|
#define | KernelMode 0x0 |
|
#define | UserMode 0x1 |
|
#define | KTSS_ESP0 0x4 |
|
#define | KTSS_CR3 0x1C |
|
#define | KTSS_EIP 0x20 |
|
#define | KTSS_EFLAGS 0x24 |
|
#define | KTSS_EAX 0x28 |
|
#define | KTSS_ECX 0x2C |
|
#define | KTSS_EDX 0x30 |
|
#define | KTSS_EBX 0x34 |
|
#define | KTSS_ESP 0x38 |
|
#define | KTSS_EBP 0x3C |
|
#define | KTSS_ESI 0x40 |
|
#define | KTSS_EDI 0x44 |
|
#define | KTSS_ES 0x48 |
|
#define | KTSS_CS 0x4C |
|
#define | KTSS_SS 0x50 |
|
#define | KTSS_DS 0x54 |
|
#define | KTSS_FS 0x58 |
|
#define | KTSS_GS 0x5C |
|
#define | KTSS_LDT 0x60 |
|
#define | KTSS_IOMAPBASE 0x66 |
|
#define | KTSS_IO_MAPS 0x68 |
|
#define | KTHREAD_DEBUG_ACTIVE 0x03 |
|
#define | KTHREAD_INITIAL_STACK 0x18 |
|
#define | KTHREAD_STACK_LIMIT 0x1C |
|
#define | KTHREAD_TEB 0x74 |
|
#define | KTHREAD_KERNEL_STACK 0x20 |
|
#define | KTHREAD_ALERTED 0x5E |
|
#define | KTHREAD_APCSTATE_PROCESS 0x28 + 0x10 |
|
#define | KTHREAD_PENDING_USER_APC 0x28 + 0x16 |
|
#define | KTHREAD_PENDING_KERNEL_APC 0x28 + 0x15 |
|
#define | KTHREAD_CONTEXT_SWITCHES 0x48 |
|
#define | KTHREAD_STATE_ 0x4C |
|
#define | KTHREAD_NPX_STATE 0x4D |
|
#define | KTHREAD_WAIT_IRQL 0x4E |
|
#define | KTHREAD_NEXT_PROCESSOR 0x40 |
|
#define | KTHREAD_WAIT_REASON 0x5A |
|
#define | KTHREAD_PRIORITY 0x5B |
|
#define | KTHREAD_SWAP_BUSY 0x5D |
|
#define | KTHREAD_SERVICE_TABLE 0x118 |
|
#define | KTHREAD_PREVIOUS_MODE 0xD7 |
|
#define | KTHREAD_COMBINED_APC_DISABLE 0x70 |
|
#define | KTHREAD_SPECIAL_APC_DISABLE 0x72 |
|
#define | KTHREAD_LARGE_STACK 0x107 |
|
#define | KTHREAD_TRAP_FRAME 0x110 |
|
#define | KTHREAD_CALLBACK_STACK 0x114 |
|
#define | KTHREAD_APC_STATE_INDEX 0x11C |
|
#define | KTHREAD_STACK_BASE 0x158 |
|
#define | KTHREAD_QUANTUM 0x15D |
|
#define | KTHREAD_KERNEL_TIME 0x160 |
|
#define | KTHREAD_USER_TIME 0x18C |
|
#define | KPROCESS_DIRECTORY_TABLE_BASE 0x18 |
|
#define | KPROCESS_LDT_DESCRIPTOR0 0x20 |
|
#define | KPROCESS_LDT_DESCRIPTOR1 0x24 |
|
#define | KPROCESS_INT21_DESCRIPTOR0 0x28 |
|
#define | KPROCESS_INT21_DESCRIPTOR1 0x2C |
|
#define | KPROCESS_IOPM_OFFSET 0x30 |
|
#define | KPROCESS_ACTIVE_PROCESSORS 0x34 |
|
#define | EPROCESS_VDM_OBJECTS 0x144 |
|
#define | KPRCB_DR0 0x2F8 |
|
#define | KPRCB_DR1 0x2FC |
|
#define | KPRCB_DR2 0x300 |
|
#define | KPRCB_DR3 0x304 |
|
#define | KPRCB_DR6 0x308 |
|
#define | KPRCB_DR7 0x30C |
|
#define | KPRCB_TIMER_HAND 0x964 |
|
#define | KPRCB_TIMER_REQUEST 0x968 |
|
#define | KPCR_EXCEPTION_LIST 0x0 |
|
#define | KPCR_INITIAL_STACK 0x4 |
|
#define | KPCR_STACK_LIMIT 0x8 |
|
#define | KPCR_PERF_GLOBAL_GROUP_MASK 0x8 |
|
#define | KPCR_CONTEXT_SWITCHES 0x10 |
|
#define | KPCR_SET_MEMBER_COPY 0x14 |
|
#define | KPCR_TEB 0x18 |
|
#define | KPCR_SELF 0x1C |
|
#define | KPCR_PRCB 0x20 |
|
#define | KPCR_IRQL 0x24 |
|
#define | KPCR_IRR 0x28 |
|
#define | KPCR_IRR_ACTIVE 0x2C |
|
#define | KPCR_IDR 0x30 |
|
#define | KPCR_KD_VERSION_BLOCK 0x34 |
|
#define | KPCR_IDT 0x38 |
|
#define | KPCR_GDT 0x3C |
|
#define | KPCR_TSS 0x40 |
|
#define | KPCR_STALL_SCALE_FACTOR 0x4C |
|
#define | KPCR_SET_MEMBER 0x48 |
|
#define | KPCR_NUMBER 0x51 |
|
#define | KPCR_VDM_ALERT 0x54 |
|
#define | KPCR_PRCB_DATA 0x120 |
|
#define | KPCR_CURRENT_THREAD 0x124 |
|
#define | KPCR_PRCB_NEXT_THREAD 0x128 |
|
#define | KPCR_PRCB_IDLE_THREAD 0x12C |
|
#define | KPCR_PROCESSOR_NUMBER 0x130 |
|
#define | KPCR_PRCB_SET_MEMBER 0x134 |
|
#define | KPCR_PRCB_CPU_TYPE 0x138 |
|
#define | KPCR_PRCB_PRCB_LOCK 0xA7C |
|
#define | KPCR_NPX_THREAD 0x640 |
|
#define | KPCR_DR6 0x428 |
|
#define | KPCR_DR7 0x42C |
|
#define | KPCR_PRCB_INTERRUPT_COUNT 0x644 |
|
#define | KPCR_PRCB_KERNEL_TIME 0x648 |
|
#define | KPCR_PRCB_USER_TIME 0x64C |
|
#define | KPCR_PRCB_DPC_TIME 0x650 |
|
#define | KPCR_PRCB_DEBUG_DPC_TIME 0x654 |
|
#define | KPCR_PRCB_INTERRUPT_TIME 0x658 |
|
#define | KPCR_PRCB_ADJUST_DPC_THRESHOLD 0x65C |
|
#define | KPCR_PRCB_SKIP_TICK 0x664 |
|
#define | KPCR_SYSTEM_CALLS 0x6B8 |
|
#define | KPCR_PRCB_DPC_QUEUE_DEPTH 0xA4C |
|
#define | KPCR_PRCB_DPC_COUNT 0xA50 |
|
#define | KPCR_PRCB_DPC_STACK 0xA68 |
|
#define | KPCR_PRCB_MAXIMUM_DPC_QUEUE_DEPTH 0xA6C |
|
#define | KPCR_PRCB_DPC_REQUEST_RATE 0xA70 |
|
#define | KPCR_PRCB_DPC_INTERRUPT_REQUESTED 0xA78 |
|
#define | KPCR_PRCB_DPC_ROUTINE_ACTIVE 0xA7A |
|
#define | KPCR_PRCB_DPC_LAST_COUNT 0xA80 |
|
#define | KPCR_PRCB_TIMER_REQUEST 0xA88 |
|
#define | KPCR_PRCB_QUANTUM_END 0xAA1 |
|
#define | KPCR_PRCB_IDLE_SCHEDULE 0xAA3 |
|
#define | KPCR_PRCB_DEFERRED_READY_LIST_HEAD 0xC10 |
|
#define | KPCR_PRCB_POWER_STATE_IDLE_FUNCTION 0xEC0 |
|
#define | KINTERRUPT_INTERRUPT_LIST_HEAD 0x04 |
|
#define | KINTERRUPT_SERVICE_ROUTINE 0x0C |
|
#define | KINTERRUPT_SERVICE_CONTEXT 0x10 |
|
#define | KINTERRUPT_TICK_COUNT 0x18 |
|
#define | KINTERRUPT_ACTUAL_LOCK 0x1C |
|
#define | KINTERRUPT_DISPATCH_ADDRESS 0x20 |
|
#define | KINTERRUPT_VECTOR 0x24 |
|
#define | KINTERRUPT_IRQL 0x28 |
|
#define | KINTERRUPT_SYNCHRONIZE_IRQL 0x29 |
|
#define | KINTERRUPT_DISPATCH_COUNT 0x38 |
|
#define | KINTERRUPT_DISPATCH_CODE 0x3C |
|
#define | KGDT_BASE_LOW 0x2 |
|
#define | KGDT_BASE_MID 0x4 |
|
#define | KGDT_BASE_HI 0x7 |
|
#define | KGDT_LIMIT_HI 0x6 |
|
#define | KGDT_LIMIT_LOW 0x0 |
|
#define | FP_CONTROL_WORD 0x0 |
|
#define | FP_STATUS_WORD 0x4 |
|
#define | FP_TAG_WORD 0x8 |
|
#define | FP_ERROR_OFFSET 0xC |
|
#define | FP_ERROR_SELECTOR 0x10 |
|
#define | FP_DATA_OFFSET 0x14 |
|
#define | FP_DATA_SELECTOR 0x18 |
|
#define | FN_CR0_NPX_STATE 0x20C |
|
#define | SIZEOF_FX_SAVE_AREA 528 |
|
#define | NPX_FRAME_LENGTH 0x210 |
|
#define | FX_CONTROL_WORD 0x0 |
|
#define | FX_STATUS_WORD 0x2 |
|
#define | FX_TAG_WORD 0x4 |
|
#define | FX_ERROR_OPCODE 0x6 |
|
#define | FX_ERROR_OFFSET 0x8 |
|
#define | FX_ERROR_SELECTOR 0xC |
|
#define | FX_DATA_OFFSET 0x10 |
|
#define | FX_DATA_SELECTOR 0x14 |
|
#define | FX_MXCSR 0x18 |
|
#define | NPX_STATE_NOT_LOADED 0xA |
|
#define | NPX_STATE_LOADED 0x0 |
|
#define | KTRAP_FRAME_DEBUGEBP 0x0 |
|
#define | KTRAP_FRAME_DEBUGEIP 0x4 |
|
#define | KTRAP_FRAME_DEBUGARGMARK 0x8 |
|
#define | KTRAP_FRAME_DEBUGPOINTER 0xC |
|
#define | KTRAP_FRAME_TEMPCS 0x10 |
|
#define | KTRAP_FRAME_TEMPESP 0x14 |
|
#define | KTRAP_FRAME_DR0 0x18 |
|
#define | KTRAP_FRAME_DR1 0x1C |
|
#define | KTRAP_FRAME_DR2 0x20 |
|
#define | KTRAP_FRAME_DR3 0x24 |
|
#define | KTRAP_FRAME_DR6 0x28 |
|
#define | KTRAP_FRAME_DR7 0x2C |
|
#define | KTRAP_FRAME_GS 0x30 |
|
#define | KTRAP_FRAME_RESERVED1 0x32 |
|
#define | KTRAP_FRAME_ES 0x34 |
|
#define | KTRAP_FRAME_RESERVED2 0x36 |
|
#define | KTRAP_FRAME_DS 0x38 |
|
#define | KTRAP_FRAME_RESERVED3 0x3A |
|
#define | KTRAP_FRAME_EDX 0x3C |
|
#define | KTRAP_FRAME_ECX 0x40 |
|
#define | KTRAP_FRAME_EAX 0x44 |
|
#define | KTRAP_FRAME_PREVIOUS_MODE 0x48 |
|
#define | KTRAP_FRAME_EXCEPTION_LIST 0x4C |
|
#define | KTRAP_FRAME_FS 0x50 |
|
#define | KTRAP_FRAME_RESERVED4 0x52 |
|
#define | KTRAP_FRAME_EDI 0x54 |
|
#define | KTRAP_FRAME_ESI 0x58 |
|
#define | KTRAP_FRAME_EBX 0x5C |
|
#define | KTRAP_FRAME_EBP 0x60 |
|
#define | KTRAP_FRAME_ERROR_CODE 0x64 |
|
#define | KTRAP_FRAME_EIP 0x68 |
|
#define | KTRAP_FRAME_CS 0x6C |
|
#define | KTRAP_FRAME_EFLAGS 0x70 |
|
#define | KTRAP_FRAME_ESP 0x74 |
|
#define | KTRAP_FRAME_SS 0x78 |
|
#define | KTRAP_FRAME_RESERVED5 0x7A |
|
#define | KTRAP_FRAME_V86_ES 0x7C |
|
#define | KTRAP_FRAME_RESERVED6 0x7E |
|
#define | KTRAP_FRAME_V86_DS 0x80 |
|
#define | KTRAP_FRAME_RESERVED7 0x82 |
|
#define | KTRAP_FRAME_V86_FS 0x84 |
|
#define | KTRAP_FRAME_RESERVED8 0x86 |
|
#define | KTRAP_FRAME_V86_GS 0x88 |
|
#define | KTRAP_FRAME_RESERVED9 0x8A |
|
#define | KTRAP_FRAME_SIZE 0x8C |
|
#define | KTRAP_FRAME_LENGTH 0x8C |
|
#define | KTRAP_FRAME_ALIGN 0x04 |
|
#define | FRAME_EDITED 0xFFF8 |
|
#define | USER_SHARED_DATA_INTERRUPT_TIME 0x8 |
|
#define | USER_SHARED_DATA_SYSTEM_TIME 0x14 |
|
#define | USER_SHARED_DATA_PROCESSOR_FEATURES 0x274 |
|
#define | USER_SHARED_DATA_TICK_COUNT 0x320 |
|
#define | KERNEL_USER_SHARED_DATA 0x7FFE0000 |
|
#define | KUSER_SHARED_PROCESSOR_FEATURES KERNEL_USER_SHARED_DATA + 0x274 |
|
#define | KUSER_SHARED_SYSCALL KERNEL_USER_SHARED_DATA + 0x300 |
|
#define | KUSER_SHARED_SYSCALL_RET KERNEL_USER_SHARED_DATA + 0x304 |
|
#define | PROCESSOR_FEATURE_FXSR KUSER_SHARED_PROCESSOR_FEATURES + 0x4 |
|
#define | CONTEXT_FLAGS 0x0 |
|
#define | CONTEXT_DR6 0x14 |
|
#define | CONTEXT_FLOAT_SAVE 0x1C |
|
#define | CONTEXT_SEGGS 0x8C |
|
#define | CONTEXT_SEGFS 0x90 |
|
#define | CONTEXT_SEGES 0x94 |
|
#define | CONTEXT_SEGDS 0x98 |
|
#define | CONTEXT_EDI 0x9C |
|
#define | CONTEXT_ESI 0xA0 |
|
#define | CONTEXT_EBX 0xA4 |
|
#define | CONTEXT_EDX 0xA8 |
|
#define | CONTEXT_ECX 0xAC |
|
#define | CONTEXT_EAX 0xB0 |
|
#define | CONTEXT_EBP 0xB4 |
|
#define | CONTEXT_EIP 0xB8 |
|
#define | CONTEXT_SEGCS 0xBC |
|
#define | CONTEXT_EFLAGS 0xC0 |
|
#define | CONTEXT_ESP 0xC4 |
|
#define | CONTEXT_SEGSS 0xC8 |
|
#define | CONTEXT_FLOAT_SAVE_CONTROL_WORD CONTEXT_FLOAT_SAVE + FP_CONTROL_WORD |
|
#define | CONTEXT_FLOAT_SAVE_STATUS_WORD CONTEXT_FLOAT_SAVE + FP_STATUS_WORD |
|
#define | CONTEXT_FLOAT_SAVE_TAG_WORD CONTEXT_FLOAT_SAVE + FP_TAG_WORD |
|
#define | CONTEXT_ALIGNED_SIZE 0x2CC |
|
#define | CONTEXT_FRAME_LENGTH 0x2D0 |
|
#define | EXCEPTION_RECORD_EXCEPTION_CODE 0x0 |
|
#define | EXCEPTION_RECORD_EXCEPTION_FLAGS 0x4 |
|
#define | EXCEPTION_RECORD_EXCEPTION_RECORD 0x8 |
|
#define | EXCEPTION_RECORD_EXCEPTION_ADDRESS 0xC |
|
#define | EXCEPTION_RECORD_NUMBER_PARAMETERS 0x10 |
|
#define | SIZEOF_EXCEPTION_RECORD 0x14 |
|
#define | EXCEPTION_RECORD_LENGTH 0x50 |
|
#define | TEB_EXCEPTION_LIST 0x0 |
|
#define | TEB_STACK_BASE 0x4 |
|
#define | TEB_STACK_LIMIT 0x8 |
|
#define | TEB_FIBER_DATA 0x10 |
|
#define | TEB_SELF 0x18 |
|
#define | TEB_PEB 0x30 |
|
#define | TEB_EXCEPTION_CODE 0x1A4 |
|
#define | TEB_ACTIVATION_CONTEXT_STACK_POINTER 0x1A8 |
|
#define | TEB_GL_TABLE 0xBE8 |
|
#define | TEB_DEALLOCATION_STACK 0xE0C |
|
#define | TEB_GDI_BATCH_COUNT 0xF70 |
|
#define | TEB_GUARANTEED_STACK_BYTES 0xF78 |
|
#define | TEB_FLS_DATA 0xFB4 |
|
#define | PEB_KERNEL_CALLBACK_TABLE 0x2C |
|
#define | FIBER_PARAMETER 0x0 |
|
#define | FIBER_EXCEPTION_LIST 0x4 |
|
#define | FIBER_STACK_BASE 0x8 |
|
#define | FIBER_STACK_LIMIT 0xC |
|
#define | FIBER_DEALLOCATION_STACK 0x10 |
|
#define | FIBER_CONTEXT 0x14 |
|
#define | FIBER_GUARANTEED_STACK_BYTES 0x2E0 |
|
#define | FIBER_FLS_DATA 0x2E4 |
|
#define | FIBER_ACTIVATION_CONTEXT_STACK 0x2E8 |
|
#define | FIBER_CONTEXT_FLAGS FIBER_CONTEXT + CONTEXT_FLAGS |
|
#define | FIBER_CONTEXT_EAX FIBER_CONTEXT + CONTEXT_EAX |
|
#define | FIBER_CONTEXT_EBX FIBER_CONTEXT + CONTEXT_EBX |
|
#define | FIBER_CONTEXT_ECX FIBER_CONTEXT + CONTEXT_ECX |
|
#define | FIBER_CONTEXT_EDX FIBER_CONTEXT + CONTEXT_EDX |
|
#define | FIBER_CONTEXT_ESI FIBER_CONTEXT + CONTEXT_ESI |
|
#define | FIBER_CONTEXT_EDI FIBER_CONTEXT + CONTEXT_EDI |
|
#define | FIBER_CONTEXT_EBP FIBER_CONTEXT + CONTEXT_EBP |
|
#define | FIBER_CONTEXT_EIP FIBER_CONTEXT + CONTEXT_EIP |
|
#define | FIBER_CONTEXT_ESP FIBER_CONTEXT + CONTEXT_ESP |
|
#define | FIBER_CONTEXT_DR6 FIBER_CONTEXT + CONTEXT_DR6 |
|
#define | FIBER_CONTEXT_FLOAT_SAVE_STATUS_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_STATUS_WORD |
|
#define | FIBER_CONTEXT_FLOAT_SAVE_CONTROL_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_CONTROL_WORD |
|
#define | FIBER_CONTEXT_FLOAT_SAVE_TAG_WORD FIBER_CONTEXT + CONTEXT_FLOAT_SAVE_TAG_WORD |
|
#define | EFLAGS_USER_SANITIZE 0x3F4DD7 |
|
#define | CR0_PE 0x1 |
|
#define | CR0_MP 0x2 |
|
#define | CR0_EM 0x4 |
|
#define | CR0_TS 0x8 |
|
#define | CR0_ET 0x10 |
|
#define | CR0_NE 0x20 |
|
#define | CR0_WP 0x10000 |
|
#define | CR0_AM 0x40000 |
|
#define | CR0_NW 0x20000000 |
|
#define | CR0_CD 0x40000000 |
|
#define | CR0_PG 0x80000000 |
|
#define | DR6_LEGAL 0xE00F |
|
#define | DR7_LEGAL 0xFFFF0155 |
|
#define | DR7_ACTIVE 0x55 |
|
#define | DR7_OVERRIDE_V 0x04 |
|
#define | DR7_RESERVED_MASK 0xDC00 |
|
#define | DR7_OVERRIDE_MASK 0xF0000 |
|
#define | CBSTACK_STACK 0x0 |
|
#define | CBSTACK_TRAP_FRAME 0x4 |
|
#define | CBSTACK_CALLBACK_STACK 0x8 |
|
#define | CBSTACK_EBP 0x18 |
|
#define | CBSTACK_RESULT 0x20 |
|
#define | CBSTACK_RESULT_LENGTH 0x24 |
|
#define | SERVICE_DESCRIPTOR_BASE 0x0000 |
|
#define | SERVICE_DESCRIPTOR_COUNT 0x0004 |
|
#define | SERVICE_DESCRIPTOR_LIMIT 0x0008 |
|
#define | SERVICE_DESCRIPTOR_NUMBER 0x000C |
|
#define | SERVICE_DESCRIPTOR_LENGTH 0x0010 |
|
#define | EXCEPTION_DIVIDED_BY_ZERO 0 |
|
#define | EXCEPTION_DEBUG 1 |
|
#define | EXCEPTION_NMI 2 |
|
#define | EXCEPTION_INT3 3 |
|
#define | EXCEPTION_BOUND_CHECK 5 |
|
#define | EXCEPTION_INVALID_OPCODE 6 |
|
#define | EXCEPTION_NPX_NOT_AVAILABLE 7 |
|
#define | EXCEPTION_DOUBLE_FAULT 8 |
|
#define | EXCEPTION_NPX_OVERRUN 9 |
|
#define | EXCEPTION_INVALID_TSS 0x0A |
|
#define | EXCEPTION_SEGMENT_NOT_PRESENT 0x0B |
|
#define | EXCEPTION_STACK_FAULT 0x0C |
|
#define | EXCEPTION_GP_FAULT 0x0D |
|
#define | EXCEPTION_RESERVED_TRAP 0x0F |
|
#define | EXCEPTION_NPX_ERROR 0x010 |
|
#define | EXCEPTION_ALIGNMENT_CHECK 0x011 |
|
#define | HV_MMU_USE_HYPERCALL_FOR_ADDRESS_SWITCH 0x01 |
|
#define | HV_MMU_USE_HYPERCALL_FOR_LOCAL_FLUSH 0x02 |
|
#define | HV_MMU_USE_HYPERCALL_FOR_REMOTE_FLUSH 0x04 |
|
#define | HV_APIC_ENLIGHTENED 0x10 |
|
#define | HV_KE_USE_HYPERCALL_FOR_LONG_SPIN_WAIT 0x40 |
|
#define | FIXED_NTVDMSTATE_LINEAR_PC_AT 0x714 |
|
#define | PRIMARY_VECTOR_BASE 0x30 |
|
#define | MAXIMUM_IDTVECTOR 0xFF |
|