ntdll.dll.h

一个 windows 内核级别的调试器

    void* CompletionPort;
    void* CompletionKey;
    DWORD SessionId;
    DWORD SchedulingClass;
    ULONGLONG ReadOperationCount;
    ULONGLONG WriteOperationCount;
    ULONGLONG OtherOperationCount;
    ULONGLONG ReadTransferCount;
    ULONGLONG WriteTransferCount;
    ULONGLONG OtherTransferCount;
    struct _IO_COUNTERS IoInfo;
    DWORD ProcessMemoryLimit;
    DWORD JobMemoryLimit;
    DWORD PeakProcessMemoryUsed;
    DWORD PeakJobMemoryUsed;
    DWORD CurrentJobMemoryUsed;
    struct _FAST_MUTEX MemoryLimitsLock;
    struct _LIST_ENTRY JobSetLinks;
    DWORD MemberLevel;
    DWORD JobFlags;
};

struct UnnamedStruct_47AFD0
{
    long Count;
    struct _KTHREAD* Owner;
    DWORD Contention;
    struct _KEVENT Event;
    DWORD OldIrql;
};

struct UnnamedStruct_47B298
{
    WORD Machine;
    WORD NumberOfSections;
    DWORD TimeDateStamp;
    DWORD PointerToSymbolTable;
    DWORD NumberOfSymbols;
    WORD SizeOfOptionalHeader;
    WORD Characteristics;
};

enum UnnamedEnum_47B6C0
{
    NonPagedPoolCacheAlignedMustSSession = 38,
    PagedPoolCacheAlignedSession = 37,
    NonPagedPoolCacheAlignedSession = 36,
    DontUseThisTypeSession = 35,
    NonPagedPoolMustSucceedSession = 34,
    PagedPoolSession = 33,
    NonPagedPoolSession = 32,
    MaxPoolType = 7,
    NonPagedPoolCacheAlignedMustS = 6,
    PagedPoolCacheAligned = 5,
    NonPagedPoolCacheAligned = 4,
    DontUseThisType = 3,
    NonPagedPoolMustSucceed = 2,
    PagedPool = 1,
    NonPagedPool = 0,
};

enum _POOL_TYPE
{
    NonPagedPoolCacheAlignedMustSSession = 38,
    PagedPoolCacheAlignedSession = 37,
    NonPagedPoolCacheAlignedSession = 36,
    DontUseThisTypeSession = 35,
    NonPagedPoolMustSucceedSession = 34,
    PagedPoolSession = 33,
    NonPagedPoolSession = 32,
    MaxPoolType = 7,
    NonPagedPoolCacheAlignedMustS = 6,
    PagedPoolCacheAligned = 5,
    NonPagedPoolCacheAligned = 4,
    DontUseThisType = 3,
    NonPagedPoolMustSucceed = 2,
    PagedPool = 1,
    NonPagedPool = 0,
};

INVALID_TYPE*;

INVALID_TYPE*;

struct UnnamedStruct_47BFC8
{
    struct _SLIST_HEADER ListHead;
    WORD Depth;
    WORD MaximumDepth;
    DWORD TotalAllocates;
    DWORD AllocateMisses;
    DWORD AllocateHits;
    DWORD TotalFrees;
    DWORD FreeMisses;
    DWORD FreeHits;
    enum _POOL_TYPE Type;
    DWORD Tag;
    DWORD Size;
    INVALID_TYPE* Allocate;
    INVALID_TYPE* Free;
    struct _LIST_ENTRY ListEntry;
    DWORD LastTotalAllocates;
    DWORD LastAllocateMisses;
    DWORD LastAllocateHits;
    DWORD Future[2];
};

struct _SINGLE_LIST_ENTRY*;

struct UnnamedStruct_47CA48
{
    struct _SINGLE_LIST_ENTRY* Next;
};

struct _KSPIN_LOCK_QUEUE*;

DWORD*;

struct UnnamedStruct_47CB58
{
    struct _KSPIN_LOCK_QUEUE* Next;
    DWORD* Lock;
};

struct UnnamedStruct_47CCA0
{
    struct _NPAGED_LOOKASIDE_LIST* P;
    struct _NPAGED_LOOKASIDE_LIST* L;
};

struct _PEB_LDR_DATA
{
    DWORD Length;
    BYTE Initialized;
    void* SsHandle;
    struct _LIST_ENTRY InLoadOrderModuleList;
    struct _LIST_ENTRY InMemoryOrderModuleList;
    struct _LIST_ENTRY InInitializationOrderModuleList;
};

struct _PEB_LDR_DATA*;

struct _RTL_USER_PROCESS_PARAMETERS
{
    DWORD MaximumLength;
    DWORD Length;
    DWORD Flags;
    DWORD DebugFlags;
    void* ConsoleHandle;
    DWORD ConsoleFlags;
    void* StandardInput;
    void* StandardOutput;
    void* StandardError;
    struct _CURDIR CurrentDirectory;
    struct _UNICODE_STRING DllPath;
    struct _UNICODE_STRING ImagePathName;
    struct _UNICODE_STRING CommandLine;
    void* Environment;
    DWORD StartingX;
    DWORD StartingY;
    DWORD CountX;
    DWORD CountY;
    DWORD CountCharsX;
    DWORD CountCharsY;
    DWORD FillAttribute;
    DWORD WindowFlags;
    DWORD ShowWindowFlags;
    struct _UNICODE_STRING WindowTitle;
    struct _UNICODE_STRING DesktopInfo;
    struct _UNICODE_STRING ShellInfo;
    struct _UNICODE_STRING RuntimeData;
    struct _RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
};

struct _RTL_USER_PROCESS_PARAMETERS*;

struct _PEB_FREE_BLOCK
{
    struct _PEB_FREE_BLOCK* Next;
    DWORD Size;
};

struct _PEB_FREE_BLOCK*;

void**;

DWORD;

INVALID_TYPE*;

DWORD;

struct UnnamedStruct_47D1A0
{
    BYTE InheritedAddressSpace;
    BYTE ReadImageFileExecOptions;
    BYTE BeingDebugged;
    BYTE SpareBool;
    void* Mutant;
    void* ImageBaseAddress;
    struct _PEB_LDR_DATA* Ldr;
    struct _RTL_USER_PROCESS_PARAMETERS* ProcessParameters;
    void* SubSystemData;
    void* ProcessHeap;
    void* FastPebLock;
    void* FastPebLockRoutine;
    void* FastPebUnlockRoutine;
    DWORD EnvironmentUpdateCount;
    void* KernelCallbackTable;
    DWORD SystemReserved[2];
    struct _PEB_FREE_BLOCK* FreeList;
    DWORD TlsExpansionCounter;
    void* TlsBitmap;
    DWORD TlsBitmapBits[2];
    void* ReadOnlySharedMemoryBase;
    void* ReadOnlySharedMemoryHeap;
    void** ReadOnlyStaticServerData;
    void* AnsiCodePageData;
    void* OemCodePageData;
    void* UnicodeCaseTableData;
    DWORD NumberOfProcessors;
    DWORD NtGlobalFlag;
    struct _LARGE_INTEGER CriticalSectionTimeout;
    DWORD HeapSegmentReserve;
    DWORD HeapSegmentCommit;
    DWORD HeapDeCommitTotalFreeThreshold;
    DWORD HeapDeCommitFreeBlockThreshold;
    DWORD NumberOfHeaps;
    DWORD MaximumNumberOfHeaps;
    void** ProcessHeaps;
    void* GdiSharedHandleTable;
    void* ProcessStarterHelper;
    DWORD GdiDCAttributeList;
    void* LoaderLock;
    DWORD OSMajorVersion;
    DWORD OSMinorVersion;
    WORD OSBuildNumber;
    WORD OSCSDVersion;
    DWORD OSPlatformId;
    DWORD ImageSubsystem;
    DWORD ImageSubsystemMajorVersion;
    DWORD ImageSubsystemMinorVersion;
    DWORD ImageProcessAffinityMask;
    DWORD GdiHandleBuffer[34];
    INVALID_TYPE* PostProcessInitRoutine;
    void* TlsExpansionBitmap;
    DWORD TlsExpansionBitmapBits[32];
    DWORD SessionId;
    struct _ULARGE_INTEGER AppCompatFlags;
    void* pShimData;
    void* AppCompatInfo;
    struct _UNICODE_STRING CSDVersion;
    void* ActivationContextData;
    void* ProcessAssemblyStorageMap;
    void* SystemDefaultActivationContextData;
    void* SystemAssemblyStorageMap;
    DWORD MinimumStackCommit;
};

enum UnnamedEnum_47F4E0
{
    SecurityDelegation = 3,
    SecurityImpersonation = 2,
    SecurityIdentification = 1,
    SecurityAnonymous = 0,
};

enum _SECURITY_IMPERSONATION_LEVEL
{
    SecurityDelegation = 3,
    SecurityImpersonation = 2,
    SecurityIdentification = 1,
    SecurityAnonymous = 0,
};

struct UnnamedStruct_47F7C8
{
    void* Token;
    BYTE CopyOnOpen;
    BYTE EffectiveOnly;
    enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
};

struct UnnamedStruct_47FA30
{
    DWORD Usage;
    DWORD Limit;
    DWORD Peak;
    DWORD Return;
};

struct _FNSAVE_FORMAT
{
    DWORD ControlWord;
    DWORD StatusWord;
    DWORD TagWord;
    DWORD ErrorOffset;
    DWORD ErrorSelector;
    DWORD DataOffset;
    DWORD DataSelector;
    BYTE RegisterArea[80];
};

struct _FXSAVE_FORMAT
{
    WORD ControlWord;
    WORD StatusWord;
    WORD TagWord;
    WORD ErrorOpcode;
    DWORD ErrorOffset;
    DWORD ErrorSelector;
    DWORD DataOffset;
    DWORD DataSelector;
    DWORD MXCsr;
    DWORD MXCsrMask;
    BYTE RegisterArea[128];
    BYTE Reserved3[128];
    BYTE Reserved4[224];
    BYTE Align16Byte[8];
};

struct UnnamedStruct_47FD98
{
    struct _FNSAVE_FORMAT FnArea;
    struct _FXSAVE_FORMAT FxArea;
};

struct UnnamedStruct_47FEE0
{
    struct _FNSAVE_FORMAT FnArea;
    struct _FXSAVE_FORMAT FxArea;
};

struct UnnamedStruct_47FF28
{
    struct UnnamedStruct_47FEE0 U;
    DWORD NpxSavedCpu;
    DWORD Cr0NpxState;
};

struct _PROCESSOR_POWER_STATE*;

INVALID_TYPE*;

struct PROCESSOR_IDLE_TIMES
{
    ULONGLONG StartTime;
    ULONGLONG EndTime;
    DWORD IdleHandlerReserved[4];
};

ULONGLONG;

struct _KTIMER
{
    struct _DISPATCHER_HEADER Header;
    struct _ULARGE_INTEGER DueTime;
    struct _LIST_ENTRY TimerListEntry;
    struct _KDPC* Dpc;
    long Period;
};

struct _KDPC
{
    short Type;
    BYTE Number;
    BYTE Importance;
    struct _LIST_ENTRY DpcListEntry;
    INVALID_TYPE* DeferredRoutine;
    void* DeferredContext;
    void* SystemArgument1;
    void* SystemArgument2;
    DWORD* Lock;
};

struct PROCESSOR_PERF_STATE
{
    BYTE PercentFrequency;
    BYTE MinCapacity;
    WORD Power;
    BYTE IncreaseLevel;
    BYTE DecreaseLevel;
    WORD Flags;
    DWORD IncreaseTime;
    DWORD DecreaseTime;
    DWORD IncreaseCount;
    DWORD DecreaseCount;
    ULONGLONG PerformanceTime;
};

struct PROCESSOR_PERF_STATE*;

INVALID_TYPE*;

struct UnnamedStruct_480CB0
{
    INVALID_TYPE* IdleFunction;
    DWORD Idle0KernelTimeLimit;
    DWORD Idle0LastTime;
    void* IdleHandlers;
    void* IdleState;
    DWORD IdleHandlersCount;
    ULONGLONG LastCheck;
    struct PROCESSOR_IDLE_TIMES IdleTimes;
    DWORD IdleTime1;
    DWORD PromotionCheck;
    DWORD IdleTime2;
    BYTE CurrentThrottle;
    BYTE ThermalThrottleLimit;
    BYTE CurrentThrottleIndex;
    BYTE ThermalThrottleIndex;
    DWORD PerfSystemTime;
    DWORD PerfIdleTime;
    ULONGLONG DebugDelta;
    DWORD DebugCount;
    DWORD LastSysTime;
    ULONGLONG TotalIdleStateTime[3];
    DWORD TotalIdleTransitions[3];
    ULONGLONG PreviousC3StateTime;
    BYTE KneeThrottleIndex;
    BYTE ThrottleLimitIndex;
    BYTE PerfStatesCount;
    BYTE ProcessorMinThrottle;
    BYTE ProcessorMaxThrottle;
    BYTE LastBusyPercentage;
    BYTE LastC3Percentage;
    BYTE LastAdjustedBusyPercentage;
    DWORD PromotionCount;
    DWORD DemotionCount;
    DWORD ErrorCount;
    DWORD RetryCount;
    DWORD Flags;
    struct _LARGE_INTEGER PerfCounterFrequency;
    DWORD PerfTickCount;
    struct _KTIMER PerfTimer;
    struct _KDPC PerfDpc;
    struct PROCESSOR_PERF_STATE* PerfStates;
    INVALID_TYPE* PerfSetThrottle;
    DWORD Spare1[2];
};

struct UnnamedStruct_482008
{
    ULONGLONG ReadOperationCount;
    ULONGLONG WriteOperationCount;
    ULONGLONG OtherOperationCount;
    ULONGLONG ReadTransferCount;
    ULONGLONG WriteTransferCount;
    ULONGLONG OtherTransferCount;
};

struct _DISPATCHER_HEADER
{
    BYTE Type;
    BYTE Absolute;
    BYTE Size;
    BYTE Inserted;
    long SignalState;
    struct _LIST_ENTRY WaitListHead;
};

BYTE;

struct _KAPC_STATE
{
    struct _LIST_ENTRY ApcListHead[2];
    struct _KPROCESS* Process;
    BYTE KernelApcInProgress;
    BYTE KernelApcPending;
    BYTE UserApcPending;
};

struct _KWAIT_BLOCK
{
    struct _LIST_ENTRY WaitListEntry;
    struct _KTHREAD* Thread;
    void* Object;
    struct _KWAIT_BLOCK* NextWaitBlock;
    WORD WaitKey;
    WORD WaitType;
};

struct _KWAIT_BLOCK*;

struct _KWAIT_BLOCK;

struct _KQUEUE
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY EntryListHead;
    DWORD CurrentCount;
    DWORD MaximumCount;
    struct _LIST_ENTRY ThreadListHead;
};

struct _KQUEUE*;

struct _KTRAP_FRAME
{
    DWORD DbgEbp;
    DWORD DbgEip;
    DWORD DbgArgMark;
    DWORD DbgArgPointer;
    DWORD TempSegCs;
    DWORD TempEsp;
    DWORD Dr0;
    DWORD Dr1;
    DWORD Dr2;
    DWORD Dr3;
    DWORD Dr6;
    DWORD Dr7;
    DWORD SegGs;
    DWORD SegEs;
    DWORD SegDs;
    DWORD Edx;
    DWORD Ecx;
    DWORD Eax;
    DWORD PreviousPreviousMode;
    struct _EXCEPTION_REGISTRATION_RECORD* ExceptionList;
    DWORD SegFs;
    DWORD Edi;
    DWORD Esi;
    DWORD Ebx;
    DWORD Ebp;
    DWORD ErrCode;
    DWORD Eip;
    DWORD SegCs;
    DWORD EFlags;
    DWORD HardwareEsp;
    DWORD HardwareSegSs;
    DWORD V86Es;
    DWORD V86Ds;
    DWORD V86Fs;
    DWORD V86Gs;
};

struct _KTRAP_FRAME*;

struct _KAPC_STATE*;

struct _KAPC_STATE*;

struct _KAPC
{
    short Type;
    short Size;
    DWORD Spare0;
    struct _KTHREAD* Thread;
    struct _LIST_ENTRY ApcListEntry;
    INVALID_TYPE* KernelRoutine;
    INVALID_TYPE* RundownRoutine;
    INVALID_TYPE* NormalRoutine;
    void* NormalContext;
    void* SystemArgument1;
    void* SystemArgument2;
    char ApcStateIndex;
    char ApcMode;
    BYTE Inserted;
};

struct UnnamedStruct_4828D8
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY MutantListHead;
    void* InitialStack;
    void* StackLimit;
    void* Teb;
    void* TlsArray;
    void* KernelStack;
    BYTE DebugActive;
    BYTE State;
    BYTE Alerted;
    BYTE Iopl;