41#define TABLE_NUMBER_BITS 1
42#define TABLE_OFFSET_BITS 12
47#define NUMBER_SERVICE_TABLES 2
48#define NTOS_SERVICE_INDEX 0
49#define WIN32K_SERVICE_INDEX 1
62#define BITS_PER_ENTRY 5
64#define BITS_PER_ENTRY 4
71#define SERVICE_TABLE_SHIFT (12 - BITS_PER_ENTRY)
78#define SERVICE_TABLE_MASK (((1 << TABLE_NUMBER_BITS) - 1) << BITS_PER_ENTRY)
83#define SERVICE_NUMBER_MASK ((1 << TABLE_OFFSET_BITS) - 1)
90#define SERVICE_TABLE_TEST (WIN32K_SERVICE_INDEX << BITS_PER_ENTRY)
95#define CONTEXT_DEBUGGER (CONTEXT_FULL | CONTEXT_FLOATING_POINT)
100#define SSDT_MAX_ENTRIES 2
105#define PROCESSOR_ARCHITECTURE_INTEL 0
106#define PROCESSOR_ARCHITECTURE_MIPS 1
107#define PROCESSOR_ARCHITECTURE_ALPHA 2
108#define PROCESSOR_ARCHITECTURE_PPC 3
109#define PROCESSOR_ARCHITECTURE_SHX 4
110#define PROCESSOR_ARCHITECTURE_ARM 5
111#define PROCESSOR_ARCHITECTURE_IA64 6
112#define PROCESSOR_ARCHITECTURE_ALPHA64 7
113#define PROCESSOR_ARCHITECTURE_MSIL 8
114#define PROCESSOR_ARCHITECTURE_AMD64 9
115#define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF
120#define KOBJECT_TYPE_MASK 0x7F
121#define KOBJECT_LOCK_BIT 0x80
126#define THREAD_ALERT_INCREMENT 2
131#define KI_USER_SHARED_DATA_PHYSICAL 0x41000
136#define MAX_QUANTUM 0x7F
137#define WAIT_QUANTUM_DECREMENT 1
138#define CLOCK_QUANTUM_DECREMENT 3
143#define KI_EXCEPTION_INTERNAL 0x10000000
144#define KI_EXCEPTION_ACCESS_VIOLATION (KI_EXCEPTION_INTERNAL | 0x04)
154#if (NTDDI_VERSION >= NTDDI_LONGHORN)
167#ifndef NTOS_MODE_USER
172#define DISPATCH_LENGTH 4
173#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
174#define DISPATCH_LENGTH 135
176#define DISPATCH_LENGTH 106
189#define SharedUserData ((KUSER_SHARED_DATA *)USER_SHARED_DATA)
195#define IsNEC_98 (SharedUserData->AlternativeArchitecture == NEC98x86)
199#define IsNotNEC_98 (SharedUserData->AlternativeArchitecture != NEC98x86)
216#define IsNEC_98 (FALSE)
220#define IsNotNEC_98 (TRUE)
236#define MAX_WOW64_SHARED_ENTRIES 16
241#define PROCESSOR_FEATURE_MAX 64
374#if (NTDDI_VERSION >= NTDDI_WINXPSP2)
375#define NX_SUPPORT_POLICY_ALWAYSOFF 0
376#define NX_SUPPORT_POLICY_ALWAYSON 1
377#define NX_SUPPORT_POLICY_OPTIN 2
378#define NX_SUPPORT_POLICY_OPTOUT 3
396#if (NTDDI_VERSION >= NTDDI_WS03)
525typedef struct _KUSER_SHARED_DATA
527 ULONG TickCountLowDeprecated;
528 ULONG TickCountMultiplier;
535 ULONG MaxStackTraceDepth;
536 ULONG CryptoExponent;
538 ULONG LargePageMinimum;
540#if (NTDDI_VERSION >= NTDDI_WIN8)
541 ULONG AitSamplingValue;
544 ULONG GlobalValidationRunlevel;
545 volatile LONG TimeZoneBiasStamp;
546#if (NTDDI_VERSION >= NTDDI_WIN10)
558#if (NTDDI_VERSION >= NTDDI_WIN8)
559 USHORT NativeProcessorArchitecture;
566 volatile ULONG TimeSlip;
568#if (NTDDI_VERSION >= NTDDI_WIN10)
571 ULONG AltArchitecturePad[1];
578 UCHAR MitigationPolicies;
581 UCHAR NXSupportPolicy : 2;
582 UCHAR SEHValidationPolicy : 2;
583 UCHAR CurDirDevicesSkippedForDlls : 2;
587#if (NTDDI_VERSION >= NTDDI_WIN10_19H1)
592 volatile ULONG ActiveConsoleId;
593 volatile ULONG DismountCount;
594 ULONG ComPlusPackage;
595 ULONG LastSystemRITEventTickCount;
596 ULONG NumberOfPhysicalPages;
599#if (NTDDI_VERSION == NTDDI_WIN7)
605 UCHAR TscQpcEnabled:1;
606 UCHAR TscQpcSpareFlag:1;
611#elif (NTDDI_VERSION >= NTDDI_WIN10_RS1)
614 UCHAR VirtualizationFlags;
618 UCHAR ArchStartedInEl2 : 1;
619 UCHAR QcSlIsSupported : 1;
629#if (NTDDI_VERSION >= NTDDI_VISTA)
632 ULONG SharedDataFlags;
635 ULONG DbgErrorPortPresent : 1;
636 ULONG DbgElevationEnabled : 1;
637 ULONG DbgVirtEnabled : 1;
638 ULONG DbgInstallerDetectEnabled : 1;
639#if (NTDDI_VERSION >= NTDDI_WIN8)
640 ULONG DbgLkgEnabled : 1;
642 ULONG DbgSystemDllRelocated : 1;
644 ULONG DbgDynProcessorEnabled : 1;
645#if (NTDDI_VERSION >= NTDDI_WIN8)
646 ULONG DbgConsoleBrokerEnabled : 1;
648 ULONG DbgSEHValidationEnabled : 1;
650 ULONG DbgSecureBootEnabled : 1;
651 ULONG DbgMultiSessionSku : 1;
652 ULONG DbgMultiUsersInSessionSku : 1;
653 ULONG DbgStateSeparationEnabled : 1;
654 ULONG SpareBits : 21;
661 ULONG DataFlagsPad[1];
663#if (NTDDI_VERSION >= NTDDI_WIN8)
667 ULONG SystemCallReturn;
669#if (NTDDI_VERSION >= NTDDI_WIN10_TH2)
671 ULONG SystemCallPad0;
679 volatile ULONG64 TickCountQuad;
682 ULONG ReservedTickCountOverlay[3];
683 ULONG TickCountPad[1];
688#if (NTDDI_VERSION < NTDDI_VISTA)
695#if (NTDDI_VERSION >= NTDDI_VISTA)
698 LONGLONG ConsoleSessionForegroundProcessId;
700#if (NTDDI_VERSION >= NTDDI_WIN8)
701#if (NTDDI_VERSION >= NTDDI_WINBLUE)
710#if (NTDDI_VERSION >= NTDDI_WIN10)
711 UCHAR QpcSystemTimeIncrementShift;
712 UCHAR QpcInterruptTimeIncrementShift;
713 USHORT UnparkedProcessorCount;
714 ULONG EnclaveFeatureMask[4];
715 ULONG TelemetryCoverageRound;
717 ULONG QpcSystemTimeIncrement32;
718 ULONG QpcInterruptTimeIncrement32;
719 UCHAR QpcSystemTimeIncrementShift;
720 UCHAR QpcInterruptTimeIncrementShift;
721#if (NTDDI_VERSION >= NTDDI_WINBLUE)
722 USHORT UnparkedProcessorCount;
728#elif (NTDDI_VERSION >= NTDDI_VISTASP2)
734#if (NTDDI_VERSION >= NTDDI_WIN7)
735 USHORT UserModeGlobalLogger[16];
737 USHORT UserModeGlobalLogger[8];
738 ULONG HeapTracingPid[2];
739 ULONG CritSecTracingPid[2];
742 ULONG ImageFileExecutionOptions;
743 ULONG LangGenerationCount;
745#if (NTDDI_VERSION >= NTDDI_WIN8)
747#elif (NTDDI_VERSION >= NTDDI_WIN7)
763#if (NTDDI_VERSION >= NTDDI_WIN7)
765 ULONG ActiveProcessorCount;
767#if (NTDDI_VERSION >= NTDDI_WIN8)
768 volatile UCHAR ActiveGroupCount;
775 volatile UCHAR QpcBypassEnabled;
785 volatile ULONG AitSamplingValue;
786 volatile ULONG AppCompatFlag;
788 ULONG SystemDllWowRelocation;
797#if (NTDDI_VERSION >= NTDDI_WIN10_VB)
805#if (NTDDI_VERSION >= NTDDI_WIN11_NI)
809#if (NTDDI_VERSION < NTDDI_WIN7) && defined(__REACTOS__)
818typedef struct _VdmVirtualIca
831} VDMVIRTUALICA, *PVDMVIRTUALICA;
834typedef struct _VdmIcaUserData
837 PVDMVIRTUALICA pIcaMaster;
838 PVDMVIRTUALICA pIcaSlave;
847} VDMICAUSERDATA, *PVDMICAUSERDATA;
849typedef struct _VDM_INITIALIZE_DATA
852 PVDMICAUSERDATA IcaUserData;
853} VDM_INITIALIZE_DATA, *PVDM_INITIALIZE_DATA;
900#if (NTDDI_VERSION >= NTDDI_LONGHORN) || defined(_M_ARM) || defined(_M_AMD64)
974#if (NTDDI_VERSION >= NTDDI_LONGHORN)
980#if defined(_M_AMD64) || defined(_M_ARM)
986#if (NTDDI_VERSION >= NTDDI_LONGHORN) || defined(_M_ARM)
1064#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1081#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1086#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1121#if (NTDDI_VERSION >= NTDDI_WIN7)
1158#if (NTDDI_VERSION >= NTDDI_WIN8)
1166#if (NTDDI_VERSION >= NTDDI_WINBLUE)
1173#if (NTDDI_VERSION >= NTDDI_WIN10)
1204#if (NTDDI_VERSION >= NTDDI_WIN10)
1252 volatile UCHAR HeadNodeByte;
1265#if (NTDDI_VERSION >= NTDDI_WIN10)
1268 volatile UCHAR WaitingAndBusyByte;
1327#if (NTDDI_VERSION < NTDDI_WIN8)
1332#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1345#if (NTDDI_VERSION >= NTDDI_WIN7)
1353 ULONG KernelStackResident:1;
1359 ULONG GdiFlushActive:1;
1377#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1379#if (NTDDI_VERSION >= NTDDI_WIN7)
1399#if !defined(_M_AMD64) && !defined(_M_ARM64)
1407#if (NTDDI_VERSION >= NTDDI_WIN7)
1415#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1420 ULONG KernelStackResident:1;
1426 ULONG GdiFlushActive:1;
1436#if (NTDDI_VERSION < NTDDI_LONGHORN)
1440 volatile UCHAR SwapBusy;
1449#if !defined(_M_AMD64) && !defined(_M_ARM64)
1463#if (NTDDI_VERSION >= NTDDI_WIN7)
1483#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1484 ULONG EtwStackTraceApc1Inserted:1;
1485 ULONG EtwStackTraceApc2Inserted:1;
1486 ULONG CycleChargePending:1;
1491 ULONG ReservedFlags:23;
1493 LONG ReservedFlags:30;
1498#if defined(_WIN64) && (NTDDI_VERSION < NTDDI_WIN7)
1502#if (NTDDI_VERSION >= NTDDI_WIN7)
1512#if (NTDDI_VERSION < NTDDI_WIN7)
1516#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1517 UCHAR IdealProcessor;
1530 UCHAR ResourceIndex;
1542 ULONG ContextSwitches;
1557#if (NTDDI_VERSION >= NTDDI_WIN7)
1560 UCHAR WaitBlockFill7[168];
1561 PVOID TebMappedLowVa;
1562 struct _UMS_CONTROL_BLOCK* Ucb;
1567#if (NTDDI_VERSION >= NTDDI_WIN7)
1568 UCHAR WaitBlockFill8[188];
1576 SHORT KernelApcDisable;
1577 SHORT SpecialApcDisable;
1579 ULONG CombinedApcDisable;
1586#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1587 PVOID FirstArgument;
1590 PVOID CallbackStack;
1594 PVOID CallbackStack;
1596#if (NTDDI_VERSION < NTDDI_LONGHORN) || ((NTDDI_VERSION < NTDDI_WIN7) && !defined(_WIN64))
1599#if (NTDDI_VERSION < NTDDI_LONGHORN) && defined(_WIN64)
1602 UCHAR ApcStateIndex;
1603#if (NTDDI_VERSION < NTDDI_LONGHORN)
1604 UCHAR IdealProcessor;
1614 SCHAR PriorityDecrement;
1615#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1618 CHAR AdjustIncrement;
1619#if (NTDDI_VERSION >= NTDDI_WIN7)
1626#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1627 ULONG SystemCallNumber;
1628#if (NTDDI_VERSION >= NTDDI_WIN7)
1634#if (NTDDI_VERSION >= NTDDI_WIN7)
1638 ULONG IdealProcessor;
1639 ULONG UserIdealProcessor;
1652#if (NTDDI_VERSION >= NTDDI_WIN7)
1662#if (NTDDI_VERSION >= NTDDI_WIN7)
1665 UCHAR UserIdealProcessor;
1667#if (NTDDI_VERSION >= NTDDI_WIN7)
1668#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1671 UCHAR CalloutActive;
1674 UCHAR CodePatchInProgress;
1679#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1680 UCHAR OtherPlatformFill;
1692 UCHAR SuspendApcFill0[1];
1693#if (NTDDI_VERSION >= NTDDI_WIN7)
1694 UCHAR ResourceIndex;
1695#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1703 UCHAR SuspendApcFill1[3];
1708 UCHAR SuspendApcFill2[4];
1714#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1728#if (NTDDI_VERSION >= NTDDI_WIN7)
1748 ULONG SListFaultCount;
1753 ULONG SListFaultCount;
1756#if (NTDDI_VERSION >= NTDDI_LONGHORN)
1759 PVOID SListFaultAddress;
1761 LONG64 ReadOperationCount;
1762 LONG64 WriteOperationCount;
1763 LONG64 OtherOperationCount;
1764 LONG64 ReadTransferCount;
1765 LONG64 WriteTransferCount;
1766 LONG64 OtherTransferCount;
1768#if (NTDDI_VERSION >= NTDDI_WIN7)
1771#elif (NTDDI_VERSION >= NTDDI_LONGHORN)
1772 PVOID MdlForLockedTeb;
1774#if defined(__REACTOS__) && defined(_M_AMD64)
1781#if defined(_WIN64) && (NTDDI_VERSION < 0x06032580)
1782#define NUMBER_OF_LOCK_ENTRIES 5
1784#define NUMBER_OF_LOCK_ENTRIES 6
1814#if (NTDDI_VERSION < NTDDI_WIN10)
1815 ULONG KernelStackResident : 1;
1820#if (NTDDI_VERSION < NTDDI_WIN10TH2)
1827#if (NTDDI_VERSION < NTDDI_WIN81)
1828 ULONG CodePatchInProgress : 1;
1866#if (NTDDI_VERSION >= 0x060324D7)
1867 ULONG TerminationApcRequest : 1;
1869#if (NTDDI_VERSION >= 0x06032580)
1870 ULONG AutoBoostEntriesExhausted : 1;
1872#if (NTDDI_VERSION >= 0x06032580)
1873 ULONG KernelStackResident : 1;
1875#if (NTDDI_VERSION >= NTDDI_WIN10)
1881#if (NTDDI_VERSION < NTDDI_WIN10)
1882 ULONG ReservedFlags : 10;
1888#if (NTDDI_VERSION >= NTDDI_WIN10)
1918#if (NTDDI_VERSION >= NTDDI_WIN10)
1936#if (NTDDI_VERSION >= NTDDI_WIN8 )
1954#if (NTDDI_VERSION >= NTDDI_WIN10)
2000 struct _UMS_CONTROL_BLOCK* Ucb;
2001 struct _KUMS_CONTEXT_HEADER* Uch;
2018 PVOID TebMappedLowVa;
2021#if (NTDDI_VERSION >= 0x060223F0)
2027 ULONG NextProcessorNumber : 31;
2028 ULONG SharedReadyQueue : 1;
2061#if (NTDDI_VERSION >= NTDDI_WIN10)
2076#if (NTDDI_VERSION >= NTDDI_WIN10)
2139#if (NTDDI_VERSION >= NTDDI_WIN10)
2144 ULONG SecureThreadCookie;
2146#elif (NTDDI_VERSION >= NTDDI_WINBLUE)
2150#if (NTDDI_VERSION >= NTDDI_WINBLUE )
2157 #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
2161 #if (NTDDI_VERSION >= NTDDI_WIN10)
2164 volatile SHORT AbReferenceCount;
2166 #if (NTDDI_VERSION >= 0x06040000)
2167 UCHAR AbOrphanedEntrySummary;
2168 UCHAR AbOwnedEntryCount;
2186 LONG64 ReadOperationCount;
2187 LONG64 WriteOperationCount;
2188 LONG64 OtherOperationCount;
2189 LONG64 ReadTransferCount;
2190 LONG64 WriteTransferCount;
2191 LONG64 OtherTransferCount;
2193#if (NTDDI_VERSION >= NTDDI_WIN10)
2204#define ASSERT_THREAD(object) \
2205 ASSERT((((object)->Header.Type & KOBJECT_TYPE_MASK) == ThreadObject))
2214#if (NTDDI_VERSION >= NTDDI_LONGHORN)
2263#if (NTDDI_VERSION >= NTDDI_LONGHORN)
2268#define ASSERT_PROCESS(object) \
2269 ASSERT((((object)->Header.Type & KOBJECT_TYPE_MASK) == ProcessObject))
2280 LONG TableBaseGpOffset;
2285#if (NTDDI_VERSION >= NTDDI_WIN8)
2301#define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER 0x400
2302#define KENTROPY_TIMING_BUFFER_MASK 0x7ff
2303#define KENTROPY_TIMING_ANALYSIS 0x0
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
static SERVICE_TABLE_ENTRYW ServiceTable[2]
enum _NT_PRODUCT_TYPE NT_PRODUCT_TYPE
enum _NT_PRODUCT_TYPE * PNT_PRODUCT_TYPE
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
enum _KPROFILE_SOURCE KPROFILE_SOURCE
VOID(CALLBACK * PTIMER_APC_ROUTINE)(PVOID, ULONG, LONG)
@ ProfileIntegerInstructions
@ ProfileBranchMispredictions
@ ProfileStoreInstructions
@ ProfileMemoryBarrierCycles
@ ProfileLoadLinkedIssues
@ ProfileSpecialInstructions
@ ProfileBranchInstructions
@ ProfileLoadInstructions
BOOLEAN KdDebuggerEnabled
#define NUMBER_OF_LOCK_ENTRIES
struct _KINTERRUPT KINTERRUPT
VOID(NTAPI * PKSYSTEM_ROUTINE)(PKSTART_ROUTINE StartRoutine, PVOID StartContext)
ULONG NTSYSAPI KeIcacheFlushCount
struct _KPROFILE KPROFILE
struct _KDPC_DATA KDPC_DATA
struct _KTHREAD_COUNTERS KTHREAD_COUNTERS
struct _KDPC_LIST KDPC_LIST
struct _COUNTER_READING * PCOUNTER_READING
struct _KEXECUTE_OPTIONS KEXECUTE_OPTIONS
struct _KDPC_LIST * PKDPC_LIST
enum _ADJUST_REASON ADJUST_REASON
struct _KEVENT_PAIR * PKEVENT_PAIR
@ EventSynchronizationObject
@ TimerNotificationObject
@ TimerSynchronizationObject
@ EventNotificationObject
struct _PP_LOOKASIDE_LIST * PPP_LOOKASIDE_LIST
ULONG_PTR NTSYSAPI KiBugCheckData[]
struct _KEVENT_PAIR KEVENT_PAIR
struct _KTHREAD_COUNTERS * PKTHREAD_COUNTERS
enum _KCONTINUE_STATUS KCONTINUE_STATUS
struct _RTL_RB_TREE RTL_RB_TREE
FIXME: should move to rtltypes.h, but we can't include it here.
struct _KLOCK_ENTRY KLOCK_ENTRY
struct _KDPC_DATA * PKDPC_DATA
struct _KTIMER_TABLE KTIMER_TABLE
ULONG NTSYSAPI KiDmaIoCoherency
struct _PP_LOOKASIDE_LIST PP_LOOKASIDE_LIST
@ VdmPrinterDirectIoClose
enum _KTHREAD_STATE KTHREAD_STATE
struct _COUNTER_READING COUNTER_READING
struct _KLOCK_ENTRY * PKLOCK_ENTRY
ULONG NTSYSAPI KeMaximumIncrement
struct _KTIMER_TABLE_ENTRY * PKTIMER_TABLE_ENTRY
struct _KPROCESS KPROCESS
VOID(NTAPI * PKRUNDOWN_ROUTINE)(IN struct _KAPC *Apc)
struct _KLOCK_ENTRY_LOCK_STATE KLOCK_ENTRY_LOCK_STATE
union _KWAIT_STATUS_REGISTER KWAIT_STATUS_REGISTER
struct _KPROFILE * PKPROFILE
struct _KTIMER_TABLE * PKTIMER_TABLE
struct _KENTROPY_TIMING_STATE * PKENTROPY_TIMING_STATE
enum _KPROCESS_STATE KPROCESS_STATE
enum _KTHREAD_STATE * PKTHREAD_STATE
struct _KSERVICE_TABLE_DESCRIPTOR KSERVICE_TABLE_DESCRIPTOR
BOOLEAN NTSYSAPI KiEnableTimerWatchdog
enum _KPROCESS_STATE * PKPROCESS_STATE
KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTable[SSDT_MAX_ENTRIES]
enum _VDMSERVICECLASS VDMSERVICECLASS
struct _GETSETCONTEXT * PGETSETCONTEXT
ULONG NTSYSAPI KeDcacheFlushCount
@ ContinueProcessorReselected
struct _KEXECUTE_OPTIONS * PKEXECUTE_OPTIONS
struct _KSERVICE_TABLE_DESCRIPTOR * PKSERVICE_TABLE_DESCRIPTOR
struct _KENTROPY_TIMING_STATE KENTROPY_TIMING_STATE
struct _LOADER_PARAMETER_BLOCK NTSYSAPI * KeLoaderBlock
union _KWAIT_STATUS_REGISTER * PKWAIT_STATUS_REGISTER
struct _GETSETCONTEXT GETSETCONTEXT
VOID(NTAPI * PKKERNEL_ROUTINE)(IN struct _KAPC *Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine OPTIONAL, IN OUT PVOID *NormalContext OPTIONAL, IN OUT PVOID *SystemArgument1 OPTIONAL, IN OUT PVOID *SystemArgument2 OPTIONAL)
struct _SYNCH_COUNTERS SYNCH_COUNTERS
KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTableShadow[SSDT_MAX_ENTRIES]
struct _SYNCH_COUNTERS * PSYNCH_COUNTERS
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
struct _RTL_RB_TREE * PRTL_RB_TREE
ULONG NTSYSAPI KeMinimumIncrement
struct _KTIMER_TABLE_ENTRY KTIMER_TABLE_ENTRY
enum _KAPC_ENVIRONMENT KAPC_ENVIRONMENT
struct _KLOCK_ENTRY_LOCK_STATE * PKLOCK_ENTRY_LOCK_STATE
#define DECLSPEC_ALIGN(x)
#define RTL_SIZEOF_THROUGH_FIELD(type, field)
enum _TIMER_TYPE TIMER_TYPE
enum _EVENT_TYPE EVENT_TYPE
enum _WAIT_TYPE WAIT_TYPE
UNICODE_STRING NtSystemRoot
enum _KINTERRUPT_MODE KINTERRUPT_MODE
enum _HARDWARE_COUNTER_TYPE Type
ULONG GuaranteedStackBytes
struct _ACTIVATION_CONTEXT_STACK * ActivationContextStackPointer
struct _EXCEPTION_REGISTRATION_RECORD * ExceptionList
volatile ULONG DpcQueueDepth
SINGLE_LIST_ENTRY ListHead
SINGLE_LIST_ENTRY * LastEntry
ULONG LastDeliveredBuffer
UCHAR DisableThunkEmulation
UCHAR ExecuteDispatchEnable
UCHAR ImageDispatchEnable
PKINTERRUPT_ROUTINE DispatchAddress
ULONG DispatchCode[DISPATCH_LENGTH]
KINTERRUPT_POLARITY Polarity
PKSERVICE_ROUTINE MessageServiceRoutine
LIST_ENTRY InterruptListEntry
PKSERVICE_ROUTINE ServiceRoutine
ULONG_PTR CrossThreadReleasable
KLOCK_ENTRY_LOCK_STATE LockState
volatile UCHAR CrossThreadReleasableAndBusyByte
SINGLE_LIST_ENTRY FreeListEntry
RTL_BALANCED_NODE TreeNode
USHORT IoNormalPriorityWaiterCount
SLIST_HEADER DeadStackList
struct _SINGLE_LIST_ENTRY * PfnDeferredList
struct _KNODE::_flags Flags
SLIST_HEADER PfnDereferenceSListHead
LIST_ENTRY ProcessListEntry
SINGLE_LIST_ENTRY SwapListEntry
volatile KAFFINITY ActiveProcessors
ULONG_PTR DirectoryTableBase
LIST_ENTRY ProfileListHead
LIST_ENTRY ThreadListHead
struct _KPROCESS * Process
LIST_ENTRY ProfileListEntry
struct _THREAD_PERFORMANCE_DATA * UserData
COUNTER_READING HwCounter[16]
ULONG ApcInterruptRequest
UCHAR SchedulerApcFill4[FIELD_OFFSET(KAPC, SystemArgument2)]
ULONG UserStackWalkActive
volatile INT_PTR WaitStatus
UCHAR CallbackNestingLevel
LONG AbCompletedIoQoSBoostCount
ULONG_PTR AffinityVersion
UCHAR WaitBlockFill10[2 *sizeof(KWAIT_BLOCK)+FIELD_OFFSET(KWAIT_BLOCK, SparePtr)]
ULONG_PTR InGlobalForegroundList
ULONG SystemAffinityActive
BOOLEAN Alerted[MaximumMode]
volatile ULONG64 CycleTime
LIST_ENTRY GlobalForegroundListEntry
volatile LONG AbCompletedIoBoostCount
UCHAR ApcStateFill[RTL_SIZEOF_THROUGH_FIELD(KAPC_STATE, UserApcPending)]
ULONG CommitFailTerminateRequest
UCHAR SuspendApcFill3[FIELD_OFFSET(KAPC, SystemArgument1)]
UCHAR SchedulerApcFill0[FIELD_OFFSET(KAPC, SpareByte0)]
struct _KTHREAD_COUNTERS * ThreadCounters
SINGLE_LIST_ENTRY SwapListEntry
KLOCK_ENTRY LockEntries[NUMBER_OF_LOCK_ENTRIES]
ULONG QueueDeferPreemption
UCHAR SchedulerApcFill5[FIELD_OFFSET(KAPC, Inserted)+1]
GROUP_AFFINITY UserAffinity
LIST_ENTRY ThreadListEntry
UCHAR SystemHeteroCpuPolicy
ULONG UmsPerformingSyscall
UCHAR UserHeteroCpuPolicy
UCHAR SchedulerApcFill2[FIELD_OFFSET(KAPC, SpareLong0)]
UCHAR AffinityFill[FIELD_OFFSET(GROUP_AFFINITY, Reserved)]
ULONG PriorityFloorSummary
volatile SHORT KeReferenceCount
ULONG ExplicitIdealProcessor
UCHAR WaitBlockFill8[FIELD_OFFSET(KWAIT_BLOCK, SparePtr)]
volatile ULONG HighCycleTime
LIST_ENTRY MutantListHead
UCHAR SchedulerApcFill1[FIELD_OFFSET(KAPC, SpareByte1)]
UCHAR PriorityFloorCounts[16]
UCHAR ExplicitSystemHeteroCpuPolicy
SINGLE_LIST_ENTRY IoSelfBoostsEntry
SINGLE_LIST_ENTRY PropagateBoostsEntry
KWAIT_STATUS_REGISTER WaitRegister
PKWAIT_BLOCK WaitBlockList
ULONG ProcessStackCountDecremented
ULONG64 RelativeTimerBias
ULONG EtwStackTraceApcInserted
UCHAR SavedApcStateFill[FIELD_OFFSET(KAPC_STATE, UserApcPending)+1]
UCHAR WaitBlockFill9[1 *sizeof(KWAIT_BLOCK)+FIELD_OFFSET(KWAIT_BLOCK, SparePtr)]
XSAVE_FORMAT * StateSaveArea
UCHAR WaitBlockFill11[3 *sizeof(KWAIT_BLOCK)+FIELD_OFFSET(KWAIT_BLOCK, Object)]
volatile VOID * StackLimit
LIST_ENTRY QueueListEntry
ULONG ProcessDetachActive
struct _KSCHEDULING_GROUP * SchedulingGroup
ULONG UmsDirectedSwitchEnable
SINGLE_LIST_ENTRY ForegroundDpcStackListEntry
UCHAR UserAffinityFill[FIELD_OFFSET(GROUP_AFFINITY, Reserved)]
KTIMER_TABLE_ENTRY TimerEntries[256]
struct _GENERAL_LOOKASIDE * P
struct _GENERAL_LOOKASIDE * L
FIXME: should move to rtltypes.h, but we can't include it here.
ULONG ExTryToAcqExclusiveAcquires
ULONG ExTryToAcqExclusiveAttempts
ULONG ExInitializeResourceCount
ULONG ExecutiveResourceReleaseSharedCount
ULONG ExAcqResSharedAcquiresExclusive
ULONG ExAcqResExclusiveNotAcquires
ULONG ExAcqResSharedStarveExclusiveNotAcquires
ULONG ExSetResOwnerPointerSharedOld
ULONG ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive
ULONG ExAcqResExclusiveAcquiresExclusiveRecursive
ULONG ExEtwSynchTrackingNotificationsAccountedCount
ULONG ExecutiveResourceConvertsCount
ULONG ExecutiveResourceReleaseExclusiveCount
ULONG IpiSendRequestBroadcastCount
ULONG ExAcqResExclusiveWaits
ULONG ExAcqResSharedWaitForExclusiveWaits
ULONG ExAcqResSharedWaits
ULONG ExAcqResSharedWaitForExclusiveAcquiresExclusive
ULONG SpinLockContentionCount
ULONG ExAcqResSharedStarveExclusiveAttempts
ULONG ExAcqResSharedAttempts
ULONG ExDeleteResourceCount
ULONG ExecutiveResourceContentionsCount
ULONG ExAcqResSharedWaitForExclusiveAttempts
ULONG ExAcqResSharedWaitForExclusiveNotAcquires
ULONG ExEtwSynchTrackingNotificationsCount
ULONG ExBoostSharedOwners
ULONG IpiSendRequestRoutineCount
ULONG ExAcqResSharedStarveExclusiveAcquiresSharedRecursive
ULONG ExAcqResSharedStarveExclusiveAcquiresShared
ULONG ExAcqResSharedStarveExclusiveWaits
ULONG ExAcqResSharedAcquiresShared
ULONG IpiSendSoftwareInterruptCount
ULONG ExSetResOwnerPointerExclusive
ULONG ExAcqResSharedNotAcquires
ULONG ExReInitializeResourceCount
ULONG ExAcqResSharedWaitForExclusiveAcquiresShared
ULONG ExecutiveResourceAcquiresCount
ULONG ExAcqResSharedStarveExclusiveAcquiresExclusive
ULONG ExAcqResExclusiveAttempts
ULONG ExSetResOwnerPointerSharedNew
ULONG ExAcqResExclusiveAcquiresExclusive
ULONG SpinLockAcquireCount
ULONG ExBoostExclusiveOwner
ULONG ExAcqResSharedAcquiresSharedRecursive
#define FIELD_OFFSET(t, f)
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_ PWDFDEVICE_INIT _In_ WDF_DEVICE_POWER_STATE PowerState
_Reserved_ PVOID Reserved
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
_In_ LARGE_INTEGER _In_ ULONG Period
_In_ LONG _In_ LONG Limit
#define PROCESSOR_FEATURE_MAX
KSTART_ROUTINE * PKSTART_ROUTINE
struct _KSYSTEM_TIME KSYSTEM_TIME
KSERVICE_ROUTINE * PKSERVICE_ROUTINE
#define MAX_WOW64_SHARED_ENTRIES
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
struct _KWAIT_BLOCK KWAIT_BLOCK
enum _KINTERRUPT_POLARITY KINTERRUPT_POLARITY
#define THREAD_WAIT_OBJECTS
_ALTERNATIVE_ARCHITECTURE_TYPE
struct _KSYSTEM_TIME * PKSYSTEM_TIME
VOID(NTAPI * PKINTERRUPT_ROUTINE)(VOID)
enum _KWAIT_REASON KWAIT_REASON
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
enum _ALTERNATIVE_ARCHITECTURE_TYPE ALTERNATIVE_ARCHITECTURE_TYPE
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
_In_ PLARGE_INTEGER _In_opt_ PTIMER_APC_ROUTINE _In_opt_ PVOID TimerContext