ntkrpampsym.h

一个 windows 内核级别的调试器

Processing PDB file ntkrpampsym.pdb
-Wrong time stamp of .PDB file ntkrpampsym.pdb (0x37fbe190, 0x00000000)
struct UnnamedStruct_2F5928
{
    BYTE AclRevision;
    BYTE Sbz1;
    WORD AclSize;
    WORD AceCount;
    WORD Sbz2;
};

struct _ACL
{
    BYTE AclRevision;
    BYTE Sbz1;
    WORD AclSize;
    WORD AceCount;
    WORD Sbz2;
};

struct _PI_BUS_EXTENSION
{
    DWORD Flags;
    DWORD NumberCSNs;
    BYTE* ReadDataPort;
    BYTE DataPortMapped;
    BYTE* AddressPort;
    BYTE AddrPortMapped;
    BYTE* CommandPort;
    BYTE CmdPortMapped;
    DWORD NextSlotNumber;
    struct _SINGLE_LIST_ENTRY DeviceList;
    struct _SINGLE_LIST_ENTRY CardList;
    struct _DEVICE_OBJECT* PhysicalBusDevice;
    struct _DEVICE_OBJECT* FunctionalBusDevice;
    struct _DEVICE_OBJECT* AttachedDevice;
    DWORD BusNumber;
    int SystemPowerState;
    int DevicePowerState;
};

struct _PI_BUS_EXTENSION*;

struct UnnamedStruct_46D9F8
{
    void* Next;
    struct _PI_BUS_EXTENSION* BusExtension;
};

struct _BUS_EXTENSION_LIST
{
    void* Next;
    struct _PI_BUS_EXTENSION* BusExtension;
};

struct _CM_KEY_CONTROL_BLOCK
{
    BYTE Delete;
    WORD RefCount;
    struct _CM_KEY_HASH KeyHash;
    DWORD ConvKey;
    struct _CM_KEY_HASH* NextHash;
    struct _HHIVE* KeyHive;
    DWORD KeyCell;
    WORD ExtFlags;
    WORD Flags;
    struct _CM_KEY_CONTROL_BLOCK* ParentKcb;
    struct _CM_NAME_CONTROL_BLOCK* NameBlock;
    DWORD Security;
    struct _CACHED_CHILD_LIST ValueCache;
    struct _CM_INDEX_HINT_BLOCK* IndexHint;
    BYTE NameHint[4];
    WORD DelayedCloseIndex;
    WORD TotalLevels;
    struct _CM_KEY_NODE* KeyNode;
    struct _LIST_ENTRY KeyBodyListHead;
};

struct _CM_KEY_CONTROL_BLOCK*;

struct _CM_NOTIFY_BLOCK
{
    struct _LIST_ENTRY HiveList;
    struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
    struct _CM_KEY_BODY* KeyBody;
    DWORD Filter;
    struct _LIST_ENTRY PostList;
    struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
    BYTE WatchTree;
    BYTE NotifyPending;
};

struct _CM_NOTIFY_BLOCK*;

struct _EPROCESS
{
    struct _KPROCESS Pcb;
    long ExitStatus;
    struct _KEVENT LockEvent;
    DWORD LockCount;
    struct _LARGE_INTEGER CreateTime;
    struct _LARGE_INTEGER ExitTime;
    struct _KTHREAD* LockOwner;
    void* UniqueProcessId;
    struct _LIST_ENTRY ActiveProcessLinks;
    DWORD QuotaPeakPoolUsage[2];
    DWORD QuotaPoolUsage[2];
    DWORD PagefileUsage;
    DWORD CommitCharge;
    DWORD PeakPagefileUsage;
    DWORD PeakVirtualSize;
    DWORD VirtualSize;
    struct _MMSUPPORT Vm;
    struct _LIST_ENTRY SessionProcessLinks;
    void* DebugPort;
    void* ExceptionPort;
    struct _HANDLE_TABLE* ObjectTable;
    void* Token;
    struct _FAST_MUTEX WorkingSetLock;
    DWORD WorkingSetPage;
    BYTE ProcessOutswapEnabled;
    BYTE ProcessOutswapped;
    BYTE AddressSpaceInitialized;
    BYTE AddressSpaceDeleted;
    struct _FAST_MUTEX AddressCreationLock;
    DWORD HyperSpaceLock;
    struct _ETHREAD* ForkInProgress;
    WORD VmOperation;
    BYTE ForkWasSuccessful;
    BYTE MmAgressiveWsTrimMask;
    struct _KEVENT* VmOperationEvent;
    void* PaeTop;
    DWORD LastFaultCount;
    DWORD ModifiedPageCount;
    void* VadRoot;
    void* VadHint;
    void* CloneRoot;
    DWORD NumberOfPrivatePages;
    DWORD NumberOfLockedPages;
    WORD NextPageColor;
    BYTE ExitProcessCalled;
    BYTE CreateProcessReported;
    void* SectionHandle;
    struct _PEB* Peb;
    void* SectionBaseAddress;
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;
    long LastThreadExitStatus;
    struct _PAGEFAULT_HISTORY* WorkingSetWatch;
    void* Win32WindowStation;
    void* InheritedFromUniqueProcessId;
    DWORD GrantedAccess;
    DWORD DefaultHardErrorProcessing;
    void* LdtInformation;
    void* VadFreeHint;
    void* VdmObjects;
    void* DeviceMap;
    DWORD SessionId;
    struct _LIST_ENTRY PhysicalVadList;
    struct _HARDWARE_PTE_X86PAE PageDirectoryPte;
    ULONGLONG Filler;
    DWORD PaePageDirectoryPage;
    BYTE ImageFileName[16];
    DWORD VmTrimFaultValue;
    BYTE SetTimerResolution;
    BYTE PriorityClass;
    BYTE SubSystemMinorVersion;
    BYTE SubSystemMajorVersion;
    WORD SubSystemVersion;
    void* Win32Process;
    struct _EJOB* Job;
    DWORD JobStatus;
    struct _LIST_ENTRY JobLinks;
    void* LockedPagesList;
    void* SecurityPort;
    struct _UNICODE_STRING* AuditImageName;
    struct _WOW64_PROCESS* Wow64Process;
    struct _LARGE_INTEGER ReadOperationCount;
    struct _LARGE_INTEGER WriteOperationCount;
    struct _LARGE_INTEGER OtherOperationCount;
    struct _LARGE_INTEGER ReadTransferCount;
    struct _LARGE_INTEGER WriteTransferCount;
    struct _LARGE_INTEGER OtherTransferCount;
    DWORD CommitChargeLimit;
    DWORD CommitChargePeak;
    struct _LIST_ENTRY ThreadListHead;
    struct _RTL_BITMAP* VadPhysicalPagesBitMap;
    DWORD VadPhysicalPages;
    DWORD AweLock;
};

struct _EPROCESS*;

struct _LIST_ENTRY
{
    struct _LIST_ENTRY* Flink;
    struct _LIST_ENTRY* Blink;
};

struct UnnamedStruct_46DED8
{
    DWORD Type;
    struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
    struct _CM_NOTIFY_BLOCK* NotifyBlock;
    struct _EPROCESS* Process;
    struct _LIST_ENTRY KeyBodyList;
};

struct _CM_KEY_BODY
{
    DWORD Type;
    struct _CM_KEY_CONTROL_BLOCK* KeyControlBlock;
    struct _CM_NOTIFY_BLOCK* NotifyBlock;
    struct _EPROCESS* Process;
    struct _LIST_ENTRY KeyBodyList;
};

struct _FILE_OBJECT
{
    unsigned short Type;
    unsigned short Size;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _VPB* Vpb;
    void* FsContext;
    void* FsContext2;
    struct _SECTION_OBJECT_POINTERS* SectionObjectPointer;
    void* PrivateCacheMap;
    long FinalStatus;
    struct _FILE_OBJECT* RelatedFileObject;
    BYTE LockOperation;
    BYTE DeletePending;
    BYTE ReadAccess;
    BYTE WriteAccess;
    BYTE DeleteAccess;
    BYTE SharedRead;
    BYTE SharedWrite;
    BYTE SharedDelete;
    DWORD Flags;
    struct _UNICODE_STRING FileName;
    struct _LARGE_INTEGER CurrentByteOffset;
    DWORD Waiters;
    DWORD Busy;
    void* LastLock;
    struct _KEVENT Lock;
    struct _KEVENT Event;
    struct _IO_COMPLETION_CONTEXT* CompletionContext;
};

struct _FILE_OBJECT*;

struct _KEVENT
{
    struct _DISPATCHER_HEADER Header;
};

struct _KEVENT*;

INVALID_TYPE*;

struct UnnamedStruct_46E428
{
    unsigned short NodeTypeCode;
    unsigned short NodeByteSize;
    struct _FILE_OBJECT* FileObject;
    DWORD BytesToWrite;
    struct _LIST_ENTRY DeferredWriteLinks;
    struct _KEVENT* Event;
    INVALID_TYPE* PostRoutine;
    void* Context1;
    void* Context2;
    BYTE LimitModifiedPages;
};

struct _DEFERRED_WRITE
{
    unsigned short NodeTypeCode;
    unsigned short NodeByteSize;
    struct _FILE_OBJECT* FileObject;
    DWORD BytesToWrite;
    struct _LIST_ENTRY DeferredWriteLinks;
    struct _KEVENT* Event;
    INVALID_TYPE* PostRoutine;
    void* Context1;
    void* Context2;
    BYTE LimitModifiedPages;
};

struct _DEVICE_NODE
{
    struct _DEVICE_NODE* Sibling;
    struct _DEVICE_NODE* Child;
    struct _DEVICE_NODE* Parent;
    struct _DEVICE_NODE* LastChild;
    DWORD Level;
    struct _PO_DEVICE_NOTIFY* Notify;
    DWORD Flags;
    DWORD UserFlags;
    DWORD Problem;
    struct _DEVICE_OBJECT* PhysicalDeviceObject;
    struct _CM_RESOURCE_LIST* ResourceList;
    struct _CM_RESOURCE_LIST* ResourceListTranslated;
    struct _KEVENT EnumerationMutex;
    struct _UNICODE_STRING InstancePath;
    struct _UNICODE_STRING ServiceName;
    struct _DEVICE_OBJECT* DuplicatePDO;
    struct _IO_RESOURCE_REQUIREMENTS_LIST* ResourceRequirements;
    int InterfaceType;
    DWORD BusNumber;
    int ChildInterfaceType;
    DWORD ChildBusNumber;
    WORD ChildBusTypeIndex;
    WORD Reserved;
    struct _LIST_ENTRY TargetDeviceNotify;
    struct _LIST_ENTRY DeviceArbiterList;
    struct _LIST_ENTRY DeviceTranslatorList;
    WORD NoTranslatorMask;
    WORD QueryTranslatorMask;
    WORD NoArbiterMask;
    WORD QueryArbiterMask;
    struct UnnamedStruct_2F6190 OverUsed1;
    struct UnnamedStruct_2F62B0 OverUsed2;
    struct _CM_RESOURCE_LIST* BootResources;
    DWORD LockCount;
    struct _RELATION_LIST* RelationList;
    DWORD CapabilityFlags;
    struct UnnamedStruct_2F65A8 DockInfo;
    DWORD DisableableDepends;
    struct _LIST_ENTRY PendedSetInterfaceState;
    DWORD FailureStatus;
    struct _CM_RESOURCE_LIST* PreviousResourceList;
    struct _IO_RESOURCE_REQUIREMENTS_LIST* PreviousResourceRequirements;
};

struct _DEVICE_NODE*;

struct _PO_DEVICE_NOTIFY
{
    struct _LIST_ENTRY Link;
    struct _DEVICE_OBJECT* TargetDevice;
    BYTE WakeNeeded;
    BYTE OrderLevel;
    struct _DEVICE_OBJECT* DeviceObject;
    void* Node;
    WORD* DeviceName;
    WORD* DriverName;
    long NodeLevel;
};

struct _PO_DEVICE_NOTIFY*;

struct _DEVICE_OBJECT
{
    unsigned short Type;
    WORD Size;
    long ReferenceCount;
    struct _DRIVER_OBJECT* DriverObject;
    struct _DEVICE_OBJECT* NextDevice;
    struct _DEVICE_OBJECT* AttachedDevice;
    struct _IRP* CurrentIrp;
    struct _IO_TIMER* Timer;
    DWORD Flags;
    DWORD Characteristics;
    struct _VPB* Vpb;
    void* DeviceExtension;
    DWORD DeviceType;
    char StackSize;
    struct UnnamedStruct_4C8620 Queue;
    DWORD AlignmentRequirement;
    struct _KDEVICE_QUEUE DeviceQueue;
    struct _KDPC Dpc;
    DWORD ActiveThreadCount;
    void* SecurityDescriptor;
    struct _KEVENT DeviceLock;
    WORD SectorSize;
    WORD Spare1;
    struct _DEVOBJ_EXTENSION* DeviceObjectExtension;
    void* Reserved;
};

struct _DEVICE_OBJECT*;

struct _CM_RESOURCE_LIST
{
    DWORD Count;
    struct _CM_FULL_RESOURCE_DESCRIPTOR List[1];
};

struct _CM_RESOURCE_LIST*;

struct _UNICODE_STRING
{
    WORD Length;
    WORD MaximumLength;
    WORD* Buffer;
};

struct _IO_RESOURCE_REQUIREMENTS_LIST
{
    DWORD ListSize;
    int InterfaceType;
    DWORD BusNumber;
    DWORD SlotNumber;
    DWORD Reserved[3];
    DWORD AlternativeLists;
    struct _IO_RESOURCE_LIST List[1];
};

struct _IO_RESOURCE_REQUIREMENTS_LIST*;

struct _DEVICE_RELATIONS
{
    DWORD Count;
    struct _DEVICE_OBJECT* Objects[1];
};

struct _DEVICE_RELATIONS*;

struct UnnamedStruct_2F6028
{
    struct _DEVICE_NODE* LegacyDeviceNode;
    struct _DEVICE_RELATIONS* PendingDeviceRelations;
};

struct UnnamedStruct_2F6190
{
    struct _DEVICE_NODE* LegacyDeviceNode;
    struct _DEVICE_RELATIONS* PendingDeviceRelations;
};

struct UnnamedStruct_2F61D8
{
    struct _DEVICE_NODE* NextResourceDeviceNode;
};

struct UnnamedStruct_2F62B0
{
    struct _DEVICE_NODE* NextResourceDeviceNode;
};

struct _RELATION_LIST
{
    DWORD Count;
    DWORD TagCount;
    DWORD FirstLevel;
    DWORD MaxLevel;
    struct _RELATION_LIST_ENTRY* Entries[1];
};

struct _RELATION_LIST*;

struct UnnamedStruct_2F63D0
{
    int DockStatus;
    struct _LIST_ENTRY ListEntry;
    WORD* SerialNumber;
};

struct UnnamedStruct_2F65A8
{
    int DockStatus;
    struct _LIST_ENTRY ListEntry;
    WORD* SerialNumber;
};

struct UnnamedStruct_2F65F0
{
    struct _DEVICE_NODE* Sibling;
    struct _DEVICE_NODE* Child;
    struct _DEVICE_NODE* Parent;
    struct _DEVICE_NODE* LastChild;
    DWORD Level;
    struct _PO_DEVICE_NOTIFY* Notify;
    DWORD Flags;
    DWORD UserFlags;
    DWORD Problem;
    struct _DEVICE_OBJECT* PhysicalDeviceObject;
    struct _CM_RESOURCE_LIST* ResourceList;
    struct _CM_RESOURCE_LIST* ResourceListTranslated;
    struct _KEVENT EnumerationMutex;
    struct _UNICODE_STRING InstancePath;
    struct _UNICODE_STRING ServiceName;
    struct _DEVICE_OBJECT* DuplicatePDO;
    struct _IO_RESOURCE_REQUIREMENTS_LIST* ResourceRequirements;
    int InterfaceType;
    DWORD BusNumber;
    int ChildInterfaceType;
    DWORD ChildBusNumber;
    WORD ChildBusTypeIndex;
    WORD Reserved;
    struct _LIST_ENTRY TargetDeviceNotify;
    struct _LIST_ENTRY DeviceArbiterList;
    struct _LIST_ENTRY DeviceTranslatorList;
    WORD NoTranslatorMask;
    WORD QueryTranslatorMask;
    WORD NoArbiterMask;
    WORD QueryArbiterMask;
    struct UnnamedStruct_2F6190 OverUsed1;
    struct UnnamedStruct_2F62B0 OverUsed2;
    struct _CM_RESOURCE_LIST* BootResources;
    DWORD LockCount;
    struct _RELATION_LIST* RelationList;
    DWORD CapabilityFlags;
    struct UnnamedStruct_2F65A8 DockInfo;
    DWORD DisableableDepends;
    struct _LIST_ENTRY PendedSetInterfaceState;
    DWORD FailureStatus;
    struct _CM_RESOURCE_LIST* PreviousResourceList;
    struct _IO_RESOURCE_REQUIREMENTS_LIST* PreviousResourceRequirements;
};

struct _POWER_CHANNEL_SUMMARY
{
    DWORD Signature;
    struct _DEVICE_OBJECT* Owner;
    DWORD TotalCount;
    DWORD D0Count;
    struct _LIST_ENTRY NotifyList;
};

struct UnnamedStruct_2F7D78
{
    DWORD IdleCount;
    DWORD ConservationIdleTime;
    DWORD PerformanceIdleTime;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _LIST_ENTRY IdleList;
    BYTE DeviceType;
    int State;
    struct _LIST_ENTRY NotifySourceList;
    struct _LIST_ENTRY NotifyTargetList;
    struct _POWER_CHANNEL_SUMMARY PowerChannelSummary;
    struct _LIST_ENTRY Volume;
};

struct _DEVICE_OBJECT_POWER_EXTENSION
{
    DWORD IdleCount;
    DWORD ConservationIdleTime;
    DWORD PerformanceIdleTime;
    struct _DEVICE_OBJECT* DeviceObject;
    struct _LIST_ENTRY IdleList;
    BYTE DeviceType;
    int State;
    struct _LIST_ENTRY NotifySourceList;
    struct _LIST_ENTRY NotifyTargetList;
    struct _POWER_CHANNEL_SUMMARY PowerChannelSummary;
    struct _LIST_ENTRY Volume;
};

struct _KPROCESS
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY ProfileListHead;
    DWORD DirectoryTableBase[2];
    struct _KGDTENTRY LdtDescriptor;
    struct _KIDTENTRY Int21Descriptor;
    WORD IopmOffset;
    BYTE Iopl;
    BYTE VdmFlag;
    DWORD ActiveProcessors;
    DWORD KernelTime;
    DWORD UserTime;
    struct _LIST_ENTRY ReadyListHead;