ntdll.dll.h

一个 windows 内核级别的调试器

Processing PDB file ntdll.pdb.dll
-Wrong time stamp of .PDB file ntdll.pdb.dll (0x3ab278a6, 0x00000000)
-Type server .PDB imports ignored!
struct LIST_ENTRY64
{
    ULONGLONG Flink;
    ULONGLONG Blink;
};

struct LIST_ENTRY64*;

struct UnnamedStruct_315850
{
    ULONGLONG Flink;
    ULONGLONG Blink;
};

struct LIST_ENTRY32
{
    DWORD Flink;
    DWORD Blink;
};

struct LIST_ENTRY32*;

struct UnnamedStruct_315A70
{
    DWORD Flink;
    DWORD Blink;
};

struct _SLIST_HEADER
{
    ULONGLONG Alignment;
    struct _SINGLE_LIST_ENTRY Next;
    WORD Depth;
    WORD Sequence;
};

struct _SLIST_HEADER*;

struct _SINGLE_LIST_ENTRY
{
    struct _SINGLE_LIST_ENTRY* Next;
};

struct UnnamedStruct_315D20
{
    ULONGLONG Alignment;
    struct _SINGLE_LIST_ENTRY Next;
    WORD Depth;
    WORD Sequence;
};

struct _IMAGE_NT_HEADERS
{
    DWORD Signature;
    struct _IMAGE_FILE_HEADER FileHeader;
    struct _IMAGE_OPTIONAL_HEADER OptionalHeader;
};

struct _IMAGE_NT_HEADERS*;

struct _IMAGE_FILE_HEADER
{
    WORD Machine;
    WORD NumberOfSections;
    DWORD TimeDateStamp;
    DWORD PointerToSymbolTable;
    DWORD NumberOfSymbols;
    WORD SizeOfOptionalHeader;
    WORD Characteristics;
};

struct _IMAGE_OPTIONAL_HEADER
{
    WORD Magic;
    BYTE MajorLinkerVersion;
    BYTE MinorLinkerVersion;
    DWORD SizeOfCode;
    DWORD SizeOfInitializedData;
    DWORD SizeOfUninitializedData;
    DWORD AddressOfEntryPoint;
    DWORD BaseOfCode;
    DWORD BaseOfData;
    DWORD ImageBase;
    DWORD SectionAlignment;
    DWORD FileAlignment;
    WORD MajorOperatingSystemVersion;
    WORD MinorOperatingSystemVersion;
    WORD MajorImageVersion;
    WORD MinorImageVersion;
    WORD MajorSubsystemVersion;
    WORD MinorSubsystemVersion;
    DWORD Win32VersionValue;
    DWORD SizeOfImage;
    DWORD SizeOfHeaders;
    DWORD CheckSum;
    WORD Subsystem;
    WORD DllCharacteristics;
    DWORD SizeOfStackReserve;
    DWORD SizeOfStackCommit;
    DWORD SizeOfHeapReserve;
    DWORD SizeOfHeapCommit;
    DWORD LoaderFlags;
    DWORD NumberOfRvaAndSizes;
    struct _IMAGE_DATA_DIRECTORY DataDirectory[16];
};

struct UnnamedStruct_474E40
{
    DWORD Signature;
    struct _IMAGE_FILE_HEADER FileHeader;
    struct _IMAGE_OPTIONAL_HEADER OptionalHeader;
};

struct _LARGE_INTEGER
{
    DWORD LowPart;
    long HighPart;
    struct UnnamedStruct_4751F0 u;
    __int64 QuadPart;
};

struct UnnamedStruct_4750A8
{
    DWORD LowPart;
    long HighPart;
};

struct UnnamedStruct_4751F0
{
    DWORD LowPart;
    long HighPart;
};

struct UnnamedStruct_475238
{
    DWORD LowPart;
    long HighPart;
    struct UnnamedStruct_4751F0 u;
    __int64 QuadPart;
};

struct _ULARGE_INTEGER
{
    DWORD LowPart;
    DWORD HighPart;
    struct UnnamedStruct_475658 u;
    ULONGLONG QuadPart;
};

struct UnnamedStruct_475510
{
    DWORD LowPart;
    DWORD HighPart;
};

struct UnnamedStruct_475658
{
    DWORD LowPart;
    DWORD HighPart;
};

struct UnnamedStruct_4756A0
{
    DWORD LowPart;
    DWORD HighPart;
    struct UnnamedStruct_475658 u;
    ULONGLONG QuadPart;
};

struct _LUID
{
    DWORD LowPart;
    long HighPart;
};

INVALID_TYPE*;

enum UnnamedEnum_4759B0
{
    LockQueueMaximumLock = 15,
    LockQueueBcbLock = 14,
    LockQueueAfdWorkQueueLock = 13,
    LockQueueNtfsStructLock = 12,
    LockQueueIoCompletionLock = 11,
    LockQueueIoDatabaseLock = 10,
    LockQueueIoVpbLock = 9,
    LockQueueWorkQueueLock = 8,
    LockQueueIoCancelLock = 7,
    LockQueueNonPagedPoolLock = 6,
    LockQueueMasterLock = 5,
    LockQueueVacbLock = 4,
    LockQueueSystemSpaceLock = 3,
    LockQueuePfnLock = 2,
    LockQueueContextSwapLock = 1,
    LockQueueDispatcherLock = 0,
};

enum _KSPIN_LOCK_QUEUE_NUMBER
{
    LockQueueMaximumLock = 15,
    LockQueueBcbLock = 14,
    LockQueueAfdWorkQueueLock = 13,
    LockQueueNtfsStructLock = 12,
    LockQueueIoCompletionLock = 11,
    LockQueueIoDatabaseLock = 10,
    LockQueueIoVpbLock = 9,
    LockQueueWorkQueueLock = 8,
    LockQueueIoCancelLock = 7,
    LockQueueNonPagedPoolLock = 6,
    LockQueueMasterLock = 5,
    LockQueueVacbLock = 4,
    LockQueueSystemSpaceLock = 3,
    LockQueuePfnLock = 2,
    LockQueueContextSwapLock = 1,
    LockQueueDispatcherLock = 0,
};

struct _KPRCB
{
    WORD MinorVersion;
    WORD MajorVersion;
    struct _KTHREAD* CurrentThread;
    struct _KTHREAD* NextThread;
    struct _KTHREAD* IdleThread;
    char Number;
    char Reserved;
    WORD BuildType;
    DWORD SetMember;
    char CpuType;
    char CpuID;
    WORD CpuStep;
    struct _KPROCESSOR_STATE ProcessorState;
    DWORD KernelReserved[16];
    DWORD HalReserved[16];
    struct _KSPIN_LOCK_QUEUE LockQueue[16];
    struct _KTHREAD* NpxThread;
    DWORD InterruptCount;
    DWORD KernelTime;
    DWORD UserTime;
    DWORD DpcTime;
    DWORD InterruptTime;
    DWORD Spare1[1];
    BYTE MultiThreadSetBusy;
    BYTE Spare2[3];
    DWORD AdjustDpcThreshold;
    DWORD DebugDpcTime;
    DWORD PageColor;
    struct _KNODE* ParentNode;
    DWORD MultiThreadProcessorSet;
    struct _KPRCB* MultiThreadSetMaster;
    DWORD ThreadStartCount[2];
    void* SpareHotData[2];
    DWORD CcFastReadNoWait;
    DWORD CcFastReadWait;
    DWORD CcFastReadNotPossible;
    DWORD CcCopyReadNoWait;
    DWORD CcCopyReadWait;
    DWORD CcCopyReadNoWaitMiss;
    DWORD KeAlignmentFixupCount;
    DWORD KeContextSwitches;
    DWORD KeDcacheFlushCount;
    DWORD KeExceptionDispatchCount;
    DWORD KeFirstLevelTbFills;
    DWORD KeFloatingEmulationCount;
    DWORD KeIcacheFlushCount;
    DWORD KeSecondLevelTbFills;
    DWORD KeSystemCalls;
    DWORD ReservedCounter[8];
    void* SmallIrpFreeEntry;
    void* LargeIrpFreeEntry;
    void* MdlFreeEntry;
    void* CreateInfoFreeEntry;
    void* NameBufferFreeEntry;
    void* SharedCacheMapEntry;
    DWORD CachePad0[2];
    struct _PP_LOOKASIDE_LIST PPLookasideList[16];
    struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[32];
    struct _PP_LOOKASIDE_LIST PPPagedLookasideList[32];
    BYTE ReservedPad[124];
    INVALID_TYPE PacketBarrier;
    void* CurrentPacket[3];
    INVALID_TYPE TargetSet;
    INVALID_TYPE* WorkerRoutine;
    INVALID_TYPE IpiFrozen;
    DWORD CachePad1[2];
    INVALID_TYPE RequestSummary;
    INVALID_TYPE* SignalDone;
    INVALID_TYPE ReverseStall;
    void* IpiFrame;
    DWORD CachePad2[4];
    DWORD DpcInterruptRequested;
    void* ChainedInterruptList;
    DWORD CachePad3[2];
    DWORD MaximumDpcQueueDepth;
    DWORD MinimumDpcRate;
    DWORD CachePad4[2];
    struct _LIST_ENTRY DpcListHead;
    DWORD DpcQueueDepth;
    DWORD DpcRoutineActive;
    DWORD DpcCount;
    DWORD DpcLastCount;
    DWORD DpcRequestRate;
    void* DpcStack;
    DWORD KernelReserved2[10];
    DWORD DpcLock;
    BYTE SkipTick;
    BYTE VendorString[13];
    BYTE InitialApicId;
    BYTE LogicalProcessorsPerPhysicalProcessor;
    DWORD MHz;
    DWORD FeatureBits;
    struct _LARGE_INTEGER UpdateSignature;
    DWORD QuantumEnd;
    DWORD NpxPad[3];
    struct _FX_SAVE_AREA NpxSaveArea;
    struct _PROCESSOR_POWER_STATE PowerState;
};

struct _KPRCB*;

struct _KTHREAD
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY MutantListHead;
    void* InitialStack;
    void* StackLimit;
    void* Teb;
    void* TlsArray;
    void* KernelStack;
    BYTE DebugActive;
    BYTE State;
    BYTE Alerted;
    BYTE Iopl;
    BYTE NpxState;
    char Saturation;
    char Priority;
    struct _KAPC_STATE ApcState;
    DWORD ContextSwitches;
    BYTE IdleSwapBlock;
    BYTE Spare0[3];
    long WaitStatus;
    BYTE WaitIrql;
    char WaitMode;
    BYTE WaitNext;
    BYTE WaitReason;
    struct _KWAIT_BLOCK* WaitBlockList;
    struct _LIST_ENTRY WaitListEntry;
    struct _SINGLE_LIST_ENTRY SwapListEntry;
    DWORD WaitTime;
    char BasePriority;
    BYTE DecrementCount;
    char PriorityDecrement;
    char Quantum;
    struct _KWAIT_BLOCK WaitBlock[4];
    void* LegoData;
    DWORD KernelApcDisable;
    DWORD UserAffinity;
    BYTE SystemAffinityActive;
    BYTE PowerState;
    BYTE NpxIrql;
    BYTE InitialNode;
    void* ServiceTable;
    struct _KQUEUE* Queue;
    DWORD ApcQueueLock;
    struct _KTIMER Timer;
    struct _LIST_ENTRY QueueListEntry;
    DWORD SoftAffinity;
    DWORD Affinity;
    BYTE Preempted;
    BYTE ProcessReadyQueue;
    BYTE KernelStackResident;
    BYTE NextProcessor;
    void* CallbackStack;
    void* Win32Thread;
    struct _KTRAP_FRAME* TrapFrame;
    struct _KAPC_STATE* ApcStatePointer[2];
    char PreviousMode;
    BYTE EnableStackSwap;
    BYTE LargeStack;
    BYTE ResourceIndex;
    DWORD KernelTime;
    DWORD UserTime;
    struct _KAPC_STATE SavedApcState;
    BYTE Alertable;
    BYTE ApcStateIndex;
    BYTE ApcQueueable;
    BYTE AutoAlignment;
    void* StackBase;
    struct _KAPC SuspendApc;
    struct _KSEMAPHORE SuspendSemaphore;
    struct _LIST_ENTRY ThreadListEntry;
    char FreezeCount;
    char SuspendCount;
    BYTE IdealProcessor;
    BYTE DisableBoost;
};

struct _KTHREAD*;

struct _KPROCESSOR_STATE
{
    struct _CONTEXT ContextFrame;
    struct _KSPECIAL_REGISTERS SpecialRegisters;
};

DWORD;

struct _KSPIN_LOCK_QUEUE
{
    struct _KSPIN_LOCK_QUEUE* Next;
    DWORD* Lock;
};

struct _KSPIN_LOCK_QUEUE;

DWORD;

BYTE;

struct _KNODE
{
    DWORD ProcessorMask;
    DWORD Color;
    DWORD FreeCount[2];
    struct _SLIST_HEADER DeadStackList;
    struct _SLIST_HEADER PfnDereferenceSListHead;
    struct _SINGLE_LIST_ENTRY* PfnDeferredList;
    BYTE Seed;
    struct _flags Flags;
};

struct _KNODE*;

DWORD;

void*;

DWORD;

struct _PP_LOOKASIDE_LIST
{
    struct _NPAGED_LOOKASIDE_LIST* P;
    struct _NPAGED_LOOKASIDE_LIST* L;
};

struct _PP_LOOKASIDE_LIST;

struct _PP_LOOKASIDE_LIST;

BYTE;

void*;

void*;

INVALID_TYPE*;

INVALID_TYPE*;

DWORD;

struct _LIST_ENTRY
{
    struct _LIST_ENTRY* Flink;
    struct _LIST_ENTRY* Blink;
};

DWORD;

BYTE;

DWORD;

struct _FX_SAVE_AREA
{
    struct UnnamedStruct_47FEE0 U;
    DWORD NpxSavedCpu;
    DWORD Cr0NpxState;
};

struct _PROCESSOR_POWER_STATE
{
    INVALID_TYPE* IdleFunction;
    DWORD Idle0KernelTimeLimit;
    DWORD Idle0LastTime;
    void* IdleHandlers;
    void* IdleState;
    DWORD IdleHandlersCount;
    ULONGLONG LastCheck;
    struct PROCESSOR_IDLE_TIMES IdleTimes;
    DWORD IdleTime1;
    DWORD PromotionCheck;
    DWORD IdleTime2;
    BYTE CurrentThrottle;
    BYTE ThermalThrottleLimit;
    BYTE CurrentThrottleIndex;
    BYTE ThermalThrottleIndex;
    DWORD PerfSystemTime;
    DWORD PerfIdleTime;
    ULONGLONG DebugDelta;
    DWORD DebugCount;
    DWORD LastSysTime;
    ULONGLONG TotalIdleStateTime[3];
    DWORD TotalIdleTransitions[3];
    ULONGLONG PreviousC3StateTime;
    BYTE KneeThrottleIndex;
    BYTE ThrottleLimitIndex;
    BYTE PerfStatesCount;
    BYTE ProcessorMinThrottle;
    BYTE ProcessorMaxThrottle;
    BYTE LastBusyPercentage;
    BYTE LastC3Percentage;
    BYTE LastAdjustedBusyPercentage;
    DWORD PromotionCount;
    DWORD DemotionCount;
    DWORD ErrorCount;
    DWORD RetryCount;
    DWORD Flags;
    struct _LARGE_INTEGER PerfCounterFrequency;
    DWORD PerfTickCount;
    struct _KTIMER PerfTimer;
    struct _KDPC PerfDpc;
    struct PROCESSOR_PERF_STATE* PerfStates;
    INVALID_TYPE* PerfSetThrottle;
    DWORD Spare1[2];
};

struct UnnamedStruct_476CF8
{
    WORD MinorVersion;
    WORD MajorVersion;
    struct _KTHREAD* CurrentThread;
    struct _KTHREAD* NextThread;
    struct _KTHREAD* IdleThread;
    char Number;
    char Reserved;
    WORD BuildType;
    DWORD SetMember;
    char CpuType;
    char CpuID;
    WORD CpuStep;
    struct _KPROCESSOR_STATE ProcessorState;
    DWORD KernelReserved[16];
    DWORD HalReserved[16];
    struct _KSPIN_LOCK_QUEUE LockQueue[16];
    struct _KTHREAD* NpxThread;
    DWORD InterruptCount;
    DWORD KernelTime;
    DWORD UserTime;
    DWORD DpcTime;
    DWORD InterruptTime;
    DWORD Spare1[1];
    BYTE MultiThreadSetBusy;
    BYTE Spare2[3];
    DWORD AdjustDpcThreshold;
    DWORD DebugDpcTime;
    DWORD PageColor;
    struct _KNODE* ParentNode;
    DWORD MultiThreadProcessorSet;
    struct _KPRCB* MultiThreadSetMaster;
    DWORD ThreadStartCount[2];
    void* SpareHotData[2];
    DWORD CcFastReadNoWait;
    DWORD CcFastReadWait;
    DWORD CcFastReadNotPossible;
    DWORD CcCopyReadNoWait;
    DWORD CcCopyReadWait;
    DWORD CcCopyReadNoWaitMiss;
    DWORD KeAlignmentFixupCount;
    DWORD KeContextSwitches;