ntkrnlpa.exe.h

一个 windows 内核级别的调试器

    BYTE RegisterArea[80];
};

struct _FXSAVE_FORMAT
{
    WORD ControlWord;
    WORD StatusWord;
    WORD TagWord;
    WORD ErrorOpcode;
    DWORD ErrorOffset;
    DWORD ErrorSelector;
    DWORD DataOffset;
    DWORD DataSelector;
    DWORD MXCsr;
    DWORD MXCsrMask;
    BYTE RegisterArea[128];
    BYTE Reserved3[128];
    BYTE Reserved4[224];
    BYTE Align16Byte[8];
};

struct UnnamedStruct_5E3E20
{
    struct _FNSAVE_FORMAT FnArea;
    struct _FXSAVE_FORMAT FxArea;
};

struct UnnamedStruct_5E3F68
{
    struct _FNSAVE_FORMAT FnArea;
    struct _FXSAVE_FORMAT FxArea;
};

struct UnnamedStruct_5E3FB0
{
    struct UnnamedStruct_5E3F68 U;
    DWORD NpxSavedCpu;
    DWORD Cr0NpxState;
};

struct _VACB
{
    void* BaseAddress;
    struct _SHARED_CACHE_MAP* SharedCacheMap;
    struct UnnamedStruct_5E44A8 Overlay;
    struct _LIST_ENTRY LruList;
};

struct _VACB*;

struct _VACB**;

struct _SHARED_CACHE_MAP
{
    short NodeTypeCode;
    short NodeByteSize;
    DWORD OpenCount;
    struct _LARGE_INTEGER FileSize;
    struct _LIST_ENTRY BcbList;
    struct _LARGE_INTEGER SectionSize;
    struct _LARGE_INTEGER ValidDataLength;
    struct _LARGE_INTEGER ValidDataGoal;
    struct _VACB* InitialVacbs[4];
    struct _VACB** Vacbs;
    struct _FILE_OBJECT* FileObject;
    struct _VACB* ActiveVacb;
    void* NeedToZero;
    DWORD ActivePage;
    DWORD NeedToZeroPage;
    DWORD ActiveVacbSpinLock;
    DWORD VacbActiveCount;
    DWORD DirtyPages;
    struct _LIST_ENTRY SharedCacheMapLinks;
    DWORD Flags;
    long Status;
    struct _MBCB* Mbcb;
    void* Section;
    struct _KEVENT* CreateEvent;
    struct _KEVENT* WaitOnActiveCount;
    DWORD PagesToWrite;
    __int64 BeyondLastFlush;
    struct _CACHE_MANAGER_CALLBACKS* Callbacks;
    void* LazyWriteContext;
    struct _LIST_ENTRY PrivateList;
    void* LogHandle;
    INVALID_TYPE* FlushToLsnRoutine;
    DWORD DirtyPageThreshold;
    DWORD LazyWritePassCount;
    struct _CACHE_UNINITIALIZE_EVENT* UninitializeEvent;
    struct _VACB* NeedToZeroVacb;
    DWORD BcbSpinLock;
    void* Reserved;
    struct _KEVENT Event;
    struct _PRIVATE_CACHE_MAP PrivateCacheMap;
};

struct _SHARED_CACHE_MAP*;

struct UnnamedStruct_5E4360
{
    struct _LARGE_INTEGER FileOffset;
    WORD ActiveCount;
};

struct UnnamedStruct_5E44A8
{
    struct _LARGE_INTEGER FileOffset;
    WORD ActiveCount;
};

struct UnnamedStruct_5E44F0
{
    void* BaseAddress;
    struct _SHARED_CACHE_MAP* SharedCacheMap;
    struct UnnamedStruct_5E44A8 Overlay;
    struct _LIST_ENTRY LruList;
};

struct _VACB*;

struct _FILE_OBJECT
{
    short Type;
    short Size;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _VPB* Vpb;
    void* FsContext;
    void* FsContext2;
    struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;
    void* PrivateCacheMap;
    long FinalStatus;
    struct _FILE_OBJECT* RelatedFileObject;
    BYTE LockOperation;
    BYTE DeletePending;
    BYTE ReadAccess;
    BYTE WriteAccess;
    BYTE DeleteAccess;
    BYTE SharedRead;
    BYTE SharedWrite;
    BYTE SharedDelete;
    DWORD Flags;
    struct _UNICODE_STRING FileName;
    struct _LARGE_INTEGER CurrentByteOffset;
    DWORD Waiters;
    DWORD Busy;
    void* LastLock;
    struct _KEVENT Lock;
    struct _KEVENT Event;
    struct _IO_COMPLETION_CONTEXT* CompletionContext;
};

struct _FILE_OBJECT*;

struct _MBCB
{
    short NodeTypeCode;
    short NodeIsInZone;
    DWORD PagesToWrite;
    DWORD DirtyPages;
    DWORD Reserved;
    struct _LIST_ENTRY BitmapRanges;
    __int64 ResumeWritePage;
    struct _BITMAP_RANGE BitmapRange1;
    struct _BITMAP_RANGE BitmapRange2;
    struct _BITMAP_RANGE BitmapRange3;
};

struct _MBCB*;

struct _KEVENT*;

struct _CACHE_MANAGER_CALLBACKS
{
    INVALID_TYPE* AcquireForLazyWrite;
    INVALID_TYPE* ReleaseFromLazyWrite;
    INVALID_TYPE* AcquireForReadAhead;
    INVALID_TYPE* ReleaseFromReadAhead;
};

struct _CACHE_MANAGER_CALLBACKS*;

INVALID_TYPE*;

struct _CACHE_UNINITIALIZE_EVENT
{
    struct _CACHE_UNINITIALIZE_EVENT* Next;
    struct _KEVENT Event;
};

struct _CACHE_UNINITIALIZE_EVENT*;

struct _PRIVATE_CACHE_MAP
{
    short NodeTypeCode;
    struct _PRIVATE_CACHE_MAP_FLAGS Flags;
    DWORD UlongFlags;
    DWORD ReadAheadMask;
    struct _FILE_OBJECT* FileObject;
    struct _LARGE_INTEGER FileOffset1;
    struct _LARGE_INTEGER BeyondLastByte1;
    struct _LARGE_INTEGER FileOffset2;
    struct _LARGE_INTEGER BeyondLastByte2;
    struct _LARGE_INTEGER ReadAheadOffset[2];
    DWORD ReadAheadLength[2];
    DWORD ReadAheadSpinLock;
    struct _LIST_ENTRY PrivateLinks;
};

struct UnnamedStruct_5E4C00
{
    short NodeTypeCode;
    short NodeByteSize;
    DWORD OpenCount;
    struct _LARGE_INTEGER FileSize;
    struct _LIST_ENTRY BcbList;
    struct _LARGE_INTEGER SectionSize;
    struct _LARGE_INTEGER ValidDataLength;
    struct _LARGE_INTEGER ValidDataGoal;
    struct _VACB* InitialVacbs[4];
    struct _VACB** Vacbs;
    struct _FILE_OBJECT* FileObject;
    struct _VACB* ActiveVacb;
    void* NeedToZero;
    DWORD ActivePage;
    DWORD NeedToZeroPage;
    DWORD ActiveVacbSpinLock;
    DWORD VacbActiveCount;
    DWORD DirtyPages;
    struct _LIST_ENTRY SharedCacheMapLinks;
    DWORD Flags;
    long Status;
    struct _MBCB* Mbcb;
    void* Section;
    struct _KEVENT* CreateEvent;
    struct _KEVENT* WaitOnActiveCount;
    DWORD PagesToWrite;
    __int64 BeyondLastFlush;
    struct _CACHE_MANAGER_CALLBACKS* Callbacks;
    void* LazyWriteContext;
    struct _LIST_ENTRY PrivateList;
    void* LogHandle;
    INVALID_TYPE* FlushToLsnRoutine;
    DWORD DirtyPageThreshold;
    DWORD LazyWritePassCount;
    struct _CACHE_UNINITIALIZE_EVENT* UninitializeEvent;
    struct _VACB* NeedToZeroVacb;
    DWORD BcbSpinLock;
    void* Reserved;
    struct _KEVENT Event;
    struct _PRIVATE_CACHE_MAP PrivateCacheMap;
};

struct _VACB_LEVEL_REFERENCE
{
    long Reference;
    long SpecialReference;
};

struct _VACB_LEVEL_REFERENCE*;

struct UnnamedStruct_5E6250
{
    long Reference;
    long SpecialReference;
};

struct _HEAP_ENTRY
{
    WORD Size;
    WORD PreviousSize;
    BYTE SegmentIndex;
    BYTE Flags;
    BYTE UnusedBytes;
    BYTE SmallTagIndex;
};

struct _HEAP_ENTRY*;

struct UnnamedStruct_5E6470
{
    WORD Size;
    WORD PreviousSize;
    BYTE SegmentIndex;
    BYTE Flags;
    BYTE UnusedBytes;
    BYTE SmallTagIndex;
};

struct _HEAP_UCR_SEGMENT
{
    struct _HEAP_UCR_SEGMENT* Next;
    DWORD ReservedSize;
    DWORD CommittedSize;
    DWORD filler;
};

struct _HEAP_UCR_SEGMENT*;

struct UnnamedStruct_5E68C0
{
    struct _HEAP_UCR_SEGMENT* Next;
    DWORD ReservedSize;
    DWORD CommittedSize;
    DWORD filler;
};

INVALID_TYPE*;

struct _OBJECT_SYMBOLIC_LINK
{
    struct _LARGE_INTEGER CreationTime;
    struct _UNICODE_STRING LinkTarget;
    struct _UNICODE_STRING LinkTargetRemaining;
    void* LinkTargetObject;
    DWORD DosDeviceDriveIndex;
};

struct _UNICODE_STRING
{
    WORD Length;
    WORD MaximumLength;
    WORD* Buffer;
};

struct UnnamedStruct_5E6C90
{
    struct _LARGE_INTEGER CreationTime;
    struct _UNICODE_STRING LinkTarget;
    struct _UNICODE_STRING LinkTargetRemaining;
    void* LinkTargetObject;
    DWORD DosDeviceDriveIndex;
};

struct _POOL_BLOCK_HEAD
{
    struct _POOL_HEADER Header;
    struct _LIST_ENTRY List;
};

struct _POOL_HEADER
{
    INVALID_TYPE PreviousSize;
    INVALID_TYPE PoolIndex;
    INVALID_TYPE BlockSize;
    INVALID_TYPE PoolType;
    DWORD Ulong1;
    struct _EPROCESS* ProcessBilled;
    DWORD PoolTag;
    WORD AllocatorBackTraceIndex;
    WORD PoolTagHash;
};

struct UnnamedStruct_5E70B8
{
    struct _POOL_HEADER Header;
    struct _LIST_ENTRY List;
};

struct _HEAP
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    DWORD ForceFlags;
    DWORD VirtualMemoryThreshold;
    DWORD SegmentReserve;
    DWORD SegmentCommit;
    DWORD DeCommitFreeBlockThreshold;
    DWORD DeCommitTotalFreeThreshold;
    DWORD TotalFreeSize;
    DWORD MaximumAllocationSize;
    WORD ProcessHeapsListIndex;
    WORD HeaderValidateLength;
    void* HeaderValidateCopy;
    WORD NextAvailableTagIndex;
    WORD MaximumTagIndex;
    struct _HEAP_TAG_ENTRY* TagEntries;
    struct _HEAP_UCR_SEGMENT* UCRSegments;
    struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges;
    DWORD AlignRound;
    DWORD AlignMask;
    struct _LIST_ENTRY VirtualAllocdBlocks;
    struct _HEAP_SEGMENT* Segments[64];
    struct UnnamedStruct_5E76B8 u;
    struct UnnamedStruct_315870 u2;
    WORD AllocatorBackTraceIndex;
    DWORD NonDedicatedListLength;
    void* LargeBlocksIndex;
    struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
    struct _LIST_ENTRY FreeLists[128];
    struct _HEAP_LOCK* LockVariable;
    INVALID_TYPE* CommitRoutine;
    void* FrontEndHeap;
    WORD FrontHeapLockCount;
    BYTE FrontEndHeapType;
    BYTE LastSegmentIndex;
};

struct _HEAP_TAG_ENTRY
{
    DWORD Allocs;
    DWORD Frees;
    DWORD Size;
    WORD TagIndex;
    WORD CreatorBackTraceIndex;
    WORD TagName[24];
};

struct _HEAP_TAG_ENTRY*;

struct _HEAP_UNCOMMMTTED_RANGE
{
    struct _HEAP_UNCOMMMTTED_RANGE* Next;
    DWORD Address;
    DWORD Size;
    DWORD filler;
};

struct _HEAP_UNCOMMMTTED_RANGE*;

struct _HEAP_SEGMENT
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    struct _HEAP* Heap;
    DWORD LargestUnCommittedRange;
    void* BaseAddress;
    DWORD NumberOfPages;
    struct _HEAP_ENTRY* FirstEntry;
    struct _HEAP_ENTRY* LastValidEntry;
    DWORD NumberOfUnCommittedPages;
    DWORD NumberOfUnCommittedRanges;
    struct _HEAP_UNCOMMMTTED_RANGE* UnCommittedRanges;
    WORD AllocatorBackTraceIndex;
    WORD Reserved;
    struct _HEAP_ENTRY* LastEntryInSegment;
};

struct _HEAP_SEGMENT*;

struct _HEAP_SEGMENT*;

struct UnnamedStruct_5E7550
{
    DWORD FreeListsInUseUlong[4];
    BYTE FreeListsInUseBytes[16];
};

struct UnnamedStruct_5E76B8
{
    DWORD FreeListsInUseUlong[4];
    BYTE FreeListsInUseBytes[16];
};

struct UnnamedStruct_5E7F38
{
    WORD FreeListsInUseTerminate;
    WORD DecommitCount;
};

struct UnnamedStruct_315870
{
    WORD FreeListsInUseTerminate;
    WORD DecommitCount;
};

struct _HEAP_PSEUDO_TAG_ENTRY
{
    DWORD Allocs;
    DWORD Frees;
    DWORD Size;
};

struct _HEAP_PSEUDO_TAG_ENTRY*;

struct _LIST_ENTRY;

struct _HEAP_LOCK
{
    struct UnnamedStruct_5FC488 Lock;
};

struct _HEAP_LOCK*;

void**;

INVALID_TYPE*;

struct UnnamedStruct_315B30
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    DWORD ForceFlags;
    DWORD VirtualMemoryThreshold;
    DWORD SegmentReserve;
    DWORD SegmentCommit;
    DWORD DeCommitFreeBlockThreshold;
    DWORD DeCommitTotalFreeThreshold;
    DWORD TotalFreeSize;
    DWORD MaximumAllocationSize;
    WORD ProcessHeapsListIndex;
    WORD HeaderValidateLength;
    void* HeaderValidateCopy;
    WORD NextAvailableTagIndex;
    WORD MaximumTagIndex;
    struct _HEAP_TAG_ENTRY* TagEntries;
    struct _HEAP_UCR_SEGMENT* UCRSegments;
    struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges;
    DWORD AlignRound;
    DWORD AlignMask;
    struct _LIST_ENTRY VirtualAllocdBlocks;
    struct _HEAP_SEGMENT* Segments[64];
    struct UnnamedStruct_5E76B8 u;
    struct UnnamedStruct_315870 u2;
    WORD AllocatorBackTraceIndex;
    DWORD NonDedicatedListLength;
    void* LargeBlocksIndex;
    struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
    struct _LIST_ENTRY FreeLists[128];
    struct _HEAP_LOCK* LockVariable;
    INVALID_TYPE* CommitRoutine;
    void* FrontEndHeap;
    WORD FrontHeapLockCount;
    BYTE FrontEndHeapType;
    BYTE LastSegmentIndex;
};

struct _LDR_DATA_TABLE_ENTRY
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
    void* EntryPointActivationContext;
};

struct UnnamedStruct_5E93A0
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
    void* EntryPointActivationContext;