ntkrnlpa.exe.h

一个 windows 内核级别的调试器

struct _KSPIN_LOCK_QUEUE
{
    struct _KSPIN_LOCK_QUEUE* Next;
    DWORD* Lock;
};

struct _KSPIN_LOCK_QUEUE;

DWORD;

BYTE;

struct _KNODE
{
    DWORD ProcessorMask;
    DWORD Color;
    DWORD FreeCount[2];
    struct _SLIST_HEADER DeadStackList;
    struct _SLIST_HEADER PfnDereferenceSListHead;
    struct _SINGLE_LIST_ENTRY* PfnDeferredList;
    BYTE Seed;
    struct _flags Flags;
};

struct _KNODE*;

DWORD;

void*;

DWORD;

struct _PP_LOOKASIDE_LIST
{
    struct _NPAGED_LOOKASIDE_LIST* P;
    struct _NPAGED_LOOKASIDE_LIST* L;
};

struct _PP_LOOKASIDE_LIST;

struct _PP_LOOKASIDE_LIST;

BYTE;

void*;

void*;

INVALID_TYPE*;

INVALID_TYPE*;

DWORD;

struct _LIST_ENTRY
{
    struct _LIST_ENTRY* Flink;
    struct _LIST_ENTRY* Blink;
};

DWORD;

BYTE;

DWORD;

struct _FX_SAVE_AREA
{
    struct UnnamedStruct_5E3F68 U;
    DWORD NpxSavedCpu;
    DWORD Cr0NpxState;
};

struct _PROCESSOR_POWER_STATE
{
    INVALID_TYPE* IdleFunction;
    DWORD Idle0KernelTimeLimit;
    DWORD Idle0LastTime;
    void* IdleHandlers;
    void* IdleState;
    DWORD IdleHandlersCount;
    ULONGLONG LastCheck;
    struct PROCESSOR_IDLE_TIMES IdleTimes;
    DWORD IdleTime1;
    DWORD PromotionCheck;
    DWORD IdleTime2;
    BYTE CurrentThrottle;
    BYTE ThermalThrottleLimit;
    BYTE CurrentThrottleIndex;
    BYTE ThermalThrottleIndex;
    DWORD PerfSystemTime;
    DWORD PerfIdleTime;
    ULONGLONG DebugDelta;
    DWORD DebugCount;
    DWORD LastSysTime;
    ULONGLONG TotalIdleStateTime[3];
    DWORD TotalIdleTransitions[3];
    ULONGLONG PreviousC3StateTime;
    BYTE KneeThrottleIndex;
    BYTE ThrottleLimitIndex;
    BYTE PerfStatesCount;
    BYTE ProcessorMinThrottle;
    BYTE ProcessorMaxThrottle;
    BYTE LastBusyPercentage;
    BYTE LastC3Percentage;
    BYTE LastAdjustedBusyPercentage;
    DWORD PromotionCount;
    DWORD DemotionCount;
    DWORD ErrorCount;
    DWORD RetryCount;
    DWORD Flags;
    struct _LARGE_INTEGER PerfCounterFrequency;
    DWORD PerfTickCount;
    struct _KTIMER PerfTimer;
    struct _KDPC PerfDpc;
    struct PROCESSOR_PERF_STATE* PerfStates;
    INVALID_TYPE* PerfSetThrottle;
    DWORD Spare1[2];
};

struct UnnamedStruct_3167D0
{
    WORD MinorVersion;
    WORD MajorVersion;
    struct _KTHREAD* CurrentThread;
    struct _KTHREAD* NextThread;
    struct _KTHREAD* IdleThread;
    char Number;
    char Reserved;
    WORD BuildType;
    DWORD SetMember;
    char CpuType;
    char CpuID;
    WORD CpuStep;
    struct _KPROCESSOR_STATE ProcessorState;
    DWORD KernelReserved[16];
    DWORD HalReserved[16];
    struct _KSPIN_LOCK_QUEUE LockQueue[16];
    struct _KTHREAD* NpxThread;
    DWORD InterruptCount;
    DWORD KernelTime;
    DWORD UserTime;
    DWORD DpcTime;
    DWORD InterruptTime;
    DWORD Spare1[1];
    BYTE MultiThreadSetBusy;
    BYTE Spare2[3];
    DWORD AdjustDpcThreshold;
    DWORD DebugDpcTime;
    DWORD PageColor;
    struct _KNODE* ParentNode;
    DWORD MultiThreadProcessorSet;
    struct _KPRCB* MultiThreadSetMaster;
    DWORD ThreadStartCount[2];
    void* SpareHotData[2];
    DWORD CcFastReadNoWait;
    DWORD CcFastReadWait;
    DWORD CcFastReadNotPossible;
    DWORD CcCopyReadNoWait;
    DWORD CcCopyReadWait;
    DWORD CcCopyReadNoWaitMiss;
    DWORD KeAlignmentFixupCount;
    DWORD KeContextSwitches;
    DWORD KeDcacheFlushCount;
    DWORD KeExceptionDispatchCount;
    DWORD KeFirstLevelTbFills;
    DWORD KeFloatingEmulationCount;
    DWORD KeIcacheFlushCount;
    DWORD KeSecondLevelTbFills;
    DWORD KeSystemCalls;
    DWORD ReservedCounter[8];
    void* SmallIrpFreeEntry;
    void* LargeIrpFreeEntry;
    void* MdlFreeEntry;
    void* CreateInfoFreeEntry;
    void* NameBufferFreeEntry;
    void* SharedCacheMapEntry;
    DWORD CachePad0[2];
    struct _PP_LOOKASIDE_LIST PPLookasideList[16];
    struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[32];
    struct _PP_LOOKASIDE_LIST PPPagedLookasideList[32];
    BYTE ReservedPad[124];
    INVALID_TYPE PacketBarrier;
    void* CurrentPacket[3];
    INVALID_TYPE TargetSet;
    INVALID_TYPE* WorkerRoutine;
    INVALID_TYPE IpiFrozen;
    DWORD CachePad1[2];
    INVALID_TYPE RequestSummary;
    INVALID_TYPE* SignalDone;
    INVALID_TYPE ReverseStall;
    void* IpiFrame;
    DWORD CachePad2[4];
    DWORD DpcInterruptRequested;
    void* ChainedInterruptList;
    DWORD CachePad3[2];
    DWORD MaximumDpcQueueDepth;
    DWORD MinimumDpcRate;
    DWORD CachePad4[2];
    struct _LIST_ENTRY DpcListHead;
    DWORD DpcQueueDepth;
    DWORD DpcRoutineActive;
    DWORD DpcCount;
    DWORD DpcLastCount;
    DWORD DpcRequestRate;
    void* DpcStack;
    DWORD KernelReserved2[10];
    DWORD DpcLock;
    BYTE SkipTick;
    BYTE VendorString[13];
    BYTE InitialApicId;
    BYTE LogicalProcessorsPerPhysicalProcessor;
    DWORD MHz;
    DWORD FeatureBits;
    struct _LARGE_INTEGER UpdateSignature;
    DWORD QuantumEnd;
    DWORD NpxPad[3];
    struct _FX_SAVE_AREA NpxSaveArea;
    struct _PROCESSOR_POWER_STATE PowerState;
};

struct _LUID*;

struct _EX_FAST_REF
{
    void* Object;
    DWORD RefCnt;
    DWORD Value;
};

struct UnnamedBitfield_319D10
{
    WORD MinorVersion;
    WORD MajorVersion;
    struct _KTHREAD* CurrentThread;
    struct _KTHREAD* NextThread;
    struct _KTHREAD* IdleThread;
    char Number;
    char Reserved;
    WORD BuildType;
    DWORD SetMember;
    char CpuType;
    char CpuID;
    WORD CpuStep;
    struct _KPROCESSOR_STATE ProcessorState;
    DWORD KernelReserved;
    DWORD HalReserved;
    struct _KSPIN_LOCK_QUEUE LockQueue;
    struct _KTHREAD* NpxThread;
    DWORD InterruptCount;
    DWORD KernelTime;
    DWORD UserTime;
    DWORD DpcTime;
    DWORD InterruptTime;
    DWORD Spare1;
    BYTE MultiThreadSetBusy;
    BYTE Spare2;
    DWORD AdjustDpcThreshold;
    DWORD DebugDpcTime;
    DWORD PageColor;
    struct _KNODE* ParentNode;
    DWORD MultiThreadProcessorSet;
    struct _KPRCB* MultiThreadSetMaster;
    DWORD ThreadStartCount;
    void* SpareHotData;
    DWORD CcFastReadNoWait;
    DWORD CcFastReadWait;
    DWORD CcFastReadNotPossible;
    DWORD CcCopyReadNoWait;
    DWORD CcCopyReadWait;
    DWORD CcCopyReadNoWaitMiss;
    DWORD KeAlignmentFixupCount;
    DWORD KeContextSwitches;
    DWORD KeDcacheFlushCount;
    DWORD KeExceptionDispatchCount;
    DWORD KeFirstLevelTbFills;
    DWORD KeFloatingEmulationCount;
    DWORD KeIcacheFlushCount;
    DWORD KeSecondLevelTbFills;
    DWORD KeSystemCalls;
    DWORD ReservedCounter;
    void* SmallIrpFreeEntry;
    void* LargeIrpFreeEntry;
    void* MdlFreeEntry;
    void* CreateInfoFreeEntry;
    void* NameBufferFreeEntry;
    void* SharedCacheMapEntry;
    DWORD CachePad0;
    struct _PP_LOOKASIDE_LIST PPLookasideList;
    struct _PP_LOOKASIDE_LIST PPNPagedLookasideList;
    struct _PP_LOOKASIDE_LIST PPPagedLookasideList;
    BYTE ReservedPad;
    INVALID_TYPE PacketBarrier;
    void* CurrentPacket;
    INVALID_TYPE TargetSet;
    INVALID_TYPE* WorkerRoutine;
    INVALID_TYPE IpiFrozen;
    DWORD CachePad1;
    INVALID_TYPE RequestSummary;
    INVALID_TYPE* SignalDone;
    INVALID_TYPE ReverseStall;
    void* IpiFrame;
    DWORD CachePad2;
    DWORD DpcInterruptRequested;
    void* ChainedInterruptList;
    DWORD CachePad3;
    DWORD MaximumDpcQueueDepth;
    DWORD MinimumDpcRate;
    DWORD CachePad4;
    struct _LIST_ENTRY DpcListHead;
    DWORD DpcQueueDepth;
    DWORD DpcRoutineActive;
    DWORD DpcCount;
    DWORD DpcLastCount;
    DWORD DpcRequestRate;
    void* DpcStack;
    DWORD KernelReserved2;
    DWORD DpcLock;
    BYTE SkipTick;
    BYTE VendorString;
    BYTE InitialApicId;
    BYTE LogicalProcessorsPerPhysicalProcessor;
    DWORD MHz;
    DWORD FeatureBits;
    struct _LARGE_INTEGER UpdateSignature;
    DWORD QuantumEnd;
    DWORD NpxPad;
    struct _FX_SAVE_AREA NpxSaveArea;
    struct _PROCESSOR_POWER_STATE PowerState;
};

struct UnnamedStruct_319D58
{
    void* Object;
    DWORD RefCnt;
    DWORD Value;
};

struct _EX_FAST_REF*;

struct _EX_PUSH_LOCK
{
    DWORD Waiting;
    DWORD Exclusive;
    DWORD Shared;
    DWORD Value;
    void* Ptr;
};

struct _EX_PUSH_LOCK*;

struct UnnamedBitfield_31A040
{
    void* Object;
    DWORD RefCnt;
    DWORD Value;
};

struct UnnamedBitfield_31A088
{
     (null);
};

struct UnnamedBitfield_31A0D0
{
     (null);
};

struct UnnamedStruct_31A118
{
    DWORD Waiting;
    DWORD Exclusive;
    DWORD Shared;
    DWORD Value;
    void* Ptr;
};

struct _EX_PUSH_LOCK_WAIT_BLOCK
{
    struct _KEVENT WakeEvent;
    struct _EX_PUSH_LOCK_WAIT_BLOCK* Next;
    DWORD ShareCount;
    BYTE Exclusive;
};

struct _EX_PUSH_LOCK_WAIT_BLOCK*;

struct _KEVENT
{
    struct _DISPATCHER_HEADER Header;
};

struct UnnamedStruct_31A538
{
    struct _KEVENT WakeEvent;
    struct _EX_PUSH_LOCK_WAIT_BLOCK* Next;
    DWORD ShareCount;
    BYTE Exclusive;
};

struct _ETHREAD
{
    struct _KTHREAD Tcb;
    struct _LARGE_INTEGER CreateTime;
    unsigned NestedFaultCount;
    unsigned ApcNeeded;
    struct _LARGE_INTEGER ExitTime;
    struct _LIST_ENTRY LpcReplyChain;
    long ExitStatus;
    void* OfsChain;
    struct _LIST_ENTRY PostBlockList;
    struct _TERMINATION_PORT* TerminationPort;
    struct _ETHREAD* ReaperLink;
    DWORD ActiveTimerListLock;
    struct _LIST_ENTRY ActiveTimerListHead;
    struct _CLIENT_ID Cid;
    struct _KSEMAPHORE LpcReplySemaphore;
    void* LpcReplyMessage;
    void* LpcWaitingOnPort;
    struct _PS_IMPERSONATION_INFORMATION* ImpersonationInfo;
    struct _LIST_ENTRY IrpList;
    DWORD TopLevelIrp;
    struct _DEVICE_OBJECT* DeviceToVerify;
    struct _EPROCESS* ThreadsProcess;
    void* StartAddress;
    void* Win32StartAddress;
    DWORD LpcReceivedMessageId;
    struct _LIST_ENTRY ThreadListEntry;
    struct _EX_RUNDOWN_REF RundownProtect;
    DWORD LpcReplyMessageId;
    DWORD ReadClusterSize;
    DWORD GrantedAccess;
    DWORD CrossThreadFlags;
    DWORD Terminated;
    DWORD DeadThread;
    DWORD HideFromDebugger;
    DWORD ActiveImpersonationInfo;
    DWORD SystemThread;
    DWORD HardErrorsAreDisabled;
    DWORD BreakOnTermination;
    DWORD SameThreadPassiveFlags;
    DWORD ActiveExWorker;
    DWORD ExWorkerCanWaitUser;
    DWORD MemoryMaker;
    DWORD SameThreadApcFlags;
    BYTE LpcReceivedMsgIdValid;
    BYTE LpcExitThreadCalled;
    BYTE AddressSpaceOwner;
    BYTE ForwardClusterOnly;
    BYTE DisablePageFaultClustering;
};

struct _ETHREAD*;

struct UnnamedBitfield_31A848
{
    struct _KEVENT WakeEvent;
    struct _EX_PUSH_LOCK_WAIT_BLOCK* Next;
    DWORD ShareCount;
    BYTE Exclusive;
};

struct UnnamedBitfield_31A890
{
     (null);
};

struct _TERMINATION_PORT
{
    struct _TERMINATION_PORT* Next;
    void* Port;
};

struct _TERMINATION_PORT*;

struct _CLIENT_ID
{
    void* UniqueProcess;
    void* UniqueThread;
};

struct _KSEMAPHORE
{
    struct _DISPATCHER_HEADER Header;
    long Limit;
};

struct _PS_IMPERSONATION_INFORMATION
{
    void* Token;
    BYTE CopyOnOpen;
    BYTE EffectiveOnly;
    enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
};

struct _PS_IMPERSONATION_INFORMATION*;

struct _DEVICE_OBJECT
{
    short Type;
    WORD Size;
    long ReferenceCount;
    struct _DRIVER_OBJECT* DriverObject;
    struct _DEVICE_OBJECT* NextDevice;
    struct _DEVICE_OBJECT* AttachedDevice;
    struct _IRP* CurrentIrp;
    struct _IO_TIMER* Timer;
    DWORD Flags;
    DWORD Characteristics;
    struct _VPB* Vpb;
    void* DeviceExtension;
    DWORD DeviceType;
    char StackSize;
    struct UnnamedStruct_6118D0 Queue;
    DWORD AlignmentRequirement;
    struct _KDEVICE_QUEUE DeviceQueue;
    struct _KDPC Dpc;
    DWORD ActiveThreadCount;
    void* SecurityDescriptor;
    struct _KEVENT DeviceLock;
    WORD SectorSize;
    WORD Spare1;
    struct _DEVOBJ_EXTENSION* DeviceObjectExtension;
    void* Reserved;
};

struct _DEVICE_OBJECT*;

struct _EPROCESS
{
    struct _KPROCESS Pcb;
    struct _EX_PUSH_LOCK ProcessLock;
    struct _LARGE_INTEGER CreateTime;
    struct _LARGE_INTEGER ExitTime;
    struct _EX_RUNDOWN_REF RundownProtect;
    void* UniqueProcessId;
    struct _LIST_ENTRY ActiveProcessLinks;
    DWORD QuotaUsage[3];
    DWORD QuotaPeak[3];
    DWORD CommitCharge;
    DWORD PeakVirtualSize;
    DWORD VirtualSize;
    struct _LIST_ENTRY SessionProcessLinks;
    void* DebugPort;
    void* ExceptionPort;
    struct _HANDLE_TABLE* ObjectTable;
    struct _EX_FAST_REF Token;
    struct _FAST_MUTEX WorkingSetLock;
    DWORD WorkingSetPage;
    struct _FAST_MUTEX AddressCreationLock;
    DWORD HyperSpaceLock;
    struct _ETHREAD* ForkInProgress;
    void* PaeTop;
    void* VadRoot;
    void* VadHint;
    void* CloneRoot;
    DWORD NumberOfPrivatePages;
    DWORD NumberOfLockedPages;
    void* Win32Process;
    struct _EJOB* Job;
    void* SectionObject;
    void* SectionBaseAddress;
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;
    void* Win32WindowStation;
    void* InheritedFromUniqueProcessId;
    void* LdtInformation;
    void* VadFreeHint;
    void* VdmObjects;