60#if defined(_M_IX86) || defined(_M_AMD64)
121#elif defined(_M_IX86)
133#if defined(_M_IX86) && (NTDDI_VERSION < NTDDI_WS03)
140#if (NTDDI_VERSION >= NTDDI_WIN8)
340#if !defined(_M_ARM) && !defined(_M_ARM64)
377HEADER(
"KAPC offsets (relative to NormalRoutine)"),
451#elif defined(_M_AMD64)
525#if (NTDDI_VERSION >= NTDDI_WIN8)
527OFFSET(KcCurrentBase, KSTACK_CONTROL, StackBase),
528OFFSET(KcActualLimit, KSTACK_CONTROL, ActualLimit),
529OFFSET(KcPreviousBase, KSTACK_CONTROL, Previous.StackBase),
530OFFSET(KcPreviousLimit, KSTACK_CONTROL, Previous.StackLimit),
531OFFSET(KcPreviousKernel, KSTACK_CONTROL, Previous.KernelStack),
532OFFSET(KcPreviousInitial, KSTACK_CONTROL, Previous.InitialStack),
534OFFSET(KcTrapFrame, KSTACK_CONTROL, PreviousTrapFrame),
535OFFSET(KcExceptionList, KSTACK_CONTROL, PreviousExceptionList),
537SIZE(KSTACK_CONTROL_LENGTH, KSTACK_CONTROL),
547OFFSET(KnPfnDereferenceSListHead,
KNODE, PfnDereferenceSListHead),
574HEADER(
"LOADER_PARAMETER_BLOCK (rel. to LoadOrderListHead)"),
623#elif defined(_M_IX86)
638#if (NTDDI_VERSION >= NTDDI_LONGHORN)
643#if defined(_M_AMD64) || defined(_M_ARM)
645#elif defined(_M_IX86)
662HEADER(
"KSERVICE_TABLE_DESCRIPTOR offsets"),
676OFFSET(TeExceptionList,
TEB, NtTib.ExceptionList),
677#elif defined(_M_AMD64)
687OFFSET(TeThreadLocalStoragePointer,
TEB, ThreadLocalStoragePointer),
690OFFSET(TeCountOfOwnedCriticalSections,
TEB, CountOfOwnedCriticalSections),
695OFFSET(TeActivationContextStackPointer,
TEB, ActivationContextStackPointer),
717OFFSET(TeGuaranteedStackBytes,
TEB, GuaranteedStackBytes),
743#if (NTDDI_VERSION >= NTDDI_LONGHORN)
755#if (NTDDI_VERSION >= NTDDI_WIN7)
759#if (NTDDI_VERSION >= NTDDI_WIN7)
763#if (NTDDI_VERSION >= NTDDI_LONGHORN)
809#if defined(_M_IX86) || defined(_M_AMD64)
821#if (NTDDI_VERSION < NTDDI_WIN7)
835HEADER(
"SYSTEM_CONTEXT_SWITCH_INFORMATION (relative to FindAny)"),
908CONSTANT(ServiceCpupReturnFromSimulatedCode),
909CONSTANT(X86AMD64_R3_LONG_MODE_CODE),
913HEADER(
"Process mitigation option flags"),
914CONSTANT(PS_MITIGATION_OPTION_BITS_PER_OPTION),
915CONSTANT(PS_MITIGATION_OPTION_ALWAYS_ON),
916CONSTANT(PS_MITIGATION_OPTION_ALWAYS_OFF),
918CONSTANT(PS_MITIGATION_OPTION_RETURN_FLOW_GUARD),
919CONSTANT(PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT),
922HEADER(
"Bounds Callback Status Codes"),
923CONSTANT(BoundExceptionContinueSearch),
928HEADER(
"PS_SYSTEM_DLL_INIT_BLOCK"),
929OFFSET(IbCfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, CfgBitMap),
930OFFSET(IbWow64CfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, Wow64CfgBitMap),
931OFFSET(IbMitigationOptionsMap, PS_SYSTEM_DLL_INIT_BLOCK, MitigationOptionsMap),
933HEADER(
"Extended context"),
934OFFSET(CxxLegacyOffset 0x8),
935OFFSET(CxxLegacyLength 0xc),
936OFFSET(CxxXStateOffset 0x10),
937OFFSET(CxxXStateLength 0x14),
939HEADER(
"Enclave call dispatch frame"),
940OFFSET(EcEnclaveNumber, ???, EnclaveNumber),
941OFFSET(EcParameterAddress, ???, ParameterAddress),
943OFFSET(EcOriginalReturn, ???, OriginalReturn),
944OFFSET(EcFramePointer, ???, FramePointer),
945OFFSET(EcReturnAddress, ???, ReturnAddress),
949OFFSET(HeEnlightenments, ???, Enlightenments),
950OFFSET(HeHypervisorConnected, ???, HypervisorConnected),
951OFFSET(HeEndOfInterrupt, ???, EndOfInterrupt),
952OFFSET(HeApicWriteIcr, ???, ApicWriteIcr),
953OFFSET(HeSpinCountMask, ???, SpinCountMask),
954OFFSET(HeLongSpinWait, ???, LongSpinWait),
957HEADER(
"Processor Descriptor Area"),
959OFFSET(PdaKernelGsBase, ????, ),
962OFFSET(EtwTSLength, ????, ),
963OFFSET(CmThreadEnvironmentBlockOffset, ????, ),
964OFFSET(PbEntropyCount, ????, ),
965OFFSET(PbEntropyBuffer, ????, ),
static SERVICE_TABLE_ENTRYW ServiceTable[2]
static LIST_ENTRY DeviceListHead
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
_In_opt_ PWSTR _In_ PWSTR _Inout_ PULONG ParameterValue
#define STATUS_ILLEGAL_INSTRUCTION
#define STATUS_INVALID_HANDLE
@ ExceptionContinueSearch
@ ExceptionCollidedUnwind
@ ExceptionNestedException
@ ExceptionContinueExecution
#define MAXIMUM_PROCESSORS
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define CONSTANTX(name, value)
#define RELOFFSET(name, struct, member, to)
#define PRIMARY_VECTOR_BASE
#define TLS_EXPANSION_SLOTS
#define EXCEPTION_EXECUTE_HANDLER
#define EXCEPTION_CONTINUE_SEARCH
#define EXCEPTION_CONTINUE_EXECUTION
#define LOW_REALTIME_PRIORITY
static LIST_ENTRY ThreadListHead
CRITICAL_SECTION CriticalSection
BOOLEAN KdDebuggerEnabled
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
_In_ UINT _In_ UINT _In_ PNDIS_PACKET Source
#define DOUBLE_FAULT_STACK_SIZE
#define INITIAL_STALL_COUNT
#define IPI_SYNCH_REQUEST
#define MAXIMUM_IDTVECTOR
#define EXCEPTION_RECORD_LENGTH
#define BREAKPOINT_COMMAND_STRING
#define BREAKPOINT_LOAD_SYMBOLS
#define BREAKPOINT_UNLOAD_SYMBOLS
#define BREAKPOINT_PROMPT
#define DBG_STATUS_CONTROL_C
#define SERVICE_TABLE_SHIFT
#define SERVICE_TABLE_MASK
#define KENTROPY_TIMING_ANALYSIS
#define KI_EXCEPTION_ACCESS_VIOLATION
#define NUMBER_SERVICE_TABLES
#define SERVICE_NUMBER_MASK
#define WAIT_QUANTUM_DECREMENT
#define CLOCK_QUANTUM_DECREMENT
#define SERVICE_TABLE_TEST
#define KENTROPY_TIMING_BUFFER_MASK
#define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER
_Out_writes_bytes_to_opt_ AbsoluteSecurityDescriptorSize PSECURITY_DESCRIPTOR _Inout_ PULONG _Out_writes_bytes_to_opt_ DaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ SaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ OwnerSize PSID Owner
#define EXCEPTION_CHAIN_END
#define CONTEXT_DEBUG_REGISTERS
#define CONTEXT_FLOATING_POINT
_In_ ULONG _In_ ULONG _In_ ULONG Length
UNICODE_STRING NtSystemRoot
_Out_ PKAPC_STATE ApcState
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
#define STATUS_FLOAT_UNDERFLOW
#define STATUS_NO_EVENT_PAIR
#define STATUS_ILLEGAL_FLOAT_CONTEXT
#define STATUS_FLOAT_OVERFLOW
#define STATUS_BAD_COMPRESSION_BUFFER
#define STATUS_FLOAT_STACK_CHECK
#define STATUS_THREAD_IS_TERMINATING
#define STATUS_INSTRUCTION_MISALIGNMENT
#define STATUS_ARRAY_BOUNDS_EXCEEDED
#define STATUS_ASSERTION_FAILURE
#define STATUS_CALLBACK_POP_STACK
#define STATUS_KERNEL_APC
#define STATUS_STACK_OVERFLOW
#define STATUS_NO_CALLBACK_ACTIVE
#define STATUS_SINGLE_STEP
#define STATUS_UNWIND_CONSOLIDATE
#define STATUS_FLOAT_DIVIDE_BY_ZERO
#define STATUS_FLOAT_MULTIPLE_FAULTS
#define STATUS_PRIVILEGED_INSTRUCTION
#define STATUS_WAKE_SYSTEM
#define STATUS_BREAKPOINT
#define STATUS_FLOAT_MULTIPLE_TRAPS
#define STATUS_ACCESS_VIOLATION
#define STATUS_INVALID_SYSTEM_SERVICE
#define STATUS_FLOAT_INVALID_OPERATION
#define STATUS_IN_PAGE_ERROR
#define STATUS_FLOAT_INEXACT_RESULT
#define STATUS_FLOAT_DENORMAL_OPERAND
#define STATUS_DATATYPE_MISALIGNMENT
#define STATUS_STACK_BUFFER_OVERRUN
#define STATUS_GUARD_PAGE_VIOLATION
#define STATUS_INVALID_PARAMETER_1
#define STATUS_INTEGER_OVERFLOW
#define STATUS_INTEGER_DIVIDE_BY_ZERO
#define STATUS_WAKE_SYSTEM_DEBUGGER
#define STATUS_INVALID_LOCK_SEQUENCE
#define STATUS_INVALID_OWNER
#define KERNEL_LARGE_STACK_SIZE
#define KERNEL_MCA_EXCEPTION_STACK_SIZE
#define KERNEL_STACK_SIZE
#define KERNEL_LARGE_STACK_COMMIT
#define TLS_MINIMUM_AVAILABLE
#define EXCEPTION_NONCONTINUABLE
#define STATUS_INVALID_PARAMETER
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_In_ WDFDMATRANSACTION _In_ size_t MaximumLength
_Must_inspect_result_ _In_ PWDF_DPC_CONFIG _In_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFDPC * Dpc
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
_In_ WDFREQUEST _In_ NTSTATUS _In_ ULONG_PTR Information
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFSPINLOCK * SpinLock
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFWAITLOCK * Lock
_In_ WDFTIMER _In_ LONGLONG DueTime
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD OwningThread
_Must_inspect_result_ _In_ ULONG Flags
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
_In_ PKSERVICE_ROUTINE ServiceRoutine
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL SynchronizeIrql
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL _In_ KINTERRUPT_MODE _In_ BOOLEAN _In_ KAFFINITY _In_ BOOLEAN FloatingSave
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL _In_ KINTERRUPT_MODE _In_ BOOLEAN ShareVector
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID ServiceContext
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
_In_ KDPC_IMPORTANCE Importance
_In_ LARGE_INTEGER _In_ ULONG Period
_Inout_ PKDEVICE_QUEUE_ENTRY _In_ ULONG SortKey
*Count PHARDWARE_COUNTER _In_ ULONG MaximumCount
_In_ LONG _In_ LONG Limit
_Out_ PCLIENT_ID ClientId
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_opt_ PVOID DeferredContext
@ LockQueueDispatcherLock
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
#define FAST_FAIL_GUARD_ICALL_CHECK_FAILURE
#define FAST_FAIL_INVALID_JUMP_BUFFER
#define FAST_FAIL_INVALID_SET_OF_CONTEXT
#define EXCEPTION_EXIT_UNWIND
#define EXCEPTION_NESTED_CALL
#define EXCEPTION_STACK_INVALID
#define EXCEPTION_UNWINDING
#define EXCEPTION_TARGET_UNWIND
#define EXCEPTION_COLLIDED_UNWIND
_In_ KPROCESSOR_MODE PreviousMode