ntkrpampsym.h

一个 windows 内核级别的调试器

    struct _LIST_ENTRY WaitListHead;
};

struct UnnamedStruct_2FD510
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY MutantListEntry;
    struct _KTHREAD* OwnerThread;
    BYTE Abandoned;
    BYTE ApcDisable;
};

struct _KMUTANT
{
    struct _DISPATCHER_HEADER Header;
    struct _LIST_ENTRY MutantListEntry;
    struct _KTHREAD* OwnerThread;
    BYTE Abandoned;
    BYTE ApcDisable;
};

struct _NT_TIB
{
    struct _EXCEPTION_REGISTRATION_RECORD* ExceptionList;
    void* StackBase;
    void* StackLimit;
    void* SubSystemTib;
    void* FiberData;
    DWORD Version;
    void* ArbitraryUserPointer;
    struct _NT_TIB* Self;
};

struct _KPCR
{
    struct _NT_TIB NtTib;
    struct _KPCR* SelfPcr;
    struct _KPRCB* Prcb;
    BYTE Irql;
    DWORD IRR;
    DWORD IrrActive;
    DWORD IDR;
    DWORD Reserved2;
    struct _KIDTENTRY* IDT;
    struct _KGDTENTRY* GDT;
    struct _KTSS* TSS;
    WORD MajorVersion;
    WORD MinorVersion;
    DWORD SetMember;
    DWORD StallScaleFactor;
    BYTE DebugActive;
    BYTE Number;
    BYTE VdmAlert;
    BYTE Reserved[1];
    DWORD KernelReserved[15];
    DWORD SecondLevelCacheSize;
    DWORD HalReserved[16];
    DWORD InterruptMode;
    BYTE Spare1;
    DWORD KernelReserved2[17];
    struct _KPRCB PrcbData;
};

struct _KPCR*;

struct _KPRCB
{
    WORD MinorVersion;
    WORD MajorVersion;
    struct _KTHREAD* CurrentThread;
    struct _KTHREAD* NextThread;
    struct _KTHREAD* IdleThread;
    char Number;
    char Reserved;
    WORD BuildType;
    DWORD SetMember;
    char CpuType;
    char CpuID;
    WORD CpuStep;
    struct _KPROCESSOR_STATE ProcessorState;
    DWORD KernelReserved[16];
    DWORD HalReserved[16];
    struct _KSPIN_LOCK_QUEUE LockQueue[16];
    struct _KTHREAD* NpxThread;
    DWORD InterruptCount;
    DWORD KernelTime;
    DWORD UserTime;
    DWORD DpcTime;
    DWORD InterruptTime;
    DWORD ApcBypassCount;
    DWORD DpcBypassCount;
    DWORD AdjustDpcThreshold;
    DWORD DebugDpcTime;
    DWORD Spare2[4];
    DWORD ThreadStartCount[2];
    void* SpareHotData[2];
    DWORD CcFastReadNoWait;
    DWORD CcFastReadWait;
    DWORD CcFastReadNotPossible;
    DWORD CcCopyReadNoWait;
    DWORD CcCopyReadWait;
    DWORD CcCopyReadNoWaitMiss;
    DWORD KeAlignmentFixupCount;
    DWORD KeContextSwitches;
    DWORD KeDcacheFlushCount;
    DWORD KeExceptionDispatchCount;
    DWORD KeFirstLevelTbFills;
    DWORD KeFloatingEmulationCount;
    DWORD KeIcacheFlushCount;
    DWORD KeSecondLevelTbFills;
    DWORD KeSystemCalls;
    DWORD ReservedCounter[8];
    void* SmallIrpFreeEntry;
    void* LargeIrpFreeEntry;
    void* MdlFreeEntry;
    void* CreateInfoFreeEntry;
    void* NameBufferFreeEntry;
    void* SharedCacheMapEntry;
    DWORD CachePad0[2];
    struct _PP_LOOKASIDE_LIST PPLookasideList[16];
    struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[8];
    struct _PP_LOOKASIDE_LIST PPPagedLookasideList[8];
    BYTE ReservedPad[128];
    void* CurrentPacket[3];
    INVALID_TYPE TargetSet;
    INVALID_TYPE* WorkerRoutine;
    INVALID_TYPE IpiFrozen;
    DWORD CachePad1[2];
    INVALID_TYPE RequestSummary;
    INVALID_TYPE* SignalDone;
    INVALID_TYPE ReverseStall;
    void* IpiFrame;
    DWORD CachePad2[4];
    DWORD DpcInterruptRequested;
    void* ChainedInterruptList;
    DWORD CachePad3[2];
    DWORD MaximumDpcQueueDepth;
    DWORD MinimumDpcRate;
    DWORD CachePad4[2];
    struct _LIST_ENTRY DpcListHead;
    DWORD DpcQueueDepth;
    DWORD DpcRoutineActive;
    DWORD DpcCount;
    DWORD DpcLastCount;
    DWORD DpcRequestRate;
    void* DpcStack;
    DWORD KernelReserved2[10];
    DWORD DpcLock;
    BYTE SkipTick;
    BYTE VendorString[13];
    DWORD MHz;
    DWORD FeatureBits;
    struct _LARGE_INTEGER UpdateSignature;
    DWORD QuantumEnd;
    struct _PROCESSOR_POWER_STATE PowerState;
    struct _FX_SAVE_AREA NpxSaveArea;
};

struct _KPRCB*;

struct _KIDTENTRY
{
    WORD Offset;
    WORD Selector;
    WORD Access;
    WORD ExtendedOffset;
};

struct _KIDTENTRY*;

struct _KGDTENTRY
{
    WORD LimitLow;
    WORD BaseLow;
    struct UnnamedStruct_4AF6B8 HighWord;
};

struct _KGDTENTRY*;

struct _KTSS
{
    WORD Backlink;
    WORD Reserved0;
    DWORD Esp0;
    WORD Ss0;
    WORD Reserved1;
    DWORD NotUsed1[4];
    DWORD CR3;
    DWORD Eip;
    DWORD NotUsed2[9];
    WORD Es;
    WORD Reserved2;
    WORD Cs;
    WORD Reserved3;
    WORD Ss;
    WORD Reserved4;
    WORD Ds;
    WORD Reserved5;
    WORD Fs;
    WORD Reserved6;
    WORD Gs;
    WORD Reserved7;
    WORD LDT;
    WORD Reserved8;
    WORD Flags;
    WORD IoMapBase;
    struct _KiIoAccessMap IoMaps[1];
    BYTE IntDirectionMap[32];
};

struct _KTSS*;

BYTE;

DWORD;

DWORD;

DWORD;

struct UnnamedStruct_2FDDF0
{
    struct _NT_TIB NtTib;
    struct _KPCR* SelfPcr;
    struct _KPRCB* Prcb;
    BYTE Irql;
    DWORD IRR;
    DWORD IrrActive;
    DWORD IDR;
    DWORD Reserved2;
    struct _KIDTENTRY* IDT;
    struct _KGDTENTRY* GDT;
    struct _KTSS* TSS;
    WORD MajorVersion;
    WORD MinorVersion;
    DWORD SetMember;
    DWORD StallScaleFactor;
    BYTE DebugActive;
    BYTE Number;
    BYTE VdmAlert;
    BYTE Reserved[1];
    DWORD KernelReserved[15];
    DWORD SecondLevelCacheSize;
    DWORD HalReserved[16];
    DWORD InterruptMode;
    BYTE Spare1;
    DWORD KernelReserved2[17];
    struct _KPRCB PrcbData;
};

struct _KSYSTEM_TIME
{
    DWORD LowPart;
    long High1Time;
    long High2Time;
};

WORD;

DWORD;

BYTE;

struct UnnamedStruct_2FED10
{
    INVALID_TYPE TickCountLow;
    DWORD TickCountMultiplier;
    INVALID_TYPE InterruptTime;
    INVALID_TYPE SystemTime;
    INVALID_TYPE TimeZoneBias;
    WORD ImageNumberLow;
    WORD ImageNumberHigh;
    WORD NtSystemRoot[260];
    DWORD MaxStackTraceDepth;
    DWORD CryptoExponent;
    DWORD TimeZoneId;
    DWORD Reserved2[8];
    int NtProductType;
    BYTE ProductTypeIsValid;
    DWORD NtMajorVersion;
    DWORD NtMinorVersion;
    BYTE ProcessorFeatures[64];
    DWORD Reserved1;
    DWORD Reserved3;
    INVALID_TYPE TimeSlip;
    int AlternativeArchitecture;
    struct _LARGE_INTEGER SystemExpirationDate;
    DWORD SuiteMask;
    BYTE KdDebuggerEnabled;
};

struct _KUSER_SHARED_DATA
{
    INVALID_TYPE TickCountLow;
    DWORD TickCountMultiplier;
    INVALID_TYPE InterruptTime;
    INVALID_TYPE SystemTime;
    INVALID_TYPE TimeZoneBias;
    WORD ImageNumberLow;
    WORD ImageNumberHigh;
    WORD NtSystemRoot[260];
    DWORD MaxStackTraceDepth;
    DWORD CryptoExponent;
    DWORD TimeZoneId;
    DWORD Reserved2[8];
    int NtProductType;
    BYTE ProductTypeIsValid;
    DWORD NtMajorVersion;
    DWORD NtMinorVersion;
    BYTE ProcessorFeatures[64];
    DWORD Reserved1;
    DWORD Reserved3;
    INVALID_TYPE TimeSlip;
    int AlternativeArchitecture;
    struct _LARGE_INTEGER SystemExpirationDate;
    DWORD SuiteMask;
    BYTE KdDebuggerEnabled;
};

struct UnnamedStruct_2FFAF8
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
};

struct _LDR_DATA_TABLE_ENTRY
{
    struct _LIST_ENTRY InLoadOrderLinks;
    struct _LIST_ENTRY InMemoryOrderLinks;
    struct _LIST_ENTRY InInitializationOrderLinks;
    void* DllBase;
    void* EntryPoint;
    DWORD SizeOfImage;
    struct _UNICODE_STRING FullDllName;
    struct _UNICODE_STRING BaseDllName;
    DWORD Flags;
    WORD LoadCount;
    WORD TlsIndex;
    struct _LIST_ENTRY HashLinks;
    void* SectionPointer;
    DWORD CheckSum;
    DWORD TimeDateStamp;
    void* LoadedImports;
};

struct _SINGLE_LIST_ENTRY
{
    struct _SINGLE_LIST_ENTRY* Next;
};

struct _PORT_MESSAGE
{
    struct UnnamedStruct_4899A8 u1;
    struct UnnamedStruct_489CD8 u2;
    struct _CLIENT_ID ClientId;
    double DoNotUseThisField;
    DWORD MessageId;
    DWORD ClientViewSize;
    DWORD CallbackId;
};

struct UnnamedStruct_46F528
{
    struct _LIST_ENTRY Entry;
    struct _SINGLE_LIST_ENTRY FreeEntry;
    DWORD Reserved0;
    WORD Reserved1;
    WORD ZoneIndex;
    DWORD Reserved;
    struct _ETHREAD* RepliedToThread;
    void* PortContext;
    struct _PORT_MESSAGE Request;
};

struct _LPCP_MESSAGE
{
    struct _LIST_ENTRY Entry;
    struct _SINGLE_LIST_ENTRY FreeEntry;
    DWORD Reserved0;
    WORD Reserved1;
    WORD ZoneIndex;
    DWORD Reserved;
    struct _ETHREAD* RepliedToThread;
    void* PortContext;
    struct _PORT_MESSAGE Request;
};

struct _LPCP_PORT_OBJECT
{
    DWORD Length;
    DWORD Flags;
    struct _LPCP_PORT_OBJECT* ConnectionPort;
    struct _LPCP_PORT_OBJECT* ConnectedPort;
    struct _LPCP_PORT_QUEUE MsgQueue;
    struct _CLIENT_ID Creator;
    void* ClientSectionBase;
    void* ServerSectionBase;
    void* PortContext;
    DWORD MaxMessageLength;
    DWORD MaxConnectionInfoLength;
    struct _ETHREAD* ClientThread;
    struct _SECURITY_QUALITY_OF_SERVICE SecurityQos;
    struct _SECURITY_CLIENT_CONTEXT StaticSecurity;
    struct _LIST_ENTRY LpcReplyChainHead;
    struct _LIST_ENTRY LpcDataInfoChainHead;
    struct _EPROCESS* ServerProcess;
    DWORD Reserved;
    struct _KEVENT WaitEvent;
};

struct _LPCP_PORT_OBJECT*;

struct _LPCP_PORT_QUEUE
{
    struct _LPCP_NONPAGED_PORT_QUEUE* NonPagedPortQueue;
    struct _KSEMAPHORE* Semaphore;
    struct _LIST_ENTRY ReceiveHead;
};

struct _CLIENT_ID
{
    void* UniqueProcess;
    void* UniqueThread;
};

struct _SECURITY_QUALITY_OF_SERVICE
{
    DWORD Length;
    int ImpersonationLevel;
    BYTE ContextTrackingMode;
    BYTE EffectiveOnly;
};

struct _SECURITY_CLIENT_CONTEXT
{
    struct _SECURITY_QUALITY_OF_SERVICE SecurityQos;
    void* ClientToken;
    BYTE DirectlyAccessClientToken;
    BYTE DirectAccessEffectiveOnly;
    BYTE ServerIsRemote;
    struct _TOKEN_CONTROL ClientTokenControl;
};

struct UnnamedStruct_46FDA8
{
    DWORD Length;
    DWORD Flags;
    struct _LPCP_PORT_OBJECT* ConnectionPort;
    struct _LPCP_PORT_OBJECT* ConnectedPort;
    struct _LPCP_PORT_QUEUE MsgQueue;
    struct _CLIENT_ID Creator;
    void* ClientSectionBase;
    void* ServerSectionBase;
    void* PortContext;
    DWORD MaxMessageLength;
    DWORD MaxConnectionInfoLength;
    struct _ETHREAD* ClientThread;
    struct _SECURITY_QUALITY_OF_SERVICE SecurityQos;
    struct _SECURITY_CLIENT_CONTEXT StaticSecurity;
    struct _LIST_ENTRY LpcReplyChainHead;
    struct _LIST_ENTRY LpcDataInfoChainHead;
    struct _EPROCESS* ServerProcess;
    DWORD Reserved;
    struct _KEVENT WaitEvent;
};

struct _MMPFN
{
    struct UnnamedStruct_470BC0 u1;
    struct _MMPTE* PteAddress;
    struct UnnamedStruct_470EA8 u2;
    struct UnnamedStruct_471258 u3;
    struct _MMPTE OriginalPte;
    DWORD PteFrame;
};

struct _MMPFN*;

struct UnnamedStruct_4708E8
{
    DWORD Flink;
    DWORD WsIndex;
    struct _KEVENT* Event;
    long ReadStatus;
    struct _MMPFN* NextStackPfn;
};

struct UnnamedStruct_470BC0
{
    DWORD Flink;
    DWORD WsIndex;
    struct _KEVENT* Event;
    long ReadStatus;
    struct _MMPFN* NextStackPfn;
};

struct _MMPTE
{
    struct UnnamedStruct_4CA138 u;
};

struct _MMPTE*;

struct UnnamedStruct_470CD0
{
    DWORD Blink;
    DWORD ShareCount;
    DWORD SecondaryColorFlink;
};

struct UnnamedStruct_470EA8
{
    DWORD Blink;
    DWORD ShareCount;
    DWORD SecondaryColorFlink;
};

struct _MMPFNENTRY
{
    DWORD Modified;
    DWORD ReadInProgress;
    DWORD WriteInProgress;
    DWORD PrototypePte;
    DWORD PageColor;
    DWORD ParityError;
    DWORD PageLocation;
    DWORD InPageError;
    DWORD VerifierAllocation;
    DWORD RemovalRequested;
    DWORD Reserved;
    DWORD DontUse;
};

struct UnnamedStruct_470F70
{
    WORD ShortFlags;
    WORD ReferenceCount;
};

struct UnnamedStruct_4710C8
{
    WORD ShortFlags;
    WORD ReferenceCount;
};

struct UnnamedStruct_471110
{
    struct _MMPFNENTRY e1;