p3.sys.h

一个 windows 内核级别的调试器

struct _MDL
{
    struct _MDL* Next;
    short Size;
    short MdlFlags;
    struct _EPROCESS* Process;
    void* MappedSystemVa;
    void* StartVa;
    DWORD ByteCount;
    DWORD ByteOffset;
};

struct _MDL*;

struct UnnamedStruct_45E278
{
    struct _IRP* MasterIrp;
    long IrpCount;
    void* SystemBuffer;
};

struct UnnamedStruct_45EC88
{
    struct _IRP* MasterIrp;
    long IrpCount;
    void* SystemBuffer;
};

struct _IO_STATUS_BLOCK
{
    long Status;
    void* Pointer;
    DWORD Information;
};

struct _IO_STATUS_BLOCK*;

struct _KEVENT*;

INVALID_TYPE*;

struct UnnamedStruct_45EE38
{
    INVALID_TYPE* UserApcRoutine;
    void* UserApcContext;
};

struct UnnamedStruct_45EFA0
{
    INVALID_TYPE* UserApcRoutine;
    void* UserApcContext;
};

struct UnnamedStruct_453930
{
    struct UnnamedStruct_45EFA0 AsynchronousParameters;
    struct _LARGE_INTEGER AllocationSize;
};

struct UnnamedStruct_453A98
{
    struct UnnamedStruct_45EFA0 AsynchronousParameters;
    struct _LARGE_INTEGER AllocationSize;
};

INVALID_TYPE*;

void*;

struct _ETHREAD
{
};

struct _ETHREAD*;

struct _IO_STACK_LOCATION
{
    BYTE MajorFunction;
    BYTE MinorFunction;
    BYTE Flags;
    BYTE Control;
    struct UnnamedStruct_46AD60 Parameters;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _FILE_OBJECT* FileObject;
    INVALID_TYPE* CompletionRoutine;
    void* Context;
};

struct _IO_STACK_LOCATION*;

struct _FILE_OBJECT
{
    short Type;
    short Size;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _VPB* Vpb;
    void* FsContext;
    void* FsContext2;
    struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;
    void* PrivateCacheMap;
    long FinalStatus;
    struct _FILE_OBJECT* RelatedFileObject;
    BYTE LockOperation;
    BYTE DeletePending;
    BYTE ReadAccess;
    BYTE WriteAccess;
    BYTE DeleteAccess;
    BYTE SharedRead;
    BYTE SharedWrite;
    BYTE SharedDelete;
    DWORD Flags;
    struct _UNICODE_STRING FileName;
    struct _LARGE_INTEGER CurrentByteOffset;
    DWORD Waiters;
    DWORD Busy;
    void* LastLock;
    struct _KEVENT Lock;
    struct _KEVENT Event;
    struct _IO_COMPLETION_CONTEXT* CompletionContext;
};

struct _FILE_OBJECT*;

struct UnnamedStruct_45F070
{
    struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
    void* DriverContext[4];
    struct _ETHREAD* Thread;
    char* AuxiliaryBuffer;
    struct _LIST_ENTRY ListEntry;
    struct _IO_STACK_LOCATION* CurrentStackLocation;
    DWORD PacketType;
    struct _FILE_OBJECT* OriginalFileObject;
};

struct UnnamedStruct_45F508
{
    struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
    void* DriverContext[4];
    struct _ETHREAD* Thread;
    char* AuxiliaryBuffer;
    struct _LIST_ENTRY ListEntry;
    struct _IO_STACK_LOCATION* CurrentStackLocation;
    DWORD PacketType;
    struct _FILE_OBJECT* OriginalFileObject;
};

struct _KAPC
{
    short Type;
    short Size;
    DWORD Spare0;
    struct _KTHREAD* Thread;
    struct _LIST_ENTRY ApcListEntry;
    INVALID_TYPE* KernelRoutine;
    INVALID_TYPE* RundownRoutine;
    INVALID_TYPE* NormalRoutine;
    void* NormalContext;
    void* SystemArgument1;
    void* SystemArgument2;
    char ApcStateIndex;
    char ApcMode;
    BYTE Inserted;
};

struct UnnamedStruct_45F5D0
{
    struct UnnamedStruct_45F508 Overlay;
    struct _KAPC Apc;
    void* CompletionKey;
};

struct UnnamedStruct_45F7A8
{
    struct UnnamedStruct_45F508 Overlay;
    struct _KAPC Apc;
    void* CompletionKey;
};

struct UnnamedStruct_45F7F0
{
    short Type;
    WORD Size;
    struct _MDL* MdlAddress;
    DWORD Flags;
    struct UnnamedStruct_45EC88 AssociatedIrp;
    struct _LIST_ENTRY ThreadListEntry;
    struct _IO_STATUS_BLOCK IoStatus;
    char RequestorMode;
    BYTE PendingReturned;
    char StackCount;
    char CurrentLocation;
    BYTE Cancel;
    BYTE CancelIrql;
    char ApcEnvironment;
    BYTE AllocationFlags;
    struct _IO_STATUS_BLOCK* UserIosb;
    struct _KEVENT* UserEvent;
    struct UnnamedStruct_453A98 Overlay;
    INVALID_TYPE* CancelRoutine;
    void* UserBuffer;
    struct UnnamedStruct_45F7A8 Tail;
};

struct UnnamedStruct_460338
{
    short Type;
    WORD Size;
    struct _DEVICE_OBJECT* DeviceObject;
};

struct _EPROCESS
{
};

struct _EPROCESS*;

struct UnnamedStruct_4605D8
{
    struct _MDL* Next;
    short Size;
    short MdlFlags;
    struct _EPROCESS* Process;
    void* MappedSystemVa;
    void* StartVa;
    DWORD ByteCount;
    DWORD ByteOffset;
};

BYTE;

struct UnnamedStruct_460A78
{
    DWORD Data1;
    WORD Data2;
    WORD Data3;
    BYTE Data4[8];
};

struct UnnamedStruct_460CC0
{
    long Status;
    void* Pointer;
    DWORD Information;
};

struct _KAPC*;

INVALID_TYPE*;

INVALID_TYPE**;

void**;

INVALID_TYPE*;

INVALID_TYPE*;

struct UnnamedStruct_461038
{
    short Type;
    short Size;
    DWORD Spare0;
    struct _KTHREAD* Thread;
    struct _LIST_ENTRY ApcListEntry;
    INVALID_TYPE* KernelRoutine;
    INVALID_TYPE* RundownRoutine;
    INVALID_TYPE* NormalRoutine;
    void* NormalContext;
    void* SystemArgument1;
    void* SystemArgument2;
    char ApcStateIndex;
    char ApcMode;
    BYTE Inserted;
};

struct _SECTION_OBJECT_POINTERS
{
    void* DataSectionObject;
    void* SharedCacheMap;
    void* ImageSectionObject;
};

struct _SECTION_OBJECT_POINTERS*;

struct _IO_COMPLETION_CONTEXT
{
    void* Port;
    void* Key;
};

struct _IO_COMPLETION_CONTEXT*;

struct UnnamedStruct_4619B0
{
    short Type;
    short Size;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _VPB* Vpb;
    void* FsContext;
    void* FsContext2;
    struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;
    void* PrivateCacheMap;
    long FinalStatus;
    struct _FILE_OBJECT* RelatedFileObject;
    BYTE LockOperation;
    BYTE DeletePending;
    BYTE ReadAccess;
    BYTE WriteAccess;
    BYTE DeleteAccess;
    BYTE SharedRead;
    BYTE SharedWrite;
    BYTE SharedDelete;
    DWORD Flags;
    struct _UNICODE_STRING FileName;
    struct _LARGE_INTEGER CurrentByteOffset;
    DWORD Waiters;
    DWORD Busy;
    void* LastLock;
    struct _KEVENT Lock;
    struct _KEVENT Event;
    struct _IO_COMPLETION_CONTEXT* CompletionContext;
};

struct UnnamedStruct_462818
{
    void* Port;
    void* Key;
};

struct _DRIVER_EXTENSION
{
    struct _DRIVER_OBJECT* DriverObject;
    INVALID_TYPE* AddDevice;
    DWORD Count;
    struct _UNICODE_STRING ServiceKeyName;
};

struct _DRIVER_EXTENSION*;

struct _FAST_IO_DISPATCH
{
    DWORD SizeOfFastIoDispatch;
    INVALID_TYPE* FastIoCheckIfPossible;
    INVALID_TYPE* FastIoRead;
    INVALID_TYPE* FastIoWrite;
    INVALID_TYPE* FastIoQueryBasicInfo;
    INVALID_TYPE* FastIoQueryStandardInfo;
    INVALID_TYPE* FastIoLock;
    INVALID_TYPE* FastIoUnlockSingle;
    INVALID_TYPE* FastIoUnlockAll;
    INVALID_TYPE* FastIoUnlockAllByKey;
    INVALID_TYPE* FastIoDeviceControl;
    INVALID_TYPE* AcquireFileForNtCreateSection;
    INVALID_TYPE* ReleaseFileForNtCreateSection;
    INVALID_TYPE* FastIoDetachDevice;
    INVALID_TYPE* FastIoQueryNetworkOpenInfo;
    INVALID_TYPE* AcquireForModWrite;
    INVALID_TYPE* MdlRead;
    INVALID_TYPE* MdlReadComplete;
    INVALID_TYPE* PrepareMdlWrite;
    INVALID_TYPE* MdlWriteComplete;
    INVALID_TYPE* FastIoReadCompressed;
    INVALID_TYPE* FastIoWriteCompressed;
    INVALID_TYPE* MdlReadCompleteCompressed;
    INVALID_TYPE* MdlWriteCompleteCompressed;
    INVALID_TYPE* FastIoQueryOpen;
    INVALID_TYPE* ReleaseForModWrite;
    INVALID_TYPE* AcquireForCcFlush;
    INVALID_TYPE* ReleaseForCcFlush;
};

struct _FAST_IO_DISPATCH*;

INVALID_TYPE*;

INVALID_TYPE*;

INVALID_TYPE*;

INVALID_TYPE*;

struct UnnamedStruct_462C30
{
    short Type;
    short Size;
    struct _DEVICE_OBJECT* DeviceObject;
    DWORD Flags;
    void* DriverStart;
    DWORD DriverSize;
    void* DriverSection;
    struct _DRIVER_EXTENSION* DriverExtension;
    struct _UNICODE_STRING DriverName;
    struct _UNICODE_STRING* HardwareDatabase;
    struct _FAST_IO_DISPATCH* FastIoDispatch;
    INVALID_TYPE* DriverInit;
    INVALID_TYPE* DriverStartIo;
    INVALID_TYPE* DriverUnload;
    INVALID_TYPE* MajorFunction[28];
};

INVALID_TYPE*;

struct UnnamedStruct_4634C0
{
    struct _DRIVER_OBJECT* DriverObject;
    INVALID_TYPE* AddDevice;
    DWORD Count;
    struct _UNICODE_STRING ServiceKeyName;
};

struct UnnamedStruct_463728
{
    struct _LIST_ENTRY DeviceListEntry;
    DWORD SortKey;
    BYTE Inserted;
};

struct UnnamedStruct_463900
{
    void* DataSectionObject;
    void* SharedCacheMap;
    void* ImageSectionObject;
};

struct _IO_SECURITY_CONTEXT
{
    struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos;
    struct _ACCESS_STATE* AccessState;
    DWORD DesiredAccess;
    DWORD FullCreateOptions;
};

struct _IO_SECURITY_CONTEXT*;

struct UnnamedStruct_463BD0
{
    struct _IO_SECURITY_CONTEXT* SecurityContext;
    DWORD Options;
    WORD FileAttributes;
    WORD ShareAccess;
    DWORD EaLength;
};

struct UnnamedStruct_463EB8
{
    struct _IO_SECURITY_CONTEXT* SecurityContext;
    DWORD Options;
    WORD FileAttributes;
    WORD ShareAccess;
    DWORD EaLength;
};

struct UnnamedStruct_463F00
{
    DWORD Length;
    DWORD Key;
    struct _LARGE_INTEGER ByteOffset;
};

struct UnnamedStruct_4640C8
{
    DWORD Length;
    DWORD Key;
    struct _LARGE_INTEGER ByteOffset;
};

enum UnnamedEnum_464110
{
    FileMaximumInformation = 41,
    FileShortNameInformation = 40,
    FileValidDataLengthInformation = 39,
    FileIdFullDirectoryInformation = 38,
    FileIdBothDirectoryInformation = 37,
    FileTrackingInformation = 36,
    FileAttributeTagInformation = 35,
    FileNetworkOpenInformation = 34,
    FileReparsePointInformation = 33,
    FileQuotaInformation = 32,
    FileMoveClusterInformation = 31,
    FileCompletionInformation = 30,
    FileObjectIdInformation = 29,
    FileCompressionInformation = 28,
    FileMailslotSetInformation = 27,
    FileMailslotQueryInformation = 26,
    FilePipeRemoteInformation = 25,
    FilePipeLocalInformation = 24,
    FilePipeInformation = 23,
    FileStreamInformation = 22,
    FileAlternateNameInformation = 21,
    FileEndOfFileInformation = 20,
    FileAllocationInformation = 19,
    FileAllInformation = 18,
    FileAlignmentInformation = 17,
    FileModeInformation = 16,
    FileFullEaInformation = 15,
    FilePositionInformation = 14,
    FileDispositionInformation = 13,
    FileNamesInformation = 12,
    FileLinkInformation = 11,
    FileRenameInformation = 10,
    FileNameInformation = 9,
    FileAccessInformation = 8,
    FileEaInformation = 7,
    FileInternalInformation = 6,
    FileStandardInformation = 5,
    FileBasicInformation = 4,
    FileBothDirectoryInformation = 3,
    FileFullDirectoryInformation = 2,
    FileDirectoryInformation = 1,
};

enum _FILE_INFORMATION_CLASS
{
    FileMaximumInformation = 41,
    FileShortNameInformation = 40,
    FileValidDataLengthInformation = 39,
    FileIdFullDirectoryInformation = 38,
    FileIdBothDirectoryInformation = 37,
    FileTrackingInformation = 36,
    FileAttributeTagInformation = 35,
    FileNetworkOpenInformation = 34,
    FileReparsePointInformation = 33,
    FileQuotaInformation = 32,
    FileMoveClusterInformation = 31,
    FileCompletionInformation = 30,
    FileObjectIdInformation = 29,
    FileCompressionInformation = 28,
    FileMailslotSetInformation = 27,
    FileMailslotQueryInformation = 26,
    FilePipeRemoteInformation = 25,
    FilePipeLocalInformation = 24,
    FilePipeInformation = 23,
    FileStreamInformation = 22,
    FileAlternateNameInformation = 21,
    FileEndOfFileInformation = 20,
    FileAllocationInformation = 19,
    FileAllInformation = 18,
    FileAlignmentInformation = 17,
    FileModeInformation = 16,
    FileFullEaInformation = 15,
    FilePositionInformation = 14,
    FileDispositionInformation = 13,
    FileNamesInformation = 12,
    FileLinkInformation = 11,
    FileRenameInformation = 10,
    FileNameInformation = 9,
    FileAccessInformation = 8,
    FileEaInformation = 7,
    FileInternalInformation = 6,
    FileStandardInformation = 5,
    FileBasicInformation = 4,
    FileBothDirectoryInformation = 3,
    FileFullDirectoryInformation = 2,
    FileDirectoryInformation = 1,
};

struct UnnamedStruct_4656D8
{
    DWORD Length;
    enum _FILE_INFORMATION_CLASS FileInformationClass;
};

struct UnnamedStruct_465830
{
    DWORD Length;
    enum _FILE_INFORMATION_CLASS FileInformationClass;
};

struct UnnamedStruct_465878
{
    DWORD Length;
    enum _FILE_INFORMATION_CLASS FileInformationClass;
    struct _FILE_OBJECT* FileObject;
    BYTE ReplaceIfExists;
    BYTE AdvanceOnly;
    DWORD ClusterCount;
    void* DeleteHandle;
};

struct UnnamedStruct_465C80
{
    DWORD Length;
    enum _FILE_INFORMATION_CLASS FileInformationClass;
    struct _FILE_OBJECT* FileObject;
    BYTE ReplaceIfExists;
    BYTE AdvanceOnly;
    DWORD ClusterCount;
    void* DeleteHandle;
};

enum UnnamedEnum_465CC8
{
    FileFsMaximumInformation = 10,
    FileFsDriverPathInformation = 9,
    FileFsObjectIdInformation = 8,
    FileFsFullSizeInformation = 7,
    FileFsControlInformation = 6,
    FileFsAttributeInformation = 5,
    FileFsDeviceInformation = 4,
    FileFsSizeInformation = 3,
    FileFsLabelInformation = 2,
    FileFsVolumeInformation = 1,
};

enum _FSINFOCLASS
{
    FileFsMaximumInformation = 10,
    FileFsDriverPathInformation = 9,
    FileFsObjectIdInformation = 8,
    FileFsFullSizeInformation = 7,
    FileFsControlInformation = 6,
    FileFsAttributeInformation = 5,
    FileFsDeviceInformation = 4,
    FileFsSizeInformation = 3,
    FileFsLabelInformation = 2,
    FileFsVolumeInformation = 1,
};

struct UnnamedStruct_4662A0
{
    DWORD Length;
    enum _FSINFOCLASS FsInformationClass;