ntkrnlmp.exe.h

一个 windows 内核级别的调试器

    BYTE ReadAccess;
    BYTE WriteAccess;
    BYTE DeleteAccess;
    BYTE SharedRead;
    BYTE SharedWrite;
    BYTE SharedDelete;
    DWORD Flags;
    struct _UNICODE_STRING FileName;
    struct _LARGE_INTEGER CurrentByteOffset;
    DWORD Waiters;
    DWORD Busy;
    void* LastLock;
    struct _KEVENT Lock;
    struct _KEVENT Event;
    struct _IO_COMPLETION_CONTEXT* CompletionContext;
};

struct _FILE_OBJECT*;

struct _MBCB
{
    short NodeTypeCode;
    short NodeIsInZone;
    DWORD PagesToWrite;
    DWORD DirtyPages;
    DWORD Reserved;
    struct _LIST_ENTRY BitmapRanges;
    __int64 ResumeWritePage;
    struct _BITMAP_RANGE BitmapRange1;
    struct _BITMAP_RANGE BitmapRange2;
    struct _BITMAP_RANGE BitmapRange3;
};

struct _MBCB*;

struct _KEVENT*;

struct _CACHE_MANAGER_CALLBACKS
{
    INVALID_TYPE* AcquireForLazyWrite;
    INVALID_TYPE* ReleaseFromLazyWrite;
    INVALID_TYPE* AcquireForReadAhead;
    INVALID_TYPE* ReleaseFromReadAhead;
};

struct _CACHE_MANAGER_CALLBACKS*;

INVALID_TYPE*;

struct _CACHE_UNINITIALIZE_EVENT
{
    struct _CACHE_UNINITIALIZE_EVENT* Next;
    struct _KEVENT Event;
};

struct _CACHE_UNINITIALIZE_EVENT*;

struct _PRIVATE_CACHE_MAP
{
    short NodeTypeCode;
    struct _PRIVATE_CACHE_MAP_FLAGS Flags;
    DWORD UlongFlags;
    DWORD ReadAheadMask;
    struct _FILE_OBJECT* FileObject;
    struct _LARGE_INTEGER FileOffset1;
    struct _LARGE_INTEGER BeyondLastByte1;
    struct _LARGE_INTEGER FileOffset2;
    struct _LARGE_INTEGER BeyondLastByte2;
    struct _LARGE_INTEGER ReadAheadOffset[2];
    DWORD ReadAheadLength[2];
    DWORD ReadAheadSpinLock;
    struct _LIST_ENTRY PrivateLinks;
};

struct UnnamedStruct_7E5C30
{
    short NodeTypeCode;
    short NodeByteSize;
    DWORD OpenCount;
    struct _LARGE_INTEGER FileSize;
    struct _LIST_ENTRY BcbList;
    struct _LARGE_INTEGER SectionSize;
    struct _LARGE_INTEGER ValidDataLength;
    struct _LARGE_INTEGER ValidDataGoal;
    struct _VACB* InitialVacbs[4];
    struct _VACB** Vacbs;
    struct _FILE_OBJECT* FileObject;
    struct _VACB* ActiveVacb;
    void* NeedToZero;
    DWORD ActivePage;
    DWORD NeedToZeroPage;
    DWORD ActiveVacbSpinLock;
    DWORD VacbActiveCount;
    DWORD DirtyPages;
    struct _LIST_ENTRY SharedCacheMapLinks;
    DWORD Flags;
    long Status;
    struct _MBCB* Mbcb;
    void* Section;
    struct _KEVENT* CreateEvent;
    struct _KEVENT* WaitOnActiveCount;
    DWORD PagesToWrite;
    __int64 BeyondLastFlush;
    struct _CACHE_MANAGER_CALLBACKS* Callbacks;
    void* LazyWriteContext;
    struct _LIST_ENTRY PrivateList;
    void* LogHandle;
    INVALID_TYPE* FlushToLsnRoutine;
    DWORD DirtyPageThreshold;
    DWORD LazyWritePassCount;
    struct _CACHE_UNINITIALIZE_EVENT* UninitializeEvent;
    struct _VACB* NeedToZeroVacb;
    DWORD BcbSpinLock;
    void* Reserved;
    struct _KEVENT Event;
    struct _PRIVATE_CACHE_MAP PrivateCacheMap;
};

struct _VACB_LEVEL_REFERENCE
{
    long Reference;
    long SpecialReference;
};

struct _VACB_LEVEL_REFERENCE*;

struct UnnamedStruct_7E7280
{
    long Reference;
    long SpecialReference;
};

struct _HEAP_ENTRY
{
    WORD Size;
    WORD PreviousSize;
    BYTE SegmentIndex;
    BYTE Flags;
    BYTE UnusedBytes;
    BYTE SmallTagIndex;
};

struct _HEAP_ENTRY*;

struct UnnamedStruct_7E74A0
{
    WORD Size;
    WORD PreviousSize;
    BYTE SegmentIndex;
    BYTE Flags;
    BYTE UnusedBytes;
    BYTE SmallTagIndex;
};

struct _HEAP_UCR_SEGMENT
{
    struct _HEAP_UCR_SEGMENT* Next;
    DWORD ReservedSize;
    DWORD CommittedSize;
    DWORD filler;
};

struct _HEAP_UCR_SEGMENT*;

struct UnnamedStruct_7E78F0
{
    struct _HEAP_UCR_SEGMENT* Next;
    DWORD ReservedSize;
    DWORD CommittedSize;
    DWORD filler;
};

INVALID_TYPE*;

struct _OBJECT_SYMBOLIC_LINK
{
    struct _LARGE_INTEGER CreationTime;
    struct _UNICODE_STRING LinkTarget;
    struct _UNICODE_STRING LinkTargetRemaining;
    void* LinkTargetObject;
    DWORD DosDeviceDriveIndex;
};

struct _UNICODE_STRING
{
    WORD Length;
    WORD MaximumLength;
    WORD* Buffer;
};

struct UnnamedStruct_7E7CC0
{
    struct _LARGE_INTEGER CreationTime;
    struct _UNICODE_STRING LinkTarget;
    struct _UNICODE_STRING LinkTargetRemaining;
    void* LinkTargetObject;
    DWORD DosDeviceDriveIndex;
};

struct _POOL_BLOCK_HEAD
{
    struct _POOL_HEADER Header;
    struct _LIST_ENTRY List;
};

struct _POOL_HEADER
{
    INVALID_TYPE PreviousSize;
    INVALID_TYPE PoolIndex;
    INVALID_TYPE BlockSize;
    INVALID_TYPE PoolType;
    DWORD Ulong1;
    struct _EPROCESS* ProcessBilled;
    DWORD PoolTag;
    WORD AllocatorBackTraceIndex;
    WORD PoolTagHash;
};

struct UnnamedStruct_7E80E8
{
    struct _POOL_HEADER Header;
    struct _LIST_ENTRY List;
};

struct _HEAP
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    DWORD ForceFlags;
    DWORD VirtualMemoryThreshold;
    DWORD SegmentReserve;
    DWORD SegmentCommit;
    DWORD DeCommitFreeBlockThreshold;
    DWORD DeCommitTotalFreeThreshold;
    DWORD TotalFreeSize;
    DWORD MaximumAllocationSize;
    WORD ProcessHeapsListIndex;
    WORD HeaderValidateLength;
    void* HeaderValidateCopy;
    WORD NextAvailableTagIndex;
    WORD MaximumTagIndex;
    struct _HEAP_TAG_ENTRY* TagEntries;
    struct _HEAP_UCR_SEGMENT* UCRSegments;
    struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges;
    DWORD AlignRound;
    DWORD AlignMask;
    struct _LIST_ENTRY VirtualAllocdBlocks;
    struct _HEAP_SEGMENT* Segments[64];
    struct UnnamedStruct_7E86E8 u;
    struct UnnamedStruct_7E8898 u2;
    WORD AllocatorBackTraceIndex;
    DWORD NonDedicatedListLength;
    void* LargeBlocksIndex;
    struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
    struct _LIST_ENTRY FreeLists[128];
    struct _HEAP_LOCK* LockVariable;
    INVALID_TYPE* CommitRoutine;
    void* FrontEndHeap;
    WORD FrontHeapLockCount;
    BYTE FrontEndHeapType;
    BYTE LastSegmentIndex;
};

struct _HEAP_TAG_ENTRY
{
    DWORD Allocs;
    DWORD Frees;
    DWORD Size;
    WORD TagIndex;
    WORD CreatorBackTraceIndex;
    WORD TagName[24];
};

struct _HEAP_TAG_ENTRY*;

struct _HEAP_UNCOMMMTTED_RANGE
{
    struct _HEAP_UNCOMMMTTED_RANGE* Next;
    DWORD Address;
    DWORD Size;
    DWORD filler;
};

struct _HEAP_UNCOMMMTTED_RANGE*;

struct _HEAP_SEGMENT
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    struct _HEAP* Heap;
    DWORD LargestUnCommittedRange;
    void* BaseAddress;
    DWORD NumberOfPages;
    struct _HEAP_ENTRY* FirstEntry;
    struct _HEAP_ENTRY* LastValidEntry;
    DWORD NumberOfUnCommittedPages;
    DWORD NumberOfUnCommittedRanges;
    struct _HEAP_UNCOMMMTTED_RANGE* UnCommittedRanges;
    WORD AllocatorBackTraceIndex;
    WORD Reserved;
    struct _HEAP_ENTRY* LastEntryInSegment;
};

struct _HEAP_SEGMENT*;

struct _HEAP_SEGMENT*;

struct UnnamedStruct_7E8580
{
    DWORD FreeListsInUseUlong[4];
    BYTE FreeListsInUseBytes[16];
};

struct UnnamedStruct_7E86E8
{
    DWORD FreeListsInUseUlong[4];
    BYTE FreeListsInUseBytes[16];
};

struct UnnamedStruct_7E8730
{
    WORD FreeListsInUseTerminate;
    WORD DecommitCount;
};

struct UnnamedStruct_7E8898
{
    WORD FreeListsInUseTerminate;
    WORD DecommitCount;
};

struct _HEAP_PSEUDO_TAG_ENTRY
{
    DWORD Allocs;
    DWORD Frees;
    DWORD Size;
};

struct _HEAP_PSEUDO_TAG_ENTRY*;

struct _LIST_ENTRY;

struct _HEAP_LOCK
{
    struct UnnamedStruct_7FD4A0 Lock;
};

struct _HEAP_LOCK*;

void**;

INVALID_TYPE*;

struct UnnamedStruct_7E8B58
{
    struct _HEAP_ENTRY Entry;
    DWORD Signature;
    DWORD Flags;
    DWORD ForceFlags;
    DWORD VirtualMemoryThreshold;
    DWORD SegmentReserve;
    DWORD SegmentCommit;
    DWORD DeCommitFreeBlockThreshold;
    DWORD DeCommitTotalFreeThreshold;
    DWORD TotalFreeSize;
    DWORD MaximumAllocationSize;
    WORD ProcessHeapsListIndex;
    WORD HeaderValidateLength;
    void* HeaderValidateCopy;
    WORD NextAvailableTagIndex;
    WORD MaximumTagIndex;
    struct _HEAP_TAG_ENTRY* TagEntries;
    struct _HEAP_UCR_SEGMENT* UCRSegments;
    struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges;
    DWORD AlignRound;
    DWORD AlignMask;
    struct _LIST_ENTRY VirtualAllocdBlocks;
    struct _HEAP_SEGMENT* Segments[64];
    struct UnnamedStruct_7E86E8 u;
    struct UnnamedStruct_7E8898 u2;
    WORD AllocatorBackTraceIndex;
    DWORD NonDedicatedListLength;
    void* LargeBlocksIndex;
    struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
    struct _LIST_ENTRY FreeLists[128];
    struct _HEAP_LOCK* LockVariable;
    INVALID_TYPE* CommitRoutine;
    void* FrontEndHeap;
    WORD FrontHeapLockCount;
    BYTE FrontEndHeapType;
    BYTE LastSegmentIndex;
};

struct _LDR_DATA_TABLE_ENTRY
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
    void* EntryPointActivationContext;
};

struct UnnamedStruct_7E9FB0
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
    void* EntryPointActivationContext;
};

struct UnnamedStruct_3167E0
{
    struct _HEAP_UNCOMMMTTED_RANGE* Next;
    DWORD Address;
    DWORD Size;
    DWORD filler;
};

enum UnnamedEnum_316A28
{
    PfMaxScenarioType = 2,
    PfSystemBootScenarioType = 1,
    PfApplicationLaunchScenarioType = 0,
};

enum _PF_SCENARIO_TYPE
{
    PfMaxScenarioType = 2,
    PfSystemBootScenarioType = 1,
    PfApplicationLaunchScenarioType = 0,
};

struct _SECTION_OBJECT
{
    void* StartingVa;
    void* EndingVa;
    void* Parent;
    void* LeftChild;
    void* RightChild;
    struct _SEGMENT_OBJECT* Segment;
};

struct _SEGMENT_OBJECT
{
    void* BaseAddress;
    DWORD TotalNumberOfPtes;
    struct _LARGE_INTEGER SizeOfSegment;
    DWORD NonExtendedPtes;
    DWORD ImageCommitment;
    struct _CONTROL_AREA* ControlArea;
    struct _SUBSECTION* Subsection;
    struct _LARGE_CONTROL_AREA* LargeControlArea;
    struct _MMSECTION_FLAGS* MmSectionFlags;
    struct _MMSUBSECTION_FLAGS* MmSubSectionFlags;
};

struct _SEGMENT_OBJECT*;

struct UnnamedStruct_7EB318
{
    void* StartingVa;
    void* EndingVa;
    void* Parent;
    void* LeftChild;
    void* RightChild;
    struct _SEGMENT_OBJECT* Segment;
};

struct _POWER_STATE
{
    enum _SYSTEM_POWER_STATE SystemState;
    enum _DEVICE_POWER_STATE DeviceState;
};

enum UnnamedEnum_7EB6F0
{
    PowerSystemMaximum = 7,
    PowerSystemShutdown = 6,
    PowerSystemHibernate = 5,
    PowerSystemSleeping3 = 4,
    PowerSystemSleeping2 = 3,
    PowerSystemSleeping1 = 2,
    PowerSystemWorking = 1,
    PowerSystemUnspecified = 0,
};

enum _SYSTEM_POWER_STATE
{
    PowerSystemMaximum = 7,
    PowerSystemShutdown = 6,
    PowerSystemHibernate = 5,
    PowerSystemSleeping3 = 4,
    PowerSystemSleeping2 = 3,
    PowerSystemSleeping1 = 2,
    PowerSystemWorking = 1,
    PowerSystemUnspecified = 0,
};

enum UnnamedEnum_7EBBC8
{
    PowerDeviceMaximum = 5,
    PowerDeviceD3 = 4,
    PowerDeviceD2 = 3,
    PowerDeviceD1 = 2,
    PowerDeviceD0 = 1,
    PowerDeviceUnspecified = 0,
};

enum _DEVICE_POWER_STATE
{
    PowerDeviceMaximum = 5,
    PowerDeviceD3 = 4,
    PowerDeviceD2 = 3,
    PowerDeviceD1 = 2,
    PowerDeviceD0 = 1,
    PowerDeviceUnspecified = 0,
};

struct UnnamedStruct_7EBFA0
{
    enum _SYSTEM_POWER_STATE SystemState;
    enum _DEVICE_POWER_STATE DeviceState;
};

struct _CONTROL_AREA
{
    struct _SEGMENT* Segment;
    struct _LIST_ENTRY DereferenceList;
    DWORD NumberOfSectionReferences;
    DWORD NumberOfPfnReferences;
    DWORD NumberOfMappedViews;
    WORD NumberOfSubsections;
    WORD FlushInProgressCount;
    DWORD NumberOfUserReferences;
    struct UnnamedStruct_7ECCD8 u;