ntkrpamp.h

一个 windows 内核级别的调试器

struct LIST_ENTRY64 {
	DWORD Flink;
	DWORD Blink;
};

struct LIST_ENTRY64 {
	DWORD Flink;
	DWORD Blink;
};

struct LIST_ENTRY32 {
	DWORD Flink;
	DWORD Blink;
};

struct LIST_ENTRY32 {
	DWORD Flink;
	DWORD Blink;
};

struct _LIST_ENTRY {
	_LIST_ENTRY* Flink;
	_LIST_ENTRY* Blink;
};

struct _LIST_ENTRY {
	_LIST_ENTRY* Flink;
	_LIST_ENTRY* Blink;
};

struct _IMAGE_NT_HEADERS {
	DWORD Signature;
	_IMAGE_FILE_HEADER FileHeader;
	_IMAGE_OPTIONAL_HEADER OptionalHeader;
};

struct _IMAGE_FILE_HEADER {
	DWORD Machine;
	DWORD NumberOfSections;
	DWORD TimeDateStamp;
	DWORD PointerToSymbolTable;
	DWORD NumberOfSymbols;
	DWORD SizeOfOptionalHeader;
	DWORD Characteristics;
};

struct _IMAGE_OPTIONAL_HEADER {
	DWORD Magic;
	DWORD MajorLinkerVersion;
	DWORD MinorLinkerVersion;
	DWORD SizeOfCode;
	DWORD SizeOfInitializedData;
	DWORD SizeOfUninitializedData;
	DWORD AddressOfEntryPoint;
	DWORD BaseOfCode;
	DWORD BaseOfData;
	DWORD ImageBase;
	DWORD SectionAlignment;
	DWORD FileAlignment;
	DWORD MajorOperatingSystemVersion;
	DWORD MinorOperatingSystemVersion;
	DWORD MajorImageVersion;
	DWORD MinorImageVersion;
	DWORD MajorSubsystemVersion;
	DWORD MinorSubsystemVersion;
	DWORD Win32VersionValue;
	DWORD SizeOfImage;
	DWORD SizeOfHeaders;
	DWORD CheckSum;
	DWORD Subsystem;
	DWORD DllCharacteristics;
	DWORD SizeOfStackReserve;
	DWORD SizeOfStackCommit;
	DWORD SizeOfHeapReserve;
	DWORD SizeOfHeapCommit;
	DWORD LoaderFlags;
	DWORD NumberOfRvaAndSizes;
	_IMAGE_DATA_DIRECTORY DataDirectory[16];
};

struct _IMAGE_NT_HEADERS {
	DWORD Signature;
	_IMAGE_FILE_HEADER FileHeader;
	_IMAGE_OPTIONAL_HEADER OptionalHeader;
};

struct _LARGE_INTEGER {
	DWORD LowPart;
	int HighPart;
	__unnamed u;
	int QuadPart;
};

struct __unnamed {
	DWORD LowPart;
	int HighPart;
};

struct _LARGE_INTEGER {
	DWORD LowPart;
	int HighPart;
	__unnamed u;
	int QuadPart;
};

struct _ULARGE_INTEGER {
	DWORD LowPart;
	DWORD HighPart;
	__unnamed u;
	DWORD QuadPart;
};

struct __unnamed {
	DWORD LowPart;
	DWORD HighPart;
};

struct _ULARGE_INTEGER {
	DWORD LowPart;
	DWORD HighPart;
	__unnamed u;
	DWORD QuadPart;
};

struct _LUID {
	DWORD LowPart;
	int HighPart;
};

struct _LUID {
	DWORD LowPart;
	int HighPart;
};

struct _KAPC {
	int Type;
	int Size;
	DWORD Spare0;
	_KTHREAD* Thread;
	_LIST_ENTRY ApcListEntry;
	void (*KernelRoutine)(_KAPC*, void (*)(void*, void*, void*)*, void**, void**, void**);
	void (*RundownRoutine)(_KAPC*);
	void (*NormalRoutine)(void*, void*, void*);
	void* NormalContext;
	void* SystemArgument1;
	void* SystemArgument2;
	char ApcStateIndex;
	char ApcMode;
	DWORD Inserted;
};

struct _KTHREAD {
	_DISPATCHER_HEADER Header;
	_LIST_ENTRY MutantListHead;
	void* InitialStack;
	void* StackLimit;
	void* Teb;
	void* TlsArray;
	void* KernelStack;
	DWORD DebugActive;
	DWORD State;
	DWORD Alerted[2];
	DWORD Iopl;
	DWORD NpxState;
	char Saturation;
	char Priority;
	_KAPC_STATE ApcState;
	DWORD ContextSwitches;
	DWORD IdleSwapBlock;
	DWORD Spare0[3];
	int WaitStatus;
	DWORD WaitIrql;
	char WaitMode;
	DWORD WaitNext;
	DWORD WaitReason;
	_KWAIT_BLOCK* WaitBlockList;
	_LIST_ENTRY WaitListEntry;
	_SINGLE_LIST_ENTRY SwapListEntry;
	DWORD WaitTime;
	char BasePriority;
	DWORD DecrementCount;
	char PriorityDecrement;
	char Quantum;
	_KWAIT_BLOCK WaitBlock[4];
	void* LegoData;
	DWORD KernelApcDisable;
	DWORD UserAffinity;
	DWORD SystemAffinityActive;
	DWORD PowerState;
	DWORD NpxIrql;
	DWORD InitialNode;
	void* ServiceTable;
	_KQUEUE* Queue;
	DWORD ApcQueueLock;
	_KTIMER Timer;
	_LIST_ENTRY QueueListEntry;
	DWORD SoftAffinity;
	DWORD Affinity;
	DWORD Preempted;
	DWORD ProcessReadyQueue;
	DWORD KernelStackResident;
	DWORD NextProcessor;
	void* CallbackStack;
	void* Win32Thread;
	_KTRAP_FRAME* TrapFrame;
	_KAPC_STATE* ApcStatePointer[2];
	char PreviousMode;
	DWORD EnableStackSwap;
	DWORD LargeStack;
	DWORD ResourceIndex;
	DWORD KernelTime;
	DWORD UserTime;
	_KAPC_STATE SavedApcState;
	DWORD Alertable;
	DWORD ApcStateIndex;
	DWORD ApcQueueable;
	DWORD AutoAlignment;
	void* StackBase;
	_KAPC SuspendApc;
	_KSEMAPHORE SuspendSemaphore;
	_LIST_ENTRY ThreadListEntry;
	char FreezeCount;
	char SuspendCount;
	DWORD IdealProcessor;
	DWORD DisableBoost;
};

struct _KAPC {
	int Type;
	int Size;
	DWORD Spare0;
	_KTHREAD* Thread;
	_LIST_ENTRY ApcListEntry;
	void (*KernelRoutine)(_KAPC*, void (*)(void*, void*, void*)*, void**, void**, void**);
	void (*RundownRoutine)(_KAPC*);
	void (*NormalRoutine)(void*, void*, void*);
	void* NormalContext;
	void* SystemArgument1;
	void* SystemArgument2;
	char ApcStateIndex;
	char ApcMode;
	DWORD Inserted;
};

struct _SINGLE_LIST_ENTRY {
	_SINGLE_LIST_ENTRY* Next;
};

struct _SINGLE_LIST_ENTRY {
	_SINGLE_LIST_ENTRY* Next;
};

enum _KSPIN_LOCK_QUEUE_NUMBER {
	LockQueueDispatcherLock,
	LockQueueContextSwapLock,
	LockQueuePfnLock,
	LockQueueSystemSpaceLock,
	LockQueueVacbLock,
	LockQueueMasterLock,
	LockQueueNonPagedPoolLock,
	LockQueueIoCancelLock,
	LockQueueWorkQueueLock,
	LockQueueIoVpbLock,
	LockQueueIoDatabaseLock,
	LockQueueIoCompletionLock,
	LockQueueNtfsStructLock,
	LockQueueAfdWorkQueueLock,
	LockQueueBcbLock,
	LockQueueMaximumLock,
};

struct _KPRCB {
	DWORD MinorVersion;
	DWORD MajorVersion;
	_KTHREAD* CurrentThread;
	_KTHREAD* NextThread;
	_KTHREAD* IdleThread;
	char Number;
	char Reserved;
	DWORD BuildType;
	DWORD SetMember;
	char CpuType;
	char CpuID;
	DWORD CpuStep;
	_KPROCESSOR_STATE ProcessorState;
	DWORD KernelReserved[16];
	DWORD HalReserved[16];
	DWORD PrcbPad0[92];
	_KSPIN_LOCK_QUEUE LockQueue[16];
	DWORD PrcbPad1[8];
	_KTHREAD* NpxThread;
	DWORD InterruptCount;
	DWORD KernelTime;
	DWORD UserTime;
	DWORD DpcTime;
	DWORD DebugDpcTime;
	DWORD InterruptTime;
	DWORD AdjustDpcThreshold;
	DWORD PageColor;
	DWORD SkipTick;
	DWORD MultiThreadSetBusy;
	DWORD Spare2[3];
	_KNODE* ParentNode;
	DWORD MultiThreadProcessorSet;
	_KPRCB* MultiThreadSetMaster;
	DWORD ThreadStartCount[2];
	DWORD CcFastReadNoWait;
	DWORD CcFastReadWait;
	DWORD CcFastReadNotPossible;
	DWORD CcCopyReadNoWait;
	DWORD CcCopyReadWait;
	DWORD CcCopyReadNoWaitMiss;
	DWORD KeAlignmentFixupCount;
	DWORD KeContextSwitches;
	DWORD KeDcacheFlushCount;
	DWORD KeExceptionDispatchCount;
	DWORD KeFirstLevelTbFills;
	DWORD KeFloatingEmulationCount;
	DWORD KeIcacheFlushCount;
	DWORD KeSecondLevelTbFills;
	DWORD KeSystemCalls;
	DWORD SpareCounter0[1];
	_PP_LOOKASIDE_LIST PPLookasideList[16];
	_PP_LOOKASIDE_LIST PPNPagedLookasideList[32];
	_PP_LOOKASIDE_LIST PPPagedLookasideList[32];
	DWORD PacketBarrier;
	DWORD ReverseStall;
	void* IpiFrame;
	DWORD PrcbPad2[52];
	void* CurrentPacket[3];
	DWORD TargetSet;
	void (*WorkerRoutine)(void*, void*, void*, void*);
	DWORD IpiFrozen;
	DWORD PrcbPad3[40];
	DWORD RequestSummary;
	_KPRCB* SignalDone;
	DWORD PrcbPad4[56];
	_LIST_ENTRY DpcListHead;
	void* DpcStack;
	DWORD DpcCount;
	DWORD DpcQueueDepth;
	DWORD DpcRoutineActive;
	DWORD DpcInterruptRequested;
	DWORD DpcLastCount;
	DWORD DpcRequestRate;
	DWORD MaximumDpcQueueDepth;
	DWORD MinimumDpcRate;
	DWORD QuantumEnd;
	DWORD PrcbPad5[16];
	DWORD DpcLock;
	DWORD PrcbPad6[60];
	void* ChainedInterruptList;
	int LookasideIrpFloat;
	DWORD SpareFields0[6];
	DWORD VendorString[13];
	DWORD InitialApicId;
	DWORD LogicalProcessorsPerPhysicalProcessor;
	DWORD MHz;
	DWORD FeatureBits;
	_LARGE_INTEGER UpdateSignature;
	_FX_SAVE_AREA NpxSaveArea;
	_PROCESSOR_POWER_STATE PowerState;
};

struct _KPROCESSOR_STATE {
	_CONTEXT ContextFrame;
	_KSPECIAL_REGISTERS SpecialRegisters;
};

struct _KSPIN_LOCK_QUEUE {
	_KSPIN_LOCK_QUEUE* Next;
	DWORD* Lock;
};

struct _KNODE {
	DWORD ProcessorMask;
	DWORD Color;
	DWORD MmShiftedColor;
	DWORD FreeCount[2];
	_SLIST_HEADER DeadStackList;
	_SLIST_HEADER PfnDereferenceSListHead;
	_SINGLE_LIST_ENTRY* PfnDeferredList;
	DWORD Seed;
	_flags Flags;
};

struct _PP_LOOKASIDE_LIST {
	_GENERAL_LOOKASIDE* P;
	_GENERAL_LOOKASIDE* L;
};

struct _KPRCB {
	DWORD MinorVersion;
	DWORD MajorVersion;
	_KTHREAD* CurrentThread;
	_KTHREAD* NextThread;
	_KTHREAD* IdleThread;
	char Number;
	char Reserved;
	DWORD BuildType;
	DWORD SetMember;
	char CpuType;
	char CpuID;
	DWORD CpuStep;
	_KPROCESSOR_STATE ProcessorState;
	DWORD KernelReserved[16];
	DWORD HalReserved[16];
	DWORD PrcbPad0[92];
	_KSPIN_LOCK_QUEUE LockQueue[16];
	DWORD PrcbPad1[8];
	_KTHREAD* NpxThread;
	DWORD InterruptCount;
	DWORD KernelTime;
	DWORD UserTime;
	DWORD DpcTime;
	DWORD DebugDpcTime;
	DWORD InterruptTime;
	DWORD AdjustDpcThreshold;
	DWORD PageColor;
	DWORD SkipTick;
	DWORD MultiThreadSetBusy;
	DWORD Spare2[3];
	_KNODE* ParentNode;
	DWORD MultiThreadProcessorSet;
	_KPRCB* MultiThreadSetMaster;
	DWORD ThreadStartCount[2];
	DWORD CcFastReadNoWait;
	DWORD CcFastReadWait;
	DWORD CcFastReadNotPossible;
	DWORD CcCopyReadNoWait;
	DWORD CcCopyReadWait;
	DWORD CcCopyReadNoWaitMiss;
	DWORD KeAlignmentFixupCount;
	DWORD KeContextSwitches;
	DWORD KeDcacheFlushCount;
	DWORD KeExceptionDispatchCount;
	DWORD KeFirstLevelTbFills;
	DWORD KeFloatingEmulationCount;
	DWORD KeIcacheFlushCount;
	DWORD KeSecondLevelTbFills;
	DWORD KeSystemCalls;
	DWORD SpareCounter0[1];
	_PP_LOOKASIDE_LIST PPLookasideList[16];
	_PP_LOOKASIDE_LIST PPNPagedLookasideList[32];
	_PP_LOOKASIDE_LIST PPPagedLookasideList[32];
	DWORD PacketBarrier;
	DWORD ReverseStall;
	void* IpiFrame;
	DWORD PrcbPad2[52];
	void* CurrentPacket[3];
	DWORD TargetSet;
	void (*WorkerRoutine)(void*, void*, void*, void*);
	DWORD IpiFrozen;
	DWORD PrcbPad3[40];
	DWORD RequestSummary;
	_KPRCB* SignalDone;
	DWORD PrcbPad4[56];
	_LIST_ENTRY DpcListHead;
	void* DpcStack;
	DWORD DpcCount;
	DWORD DpcQueueDepth;
	DWORD DpcRoutineActive;
	DWORD DpcInterruptRequested;
	DWORD DpcLastCount;
	DWORD DpcRequestRate;
	DWORD MaximumDpcQueueDepth;
	DWORD MinimumDpcRate;
	DWORD QuantumEnd;
	DWORD PrcbPad5[16];
	DWORD DpcLock;
	DWORD PrcbPad6[60];
	void* ChainedInterruptList;
	int LookasideIrpFloat;
	DWORD SpareFields0[6];
	DWORD VendorString[13];
	DWORD InitialApicId;
	DWORD LogicalProcessorsPerPhysicalProcessor;
	DWORD MHz;
	DWORD FeatureBits;
	_LARGE_INTEGER UpdateSignature;
	_FX_SAVE_AREA NpxSaveArea;
	_PROCESSOR_POWER_STATE PowerState;
};

struct _FX_SAVE_AREA {
	__unnamed U;
	DWORD NpxSavedCpu;
	DWORD Cr0NpxState;
};

struct _PROCESSOR_POWER_STATE {
	void (*IdleFunction)(_PROCESSOR_POWER_STATE*);
	DWORD Idle0KernelTimeLimit;
	DWORD Idle0LastTime;
	void* IdleHandlers;
	void* IdleState;
	DWORD IdleHandlersCount;
	DWORD LastCheck;
	PROCESSOR_IDLE_TIMES IdleTimes;
	DWORD IdleTime1;
	DWORD PromotionCheck;
	DWORD IdleTime2;
	DWORD CurrentThrottle;
	DWORD ThermalThrottleLimit;
	DWORD CurrentThrottleIndex;
	DWORD ThermalThrottleIndex;
	DWORD PerfSystemTime;
	DWORD PerfIdleTime;
	DWORD DebugDelta;
	DWORD DebugCount;
	DWORD LastSysTime;
	DWORD TotalIdleStateTime[3];
	DWORD TotalIdleTransitions[3];
	DWORD PreviousC3StateTime;
	DWORD KneeThrottleIndex;
	DWORD ThrottleLimitIndex;
	DWORD PerfStatesCount;
	DWORD ProcessorMinThrottle;
	DWORD ProcessorMaxThrottle;
	DWORD LastBusyPercentage;
	DWORD LastC3Percentage;
	DWORD LastAdjustedBusyPercentage;
	DWORD PromotionCount;
	DWORD DemotionCount;
	DWORD ErrorCount;
	DWORD RetryCount;
	DWORD Flags;
	_LARGE_INTEGER PerfCounterFrequency;
	DWORD PerfTickCount;
	_KTIMER PerfTimer;
	_KDPC PerfDpc;
	PROCESSOR_PERF_STATE* PerfStates;
	int (*PerfSetThrottle)(DWORD);
	DWORD Spare1[2];
};

struct _KPRCB {
	DWORD MinorVersion;
	DWORD MajorVersion;
	_KTHREAD* CurrentThread;
	_KTHREAD* NextThread;
	_KTHREAD* IdleThread;
	char Number;
	char Reserved;
	DWORD BuildType;
	DWORD SetMember;
	char CpuType;
	char CpuID;
	DWORD CpuStep;
	_KPROCESSOR_STATE ProcessorState;
	DWORD KernelReserved[16];
	DWORD HalReserved[16];
	DWORD PrcbPad0[92];
	_KSPIN_LOCK_QUEUE LockQueue[16];
	DWORD PrcbPad1[8];
	_KTHREAD* NpxThread;
	DWORD InterruptCount;
	DWORD KernelTime;
	DWORD UserTime;
	DWORD DpcTime;
	DWORD DebugDpcTime;
	DWORD InterruptTime;
	DWORD AdjustDpcThreshold;
	DWORD PageColor;