ntkrnlmp.exe.h

一个 windows 内核级别的调试器

    struct _FILE_OBJECT* FilePointer;
    struct _EVENT_COUNTER* WaitingForDeletion;
    WORD ModifiedWriteCount;
    WORD NumberOfSystemCacheViews;
};

struct _CONTROL_AREA*;

struct _SUBSECTION
{
    struct _CONTROL_AREA* ControlArea;
    struct UnnamedStruct_816550 u;
    DWORD StartingSector;
    DWORD NumberOfFullSectors;
    struct _MMPTE* SubsectionBase;
    DWORD UnusedPtes;
    DWORD PtesInSubsection;
    struct _SUBSECTION* NextSubsection;
};

struct _SUBSECTION*;

struct _LARGE_CONTROL_AREA
{
    struct _SEGMENT* Segment;
    struct _LIST_ENTRY DereferenceList;
    DWORD NumberOfSectionReferences;
    DWORD NumberOfPfnReferences;
    DWORD NumberOfMappedViews;
    WORD NumberOfSubsections;
    WORD FlushInProgressCount;
    DWORD NumberOfUserReferences;
    struct UnnamedStruct_7ECCD8 u;
    struct _FILE_OBJECT* FilePointer;
    struct _EVENT_COUNTER* WaitingForDeletion;
    WORD ModifiedWriteCount;
    WORD NumberOfSystemCacheViews;
    DWORD StartingFrame;
    struct _LIST_ENTRY UserGlobalList;
    DWORD SessionId;
};

struct _LARGE_CONTROL_AREA*;

struct _MMSECTION_FLAGS
{
    unsigned BeingDeleted;
    unsigned BeingCreated;
    unsigned BeingPurged;
    unsigned NoModifiedWriting;
    unsigned FailAllIo;
    unsigned Image;
    unsigned Based;
    unsigned File;
    unsigned Networked;
    unsigned NoCache;
    unsigned PhysicalMemory;
    unsigned CopyOnWrite;
    unsigned Reserve;
    unsigned Commit;
    unsigned FloppyMedia;
    unsigned WasPurged;
    unsigned UserReference;
    unsigned GlobalMemory;
    unsigned DeleteOnClose;
    unsigned FilePointerNull;
    unsigned DebugSymbolsLoaded;
    unsigned SetMappedFileIoComplete;
    unsigned CollidedFlush;
    unsigned NoChange;
    unsigned HadUserReference;
    unsigned ImageMappedInSystemSpace;
    unsigned UserWritable;
    unsigned Accessed;
    unsigned GlobalOnlyPerSession;
    unsigned Rom;
    unsigned filler;
};

struct _MMSECTION_FLAGS*;

struct _MMSUBSECTION_FLAGS
{
    unsigned ReadOnly;
    unsigned ReadWrite;
    unsigned SubsectionStatic;
    unsigned GlobalMemory;
    unsigned Protection;
    unsigned LargePages;
    unsigned StartingSector4132;
    unsigned SectorEndOffset;
};

struct _MMSUBSECTION_FLAGS*;

struct UnnamedStruct_7EC510
{
    void* BaseAddress;
    DWORD TotalNumberOfPtes;
    struct _LARGE_INTEGER SizeOfSegment;
    DWORD NonExtendedPtes;
    DWORD ImageCommitment;
    struct _CONTROL_AREA* ControlArea;
    struct _SUBSECTION* Subsection;
    struct _LARGE_CONTROL_AREA* LargeControlArea;
    struct _MMSECTION_FLAGS* MmSectionFlags;
    struct _MMSUBSECTION_FLAGS* MmSubSectionFlags;
};

struct _SEGMENT
{
    struct _CONTROL_AREA* ControlArea;
    DWORD TotalNumberOfPtes;
    DWORD NonExtendedPtes;
    DWORD WritableUserReferences;
    ULONGLONG SizeOfSegment;
    struct _MMPTE SegmentPteTemplate;
    DWORD NumberOfCommittedPages;
    struct _MMEXTEND_INFO* ExtendInfo;
    void* SystemImageBase;
    void* BasedAddress;
    struct UnnamedStruct_83E860 u1;
    struct UnnamedStruct_83EAE8 u2;
    struct _MMPTE* PrototypePte;
    struct _MMPTE ThePtes[1];
};

struct _SEGMENT*;

struct UnnamedStruct_7ECB90
{
    DWORD LongFlags;
    struct _MMSECTION_FLAGS Flags;
};

struct UnnamedStruct_7ECCD8
{
    DWORD LongFlags;
    struct _MMSECTION_FLAGS Flags;
};

struct _EVENT_COUNTER
{
    struct _SINGLE_LIST_ENTRY ListEntry;
    DWORD RefCount;
    struct _KEVENT Event;
};

struct _EVENT_COUNTER*;

struct UnnamedStruct_7ECDF8
{
    struct _SEGMENT* Segment;
    struct _LIST_ENTRY DereferenceList;
    DWORD NumberOfSectionReferences;
    DWORD NumberOfPfnReferences;
    DWORD NumberOfMappedViews;
    WORD NumberOfSubsections;
    WORD FlushInProgressCount;
    DWORD NumberOfUserReferences;
    struct UnnamedStruct_7ECCD8 u;
    struct _FILE_OBJECT* FilePointer;
    struct _EVENT_COUNTER* WaitingForDeletion;
    WORD ModifiedWriteCount;
    WORD NumberOfSystemCacheViews;
};

struct _HANDLE_TABLE_SEQ
{
    long FirstFreeTableEntry;
    long SequenceNumber;
    __int64 ExchangeBlock;
};

struct _HANDLE_TRACE_DEBUG_INFO
{
    struct _HANDLE_TABLE_SEQ LastFreeSeq;
    DWORD CurrentStackIndex;
    struct _HANDLE_TRACE_DB_ENTRY TraceDb[682];
};

struct _HANDLE_TRACE_DEBUG_INFO*;

struct UnnamedStruct_7ED6C8
{
    struct _HANDLE_TABLE_SEQ FirstFreeSeq;
    long NextIndexNeedingPool;
    long HandleCount;
    DWORD TableCode;
    struct _EPROCESS* QuotaProcess;
    void* UniqueProcessId;
    struct _EX_PUSH_LOCK HandleTableLock;
    struct _LIST_ENTRY HandleTableList;
    struct _EX_PUSH_LOCK HandleContentionEvent;
    struct _HANDLE_TRACE_DEBUG_INFO* DebugInfo;
    long ExtraInfoPages;
};

struct UnnamedBitfield_7EDD10
{
    struct _HANDLE_TABLE_SEQ FirstFreeSeq;
    long NextIndexNeedingPool;
    long HandleCount;
    DWORD TableCode;
    struct _EPROCESS* QuotaProcess;
    void* UniqueProcessId;
    struct _EX_PUSH_LOCK HandleTableLock;
    struct _LIST_ENTRY HandleTableList;
    struct _EX_PUSH_LOCK HandleContentionEvent;
    struct _HANDLE_TRACE_DEBUG_INFO* DebugInfo;
    long ExtraInfoPages;
};

struct UnnamedBitfield_7EDD58
{
};

struct UnnamedStruct_7EDDA0
{
    INVALID_TYPE PreviousSize;
    INVALID_TYPE PoolIndex;
    INVALID_TYPE BlockSize;
    INVALID_TYPE PoolType;
    DWORD Ulong1;
    struct _EPROCESS* ProcessBilled;
    DWORD PoolTag;
    WORD AllocatorBackTraceIndex;
    WORD PoolTagHash;
};

struct _MMWSL
{
    DWORD Quota;
    DWORD FirstFree;
    DWORD FirstDynamic;
    DWORD LastEntry;
    DWORD NextSlot;
    struct _MMWSLE* Wsle;
    DWORD LastInitializedWsle;
    DWORD NonDirectCount;
    struct _MMWSLE_HASH* HashTable;
    DWORD HashTableSize;
    DWORD NumberOfCommittedPageTables;
    void* HashTableStart;
    void* HighestPermittedHashAddress;
    DWORD NumberOfImageWaiters;
    DWORD VadBitMapHint;
    WORD UsedPageTableEntries[768];
    DWORD CommittedPageTables[24];
};

struct _MMWSL*;

struct _MMSUPPORT_FLAGS
{
    unsigned SessionSpace;
    unsigned BeingTrimmed;
    unsigned SessionLeader;
    unsigned TrimHard;
    unsigned WorkingSetHard;
    unsigned AddressSpaceBeingDeleted;
    unsigned Available;
    unsigned AllowWorkingSetAdjustment;
    unsigned MemoryPriority;
};

struct UnnamedStruct_7EE3F0
{
    struct _LARGE_INTEGER LastTrimTime;
    DWORD LastTrimFaultCount;
    DWORD PageFaultCount;
    DWORD PeakWorkingSetSize;
    DWORD WorkingSetSize;
    DWORD MinimumWorkingSetSize;
    DWORD MaximumWorkingSetSize;
    struct _MMWSL* VmWorkingSetList;
    struct _LIST_ENTRY WorkingSetExpansionLinks;
    struct _MMSUPPORT_FLAGS Flags;
    DWORD Claim;
    DWORD NextEstimationSlot;
    DWORD NextAgingSlot;
    DWORD EstimatedAvailable;
    DWORD GrowthSinceLastEstimate;
};

struct UnnamedBitfield_7EEC88
{
    struct _LARGE_INTEGER LastTrimTime;
    DWORD LastTrimFaultCount;
    DWORD PageFaultCount;
    DWORD PeakWorkingSetSize;
    DWORD WorkingSetSize;
    DWORD MinimumWorkingSetSize;
    DWORD MaximumWorkingSetSize;
    struct _MMWSL* VmWorkingSetList;
    struct _LIST_ENTRY WorkingSetExpansionLinks;
    struct _MMSUPPORT_FLAGS Flags;
    DWORD Claim;
    DWORD NextEstimationSlot;
    DWORD NextAgingSlot;
    DWORD EstimatedAvailable;
    DWORD GrowthSinceLastEstimate;
};

struct UnnamedBitfield_7EECD0
{
     (null);
};

struct UnnamedBitfield_7EED18
{
     (null);
};

struct UnnamedBitfield_7EED60
{
     (null);
};

struct UnnamedBitfield_7EEDA8
{
     (null);
};

struct UnnamedBitfield_7EEDF0
{
     (null);
};

struct UnnamedBitfield_7EEE38
{
     (null);
};

struct UnnamedStruct_7EEE80
{
    unsigned ReadOnly;
    unsigned ReadWrite;
    unsigned SubsectionStatic;
    unsigned GlobalMemory;
    unsigned Protection;
    unsigned LargePages;
    unsigned StartingSector4132;
    unsigned SectorEndOffset;
};

WORD;

struct UnnamedStruct_7EF350
{
    DWORD Allocs;
    DWORD Frees;
    DWORD Size;
    WORD TagIndex;
    WORD CreatorBackTraceIndex;
    WORD TagName[24];
};

struct _DISPATCHER_HEADER
{
    BYTE Type;
    BYTE Absolute;
    BYTE Size;
    BYTE Inserted;
    long SignalState;
    struct _LIST_ENTRY WaitListHead;
};

struct UnnamedStruct_7EF738
{
    struct _DISPATCHER_HEADER Header;
};

struct _EPROCESS_QUOTA_ENTRY
{
    DWORD Usage;
    DWORD Limit;
    DWORD Peak;
    DWORD Return;
};

struct _EPROCESS_QUOTA_ENTRY;

struct UnnamedStruct_7EF8D8
{
    struct _EPROCESS_QUOTA_ENTRY QuotaEntry[3];
    struct _LIST_ENTRY QuotaList;
    DWORD ReferenceCount;
    DWORD ProcessCount;
};

struct UnnamedStruct_7EFB40
{
    WORD Length;
    WORD MaximumLength;
    WORD* Buffer;
};

struct UnnamedStruct_7EFD18
{
    struct _SINGLE_LIST_ENTRY ListEntry;
    DWORD RefCount;
    struct _KEVENT Event;
};

struct _ERESOURCE
{
    struct _LIST_ENTRY SystemResourcesList;
    struct _OWNER_ENTRY* OwnerTable;
    short ActiveCount;
    WORD Flag;
    struct _KSEMAPHORE* SharedWaiters;
    struct _KEVENT* ExclusiveWaiters;
    struct _OWNER_ENTRY OwnerThreads[2];
    DWORD ContentionCount;
    WORD NumberOfSharedWaiters;
    WORD NumberOfExclusiveWaiters;
    void* Address;
    DWORD CreatorBackTraceIndex;
    DWORD SpinLock;
};

struct _PS_JOB_TOKEN_FILTER
{
    DWORD CapturedSidCount;
    struct _SID_AND_ATTRIBUTES* CapturedSids;
    DWORD CapturedSidsLength;
    DWORD CapturedGroupCount;
    struct _SID_AND_ATTRIBUTES* CapturedGroups;
    DWORD CapturedGroupsLength;
    DWORD CapturedPrivilegeCount;
    struct _LUID_AND_ATTRIBUTES* CapturedPrivileges;
    DWORD CapturedPrivilegesLength;
};

struct _PS_JOB_TOKEN_FILTER*;

struct _IO_COUNTERS
{
    ULONGLONG ReadOperationCount;
    ULONGLONG WriteOperationCount;
    ULONGLONG OtherOperationCount;
    ULONGLONG ReadTransferCount;
    ULONGLONG WriteTransferCount;
    ULONGLONG OtherTransferCount;
};

struct UnnamedStruct_7F00C8
{
    struct _KEVENT Event;
    struct _LIST_ENTRY JobLinks;
    struct _LIST_ENTRY ProcessListHead;
    struct _ERESOURCE JobLock;
    struct _LARGE_INTEGER TotalUserTime;
    struct _LARGE_INTEGER TotalKernelTime;
    struct _LARGE_INTEGER ThisPeriodTotalUserTime;
    struct _LARGE_INTEGER ThisPeriodTotalKernelTime;
    DWORD TotalPageFaultCount;
    DWORD TotalProcesses;
    DWORD ActiveProcesses;
    DWORD TotalTerminatedProcesses;
    struct _LARGE_INTEGER PerProcessUserTimeLimit;
    struct _LARGE_INTEGER PerJobUserTimeLimit;
    DWORD LimitFlags;
    DWORD MinimumWorkingSetSize;
    DWORD MaximumWorkingSetSize;
    DWORD ActiveProcessLimit;
    DWORD Affinity;
    BYTE PriorityClass;
    DWORD UIRestrictionsClass;
    DWORD SecurityLimitFlags;
    void* Token;
    struct _PS_JOB_TOKEN_FILTER* Filter;
    DWORD EndOfJobTimeAction;
    void* CompletionPort;
    void* CompletionKey;
    DWORD SessionId;
    DWORD SchedulingClass;
    ULONGLONG ReadOperationCount;
    ULONGLONG WriteOperationCount;
    ULONGLONG OtherOperationCount;
    ULONGLONG ReadTransferCount;
    ULONGLONG WriteTransferCount;
    ULONGLONG OtherTransferCount;
    struct _IO_COUNTERS IoInfo;
    DWORD ProcessMemoryLimit;
    DWORD JobMemoryLimit;
    DWORD PeakProcessMemoryUsed;
    DWORD PeakJobMemoryUsed;
    DWORD CurrentJobMemoryUsed;
    struct _FAST_MUTEX MemoryLimitsLock;
    struct _LIST_ENTRY JobSetLinks;
    DWORD MemberLevel;
    DWORD JobFlags;
};

struct UnnamedStruct_7F19A0
{
    struct _SEGMENT* Segment;
    struct _LIST_ENTRY DereferenceList;
    DWORD NumberOfSectionReferences;
    DWORD NumberOfPfnReferences;
    DWORD NumberOfMappedViews;
    WORD NumberOfSubsections;
    WORD FlushInProgressCount;
    DWORD NumberOfUserReferences;
    struct UnnamedStruct_7ECCD8 u;
    struct _FILE_OBJECT* FilePointer;
    struct _EVENT_COUNTER* WaitingForDeletion;
    WORD ModifiedWriteCount;
    WORD NumberOfSystemCacheViews;
    DWORD StartingFrame;
    struct _LIST_ENTRY UserGlobalList;
    DWORD SessionId;
};

struct _SID_AND_ATTRIBUTES
{
    void* Sid;
    DWORD Attributes;
};

struct _SID_AND_ATTRIBUTES*;

struct _LUID_AND_ATTRIBUTES
{
    struct _LUID Luid;
    DWORD Attributes;
};

struct _LUID_AND_ATTRIBUTES*;

struct UnnamedStruct_7F2458
{
    DWORD CapturedSidCount;
    struct _SID_AND_ATTRIBUTES* CapturedSids;
    DWORD CapturedSidsLength;
    DWORD CapturedGroupCount;
    struct _SID_AND_ATTRIBUTES* CapturedGroups;
    DWORD CapturedGroupsLength;
    DWORD CapturedPrivilegeCount;
    struct _LUID_AND_ATTRIBUTES* CapturedPrivileges;
    DWORD CapturedPrivilegesLength;
};

struct UnnamedStruct_7F29B0
{
    long Count;
    struct _KTHREAD* Owner;
    DWORD Contention;
    struct _KEVENT Event;
    DWORD OldIrql;
};

struct _MM_DRIVER_VERIFIER_DATA
{
    DWORD Level;
    DWORD RaiseIrqls;
    DWO