45#if (NTDDI_VERSION >= NTDDI_VISTA)
46HEADER(
"Hypervisor Enlightenment Definitions"),
95HEADER(
"WOW64 turbo dispatch system call types"),
209HEADER(
"** FIELD OFFSETS ***************"),
410OFFSET(PebKernelCallbackTable,
PEB, KernelCallbackTable),
443HEADER(
"TEB offsets (duplicates Te* definitions!)"),
449OFFSET(TbArbitraryUserPointer,
TEB, NtTib.ArbitraryUserPointer),
452OFFSET(TbThreadLocalStoragePointer,
TEB, ThreadLocalStoragePointer),
453OFFSET(TbCountOfOwnedCriticalSections,
TEB, CountOfOwnedCriticalSections),
543#if (NTDDI_VERSION >= NTDDI_WIN10)
558RAW(
"#define USERDATA ds:[HEX(0FFDF0000)]"),
563RAW(
"#define PCR ds:[HEX(0FFDFF000)]"),
566#if (NTDDI_VERSION >= NTDDI_WIN8)
#define EFLAGS_INTERRUPT_MASK
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
_Must_inspect_result_ _In_ PFLT_CALLBACK_DATA _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkerRoutine
#define EXCEPTION_EXECUTE_HANDLER
#define EFLAGS_USER_SANITIZE
#define MSR_XD_ENABLE_MASK
#define MACHINE_TYPE_EISA
#define MSR_IA32_MISC_ENABLE
#define EFLAGS_ALIGN_CHECK
#define EXCEPTION_RECORD_EXCEPTION_RECORD
#define PEB_KERNEL_CALLBACK_TABLE
#define TEB_EXCEPTION_LIST
#define KTRAP_FRAME_ERROR_CODE
#define FIBER_EXCEPTION_LIST
#define KTRAP_FRAME_V86_GS
#define FIBER_CONTEXT_ESI
#define KPCR_PRCB_NEXT_THREAD
#define KTRAP_FRAME_TEMPESP
#define FIBER_CONTEXT_ESP
#define KPCR_PRCB_DPC_STACK
#define KTHREAD_APC_STATE_INDEX
#define EXCEPTION_RECORD_EXCEPTION_FLAGS
#define KTHREAD_DEBUG_ACTIVE
#define KPROCESS_DIRECTORY_TABLE_BASE
#define CONTEXT_FRAME_LENGTH
#define KPCR_PRCB_DEFERRED_READY_LIST_HEAD
#define FIBER_CONTEXT_EIP
#define KTHREAD_WAIT_IRQL
#define KTRAP_FRAME_DEBUGEBP
#define TEB_GUARANTEED_STACK_BYTES
#define KTHREAD_APCSTATE_PROCESS
#define FIBER_CONTEXT_EBX
#define TEB_EXCEPTION_CODE
#define TEB_ACTIVATION_CONTEXT_STACK_POINTER
#define FIBER_CONTEXT_DR6
#define FIBER_CONTEXT_EDX
#define PROCESSOR_FEATURE_FXSR
#define KPROCESS_LDT_DESCRIPTOR1
#define EXCEPTION_RECORD_NUMBER_PARAMETERS
#define HV_MMU_USE_HYPERCALL_FOR_ADDRESS_SWITCH
#define KUSER_SHARED_SYSCALL_RET
#define FIBER_CONTEXT_EDI
#define KPROCESS_IOPM_OFFSET
#define EXCEPTION_RECORD_EXCEPTION_ADDRESS
#define FIBER_CONTEXT_FLOAT_SAVE_CONTROL_WORD
#define FIBER_CONTEXT_FLOAT_SAVE_TAG_WORD
#define KTHREAD_LARGE_STACK
#define KPROCESS_INT21_DESCRIPTOR1
#define NPX_STATE_NOT_LOADED
#define SIZEOF_EXCEPTION_RECORD
#define CONTEXT_ALIGNED_SIZE
#define FIBER_CONTEXT_EBP
#define KTRAP_FRAME_PREVIOUS_MODE
#define KPCR_EXCEPTION_LIST
#define KPCR_CURRENT_THREAD
#define HV_KE_USE_HYPERCALL_FOR_LONG_SPIN_WAIT
#define KPCR_PRCB_TIMER_REQUEST
#define KPCR_PRCB_MAXIMUM_DPC_QUEUE_DEPTH
#define KPCR_STALL_SCALE_FACTOR
#define KPROCESS_LDT_DESCRIPTOR0
#define KTHREAD_INITIAL_STACK
#define FIBER_GUARANTEED_STACK_BYTES
#define TEB_DEALLOCATION_STACK
#define KTHREAD_STACK_LIMIT
#define CBSTACK_CALLBACK_STACK
#define FIBER_CONTEXT_ECX
#define KTHREAD_NPX_STATE
#define DR7_RESERVED_MASK
#define TEB_GDI_BATCH_COUNT
#define HV_MMU_USE_HYPERCALL_FOR_LOCAL_FLUSH
#define KTRAP_FRAME_V86_FS
#define KTRAP_FRAME_EFLAGS
#define KTHREAD_STACK_BASE
#define SIZEOF_FX_SAVE_AREA
#define KTRAP_FRAME_LENGTH
#define FIBER_CONTEXT_EAX
#define KTHREAD_COMBINED_APC_DISABLE
#define KPCR_PRCB_DPC_QUEUE_DEPTH
#define KTRAP_FRAME_ALIGN
#define KPCR_PRCB_QUANTUM_END
#define KPROCESS_INT21_DESCRIPTOR0
#define HV_MMU_USE_HYPERCALL_FOR_REMOTE_FLUSH
#define KPCR_PRCB_POWER_STATE_IDLE_FUNCTION
#define KTHREAD_SPECIAL_APC_DISABLE
#define FIBER_ACTIVATION_CONTEXT_STACK
#define EXCEPTION_RECORD_EXCEPTION_CODE
#define CBSTACK_RESULT_LENGTH
#define KTHREAD_KERNEL_STACK
#define FIBER_DEALLOCATION_STACK
#define KTRAP_FRAME_V86_ES
#define KPCR_CONTEXT_SWITCHES
#define FIBER_STACK_LIMIT
#define FIBER_CONTEXT_FLOAT_SAVE_STATUS_WORD
#define USER_SHARED_DATA_PROCESSOR_FEATURES
#define KTRAP_FRAME_DEBUGEIP
#define KPCR_PERF_GLOBAL_GROUP_MASK
#define KUSER_SHARED_SYSCALL
#define KTHREAD_CONTEXT_SWITCHES
#define KTHREAD_WAIT_REASON
#define KTRAP_FRAME_EXCEPTION_LIST
#define KTRAP_FRAME_V86_DS
#define EXCEPTION_RECORD_LENGTH
#define KTHREAD_CALLBACK_STACK
#define KTHREAD_TRAP_FRAME
#define KTHREAD_PENDING_KERNEL_APC
#define KPCR_PRCB_DPC_ROUTINE_ACTIVE
#define FIBER_CONTEXT_FLAGS
#define CBSTACK_TRAP_FRAME
@ Service4ArgSpSpNSpNSpReloadState
@ Service4ArgSpNSpNSpNSpReloadState
@ ServiceCpupTdReadWriteFile
@ ServiceCpupTdWaitForMultipleObjects
@ Service3ArgSpNSpNSpReloadState
@ Service2ArgNSpNSpReloadState
@ Service4ArgNSpNSpNSpNSp
@ ServiceCpupTdQuerySystemTime
@ ServiceCpupTdGetCurrentProcessorNumber
@ ServiceCpupTdRemoveIoCompletion
@ ServiceCpupTdWaitForMultipleObjects32
@ ServiceCpupTdDeviceIoControlFile
_IRQL_requires_same_ _In_ PVOID _Inout_ struct _CONTEXT * ContextRecord
_In_ ULONG _In_ ULONG _In_ ULONG Length
_Out_ PKAPC_STATE ApcState
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
#define STATUS_CALLBACK_POP_STACK
struct _KGDTENTRY::@2458::@2459 Bytes
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Out_ PCLIENT_ID ClientId
#define XSTATE_MASK_LEGACY_FLOATING_POINT
#define XSTATE_MASK_LEGACY
#define PF_XMMI_INSTRUCTIONS_AVAILABLE
#define XSTATE_MASK_LEGACY_SSE