ReactOS  0.4.15-dev-2487-g7b27e7c
ksx.template.h
Go to the documentation of this file.
1 
2 
3 HEADER("Pointer size"),
4 SIZE(SizeofPointer, PVOID),
5 
6 HEADER("Bug Check Codes"),
7 CONSTANT(APC_INDEX_MISMATCH),
8 CONSTANT(INVALID_AFFINITY_SET),
9 CONSTANT(INVALID_DATA_ACCESS_TRAP),
10 CONSTANT(IRQL_NOT_GREATER_OR_EQUAL),
11 CONSTANT(IRQL_NOT_LESS_OR_EQUAL), // 0x0a
12 CONSTANT(NO_USER_MODE_CONTEXT), // 0x0e
13 CONSTANT(SPIN_LOCK_ALREADY_OWNED), // 0x0f
14 CONSTANT(SPIN_LOCK_NOT_OWNED), // 0x10
15 CONSTANT(THREAD_NOT_MUTEX_OWNER), // 0x11
16 CONSTANT(TRAP_CAUSE_UNKNOWN), // 0x12
17 CONSTANT(KMODE_EXCEPTION_NOT_HANDLED), // 0x1e
18 CONSTANT(KERNEL_APC_PENDING_DURING_EXIT), // 0x20
19 CONSTANT(PANIC_STACK_SWITCH), // 0x2b
20 CONSTANT(DATA_BUS_ERROR), // 0x2e
21 CONSTANT(INSTRUCTION_BUS_ERROR), // 0x2f
22 CONSTANT(SYSTEM_EXIT_OWNED_MUTEX), // 0x39
23 //CONSTANT(SYSTEM_UNWIND_PREVIOUS_USER), // 0x3a
24 //CONSTANT(SYSTEM_SERVICE_EXCEPTION), // 0x3b
25 //CONSTANT(INTERRUPT_UNWIND_ATTEMPTED), // 0x3c
26 //CONSTANT(INTERRUPT_EXCEPTION_NOT_HANDLED), // 0x3d
27 CONSTANT(PAGE_FAULT_WITH_INTERRUPTS_OFF), // 0x49
28 CONSTANT(IRQL_GT_ZERO_AT_SYSTEM_SERVICE), // 0x4a
29 CONSTANT(DATA_COHERENCY_EXCEPTION), // 0x55
30 CONSTANT(INSTRUCTION_COHERENCY_EXCEPTION), // 0x56
31 CONSTANT(HAL1_INITIALIZATION_FAILED), // 0x61
32 CONSTANT(UNEXPECTED_KERNEL_MODE_TRAP), // 0x7f
33 CONSTANT(NMI_HARDWARE_FAILURE), // 0x80
34 CONSTANT(SPIN_LOCK_INIT_FAILURE), // 0x81
35 CONSTANT(ATTEMPTED_SWITCH_FROM_DPC), // 0xb8
36 //CONSTANT(MUTEX_ALREADY_OWNED), // 0xbf
37 //CONSTANT(HARDWARE_INTERRUPT_STORM), // 0xf2
38 //CONSTANT(RECURSIVE_MACHINE_CHECK), // 0xfb
39 //CONSTANT(RECURSIVE_NMI), // 0x111
40 CONSTANT(KERNEL_SECURITY_CHECK_FAILURE), // 0x139
41 //CONSTANT(UNSUPPORTED_INSTRUCTION_MODE), // 0x151
42 //CONSTANT(BUGCHECK_CONTEXT_MODIFIER), // 0x80000000
43 //CONSTANT(INVALID_CALLBACK_STACK_ADDRESS),
44 //CONSTANT(INVALID_KERNEL_STACK_ADDRESS),
45 
46 HEADER("Breakpoints"),
53 
54 HEADER("Context Frame Flags"),
60 #if defined(_M_IX86) || defined(_M_AMD64)
62 #endif
63 
64 HEADER("Exception flags"),
76 #ifdef _X86_
78 //CONSTANT(FIXED_NTVDMSTATE_LINEAR), /// FIXME ???
79 #endif
80 
81 HEADER("Exception types"),
86 
87 HEADER("Fast Fail Constants"),
89 //CONSTANT(FAST_FAIL_INVALID_BUFFER_ACCESS),
90 #ifdef _M_ASM64
93 #endif // _M_ASM64
94 //CONSTANT(FAST_FAIL_INVALID_NEXT_THREAD),
95 //CONSTANT(FAST_FAIL_INVALID_CONTROL_STACK),
96 //CONSTANT(FAST_FAIL_SET_CONTEXT_DENIED),
97 //CONSTANT(FAST_FAIL_ENCLAVE_CALL_FAILURE),
98 //CONSTANT(FAST_FAIL_GUARD_SS_FAILURE),
99 
100 HEADER("Interrupt object types"),
101 CONSTANTX(InLevelSensitive, LevelSensitive),
102 CONSTANTX(InLatched, Latched),
103 
104 HEADER("IPI"),
105 #ifndef _M_AMD64
110 #endif // _M_AMD64
111 #ifdef _M_IX86
113 #endif // _M_IX86
114 
115 HEADER("IRQL"),
119 #ifdef _M_AMD64
121 #elif defined(_M_IX86)
124 #endif
129 RAW("#ifdef NT_UP"),
130 {TYPE_CONSTANT, "SYNCH_LEVEL", DISPATCH_LEVEL},
131 RAW("#else"),
132 {TYPE_CONSTANT, "SYNCH_LEVEL", (IPI_LEVEL - 2)},
133 RAW("#endif"),
134 
135 #if (NTDDI_VERSION >= NTDDI_WIN8)
136 HEADER("Entropy Timing Constants"),
140 #endif
141 
142 HEADER("Lock Queue"),
146 
147 //HEADER("Performance Definitions"),
148 //CONSTANT(PERF_CONTEXTSWAP_OFFSET),
149 //CONSTANT(PERF_CONTEXTSWAP_FLAG),
150 //CONSTANT(PERF_INTERRUPT_OFFSET),
151 //CONSTANT(PERF_INTERRUPT_FLAG),
152 //CONSTANT(PERF_SYSCALL_OFFSET),
153 //CONSTANT(PERF_SYSCALL_FLAG),
154 #ifndef _M_ARM
155 //CONSTANT(PERF_PROFILE_OFFSET), /// FIXE: obsolete
156 //CONSTANT(PERF_PROFILE_FLAG), /// FIXE: obsolete
157 //CONSTANT(PERF_SPINLOCK_OFFSET), /// FIXE: obsolete
158 //CONSTANT(PERF_SPINLOCK_FLAG), /// FIXE: obsolete
159 #endif
160 #ifdef _M_IX86
161 //CONSTANT(PERF_IPI_OFFSET), // 00008H
162 //CONSTANT(PERF_IPI_FLAG), // 0400000H
163 //CONSTANT(PERF_IPI), // 040400000H
164 #endif
165 //CONSTANT(PERF_INTERRUPT), // 020004000H//CONSTANT(NTOS_YIELD_MACRO),
166 
167 HEADER("Process states"),
171 
172 HEADER("Processor mode"),
175 
176 HEADER("Service Table Constants"),
182 
183 HEADER("Status codes"),
210 //CONSTANT(STATUS_INVALID_THREAD),
217 #ifndef _M_ARM
219 #endif
232 //CONSTANT(STATUS_SET_CONTEXT_DENIED),
233 
234 //HEADER("Thread flags"),
235 //CONSTANT(THREAD_FLAGS_CYCLE_PROFILING),
236 //CONSTANT(THREAD_FLAGS_CYCLE_PROFILING_LOCK_BIT),
237 //CONSTANT(THREAD_FLAGS_CYCLE_PROFILING_LOCK),
238 //CONSTANT(THREAD_FLAGS_COUNTER_PROFILING),
239 //CONSTANT(THREAD_FLAGS_COUNTER_PROFILING_LOCK_BIT),
240 //CONSTANT(THREAD_FLAGS_COUNTER_PROFILING_LOCK),
241 //CONSTANT(THREAD_FLAGS_CPU_THROTTLED), /// FIXME: obsolete
242 //CONSTANT(THREAD_FLAGS_CPU_THROTTLED_BIT), /// FIXME: obsolete
243 //CONSTANT(THREAD_FLAGS_ACCOUNTING_CSWITCH),
244 //CONSTANT(THREAD_FLAGS_ACCOUNTING_INTERRUPT),
245 //CONSTANT(THREAD_FLAGS_ACCOUNTING_ANY),
246 //CONSTANT(THREAD_FLAGS_GROUP_SCHEDULING),
247 //CONSTANT(THREAD_FLAGS_AFFINITY_SET),
248 #ifdef _M_IX86
249 //CONSTANT(THREAD_FLAGS_INSTRUMENTED), // 0x0040
250 //CONSTANT(THREAD_FLAGS_INSTRUMENTED_PROFILING), // 0x0041
251 #endif // _M_IX86
252 
253 HEADER("TLS defines"),
256 
257 HEADER("Thread states"),
259 CONSTANT(Ready),
264 #ifdef _M_ARM
267 //CONSTANT(GateWaitObsolete),
268 #endif // _M_ARM
269 
270 HEADER("Wait type / reason"),
272 CONSTANT(WrMutex),
278 
279 HEADER("Stack sizes"),
283 //CONSTANT(DOUBLE_FAULT_STACK_SIZE),
284 #ifdef _M_AMD64
288 #endif
289 
290 //CONSTANT(KTHREAD_AUTO_ALIGNMENT_BIT),
291 //CONSTANT(KTHREAD_GUI_THREAD_MASK),
292 //CONSTANT(KTHREAD_SYSTEM_THREAD_BIT),
293 //CONSTANT(KTHREAD_QUEUE_DEFER_PREEMPTION_BIT),
294 //CONSTANT(KTHREAD_RESTRICTED_GUI_THREAD_MASK),
295 //CONSTANT(KTHREAD_BAM_QOS_LEVEL_MASK),
296 
297 HEADER("Miscellaneous Definitions"),
298 CONSTANT(TRUE),
299 CONSTANT(FALSE),
302 //CONSTANT(BASE_PRIORITY_THRESHOLD),
303 //CONSTANT(EVENT_PAIR_INCREMENT), /// FIXME: obsolete
306 //CONSTANT(READY_SKIP_QUANTUM),
307 //CONSTANT(THREAD_QUANTUM),
309 //CONSTANT(ROUND_TRIP_DECREMENT_COUNT),
312 //CONSTANT(EXCEPTION_EXECUTE_FAULT), // amd64
313 //CONSTANT(KCACHE_ERRATA_MONITOR_FLAGS), // not arm
314 //CONSTANT(KI_DPC_ALL_FLAGS),
315 //CONSTANT(KI_DPC_ANY_DPC_ACTIVE),
316 //CONSTANT(KI_DPC_INTERRUPT_FLAGS), // 0x2f arm and x64
317 //CONSTANT(KI_EXCEPTION_GP_FAULT), // not i386
318 //CONSTANT(KI_EXCEPTION_INVALID_OP), // not i386
319 //CONSTANT(KI_EXCEPTION_INTEGER_DIVIDE_BY_ZERO), // amd64
321 //CONSTANT(KI_EXCEPTION_SECURE_FAULT),
322 //CONSTANT(KI_EXCEPTION_SEGMENT_NOT_PRESENT),
323 //CONSTANT(KINTERRUPT_STATE_DISABLED_BIT),
324 //CONSTANT(KINTERRUPT_STATE_DISABLED),
325 //CONSTANT(TARGET_FREEZE), // amd64
326 //CONSTANT(BlackHole), // FIXME: obsolete
328 //CONSTANTPTR(USER_SHARED_DATA), // FIXME: we need the kernel mode address here!
329 //CONSTANT(MM_SHARED_USER_DATA_VA),
330 //CONSTANT(KERNEL_STACK_CONTROL_LARGE_STACK), // FIXME: obsolete
331 //CONSTANT(DISPATCH_LENGTH), // FIXME: obsolete
332 //CONSTANT(KI_SLIST_FAULT_COUNT_MAXIMUM), // i386
333 //CONSTANTUSER_CALLBACK_FILTER),
334 
335 #ifndef _M_ARM
337 //CONSTANT(MAXIMUM_PRIMARY_VECTOR),
341 //MODE_BIT equ 00000H amd64
342 //LDT_MASK equ 00004H amd64
343 #endif
344 
345 
346 /* STRUCTURE OFFSETS *********************************************************/
347 
348 //HEADER("KAFFINITY_EX"),
349 //OFFSET(AfCount, KAFFINITY_EX, Count),
350 //OFFSET(AfBitmap, KAFFINITY_EX, Bitmap),
351 //SIZE(AffinityExLength, KAFFINITY_EX),
352 
353 //HEADER("Aligned Affinity"),
354 //OFFSET(AfsCpuSet, ???, CpuSet), // FIXME: obsolete
355 
356 HEADER("KAPC"),
357 OFFSET(ApType, KAPC, Type),
358 OFFSET(ApSize, KAPC, Size),
359 OFFSET(ApThread, KAPC, Thread),
360 OFFSET(ApApcListEntry, KAPC, ApcListEntry),
361 OFFSET(ApKernelRoutine, KAPC, KernelRoutine),
362 OFFSET(ApRundownRoutine, KAPC, RundownRoutine),
363 OFFSET(ApNormalRoutine, KAPC, NormalRoutine),
364 OFFSET(ApNormalContext, KAPC, NormalContext),
365 OFFSET(ApSystemArgument1, KAPC, SystemArgument1),
366 OFFSET(ApSystemArgument2, KAPC, SystemArgument2),
367 OFFSET(ApApcStateIndex, KAPC, ApcStateIndex),
368 OFFSET(ApApcMode, KAPC, ApcMode),
369 OFFSET(ApInserted, KAPC, Inserted),
370 SIZE(ApcObjectLength, KAPC),
371 
372 HEADER("KAPC offsets (relative to NormalRoutine)"),
373 RELOFFSET(ArNormalRoutine, KAPC, NormalRoutine, NormalRoutine),
374 RELOFFSET(ArNormalContext, KAPC, NormalContext, NormalRoutine),
375 RELOFFSET(ArSystemArgument1, KAPC, SystemArgument1, NormalRoutine),
376 RELOFFSET(ArSystemArgument2, KAPC, SystemArgument2, NormalRoutine),
377 CONSTANTX(ApcRecordLength, 4 * sizeof(PVOID)),
378 
379 HEADER("KAPC_STATE"),
380 OFFSET(AsApcListHead, KAPC_STATE, ApcListHead),
381 OFFSET(AsProcess, KAPC_STATE, Process),
382 OFFSET(AsKernelApcInProgress, KAPC_STATE, KernelApcInProgress), // FIXME: obsolete
383 OFFSET(AsKernelApcPending, KAPC_STATE, KernelApcPending),
384 OFFSET(AsUserApcPending, KAPC_STATE, UserApcPending),
385 
386 HEADER("CLIENT_ID"),
387 OFFSET(CidUniqueProcess, CLIENT_ID, UniqueProcess),
388 OFFSET(CidUniqueThread, CLIENT_ID, UniqueThread),
389 
390 HEADER("RTL_CRITICAL_SECTION"), // No longer in Win 10 amd64
391 OFFSET(CsDebugInfo, RTL_CRITICAL_SECTION, DebugInfo),
392 OFFSET(CsLockCount, RTL_CRITICAL_SECTION, LockCount),
393 OFFSET(CsRecursionCount, RTL_CRITICAL_SECTION, RecursionCount),
394 OFFSET(CsOwningThread, RTL_CRITICAL_SECTION, OwningThread),
395 OFFSET(CsLockSemaphore, RTL_CRITICAL_SECTION, LockSemaphore),
396 OFFSET(CsSpinCount, RTL_CRITICAL_SECTION, SpinCount),
397 
398 HEADER("RTL_CRITICAL_SECTION_DEBUG"), // No longer in Win 10 amd64
400 OFFSET(CsCreatorBackTraceIndex, RTL_CRITICAL_SECTION_DEBUG, CreatorBackTraceIndex),
402 OFFSET(CsProcessLocksList, RTL_CRITICAL_SECTION_DEBUG, ProcessLocksList),
403 OFFSET(CsEntryCount, RTL_CRITICAL_SECTION_DEBUG, EntryCount),
404 OFFSET(CsContentionCount, RTL_CRITICAL_SECTION_DEBUG, ContentionCount),
405 
406 HEADER("KDEVICE_QUEUE_ENTRY"),
407 OFFSET(DeDeviceListEntry, KDEVICE_QUEUE_ENTRY, DeviceListEntry),
408 OFFSET(DeSortKey, KDEVICE_QUEUE_ENTRY, SortKey),
409 OFFSET(DeInserted, KDEVICE_QUEUE_ENTRY, Inserted),
410 SIZE(DeviceQueueEntryLength, KDEVICE_QUEUE_ENTRY),
411 
412 HEADER("KDPC"),
413 OFFSET(DpType, KDPC, Type),
414 OFFSET(DpImportance, KDPC, Importance),
415 OFFSET(DpNumber, KDPC, Number),
416 OFFSET(DpDpcListEntry, KDPC, DpcListEntry),
417 OFFSET(DpDeferredRoutine, KDPC, DeferredRoutine),
418 OFFSET(DpDeferredContext, KDPC, DeferredContext),
419 OFFSET(DpSystemArgument1, KDPC, SystemArgument1),
420 OFFSET(DpSystemArgument2, KDPC, SystemArgument2),
421 OFFSET(DpDpcData, KDPC, DpcData),
422 SIZE(DpcObjectLength, KDPC),
423 
424 HEADER("KDEVICE_QUEUE"),
425 OFFSET(DvType, KDEVICE_QUEUE, Type),
426 OFFSET(DvSize, KDEVICE_QUEUE, Size),
427 OFFSET(DvDeviceListHead, KDEVICE_QUEUE, DeviceListHead),
428 OFFSET(DvSpinLock, KDEVICE_QUEUE, Lock),
429 OFFSET(DvBusy, KDEVICE_QUEUE, Busy),
430 SIZE(DeviceQueueObjectLength, KDEVICE_QUEUE),
431 
432 HEADER("EXCEPTION_RECORD"),
433 OFFSET(ErExceptionCode, EXCEPTION_RECORD, ExceptionCode),
434 OFFSET(ErExceptionFlags, EXCEPTION_RECORD, ExceptionFlags),
435 OFFSET(ErExceptionRecord, EXCEPTION_RECORD, ExceptionRecord),
436 OFFSET(ErExceptionAddress, EXCEPTION_RECORD, ExceptionAddress),
437 OFFSET(ErNumberParameters, EXCEPTION_RECORD, NumberParameters),
438 OFFSET(ErExceptionInformation, EXCEPTION_RECORD, ExceptionInformation),
439 SIZE(ExceptionRecordLength, EXCEPTION_RECORD),
441 
442 HEADER("EPROCESS"),
443 OFFSET(EpDebugPort, EPROCESS, DebugPort),
444 #if defined(_M_IX86)
445 OFFSET(EpVdmObjects, EPROCESS, VdmObjects),
446 #elif defined(_M_AMD64)
447 OFFSET(EpWow64Process, EPROCESS, Wow64Process),
448 #endif
449 SIZE(ExecutiveProcessObjectLength, EPROCESS),
450 
451 HEADER("ETHREAD offsets"),
452 OFFSET(EtCid, ETHREAD, Cid), // 0x364
453 //OFFSET(EtPicoContext, ETHREAD, PicoContext),
454 SIZE(ExecutiveThreadObjectLength, ETHREAD), // 0x418
455 
456 HEADER("KEVENT"),
457 OFFSET(EvType, KEVENT, Header.Type),
458 OFFSET(EvSize, KEVENT, Header.Size),
459 OFFSET(EvSignalState, KEVENT, Header.SignalState),
460 OFFSET(EvWaitListHead, KEVENT, Header.WaitListHead),
461 SIZE(EventObjectLength, KEVENT),
462 
463 HEADER("FIBER"),
464 OFFSET(FbFiberData, FIBER, FiberData),
465 OFFSET(FbExceptionList, FIBER, ExceptionList),
466 OFFSET(FbStackBase, FIBER, StackBase),
467 OFFSET(FbStackLimit, FIBER, StackLimit),
468 OFFSET(FbDeallocationStack, FIBER, DeallocationStack),
469 OFFSET(FbFiberContext, FIBER, FiberContext),
470 //OFFSET(FbWx86Tib, FIBER, Wx86Tib),
471 //OFFSET(FbActivationContextStackPointer, FIBER, ActivationContextStackPointer),
472 OFFSET(FbFlsData, FIBER, FlsData),
473 OFFSET(FbGuaranteedStackBytes, FIBER, GuaranteedStackBytes),
474 //OFFSET(FbTebFlags, FIBER, TebFlags),
475 
476 HEADER("FAST_MUTEX"),
477 OFFSET(FmCount, FAST_MUTEX, Count),
478 OFFSET(FmOwner, FAST_MUTEX, Owner),
479 OFFSET(FmContention, FAST_MUTEX, Contention),
480 //OFFSET(FmGate, FAST_MUTEX, Gate), // obsolete
481 OFFSET(FmOldIrql, FAST_MUTEX, OldIrql),
482 
483 #ifndef _M_ARM
484 HEADER("GETSETCONTEXT offsets"), // GET_SET_CTX_CONTEXT
485 OFFSET(GetSetCtxContextPtr, GETSETCONTEXT, Context),
486 #endif // _M_ARM
487 
488 HEADER("KINTERRUPT"),
489 OFFSET(InType, KINTERRUPT, Type),
490 OFFSET(InSize, KINTERRUPT, Size),
491 OFFSET(InInterruptListEntry, KINTERRUPT, InterruptListEntry),
492 OFFSET(InServiceRoutine, KINTERRUPT, ServiceRoutine),
493 OFFSET(InServiceContext, KINTERRUPT, ServiceContext),
494 OFFSET(InSpinLock, KINTERRUPT, SpinLock),
495 OFFSET(InTickCount, KINTERRUPT, TickCount),
496 OFFSET(InActualLock, KINTERRUPT, ActualLock),
497 OFFSET(InDispatchAddress, KINTERRUPT, DispatchAddress),
498 OFFSET(InVector, KINTERRUPT, Vector),
499 OFFSET(InIrql, KINTERRUPT, Irql),
500 OFFSET(InSynchronizeIrql, KINTERRUPT, SynchronizeIrql),
501 OFFSET(InFloatingSave, KINTERRUPT, FloatingSave),
502 OFFSET(InConnected, KINTERRUPT, Connected),
503 OFFSET(InNumber, KINTERRUPT, Number),
504 OFFSET(InShareVector, KINTERRUPT, ShareVector),
505 //OFFSET(InInternalState, KINTERRUPT, InternalState),
506 OFFSET(InMode, KINTERRUPT, Mode),
507 OFFSET(InServiceCount, KINTERRUPT, ServiceCount),
508 OFFSET(InDispatchCount, KINTERRUPT, DispatchCount),
509 //OFFSET(InTrapFrame, KINTERRUPT, TrapFrame), // amd64
510 OFFSET(InDispatchCode, KINTERRUPT, DispatchCode), // obsolete
511 SIZE(InterruptObjectLength, KINTERRUPT),
512 
513 #ifdef _M_AMD64
514 HEADER("IO_STATUS_BLOCK"),
516 OFFSET(IoPointer, IO_STATUS_BLOCK, Pointer),
517 OFFSET(IoInformation, IO_STATUS_BLOCK, Information),
518 #endif /* _M_AMD64 */
519 
520 #if (NTDDI_VERSION >= NTDDI_WIN8)
521 HEADER("KSTACK_CONTROL"),
522 OFFSET(KcCurrentBase, KSTACK_CONTROL, StackBase),
523 OFFSET(KcActualLimit, KSTACK_CONTROL, ActualLimit),
524 OFFSET(KcPreviousBase, KSTACK_CONTROL, Previous.StackBase),
525 OFFSET(KcPreviousLimit, KSTACK_CONTROL, Previous.StackLimit),
526 OFFSET(KcPreviousKernel, KSTACK_CONTROL, Previous.KernelStack),
527 OFFSET(KcPreviousInitial, KSTACK_CONTROL, Previous.InitialStack),
528 #ifdef _IX86
529 OFFSET(KcTrapFrame, KSTACK_CONTROL, PreviousTrapFrame),
530 OFFSET(KcExceptionList, KSTACK_CONTROL, PreviousExceptionList),
531 #endif // _IX86
532 SIZE(KSTACK_CONTROL_LENGTH, KSTACK_CONTROL),
533 CONSTANT(KSTACK_ACTUAL_LIMIT_EXPANDED), // move somewhere else?
534 #else
535 //HEADER("KERNEL_STACK_CONTROL"), // obsolete
536 #endif
537 
538 #if 0 // no longer in win 10, different struct
539 HEADER("KNODE"),
540 //OFFSET(KnRight, KNODE, Right),
541 //OFFSET(KnLeft, KNODE, Left),
542 OFFSET(KnPfnDereferenceSListHead, KNODE, PfnDereferenceSListHead),
543 OFFSET(KnProcessorMask, KNODE, ProcessorMask),
544 OFFSET(KnColor, KNODE, Color),
545 OFFSET(KnSeed, KNODE, Seed),
546 OFFSET(KnNodeNumber, KNODE, NodeNumber),
547 OFFSET(KnFlags, KNODE, Flags),
548 OFFSET(KnMmShiftedColor, KNODE, MmShiftedColor),
549 OFFSET(KnFreeCount, KNODE, FreeCount),
550 OFFSET(KnPfnDeferredList, KNODE, PfnDeferredList),
551 SIZE(KNODE_SIZE, KNODE),
552 #endif
553 
554 HEADER("KSPIN_LOCK_QUEUE"),
555 OFFSET(LqNext, KSPIN_LOCK_QUEUE, Next),
556 OFFSET(LqLock, KSPIN_LOCK_QUEUE, Lock),
557 SIZE(LOCK_QUEUE_HEADER_SIZE, KSPIN_LOCK_QUEUE),
558 
559 HEADER("KLOCK_QUEUE_HANDLE"),
560 OFFSET(LqhLockQueue, KLOCK_QUEUE_HANDLE, LockQueue),
561 OFFSET(LqhNext, KLOCK_QUEUE_HANDLE, LockQueue.Next),
562 OFFSET(LqhLock, KLOCK_QUEUE_HANDLE, LockQueue.Lock),
563 OFFSET(LqhOldIrql, KLOCK_QUEUE_HANDLE, OldIrql),
564 
565 HEADER("LARGE_INTEGER"),
566 OFFSET(LiLowPart, LARGE_INTEGER, LowPart),
567 OFFSET(LiHighPart, LARGE_INTEGER, HighPart),
568 
569 HEADER("LOADER_PARAMETER_BLOCK (rel. to LoadOrderListHead)"),
570 RELOFFSET(LpbKernelStack, LOADER_PARAMETER_BLOCK, KernelStack, LoadOrderListHead),
571 RELOFFSET(LpbPrcb, LOADER_PARAMETER_BLOCK, Prcb, LoadOrderListHead),
572 RELOFFSET(LpbProcess, LOADER_PARAMETER_BLOCK, Process, LoadOrderListHead),
573 RELOFFSET(LpbThread, LOADER_PARAMETER_BLOCK, Thread, LoadOrderListHead),
574 
575 HEADER("LIST_ENTRY"),
576 OFFSET(LsFlink, LIST_ENTRY, Flink),
577 OFFSET(LsBlink, LIST_ENTRY, Blink),
578 
579 HEADER("PEB"),
580 OFFSET(PeBeingDebugged, PEB, BeingDebugged),
581 OFFSET(PeProcessParameters, PEB, ProcessParameters),
582 OFFSET(PeKernelCallbackTable, PEB, KernelCallbackTable),
583 SIZE(ProcessEnvironmentBlockLength, PEB),
584 
585 HEADER("KPROFILE"),
586 OFFSET(PfType, KPROFILE, Type),
587 OFFSET(PfSize, KPROFILE, Size),
588 OFFSET(PfProfileListEntry, KPROFILE, ProfileListEntry),
589 OFFSET(PfProcess, KPROFILE, Process),
590 OFFSET(PfRangeBase, KPROFILE, RangeBase),
591 OFFSET(PfRangeLimit, KPROFILE, RangeLimit),
592 OFFSET(PfBucketShift, KPROFILE, BucketShift),
593 OFFSET(PfBuffer, KPROFILE, Buffer),
594 OFFSET(PfSegment, KPROFILE, Segment),
595 OFFSET(PfAffinity, KPROFILE, Affinity),
596 OFFSET(PfSource, KPROFILE, Source),
597 OFFSET(PfStarted, KPROFILE, Started),
598 SIZE(ProfileObjectLength, KPROFILE),
599 
600 HEADER("PORT_MESSAGE"), // whole thing obsolete in win10
601 OFFSET(PmLength, PORT_MESSAGE, u1.Length),
602 OFFSET(PmZeroInit, PORT_MESSAGE, u2.ZeroInit),
603 OFFSET(PmClientId, PORT_MESSAGE, ClientId),
606 OFFSET(PmMessageId, PORT_MESSAGE, MessageId),
607 OFFSET(PmClientViewSize, PORT_MESSAGE, ClientViewSize),
608 SIZE(PortMessageLength, PORT_MESSAGE),
609 
610 HEADER("KPROCESS"),
611 OFFSET(PrType, KPROCESS, Header.Type),
612 OFFSET(PrSize, KPROCESS, Header.Size),
613 OFFSET(PrSignalState, KPROCESS, Header.SignalState),
614 OFFSET(PrProfileListHead, KPROCESS, ProfileListHead),
615 OFFSET(PrDirectoryTableBase, KPROCESS, DirectoryTableBase),
616 #ifdef _M_ARM
617 //OFFSET(PrPageDirectory, KPROCESS, PageDirectory),
618 #elif defined(_M_IX86)
619 OFFSET(PrLdtDescriptor, KPROCESS, LdtDescriptor),
620 OFFSET(PrInt21Descriptor, KPROCESS, Int21Descriptor),
621 #endif
622 OFFSET(PrThreadListHead, KPROCESS, ThreadListHead),
623 OFFSET(PrAffinity, KPROCESS, Affinity),
624 OFFSET(PrReadyListHead, KPROCESS, ReadyListHead),
625 OFFSET(PrSwapListEntry, KPROCESS, SwapListEntry),
626 OFFSET(PrActiveProcessors, KPROCESS, ActiveProcessors),
627 OFFSET(PrProcessFlags, KPROCESS, ProcessFlags),
628 OFFSET(PrBasePriority, KPROCESS, BasePriority),
629 OFFSET(PrQuantumReset, KPROCESS, QuantumReset),
630 #if defined(_M_IX86)
631 OFFSET(PrIopmOffset, KPROCESS, IopmOffset),
632 #endif
633 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
634 OFFSET(PrCycleTime, KPROCESS, CycleTime),
635 #endif
636 OFFSET(PrKernelTime, KPROCESS, KernelTime),
637 OFFSET(PrUserTime, KPROCESS, UserTime),
638 #if defined(_M_AMD64) || defined(_M_ARM)
639 //OFFSET(PrInstrumentationCallback, KPROCESS, InstrumentationCallback),
640 #elif defined(_M_IX86)
641 OFFSET(PrVdmTrapcHandler, KPROCESS, VdmTrapcHandler),
642 //OFFSET(PrVdmObjects, KPROCESS, VdmObjects),
643 OFFSET(PrFlags, KPROCESS, Flags),
644 #endif
645 SIZE(KernelProcessObjectLength, KPROCESS),
646 
647 HEADER("KQUEUE"),
648 OFFSET(QuType, KQUEUE, Header.Type), // not in win10
649 OFFSET(QuSize, KQUEUE, Header.Size), // not in win10
650 OFFSET(QuSignalState, KQUEUE, Header.SignalState),
651 OFFSET(QuEntryListHead, KQUEUE, EntryListHead),
652 OFFSET(QuCurrentCount, KQUEUE, CurrentCount),
653 OFFSET(QuMaximumCount, KQUEUE, MaximumCount),
654 OFFSET(QuThreadListHead, KQUEUE, ThreadListHead),
655 SIZE(QueueObjectLength, KQUEUE),
656 
657 HEADER("KSERVICE_TABLE_DESCRIPTOR offsets"),
659 OFFSET(SdCount, KSERVICE_TABLE_DESCRIPTOR, Count), // not in win10
663 
664 HEADER("STRING"),
665 OFFSET(StrLength, STRING, Length),
666 OFFSET(StrMaximumLength, STRING, MaximumLength),
667 OFFSET(StrBuffer, STRING, Buffer),
668 
669 HEADER("TEB"),
670 #if defined(_M_IX86)
671 OFFSET(TeExceptionList, TEB, NtTib.ExceptionList),
672 #elif defined(_M_AMD64)
673 OFFSET(TeCmTeb, TEB, NtTib),
674 #endif
675 OFFSET(TeStackBase, TEB, NtTib.StackBase),
676 OFFSET(TeStackLimit, TEB, NtTib.StackLimit),
677 OFFSET(TeFiberData, TEB, NtTib.FiberData),
678 OFFSET(TeSelf, TEB, NtTib.Self),
679 OFFSET(TeEnvironmentPointer, TEB, EnvironmentPointer),
680 OFFSET(TeClientId, TEB, ClientId),
681 OFFSET(TeActiveRpcHandle, TEB, ActiveRpcHandle),
682 OFFSET(TeThreadLocalStoragePointer, TEB, ThreadLocalStoragePointer),
683 OFFSET(TePeb, TEB, ProcessEnvironmentBlock),
684 OFFSET(TeLastErrorValue, TEB, LastErrorValue),
685 OFFSET(TeCountOfOwnedCriticalSections, TEB, CountOfOwnedCriticalSections),
686 OFFSET(TeCsrClientThread, TEB, CsrClientThread),
687 OFFSET(TeWOW32Reserved, TEB, WOW32Reserved),
688 //OFFSET(TeSoftFpcr, TEB, SoftFpcr),
689 OFFSET(TeExceptionCode, TEB, ExceptionCode),
690 OFFSET(TeActivationContextStackPointer, TEB, ActivationContextStackPointer),
691 //#if (NTDDI_VERSION >= NTDDI_WIN10)
692 //OFFSET(TeInstrumentationCallbackSp, TEB, InstrumentationCallbackSp),
693 //OFFSET(TeInstrumentationCallbackPreviousPc, TEB, InstrumentationCallbackPreviousPc),
694 //OFFSET(TeInstrumentationCallbackPreviousSp, TEB, InstrumentationCallbackPreviousSp),
695 //#endif
696 OFFSET(TeGdiClientPID, TEB, GdiClientPID),
697 OFFSET(TeGdiClientTID, TEB, GdiClientTID),
698 OFFSET(TeGdiThreadLocalInfo, TEB, GdiThreadLocalInfo),
699 OFFSET(TeglDispatchTable, TEB, glDispatchTable),
700 OFFSET(TeglReserved1, TEB, glReserved1),
701 OFFSET(TeglReserved2, TEB, glReserved2),
702 OFFSET(TeglSectionInfo, TEB, glSectionInfo),
703 OFFSET(TeglSection, TEB, glSection),
704 OFFSET(TeglTable, TEB, glTable),
705 OFFSET(TeglCurrentRC, TEB, glCurrentRC),
706 OFFSET(TeglContext, TEB, glContext),
707 OFFSET(TeDeallocationStack, TEB, DeallocationStack),
708 OFFSET(TeTlsSlots, TEB, TlsSlots),
709 OFFSET(TeVdm, TEB, Vdm),
710 OFFSET(TeInstrumentation, TEB, Instrumentation),
711 OFFSET(TeGdiBatchCount, TEB, GdiBatchCount),
712 OFFSET(TeGuaranteedStackBytes, TEB, GuaranteedStackBytes),
713 OFFSET(TeTlsExpansionSlots, TEB, TlsExpansionSlots),
714 OFFSET(TeFlsData, TEB, FlsData),
715 SIZE(ThreadEnvironmentBlockLength, TEB),
716 
717 HEADER("TIME_FIELDS"),
718 OFFSET(TfYear, TIME_FIELDS, Year),
719 OFFSET(TfMonth, TIME_FIELDS, Month),
720 OFFSET(TfDay, TIME_FIELDS, Day),
721 OFFSET(TfHour, TIME_FIELDS, Hour),
722 OFFSET(TfMinute, TIME_FIELDS, Minute),
723 OFFSET(TfSecond, TIME_FIELDS, Second),
724 OFFSET(TfMilliseconds, TIME_FIELDS, Milliseconds),
725 OFFSET(TfWeekday, TIME_FIELDS, Weekday),
726 
727 HEADER("KTHREAD"),
728 OFFSET(ThType, KTHREAD, Header.Type),
729 OFFSET(ThLock, KTHREAD, Header.Lock),
730 OFFSET(ThSize, KTHREAD, Header.Size),
731 OFFSET(ThThreadControlFlags, KTHREAD, Header.ThreadControlFlags),
732 OFFSET(ThDebugActive, KTHREAD, Header.DebugActive),
733 OFFSET(ThSignalState, KTHREAD, Header.SignalState),
734 OFFSET(ThInitialStack, KTHREAD, InitialStack),
735 OFFSET(ThStackLimit, KTHREAD, StackLimit),
736 OFFSET(ThStackBase, KTHREAD, StackBase),
737 OFFSET(ThThreadLock, KTHREAD, ThreadLock),
738 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
739 OFFSET(ThCycleTime, KTHREAD, CycleTime),
740 #if defined(_M_IX86)
741 OFFSET(ThHighCycleTime, KTHREAD, HighCycleTime),
742 #endif
743 #endif /* (NTDDI_VERSION >= NTDDI_LONGHORN) */
744 #if defined(_M_IX86)
745 OFFSET(ThServiceTable, KTHREAD, ServiceTable),
746 #endif
747 //OFFSET(ThCurrentRunTime, KTHREAD, CurrentRunTime),
748 //OFFSET(ThStateSaveArea, KTHREAD, StateSaveArea), // 0x3C not arm
749 OFFSET(ThKernelStack, KTHREAD, KernelStack),
750 #if (NTDDI_VERSION >= NTDDI_WIN7)
751 OFFSET(ThRunning, KTHREAD, Running),
752 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
753 OFFSET(ThAlerted, KTHREAD, Alerted),
754 #if (NTDDI_VERSION >= NTDDI_WIN7)
755 OFFSET(ThMiscFlags, KTHREAD, MiscFlags),
756 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
757 OFFSET(ThThreadFlags, KTHREAD, ThreadFlags),
758 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
759 OFFSET(ThSystemCallNumber, KTHREAD, SystemCallNumber),
760 #endif /* (NTDDI_VERSION >= NTDDI_LONGHORN) */
761 //OFFSET(ThFirstArgument, KTHREAD, FirstArgument),
762 OFFSET(ThTrapFrame, KTHREAD, TrapFrame),
763 OFFSET(ThApcState, KTHREAD, ApcState),
764 OFFSET(ThPriority, KTHREAD, Priority), // obsolete
765 OFFSET(ThContextSwitches, KTHREAD, ContextSwitches),
766 OFFSET(ThState, KTHREAD, State),
767 OFFSET(ThProcess, KTHREAD, Process), // thProcess in native headers
768 OFFSET(ThNpxState, KTHREAD, NpxState),
769 OFFSET(ThWaitIrql, KTHREAD, WaitIrql),
770 OFFSET(ThWaitMode, KTHREAD, WaitMode), // obsolete
771 OFFSET(ThTeb, KTHREAD, Teb),
772 OFFSET(ThTimer, KTHREAD, Timer),
773 OFFSET(ThWin32Thread, KTHREAD, Win32Thread),
774 OFFSET(ThWaitTime, KTHREAD, WaitTime),
775 OFFSET(ThCombinedApcDisable, KTHREAD, CombinedApcDisable),
776 OFFSET(ThKernelApcDisable, KTHREAD, KernelApcDisable),
777 OFFSET(ThSpecialApcDisable, KTHREAD, SpecialApcDisable),
778 #if defined(_M_ARM)
779 //OFFSET(ThVfpState, KTHREAD, VfpState),
780 #endif
781 OFFSET(ThNextProcessor, KTHREAD, NextProcessor),
782 OFFSET(ThProcess, KTHREAD, Process),
783 OFFSET(ThPreviousMode, KTHREAD, PreviousMode),
784 OFFSET(ThPriorityDecrement, KTHREAD, PriorityDecrement), // obsolete
785 OFFSET(ThAdjustReason, KTHREAD, AdjustReason),
786 OFFSET(ThAdjustIncrement, KTHREAD, AdjustIncrement),
787 OFFSET(ThAffinity, KTHREAD, Affinity), // obsolete
788 OFFSET(ThApcStateIndex, KTHREAD, ApcStateIndex),
789 OFFSET(ThIdealProcessor, KTHREAD, IdealProcessor), // obsolete
790 OFFSET(ThApcStatePointer, KTHREAD, ApcStatePointer), // obsolete
791 OFFSET(ThSavedApcState, KTHREAD, SavedApcState), // obsolete
792 OFFSET(ThWaitReason, KTHREAD, WaitReason),
793 OFFSET(ThSaturation, KTHREAD, Saturation), // obsolete
794 OFFSET(ThLegoData, KTHREAD, LegoData),
795 //#if defined(_M_ARM) && (NTDDI_VERSION >= NTDDI_WIN10)
796 //OFFSET(ThUserRoBase, KTHREAD, UserRoBase),
797 //OFFSET(ThUserRwBase, KTHREAD, UserRwBase),
798 //#endif
799 #ifdef _M_IX86
800 //OFFSET(ThSListFaultCount, KTHREAD, SListFaultCount), // 0x18E
801 //OFFSET(ThSListFaultAddress, KTHREAD, ListFaultAddress), // 0x10
802 #endif // _M_IX86
803 #if defined(_M_IX86) || defined(_M_AMD64)
804 //OFFSET(ThUserFsBase, KTHREAD, UserFsBase), // 0x434
805 //OFFSET(ThUserGsBase, KTHREAD, GsBase), // 0x438
806 #endif // defined
807 SIZE(KernelThreadObjectLength, KTHREAD),
808 
809 HEADER("ETHREAD"),
810 //OFFSET(ThSetContextState, ETHREAD, SetContextState),
811 
812 HEADER("KTIMER"),
813 OFFSET(TiType, KTIMER, Header.Type),
814 OFFSET(TiSize, KTIMER, Header.Size),
815 #if (NTDDI_VERSION < NTDDI_WIN7)
816 OFFSET(TiInserted, KTIMER, Header.Inserted),
817 #endif
818 OFFSET(TiSignalState, KTIMER, Header.SignalState),
819 OFFSET(TiDueTime, KTIMER, DueTime),
820 OFFSET(TiTimerListEntry, KTIMER, TimerListEntry),
821 OFFSET(TiDpc, KTIMER, Dpc),
822 OFFSET(TiPeriod, KTIMER, Period),
823 SIZE(TimerObjectLength, KTIMER),
824 
825 HEADER("TIME"),
826 OFFSET(TmLowTime, TIME, LowTime),
827 OFFSET(TmHighTime, TIME, HighTime),
828 
829 HEADER("SYSTEM_CONTEXT_SWITCH_INFORMATION (relative to FindAny)"),
830 RELOFFSET(TwFindAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindAny, FindAny),
831 RELOFFSET(TwFindIdeal, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindIdeal, FindAny),
832 RELOFFSET(TwFindLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, FindLast, FindAny),
833 RELOFFSET(TwIdleAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleAny, FindAny),
834 RELOFFSET(TwIdleCurrent, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleCurrent, FindAny),
835 RELOFFSET(TwIdleIdeal, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleIdeal, FindAny),
836 RELOFFSET(TwIdleLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, IdleLast, FindAny),
837 RELOFFSET(TwPreemptAny, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptAny, FindAny),
838 RELOFFSET(TwPreemptCurrent, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptCurrent, FindAny),
839 RELOFFSET(TwPreemptLast, SYSTEM_CONTEXT_SWITCH_INFORMATION, PreemptLast, FindAny),
840 RELOFFSET(TwSwitchToIdle, SYSTEM_CONTEXT_SWITCH_INFORMATION, SwitchToIdle, FindAny),
841 
842 HEADER("KUSER_SHARED_DATA"),
843 OFFSET(UsTickCountMultiplier, KUSER_SHARED_DATA, TickCountMultiplier), // 0x4
844 OFFSET(UsInterruptTime, KUSER_SHARED_DATA, InterruptTime), // 0x8
845 OFFSET(UsSystemTime, KUSER_SHARED_DATA, SystemTime), // 0x14
846 OFFSET(UsTimeZoneBias, KUSER_SHARED_DATA, TimeZoneBias), // 0x20
847 OFFSET(UsImageNumberLow, KUSER_SHARED_DATA, ImageNumberLow),
848 OFFSET(UsImageNumberHigh, KUSER_SHARED_DATA, ImageNumberHigh),
849 OFFSET(UsNtSystemRoot, KUSER_SHARED_DATA, NtSystemRoot),
850 OFFSET(UsMaxStackTraceDepth, KUSER_SHARED_DATA, MaxStackTraceDepth),
851 OFFSET(UsCryptoExponent, KUSER_SHARED_DATA, CryptoExponent),
852 OFFSET(UsTimeZoneId, KUSER_SHARED_DATA, TimeZoneId),
853 OFFSET(UsLargePageMinimum, KUSER_SHARED_DATA, LargePageMinimum),
854 //#if (NTDDI_VERSION >= NTDDI_WIN10)
855 //OFFSET(UsNtBuildNumber, KUSER_SHARED_DATA, NtBuildNumber),
856 //#else
857 OFFSET(UsReserved2, KUSER_SHARED_DATA, Reserved2),
858 //#endif
859 OFFSET(UsNtProductType, KUSER_SHARED_DATA, NtProductType),
860 OFFSET(UsProductTypeIsValid, KUSER_SHARED_DATA, ProductTypeIsValid),
861 OFFSET(UsNtMajorVersion, KUSER_SHARED_DATA, NtMajorVersion),
862 OFFSET(UsNtMinorVersion, KUSER_SHARED_DATA, NtMinorVersion),
863 OFFSET(UsProcessorFeatures, KUSER_SHARED_DATA, ProcessorFeatures),
864 OFFSET(UsReserved1, KUSER_SHARED_DATA, Reserved1),
865 OFFSET(UsReserved3, KUSER_SHARED_DATA, Reserved3),
866 OFFSET(UsTimeSlip, KUSER_SHARED_DATA, TimeSlip),
867 OFFSET(UsAlternativeArchitecture, KUSER_SHARED_DATA, AlternativeArchitecture),
868 OFFSET(UsSystemExpirationDate, KUSER_SHARED_DATA, SystemExpirationDate), // not arm
869 OFFSET(UsSuiteMask, KUSER_SHARED_DATA, SuiteMask),
870 OFFSET(UsKdDebuggerEnabled, KUSER_SHARED_DATA, KdDebuggerEnabled),
871 OFFSET(UsActiveConsoleId, KUSER_SHARED_DATA, ActiveConsoleId),
872 OFFSET(UsDismountCount, KUSER_SHARED_DATA, DismountCount),
873 OFFSET(UsComPlusPackage, KUSER_SHARED_DATA, ComPlusPackage),
874 OFFSET(UsLastSystemRITEventTickCount, KUSER_SHARED_DATA, LastSystemRITEventTickCount),
875 OFFSET(UsNumberOfPhysicalPages, KUSER_SHARED_DATA, NumberOfPhysicalPages),
876 OFFSET(UsSafeBootMode, KUSER_SHARED_DATA, SafeBootMode),
877 OFFSET(UsTestRetInstruction, KUSER_SHARED_DATA, TestRetInstruction),
878 OFFSET(UsSystemCall, KUSER_SHARED_DATA, SystemCall), // not in win10
879 OFFSET(UsSystemCallReturn, KUSER_SHARED_DATA, SystemCallReturn), // not in win10
880 OFFSET(UsSystemCallPad, KUSER_SHARED_DATA, SystemCallPad),
881 OFFSET(UsTickCount, KUSER_SHARED_DATA, TickCount),
882 OFFSET(UsTickCountQuad, KUSER_SHARED_DATA, TickCountQuad),
883 OFFSET(UsWow64SharedInformation, KUSER_SHARED_DATA, Wow64SharedInformation), // not in win10
884 //OFFSET(UsXState, KUSER_SHARED_DATA, XState), // win 10
885 
886 HEADER("KWAIT_BLOCK offsets"),
887 OFFSET(WbWaitListEntry, KWAIT_BLOCK, WaitListEntry),
888 OFFSET(WbThread, KWAIT_BLOCK, Thread),
889 OFFSET(WbObject, KWAIT_BLOCK, Object),
890 OFFSET(WbNextWaitBlock, KWAIT_BLOCK, NextWaitBlock), // not in win10
891 OFFSET(WbWaitKey, KWAIT_BLOCK, WaitKey),
892 OFFSET(WbWaitType, KWAIT_BLOCK, WaitType),
893 
894 #ifdef _M_AMD64
895 SIZE(KSTART_FRAME_LENGTH, KSTART_FRAME),
896 #endif
897 
898 #if 0
899 
900 CONSTANT(CFlushSize),
901 CONSTANT(Win32BatchFlushCallout),
902 CONSTANT(ServiceCpupReturnFromSimulatedCode),
903 CONSTANT(X86AMD64_R3_LONG_MODE_CODE),
904 CONSTANT(USER_CALLBACK_FILTER),
905 CONSTANT(SYSTEM_CALL_INT_2E),
906 
907 HEADER("Process mitigation option flags"),
908 CONSTANT(PS_MITIGATION_OPTION_BITS_PER_OPTION),
909 CONSTANT(PS_MITIGATION_OPTION_ALWAYS_ON),
910 CONSTANT(PS_MITIGATION_OPTION_ALWAYS_OFF),
911 CONSTANT(PS_MITIGATION_OPTION_MASK),
912 CONSTANT(PS_MITIGATION_OPTION_RETURN_FLOW_GUARD),
913 CONSTANT(PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT),
914 
915 #ifndef _M_ARM
916 HEADER("Bounds Callback Status Codes"),
917 CONSTANT(BoundExceptionContinueSearch),
918 CONSTANT(BoundExceptionHandled),
919 CONSTANT(BoundExceptionError),
920 #endif
921 
922 HEADER("PS_SYSTEM_DLL_INIT_BLOCK"),
923 OFFSET(IbCfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, CfgBitMap),
924 OFFSET(IbWow64CfgBitMap, PS_SYSTEM_DLL_INIT_BLOCK, Wow64CfgBitMap),
925 OFFSET(IbMitigationOptionsMap, PS_SYSTEM_DLL_INIT_BLOCK, MitigationOptionsMap),
926 
927 HEADER("Extended context"),
928 OFFSET(CxxLegacyOffset 0x8
929 OFFSET(CxxLegacyLength 0xc
930 OFFSET(CxxXStateOffset 0x10
931 OFFSET(CxxXStateLength 0x14
932 
933 HEADER("Enclave call dispatch frame"),
934 OFFSET(EcEnclaveNumber, ???, EnclaveNumber),
935 OFFSET(EcParameterAddress, ???, ParameterAddress),
936 OFFSET(EcParameterValue, ???, ParameterValue),
937 OFFSET(EcOriginalReturn, ???, OriginalReturn),
938 OFFSET(EcFramePointer, ???, FramePointer),
939 OFFSET(EcReturnAddress, ???, ReturnAddress),
940 
941 #ifndef _M_ARM
942 HEADER("Enlightenment"),
943 OFFSET(HeEnlightenments, ???, Enlightenments),
944 OFFSET(HeHypervisorConnected, ???, HypervisorConnected),
945 OFFSET(HeEndOfInterrupt, ???, EndOfInterrupt),
946 OFFSET(HeApicWriteIcr, ???, ApicWriteIcr),
947 OFFSET(HeSpinCountMask, ???, SpinCountMask),
948 OFFSET(HeLongSpinWait, ???, LongSpinWait),
949 #endif
950 
951 HEADER("Processor Descriptor Area"),
952 OFFSET(PdaGdt, ????, ),
953 OFFSET(PdaKernelGsBase, ????, ),
954 
955 OFFSET(PpFlags, ????, Flags),
956 OFFSET(EtwTSLength, ????, ),
957 OFFSET(CmThreadEnvironmentBlockOffset, ????, ),
958 OFFSET(PbEntropyCount, ????, ),
959 OFFSET(PbEntropyBuffer, ????, ),
960 
961 #endif
#define MAXIMUM_PROCESSORS
Definition: rwlock.h:5
#define INITIAL_STALL_COUNT
Definition: processor.c:22
BOOLEAN KdDebuggerEnabled
Definition: kddata.c:83
#define STATUS_UNWIND_CONSOLIDATE
Definition: ntstatus.h:220
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
Definition: cdprocs.h:1772
#define CONTEXT_CONTROL
Definition: nt_native.h:1369
GLdouble GLdouble u2
Definition: glext.h:8308
#define SERVICE_TABLE_SHIFT
Definition: ketypes.h:71
HEADER("Pointer size")
KAPC_STATE
Definition: ketypes.h:1280
#define STATUS_ILLEGAL_INSTRUCTION
Definition: ntstatus.h:266
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
_Must_inspect_result_ _In_ PWDF_DPC_CONFIG _In_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFDPC * Dpc
Definition: wdfdpc.h:107
#define FAST_FAIL_INVALID_SET_OF_CONTEXT
UNICODE_STRING NtSystemRoot
Definition: init.c:73
__int64 TIME
Definition: ms-dtyp.idl:32
#define MODE_MASK
Definition: orders.h:326
#define STATUS_WAKE_SYSTEM_DEBUGGER
Definition: ntstatus.h:188
_In_ ULONG Mode
Definition: hubbusif.h:303
static LIST_ENTRY DeviceListHead
Definition: fs.c:52
#define STATUS_CALLBACK_POP_STACK
Definition: ntstatus.h:961
#define TRUE
Definition: types.h:120
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define TLS_EXPANSION_SLOTS
Definition: pstypes.h:310
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL _In_ KINTERRUPT_MODE _In_ BOOLEAN ShareVector
Definition: iofuncs.h:798
#define STATUS_THREAD_IS_TERMINATING
Definition: ntstatus.h:311
WCHAR Second[]
Definition: FormatMessage.c:12
#define KENTROPY_TIMING_BUFFER_MASK
Definition: ketypes.h:2106
#define TYPE_CONSTANT
Definition: genincdata.c:39
#define SERVICE_TABLE_MASK
Definition: ketypes.h:78
_Inout_ PKDEVICE_QUEUE_ENTRY _In_ ULONG SortKey
Definition: kefuncs.h:339
#define FAST_FAIL_INVALID_JUMP_BUFFER
#define PRIMARY_VECTOR_BASE
Definition: halp.h:16
#define STATUS_SINGLE_STEP
Definition: ntstatus.h:185
_In_opt_ ULONG Base
Definition: rtlfuncs.h:2373
#define CLOCK_QUANTUM_DECREMENT
Definition: ketypes.h:138
#define STATUS_GUARD_PAGE_VIOLATION
Definition: ntstatus.h:182
#define EXCEPTION_NONCONTINUABLE
Definition: rtltypes.h:154
#define CONTEXT_FLOATING_POINT
Definition: nt_native.h:1372
_In_ LARGE_INTEGER _In_ ULONG Period
Definition: kefuncs.h:1324
IN PVOID IN PVOID IN USHORT IN USHORT Size
Definition: pci.h:361
#define LOW_REALTIME_PRIORITY
#define KERNEL_LARGE_STACK_SIZE
#define EXCEPTION_UNWINDING
Definition: rtltypes.h:155
GLdouble u1
Definition: glext.h:8308
#define STATUS_FLOAT_DIVIDE_BY_ZERO
Definition: ntstatus.h:378
#define KERNEL_LARGE_STACK_COMMIT
#define STATUS_FLOAT_INEXACT_RESULT
Definition: ntstatus.h:379
HANDLE UniqueProcess
Definition: compat.h:684
#define LOCK_QUEUE_OWNER
#define SERVICE_NUMBER_MASK
Definition: ketypes.h:83
_Out_ PKIRQL Irql
Definition: csq.h:179
_In_ WDFREQUEST _In_ NTSTATUS _In_ ULONG_PTR Information
Definition: wdfrequest.h:1044
#define CONTEXT_SEGMENTS
Definition: nt_native.h:1371
#define ISR_STACK_SIZE
Definition: ketypes.h:285
ULONG NtMajorVersion
Definition: init.c:43
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:245
#define STATUS_FLOAT_MULTIPLE_FAULTS
Definition: ntstatus.h:807
#define STATUS_FLOAT_STACK_CHECK
Definition: ntstatus.h:382
LONG LockCount
Definition: comsup.c:6
#define EXCEPTION_CONTINUE_EXECUTION
Definition: excpt.h:87
_Out_ PUSHORT NodeNumber
Definition: iofuncs.h:2570
#define STATUS_FLOAT_UNDERFLOW
Definition: ntstatus.h:383
#define STATUS_TIMEOUT
Definition: ntstatus.h:81
#define IPI_FREEZE
Definition: ketypes.h:238
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD OwningThread
Definition: wsk.h:182
#define CLOCK_LEVEL
#define STATUS_FLOAT_OVERFLOW
Definition: ntstatus.h:381
#define FALSE
Definition: types.h:117
Definition: Header.h:8
#define STATUS_INTEGER_OVERFLOW
Definition: ntstatus.h:385
#define STATUS_STACK_BUFFER_OVERRUN
Definition: ntstatus.h:946
#define KENTROPY_TIMING_ANALYSIS
Definition: ketypes.h:2107
#define EXCEPTION_TARGET_UNWIND
Definition: rtltypes.h:159
#define BREAKPOINT_UNLOAD_SYMBOLS
Definition: kdtypes.h:54
CRITICAL_SECTION CriticalSection
Definition: iprtprio.c:40
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFSPINLOCK * SpinLock
Definition: wdfsync.h:225
#define STATUS_INTEGER_DIVIDE_BY_ZERO
Definition: ntstatus.h:384
OFFSET(ApType, KAPC, Type)
#define LOCK_QUEUE_WAIT
#define RPL_MASK
Definition: ketypes.h:69
#define STATUS_BREAKPOINT
Definition: ntstatus.h:184
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL SynchronizeIrql
Definition: iofuncs.h:798
#define SERVICE_TABLE_TEST
Definition: ketypes.h:90
#define STATUS_FLOAT_DENORMAL_OPERAND
Definition: ntstatus.h:377
Definition: bufpool.h:45
#define STATUS_KERNEL_APC
Definition: ntstatus.h:79
#define IPI_DPC
Definition: ketypes.h:237
#define STATUS_BAD_COMPRESSION_BUFFER
Definition: ntstatus.h:710
#define IPI_SYNCH_REQUEST
Definition: ketypes.h:240
WaitType
Definition: shlextdbg.cpp:17
Definition: bcd.h:202
#define BREAKPOINT_PROMPT
Definition: kdtypes.h:52
#define NMI_STACK_SIZE
Definition: ketypes.h:284
#define EXCEPTION_STACK_INVALID
Definition: rtltypes.h:157
_Inout_ PVOID Segment
Definition: exfuncs.h:1101
#define STATUS_LONGJUMP
Definition: ntstatus.h:217
_Out_ PULONG UserTime
Definition: kefuncs.h:771
Status
Definition: gdiplustypes.h:24
FAST_MUTEX
Definition: extypes.h:17
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
Definition: ketypes.h:675
DWORD ServiceCount
Definition: svchost.c:19
#define STATUS_ASSERTION_FAILURE
Definition: ntstatus.h:960
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
int Count
Definition: noreturn.cpp:7
#define CONTEXT_FULL
Definition: nt_native.h:1375
#define IPI_LEVEL
Definition: env_spec_w32.h:701
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1163
_In_ WDFDMATRANSACTION _In_ size_t MaximumLength
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
#define EXCEPTION_COLLIDED_UNWIND
Definition: rtltypes.h:160
#define CLOCK2_LEVEL
Definition: env_spec_w32.h:700
#define LowTime
#define EXCEPTION_RECORD_LENGTH
Definition: asm.h:388
Type
Definition: Type.h:6
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
Definition: halfuncs.h:170
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
#define EXCEPTION_UNWIND
Definition: rtltypes.h:161
ULONG NtMinorVersion
Definition: init.c:44
#define KERNEL_STACK_SIZE
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID ServiceContext
Definition: iofuncs.h:798
HANDLE UniqueThread
Definition: compat.h:685
std::wstring STRING
Definition: fontsub.cpp:33
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
Definition: wdfinterrupt.h:651
#define STATUS_ILLEGAL_FLOAT_CONTEXT
Definition: ntstatus.h:566
#define BREAKPOINT_PRINT
Definition: kdtypes.h:51
#define WAIT_QUANTUM_DECREMENT
Definition: ketypes.h:137
#define EXCEPTION_EXIT_UNWIND
Definition: rtltypes.h:156
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:790
Definition: ketypes.h:687
#define CONTEXT_DEBUG_REGISTERS
Definition: nt_native.h:1373
#define STATUS_INVALID_PARAMETER_1
Definition: ntstatus.h:475
Definition: ketypes.h:412
_In_ PKSERVICE_ROUTINE _In_opt_ PVOID _In_opt_ PKSPIN_LOCK _In_ ULONG _In_ KIRQL _In_ KIRQL _In_ KINTERRUPT_MODE _In_ BOOLEAN _In_ KAFFINITY _In_ BOOLEAN FloatingSave
Definition: iofuncs.h:798
#define POWER_LEVEL
Definition: env_spec_w32.h:702
#define KERNEL_MCA_EXCEPTION_STACK_SIZE
Definition: ketypes.h:535
#define PAGE_SIZE
Definition: env_spec_w32.h:49
#define STATUS_PRIVILEGED_INSTRUCTION
Definition: ntstatus.h:386
Definition: typedefs.h:119
#define STATUS_FLOAT_MULTIPLE_TRAPS
Definition: ntstatus.h:808
RELOFFSET(ArNormalRoutine, KAPC, NormalRoutine, NormalRoutine)
#define PASSIVE_LEVEL
Definition: env_spec_w32.h:693
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
Definition: ntpoapi.h:204
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
Definition: ketypes.h:675
#define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER
Definition: ketypes.h:2105
#define DISPATCH_LEVEL
Definition: env_spec_w32.h:696
#define STATUS_USER_APC
Definition: ntstatus.h:78
#define EXCEPTION_NESTED_CALL
Definition: rtltypes.h:158
#define STATUS_NO_CALLBACK_ACTIVE
Definition: ntstatus.h:726
Definition: compat.h:694
#define HIGH_LEVEL
Definition: env_spec_w32.h:703
#define STATUS_INSTRUCTION_MISALIGNMENT
Definition: ntstatus.h:406
#define EXCEPTION_CHAIN_END
Definition: rtltypes.h:63
#define STATUS_WAKE_SYSTEM
Definition: ntstatus.h:170
#define EXCEPTION_CONTINUE_SEARCH
Definition: excpt.h:86
Definition: ketypes.h:566
#define STATUS_ACCESS_VIOLATION
Definition: ntstatus.h:242
#define PROFILE_LEVEL
Definition: env_spec_w32.h:698
#define FAST_FAIL_GUARD_ICALL_CHECK_FAILURE
_Out_ PKAPC_STATE ApcState
Definition: mm.h:1606
#define BREAKPOINT_LOAD_SYMBOLS
Definition: kdtypes.h:53
_Out_writes_bytes_to_opt_ AbsoluteSecurityDescriptorSize PSECURITY_DESCRIPTOR _Inout_ PULONG _Out_writes_bytes_to_opt_ DaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ SaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ OwnerSize PSID Owner
Definition: rtlfuncs.h:1556
#define STATUS_UNWIND
Definition: ntstatus.h:276
_In_opt_ PWSTR _In_ PWSTR _Inout_ PULONG ParameterValue
Definition: cdrom.h:960
CONSTANTX(InLevelSensitive, LevelSensitive)
#define STATUS_STACK_OVERFLOW
Definition: ntstatus.h:489
#define HighTime
Definition: bcd.h:201
_In_ WDFTIMER _In_ LONGLONG DueTime
Definition: wdftimer.h:187
#define STATUS_INVALID_OWNER
Definition: ntstatus.h:326
_In_ KDPC_IMPORTANCE Importance
Definition: kefuncs.h:80
#define NUMBER_SERVICE_TABLES
Definition: ketypes.h:47
#define DBG_STATUS_CONTROL_C
Definition: kdtypes.h:39
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
*Count PHARDWARE_COUNTER _In_ ULONG MaximumCount
Definition: kefuncs.h:1380
static LIST_ENTRY ThreadListHead
Definition: sys_arch.c:11
#define STATUS_DATATYPE_MISALIGNMENT
Definition: ntstatus.h:183
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFWAITLOCK * Lock
Definition: wdfsync.h:124
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
Definition: mxum.h:155
#define IPI_PACKET_READY
Definition: ketypes.h:239
#define STATUS_INVALID_SYSTEM_SERVICE
Definition: ntstatus.h:265
#define BREAKPOINT_COMMAND_STRING
Definition: kdtypes.h:55
#define CONTEXT_INTEGER
Definition: nt_native.h:1370
#define IPI_APC
Definition: ketypes.h:236
_In_ UINT _In_ UINT _In_ PNDIS_PACKET Source
Definition: ndis.h:3167
#define CLOCK1_LEVEL
Definition: env_spec_w32.h:699
#define STATUS_IN_PAGE_ERROR
Definition: ntstatus.h:243
#define STATUS_SUCCESS
Definition: shellext.h:65
RAW("#ifdef NT_UP")
#define STATUS_FLOAT_INVALID_OPERATION
Definition: ntstatus.h:380
CONSTANT(APC_INDEX_MISMATCH)
SIZE(SizeofPointer, PVOID)
#define STATUS_ARRAY_BOUNDS_EXCEEDED
Definition: ntstatus.h:376
#define APC_LEVEL
Definition: env_spec_w32.h:695
_In_ LONG _In_ LONG Limit
Definition: kefuncs.h:315
#define STATUS_NO_EVENT_PAIR
Definition: ntstatus.h:570
#define MAXIMUM_IDTVECTOR
Definition: asm.h:277
#define KI_EXCEPTION_ACCESS_VIOLATION
Definition: ketypes.h:177
SERVICE_TABLE_ENTRYW ServiceTable[]
Definition: service.c:21
#define BREAKPOINT_BREAK
Definition: kdtypes.h:50
#define STATUS_INVALID_LOCK_SEQUENCE
Definition: ntstatus.h:267
#define TLS_MINIMUM_AVAILABLE
Definition: ntddk_ex.h:236
_In_ PKSERVICE_ROUTINE ServiceRoutine
Definition: iofuncs.h:798
_In_opt_ PVOID DeferredContext
Definition: ketypes.h:675