUE, Next) |
|
| OFFSET (LqLock, KSPIN_LOCK_QUEUE, Lock) |
|
| SIZE (LOCK_QUEUE_HEADER_SIZE, KSPIN_LOCK_QUEUE) |
|
| HEADER ("KLOCK_QUEUE_HANDLE") |
|
| OFFSET (LqhLockQueue, KLOCK_QUEUE_HANDLE, LockQueue) |
|
| OFFSET (LqhNext, KLOCK_QUEUE_HANDLE, LockQueue.Next) |
|
| OFFSET (LqhLock, KLOCK_QUEUE_HANDLE, LockQueue.Lock) |
|
| OFFSET (LqhOldIrql, KLOCK_QUEUE_HANDLE, OldIrql) |
|
| HEADER ("LARGE_INTEGER") |
|
| OFFSET (LiLowPart, LARGE_INTEGER, LowPart) |
|
| OFFSET (LiHighPart, LARGE_INTEGER, HighPart) |
|
| HEADER ("LOADER_PARAMETER_BLOCK (rel. to LoadOrderListHead)") |
|
| RELOFFSET (LpbKernelStack, LOADER_PARAMETER_BLOCK, KernelStack, LoadOrderListHead) |
|
| RELOFFSET (LpbPrcb, LOADER_PARAMETER_BLOCK, Prcb, LoadOrderListHead) |
|
| RELOFFSET (LpbProcess, LOADER_PARAMETER_BLOCK, Process, LoadOrderListHead) |
|
| RELOFFSET (LpbThread, LOADER_PARAMETER_BLOCK, Thread, LoadOrderListHead) |
|
| HEADER ("LIST_ENTRY") |
|
| OFFSET (LsFlink, LIST_ENTRY, Flink) |
|
| OFFSET (LsBlink, LIST_ENTRY, Blink) |
|
| HEADER ("PEB") |
|
| OFFSET (PeBeingDebugged, PEB, BeingDebugged) |
|
| OFFSET (PeProcessParameters, PEB, ProcessParameters) |
|
| OFFSET (PeKernelCallbackTable, PEB, KernelCallbackTable) |
|
| SIZE (ProcessEnvironmentBlockLength, PEB) |
|
| HEADER ("KPROFILE") |
|
| OFFSET (PfType, KPROFILE, Type) |
|
| OFFSET (PfSize, KPROFILE, Size) |
|
| OFFSET (PfProfileListEntry, KPROFILE, ProfileListEntry) |
|
| OFFSET (PfProcess, KPROFILE, Process) |
|
| OFFSET (PfRangeBase, KPROFILE, RangeBase) |
|
| OFFSET (PfRangeLimit, KPROFILE, RangeLimit) |
|
| OFFSET (PfBucketShift, KPROFILE, BucketShift) |
|
| OFFSET (PfBuffer, KPROFILE, Buffer) |
|
| OFFSET (PfSegment, KPROFILE, Segment) |
|
| OFFSET (PfAffinity, KPROFILE, Affinity) |
|
| OFFSET (PfSource, KPROFILE, Source) |
|
| OFFSET (PfStarted, KPROFILE, Started) |
|
| SIZE (ProfileObjectLength, KPROFILE) |
|
| HEADER ("PORT_MESSAGE") |
|
| OFFSET (PmLength, PORT_MESSAGE, u1.Length) |
|
| OFFSET (PmZeroInit, PORT_MESSAGE, u2.ZeroInit) |
|
| OFFSET (PmClientId, PORT_MESSAGE, ClientId) |
|
| OFFSET (PmProcess, PORT_MESSAGE, ClientId.UniqueProcess) |
|
| OFFSET (PmThread, PORT_MESSAGE, ClientId.UniqueThread) |
|
| OFFSET (PmMessageId, PORT_MESSAGE, MessageId) |
|
| OFFSET (PmClientViewSize, PORT_MESSAGE, ClientViewSize) |
|
| SIZE (PortMessageLength, PORT_MESSAGE) |
|
| HEADER ("KPROCESS") |
|
| OFFSET (PrType, KPROCESS, Header.Type) |
|
| OFFSET (PrSize, KPROCESS, Header.Size) |
|
| OFFSET (PrSignalState, KPROCESS, Header.SignalState) |
|
| OFFSET (PrProfileListHead, KPROCESS, ProfileListHead) |
|
| OFFSET (PrDirectoryTableBase, KPROCESS, DirectoryTableBase) |
|
| OFFSET (PrThreadListHead, KPROCESS, ThreadListHead) |
|
| OFFSET (PrAffinity, KPROCESS, Affinity) |
|
| OFFSET (PrReadyListHead, KPROCESS, ReadyListHead) |
|
| OFFSET (PrSwapListEntry, KPROCESS, SwapListEntry) |
|
| OFFSET (PrActiveProcessors, KPROCESS, ActiveProcessors) |
|
| OFFSET (PrProcessFlags, KPROCESS, ProcessFlags) |
|
| OFFSET (PrBasePriority, KPROCESS, BasePriority) |
|
| OFFSET (PrQuantumReset, KPROCESS, QuantumReset) |
|
| OFFSET (PrCycleTime, KPROCESS, CycleTime) |
|
| OFFSET (PrKernelTime, KPROCESS, KernelTime) |
|
| OFFSET (PrUserTime, KPROCESS, UserTime) |
|
| SIZE (KernelProcessObjectLength, KPROCESS) |
|
| HEADER ("KQUEUE") |
|
| OFFSET (QuType, KQUEUE, Header.Type) |
|
| OFFSET (QuSize, KQUEUE, Header.Size) |
|
| OFFSET (QuSignalState, KQUEUE, Header.SignalState) |
|
| OFFSET (QuEntryListHead, KQUEUE, EntryListHead) |
|
| OFFSET (QuCurrentCount, KQUEUE, CurrentCount) |
|
| OFFSET (QuMaximumCount, KQUEUE, MaximumCount) |
|
| OFFSET (QuThreadListHead, KQUEUE, ThreadListHead) |
|
| SIZE (QueueObjectLength, KQUEUE) |
|
| HEADER ("KSERVICE_TABLE_DESCRIPTOR offsets") |
|
| OFFSET (SdBase, KSERVICE_TABLE_DESCRIPTOR, Base) |
|
| OFFSET (SdCount, KSERVICE_TABLE_DESCRIPTOR, Count) |
|
| OFFSET (SdLimit, KSERVICE_TABLE_DESCRIPTOR, Limit) |
|
| OFFSET (SdNumber, KSERVICE_TABLE_DESCRIPTOR, Number) |
|
| SIZE (SdLength, KSERVICE_TABLE_DESCRIPTOR) |
|
| HEADER ("STRING") |
|
| OFFSET (StrLength, STRING, Length) |
|
| OFFSET (StrMaximumLength, STRING, MaximumLength) |
|
| OFFSET (StrBuffer, STRING, Buffer) |
|
| HEADER ("TEB") |
|
| OFFSET (TeStackBase, TEB, NtTib.StackBase) |
|
| OFFSET (TeStackLimit, TEB, NtTib.StackLimit) |
|
| OFFSET (TeFiberData, TEB, NtTib.FiberData) |
|
| OFFSET (TeSelf, TEB, NtTib.Self) |
|
| OFFSET (TeEnvironmentPointer, TEB, EnvironmentPointer) |
|
| OFFSET (TeClientId, TEB, ClientId) |
|
| OFFSET (TeActiveRpcHandle, TEB, ActiveRpcHandle) |
|
| OFFSET (TeThreadLocalStoragePointer, TEB, ThreadLocalStoragePointer) |
|
| OFFSET (TePeb, TEB, ProcessEnvironmentBlock) |
|
| OFFSET (TeLastErrorValue, TEB, LastErrorValue) |
|
| OFFSET (TeCountOfOwnedCriticalSections, TEB, CountOfOwnedCriticalSections) |
|
| OFFSET (TeCsrClientThread, TEB, CsrClientThread) |
|
| OFFSET (TeWOW32Reserved, TEB, WOW32Reserved) |
|
| OFFSET (TeExceptionCode, TEB, ExceptionCode) |
|
| OFFSET (TeActivationContextStackPointer, TEB, ActivationContextStackPointer) |
|
| OFFSET (TeGdiClientPID, TEB, GdiClientPID) |
|
| OFFSET (TeGdiClientTID, TEB, GdiClientTID) |
|
| OFFSET (TeGdiThreadLocalInfo, TEB, GdiThreadLocalInfo) |
|
| OFFSET (TeglDispatchTable, TEB, glDispatchTable) |
|
| OFFSET (TeglReserved1, TEB, glReserved1) |
|
| OFFSET (TeglReserved2, TEB, glReserved2) |
|
| OFFSET (TeglSectionInfo, TEB, glSectionInfo) |
|
| OFFSET (TeglSection, TEB, glSection) |
|
| OFFSET (TeglTable, TEB, glTable) |
|
| OFFSET (TeglCurrentRC, TEB, glCurrentRC) |
|
| OFFSET (TeglContext, TEB, glContext) |
|
| OFFSET (TeDeallocationStack, TEB, DeallocationStack) |
|
| OFFSET (TeTlsSlots, TEB, TlsSlots) |
|
| OFFSET (TeVdm, TEB, Vdm) |
|
| OFFSET (TeInstrumentation, TEB, Instrumentation) |
|
| OFFSET (TeGdiBatchCount, TEB, GdiBatchCount) |
|
| OFFSET (TeGuaranteedStackBytes, TEB, GuaranteedStackBytes) |
|
| OFFSET (TeTlsExpansionSlots, TEB, TlsExpansionSlots) |
|
| OFFSET (TeFlsData, TEB, FlsData) |
|
| SIZE (ThreadEnvironmentBlockLength, TEB) |
|
| HEADER ("TIME_FIELDS") |
|
| OFFSET (TfYear, TIME_FIELDS, Year) |
|
| OFFSET (TfMonth, TIME_FIELDS, Month) |
|
| OFFSET (TfDay, TIME_FIELDS, Day) |
|
| OFFSET (TfHour, TIME_FIELDS, Hour) |
|
| OFFSET (TfMinute, TIME_FIELDS, Minute) |
|
| OFFSET (TfSecond, TIME_FIELDS, Second) |
|
| OFFSET (TfMilliseconds, TIME_FIELDS, Milliseconds) |
|
| OFFSET (TfWeekday, TIME_FIELDS, Weekday) |
|
| HEADER ("KTHREAD") |
|
| OFFSET (ThType, KTHREAD, Header.Type) |
|
| OFFSET (ThLock, KTHREAD, Header.Lock) |
|
| OFFSET (ThSize, KTHREAD, Header.Size) |
|
| OFFSET (ThThreadControlFlags, KTHREAD, Header.ThreadControlFlags) |
|
| OFFSET (ThDebugActive, KTHREAD, Header.DebugActive) |
|
| OFFSET (ThSignalState, KTHREAD, Header.SignalState) |
|
| OFFSET (ThInitialStack, KTHREAD, InitialStack) |
|
| OFFSET (ThStackLimit, KTHREAD, StackLimit) |
|
| OFFSET (ThStackBase, KTHREAD, StackBase) |
|
| OFFSET (ThThreadLock, KTHREAD, ThreadLock) |
|
| OFFSET (ThCycleTime, KTHREAD, CycleTime) |
|
| OFFSET (ThKernelStack, KTHREAD, KernelStack) |
|
| OFFSET (ThRunning, KTHREAD, Running) |
|
| OFFSET (ThAlerted, KTHREAD, Alerted) |
|
| OFFSET (ThMiscFlags, KTHREAD, MiscFlags) |
|
| OFFSET (ThThreadFlags, KTHREAD, ThreadFlags) |
|
| OFFSET (ThSystemCallNumber, KTHREAD, SystemCallNumber) |
|
| OFFSET (ThTrapFrame, KTHREAD, TrapFrame) |
|
| OFFSET (ThApcState, KTHREAD, ApcState) |
|
| OFFSET (ThPriority, KTHREAD, Priority) |
|
| OFFSET (ThSwapBusy, KTHREAD, SwapBusy) |
|
| OFFSET (ThContextSwitches, KTHREAD, ContextSwitches) |
|
| OFFSET (ThState, KTHREAD, State) |
|
| OFFSET (ThProcess, KTHREAD, Process) |
|
| OFFSET (ThNpxState, KTHREAD, NpxState) |
|
| OFFSET (ThWaitIrql, KTHREAD, WaitIrql) |
|
| OFFSET (ThWaitMode, KTHREAD, WaitMode) |
|
| OFFSET (ThTeb, KTHREAD, Teb) |
|
| OFFSET (ThTimer, KTHREAD, Timer) |
|
| OFFSET (ThWin32Thread, KTHREAD, Win32Thread) |
|
| OFFSET (ThWaitTime, KTHREAD, WaitTime) |
|
| OFFSET (ThCombinedApcDisable, KTHREAD, CombinedApcDisable) |
|
| OFFSET (ThKernelApcDisable, KTHREAD, KernelApcDisable) |
|
| OFFSET (ThSpecialApcDisable, KTHREAD, SpecialApcDisable) |
|
| OFFSET (ThNextProcessor, KTHREAD, NextProcessor) |
|
| OFFSET (ThPreviousMode, KTHREAD, PreviousMode) |
|
| OFFSET (ThPriorityDecrement, KTHREAD, PriorityDecrement) |
|
| OFFSET (ThAdjustReason, KTHREAD, AdjustReason) |
|
| OFFSET (ThAdjustIncrement, KTHREAD, AdjustIncrement) |
|
| OFFSET (ThAffinity, KTHREAD, Affinity) |
|
| OFFSET (ThApcStateIndex, KTHREAD, ApcStateIndex) |
|
| OFFSET (ThIdealProcessor, KTHREAD, IdealProcessor) |
|
| OFFSET (ThApcStatePointer, KTHREAD, ApcStatePointer) |
|
| OFFSET (ThSavedApcState, KTHREAD, SavedApcState) |
|
| OFFSET (ThWaitReason, KTHREAD, WaitReason) |
|
| OFFSET (ThSaturation, KTHREAD, Saturation) |
|
| OFFSET (ThLegoData, KTHREAD, LegoData) |
|
| SIZE (KernelThreadObjectLength, KTHREAD) |
|
| HEADER ("ETHREAD") |
|
| HEADER ("KTIMER") |
|
| OFFSET (TiType, KTIMER, Header.Type) |
|
| OFFSET (TiSize, KTIMER, Header.Size) |
|
| OFFSET (TiSignalState, KTIMER, Header.SignalState) |
|
| OFFSET (TiDueTime, KTIMER, DueTime) |
|
| OFFSET (TiTimerListEntry, KTIMER, TimerListEntry) |
|
| OFFSET (TiDpc, KTIMER, Dpc) |
|
| OFFSET (TiPeriod, KTIMER, Period) |
|
| SIZE (TimerObjectLength, KTIMER) |
|
| HEADER ("TIME") |
|
| OFFSET (TmLowTime, TIME, LowTime) |
|
| OFFSET (TmHighTime, TIME, HighTime) |
|
| HEADER ("SYSTEM_CONTEXT_SWITCH_INFORMATION (relative to FindAny)") |
|
| RELOFFSET (TwFindAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindAny, FindAny) |
|
| RELOFFSET (TwFindIdeal, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindIdeal, FindAny) |
|
| RELOFFSET (TwFindLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindLast, FindAny) |
|
| RELOFFSET (TwIdleAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleAny, FindAny) |
|
| RELOFFSET (TwIdleCurrent, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleCurrent, FindAny) |
|
| RELOFFSET (TwIdleIdeal, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleIdeal, FindAny) |
|
| RELOFFSET (TwIdleLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleLast, FindAny) |
|
| RELOFFSET (TwPreemptAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptAny, FindAny) |
|
| RELOFFSET (TwPreemptCurrent, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptCurrent, FindAny) |
|
| RELOFFSET (TwPreemptLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptLast, FindAny) |
|
| RELOFFSET (TwSwitchToIdle, SYSTEM_CONTEXT_SWITCH_INFORMATION, SwitchToIdle, FindAny) |
|
| HEADER ("KUSER_SHARED_DATA") |
|
| OFFSET (UsTickCountMultiplier, KUSER_SHARED_DATA, TickCountMultiplier) |
|
| OFFSET (UsInterruptTime, KUSER_SHARED_DATA, InterruptTime) |
|
| OFFSET (UsSystemTime, KUSER_SHARED_DATA, SystemTime) |
|
| OFFSET (UsTimeZoneBias, KUSER_SHARED_DATA, TimeZoneBias) |
|
| OFFSET (UsImageNumberLow, KUSER_SHARED_DATA, ImageNumberLow) |
|
| OFFSET (UsImageNumberHigh, KUSER_SHARED_DATA, ImageNumberHigh) |
|
| OFFSET (UsNtSystemRoot, KUSER_SHARED_DATA, NtSystemRoot) |
|
| OFFSET (UsMaxStackTraceDepth, KUSER_SHARED_DATA, MaxStackTraceDepth) |
|
| OFFSET (UsCryptoExponent, KUSER_SHARED_DATA, CryptoExponent) |
|
| OFFSET (UsTimeZoneId, KUSER_SHARED_DATA, TimeZoneId) |
|
| OFFSET (UsLargePageMinimum, KUSER_SHARED_DATA, LargePageMinimum) |
|
| OFFSET (UsReserved2, KUSER_SHARED_DATA, Reserved2) |
|
| OFFSET (UsNtProductType, KUSER_SHARED_DATA, NtProductType) |
|
| OFFSET (UsProductTypeIsValid, KUSER_SHARED_DATA, ProductTypeIsValid) |
|
| OFFSET (UsNtMajorVersion, KUSER_SHARED_DATA, NtMajorVersion) |
|
| OFFSET (UsNtMinorVersion, KUSER_SHARED_DATA, NtMinorVersion) |
|
| OFFSET (UsProcessorFeatures, KUSER_SHARED_DATA, ProcessorFeatures) |
|
| OFFSET (UsReserved1, KUSER_SHARED_DATA, Reserved1) |
|
| OFFSET (UsReserved3, KUSER_SHARED_DATA, Reserved3) |
|
| OFFSET (UsTimeSlip, KUSER_SHARED_DATA, TimeSlip) |
|
| OFFSET (UsAlternativeArchitecture, KUSER_SHARED_DATA, AlternativeArchitecture) |
|
| OFFSET (UsSystemExpirationDate, KUSER_SHARED_DATA, SystemExpirationDate) |
|
| OFFSET (UsSuiteMask, KUSER_SHARED_DATA, SuiteMask) |
|
| OFFSET (UsKdDebuggerEnabled, KUSER_SHARED_DATA, KdDebuggerEnabled) |
|
| OFFSET (UsActiveConsoleId, KUSER_SHARED_DATA, ActiveConsoleId) |
|
| OFFSET (UsDismountCount, KUSER_SHARED_DATA, DismountCount) |
|
| OFFSET (UsComPlusPackage, KUSER_SHARED_DATA, ComPlusPackage) |
|
| OFFSET (UsLastSystemRITEventTickCount, KUSER_SHARED_DATA, LastSystemRITEventTickCount) |
|
| OFFSET (UsNumberOfPhysicalPages, KUSER_SHARED_DATA, NumberOfPhysicalPages) |
|
| OFFSET (UsSafeBootMode, KUSER_SHARED_DATA, SafeBootMode) |
|
| OFFSET (UsTestRetInstruction, KUSER_SHARED_DATA, TestRetInstruction) |
|
| OFFSET (UsSystemCall, KUSER_SHARED_DATA, SystemCall) |
|
| OFFSET (UsSystemCallReturn, KUSER_SHARED_DATA, SystemCallReturn) |
|
| OFFSET (UsSystemCallPad, KUSER_SHARED_DATA, SystemCallPad) |
|
| OFFSET (UsTickCount, KUSER_SHARED_DATA, TickCount) |
|
| OFFSET (UsTickCountQuad, KUSER_SHARED_DATA, TickCountQuad) |
|
| OFFSET (UsWow64SharedInformation, KUSER_SHARED_DATA, Wow64SharedInformation) |
|
| HEADER ("KWAIT_BLOCK offsets") |
|
| OFFSET (WbWaitListEntry, KWAIT_BLOCK, WaitListEntry) |
|
| OFFSET (WbThread, KWAIT_BLOCK, Thread) |
|
| OFFSET (WbObject, KWAIT_BLOCK, Object) |
|
| OFFSET (WbNextWaitBlock, KWAIT_BLOCK, NextWaitBlock) |
|
| OFFSET (WbWaitKey, KWAIT_BLOCK, WaitKey) |
|
| OFFSET (WbWaitType, KWAIT_BLOCK, WaitType) |
|