processr.h

一个 windows 内核级别的调试器

	DWORD Flags;
	DWORD PercentFrequency;
};

struct PROCESSOR_IDLE_TIMES {
	DWORD StartTime;
	DWORD EndTime;
	DWORD IdleHandlerReserved[4];
};

struct WMIGUIDREGINFO {
	_GUID* Guid;
	DWORD InstanceCount;
	DWORD Flags;
};

struct _DEVICE_CAPABILITIES {
	DWORD Size;
	DWORD Version;
	DWORD DeviceD1:1; 	// bit offset: 04, len=1
	DWORD DeviceD2:1; 	// bit offset: 04, len=1
	DWORD LockSupported:1; 	// bit offset: 04, len=1
	DWORD EjectSupported:1; 	// bit offset: 04, len=1
	DWORD Removable:1; 	// bit offset: 04, len=1
	DWORD DockDevice:1; 	// bit offset: 04, len=1
	DWORD UniqueID:1; 	// bit offset: 04, len=1
	DWORD SilentInstall:1; 	// bit offset: 04, len=1
	DWORD RawDeviceOK:1; 	// bit offset: 04, len=1
	DWORD SurpriseRemovalOK:1; 	// bit offset: 04, len=1
	DWORD WakeFromD0:1; 	// bit offset: 04, len=1
	DWORD WakeFromD1:1; 	// bit offset: 04, len=1
	DWORD WakeFromD2:1; 	// bit offset: 04, len=1
	DWORD WakeFromD3:1; 	// bit offset: 04, len=1
	DWORD HardwareDisabled:1; 	// bit offset: 04, len=1
	DWORD NonDynamic:1; 	// bit offset: 04, len=1
	DWORD WarmEjectSupported:1; 	// bit offset: 04, len=1
	DWORD NoDisplayInUI:1; 	// bit offset: 04, len=1
	DWORD Reserved:14; 	// bit offset: 04, len=14
	DWORD Address;
	DWORD UINumber;
	enum _DEVICE_POWER_STATE DeviceState[7];
	enum _SYSTEM_POWER_STATE SystemWake;
	enum _DEVICE_POWER_STATE DeviceWake;
	DWORD D1Latency;
	DWORD D2Latency;
	DWORD D3Latency;
};

struct _DRIVER_OBJECT {
	int Type;
	int Size;
	_DEVICE_OBJECT* DeviceObject;
	DWORD Flags;
	void* DriverStart;
	DWORD DriverSize;
	void* DriverSection;
	_DRIVER_EXTENSION* DriverExtension;
	_UNICODE_STRING DriverName;
	_UNICODE_STRING* HardwareDatabase;
	_FAST_IO_DISPATCH* FastIoDispatch;
	int (*DriverInit)(_DRIVER_OBJECT*, _UNICODE_STRING*);
	void (*DriverStartIo)(_DEVICE_OBJECT*, _IRP*);
	void (*DriverUnload)(_DRIVER_OBJECT*);
	int (*)(_DEVICE_OBJECT*, _IRP*) MajorFunction[28];
};

struct _IO_TIMER {
};

struct _VPB {
	int Type;
	int Size;
	DWORD Flags;
	DWORD VolumeLabelLength;
	_DEVICE_OBJECT* DeviceObject;
	_DEVICE_OBJECT* RealDevice;
	DWORD SerialNumber;
	DWORD ReferenceCount;
	DWORD VolumeLabel[32];
};

struct _WAIT_CONTEXT_BLOCK {
	_KDEVICE_QUEUE_ENTRY WaitQueueEntry;
	enum _IO_ALLOCATION_ACTION (*DeviceRoutine)(_DEVICE_OBJECT*, _IRP*, void*, void*);
	void* DeviceContext;
	DWORD NumberOfMapRegisters;
	void* DeviceObject;
	void* CurrentIrp;
	_KDPC* BufferChainingDpc;
};

struct __unnamed {
	_LIST_ENTRY ListEntry;
	_WAIT_CONTEXT_BLOCK Wcb;
};

struct _KDEVICE_QUEUE {
	int Type;
	int Size;
	_LIST_ENTRY DeviceListHead;
	DWORD Lock;
	DWORD Busy;
};

struct _KDPC {
	int Type;
	DWORD Number;
	DWORD Importance;
	_LIST_ENTRY DpcListEntry;
	void (*DeferredRoutine)(_KDPC*, void*, void*, void*);
	void* DeferredContext;
	void* SystemArgument1;
	void* SystemArgument2;
	DWORD* Lock;
};

struct _DEVOBJ_EXTENSION {
	int Type;
	DWORD Size;
	_DEVICE_OBJECT* DeviceObject;
};

struct _DEVICE_OBJECT {
	int Type;
	DWORD Size;
	int ReferenceCount;
	_DRIVER_OBJECT* DriverObject;
	_DEVICE_OBJECT* NextDevice;
	_DEVICE_OBJECT* AttachedDevice;
	_IRP* CurrentIrp;
	_IO_TIMER* Timer;
	DWORD Flags;
	DWORD Characteristics;
	_VPB* Vpb;
	void* DeviceExtension;
	DWORD DeviceType;
	char StackSize;
	__unnamed Queue;
	DWORD AlignmentRequirement;
	_KDEVICE_QUEUE DeviceQueue;
	_KDPC Dpc;
	DWORD ActiveThreadCount;
	void* SecurityDescriptor;
	_KEVENT DeviceLock;
	DWORD SectorSize;
	DWORD Spare1;
	_DEVOBJ_EXTENSION* DeviceObjectExtension;
	void* Reserved;
};

struct _KDEVICE_QUEUE {
	int Type;
	int Size;
	_LIST_ENTRY DeviceListHead;
	DWORD Lock;
	DWORD Busy;
};

struct _GEN_ADDR {
	DWORD AddressSpaceID;
	DWORD BitWidth;
	DWORD BitOffset;
	DWORD Reserved;
	_LARGE_INTEGER Address;
};

struct _VPB {
	int Type;
	int Size;
	DWORD Flags;
	DWORD VolumeLabelLength;
	_DEVICE_OBJECT* DeviceObject;
	_DEVICE_OBJECT* RealDevice;
	DWORD SerialNumber;
	DWORD ReferenceCount;
	DWORD VolumeLabel[32];
};

struct _KDEVICE_QUEUE_ENTRY {
	_LIST_ENTRY DeviceListEntry;
	DWORD SortKey;
	DWORD Inserted;
};

enum _IO_ALLOCATION_ACTION {
	KeepObject,
	DeallocateObject,
	DeallocateObjectKeepRegisters,
};

struct _WAIT_CONTEXT_BLOCK {
	_KDEVICE_QUEUE_ENTRY WaitQueueEntry;
	enum _IO_ALLOCATION_ACTION (*DeviceRoutine)(_DEVICE_OBJECT*, _IRP*, void*, void*);
	void* DeviceContext;
	DWORD NumberOfMapRegisters;
	void* DeviceObject;
	void* CurrentIrp;
	_KDPC* BufferChainingDpc;
};

struct _KDPC {
	int Type;
	DWORD Number;
	DWORD Importance;
	_LIST_ENTRY DpcListEntry;
	void (*DeferredRoutine)(_KDPC*, void*, void*, void*);
	void* DeferredContext;
	void* SystemArgument1;
	void* SystemArgument2;
	DWORD* Lock;
};

struct _MDL {
	_MDL* Next;
	int Size;
	int MdlFlags;
	_EPROCESS* Process;
	void* MappedSystemVa;
	void* StartVa;
	DWORD ByteCount;
	DWORD ByteOffset;
};

struct __unnamed {
	_IRP* MasterIrp;
	int IrpCount;
	void* SystemBuffer;
};

struct _IO_STATUS_BLOCK {
	int Status;
	void* Pointer;
	DWORD Information;
};

struct __unnamed {
	void (*UserApcRoutine)(void*, _IO_STATUS_BLOCK*, DWORD);
	void* UserApcContext;
};

struct __unnamed {
	__unnamed AsynchronousParameters;
	_LARGE_INTEGER AllocationSize;
};

struct _ETHREAD {
};

struct _IO_STACK_LOCATION {
	DWORD MajorFunction;
	DWORD MinorFunction;
	DWORD Flags;
	DWORD Control;
	__unnamed Parameters;
	_DEVICE_OBJECT* DeviceObject;
	_FILE_OBJECT* FileObject;
	int (*CompletionRoutine)(_DEVICE_OBJECT*, _IRP*, void*);
	void* Context;
};

struct _FILE_OBJECT {
	int Type;
	int Size;
	_DEVICE_OBJECT* DeviceObject;
	_VPB* Vpb;
	void* FsContext;
	void* FsContext2;
	_SECTION_OBJECT_POINTERS* SectionObjectPointer;
	void* PrivateCacheMap;
	int FinalStatus;
	_FILE_OBJECT* RelatedFileObject;
	DWORD LockOperation;
	DWORD DeletePending;
	DWORD ReadAccess;
	DWORD WriteAccess;
	DWORD DeleteAccess;
	DWORD SharedRead;
	DWORD SharedWrite;
	DWORD SharedDelete;
	DWORD Flags;
	_UNICODE_STRING FileName;
	_LARGE_INTEGER CurrentByteOffset;
	DWORD Waiters;
	DWORD Busy;
	void* LastLock;
	_KEVENT Lock;
	_KEVENT Event;
	_IO_COMPLETION_CONTEXT* CompletionContext;
};

struct __unnamed {
	_KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
	void* DriverContext[4];
	_ETHREAD* Thread;
	char* AuxiliaryBuffer;
	_LIST_ENTRY ListEntry;
	_IO_STACK_LOCATION* CurrentStackLocation;
	DWORD PacketType;
	_FILE_OBJECT* OriginalFileObject;
};

struct _KAPC {
	int Type;
	int Size;
	DWORD Spare0;
	_KTHREAD* Thread;
	_LIST_ENTRY ApcListEntry;
	void (*KernelRoutine)(_KAPC*, void (*)(void*, void*, void*)*, void**, void**, void**);
	void (*RundownRoutine)(_KAPC*);
	void (*NormalRoutine)(void*, void*, void*);
	void* NormalContext;
	void* SystemArgument1;
	void* SystemArgument2;
	char ApcStateIndex;
	char ApcMode;
	DWORD Inserted;
};

struct __unnamed {
	__unnamed Overlay;
	_KAPC Apc;
	void* CompletionKey;
};

struct _IRP {
	int Type;
	DWORD Size;
	_MDL* MdlAddress;
	DWORD Flags;
	__unnamed AssociatedIrp;
	_LIST_ENTRY ThreadListEntry;
	_IO_STATUS_BLOCK IoStatus;
	char RequestorMode;
	DWORD PendingReturned;
	char StackCount;
	char CurrentLocation;
	DWORD Cancel;
	DWORD CancelIrql;
	char ApcEnvironment;
	DWORD AllocationFlags;
	_IO_STATUS_BLOCK* UserIosb;
	_KEVENT* UserEvent;
	__unnamed Overlay;
	void (*CancelRoutine)(_DEVICE_OBJECT*, _IRP*);
	void* UserBuffer;
	__unnamed Tail;
};

struct _DEVOBJ_EXTENSION {
	int Type;
	DWORD Size;
	_DEVICE_OBJECT* DeviceObject;
};

struct _EPROCESS {
};

struct _MDL {
	_MDL* Next;
	int Size;
	int MdlFlags;
	_EPROCESS* Process;
	void* MappedSystemVa;
	void* StartVa;
	DWORD ByteCount;
	DWORD ByteOffset;
};

struct _IO_STATUS_BLOCK {
	int Status;
	void* Pointer;
	DWORD Information;
};

struct _KAPC {
	int Type;
	int Size;
	DWORD Spare0;
	_KTHREAD* Thread;
	_LIST_ENTRY ApcListEntry;
	void (*KernelRoutine)(_KAPC*, void (*)(void*, void*, void*)*, void**, void**, void**);
	void (*RundownRoutine)(_KAPC*);
	void (*NormalRoutine)(void*, void*, void*);
	void* NormalContext;
	void* SystemArgument1;
	void* SystemArgument2;
	char ApcStateIndex;
	char ApcMode;
	DWORD Inserted;
};

struct _SECTION_OBJECT_POINTERS {
	void* DataSectionObject;
	void* SharedCacheMap;
	void* ImageSectionObject;
};

struct _IO_COMPLETION_CONTEXT {
	void* Port;
	void* Key;
};

struct _FILE_OBJECT {
	int Type;
	int Size;
	_DEVICE_OBJECT* DeviceObject;
	_VPB* Vpb;
	void* FsContext;
	void* FsContext2;
	_SECTION_OBJECT_POINTERS* SectionObjectPointer;
	void* PrivateCacheMap;
	int FinalStatus;
	_FILE_OBJECT* RelatedFileObject;
	DWORD LockOperation;
	DWORD DeletePending;
	DWORD ReadAccess;
	DWORD WriteAccess;
	DWORD DeleteAccess;
	DWORD SharedRead;
	DWORD SharedWrite;
	DWORD SharedDelete;
	DWORD Flags;
	_UNICODE_STRING FileName;
	_LARGE_INTEGER CurrentByteOffset;
	DWORD Waiters;
	DWORD Busy;
	void* LastLock;
	_KEVENT Lock;
	_KEVENT Event;
	_IO_COMPLETION_CONTEXT* CompletionContext;
};

struct _IO_COMPLETION_CONTEXT {
	void* Port;
	void* Key;
};

struct _DRIVER_EXTENSION {
	_DRIVER_OBJECT* DriverObject;
	int (*AddDevice)(_DRIVER_OBJECT*, _DEVICE_OBJECT*);
	DWORD Count;
	_UNICODE_STRING ServiceKeyName;
};

struct _FAST_IO_DISPATCH {
	DWORD SizeOfFastIoDispatch;
	DWORD (*FastIoCheckIfPossible)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, DWORD, DWORD, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoRead)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, DWORD, void*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoWrite)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, DWORD, void*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoQueryBasicInfo)(_FILE_OBJECT*, DWORD, _FILE_BASIC_INFORMATION*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoQueryStandardInfo)(_FILE_OBJECT*, DWORD, _FILE_STANDARD_INFORMATION*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoLock)(_FILE_OBJECT*, _LARGE_INTEGER*, _LARGE_INTEGER*, _EPROCESS*, DWORD, DWORD, DWORD, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoUnlockSingle)(_FILE_OBJECT*, _LARGE_INTEGER*, _LARGE_INTEGER*, _EPROCESS*, DWORD, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoUnlockAll)(_FILE_OBJECT*, _EPROCESS*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoUnlockAllByKey)(_FILE_OBJECT*, void*, DWORD, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*FastIoDeviceControl)(_FILE_OBJECT*, DWORD, void*, DWORD, void*, DWORD, DWORD, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	void (*AcquireFileForNtCreateSection)(_FILE_OBJECT*);
	void (*ReleaseFileForNtCreateSection)(_FILE_OBJECT*);
	void (*FastIoDetachDevice)(_DEVICE_OBJECT*, _DEVICE_OBJECT*);
	DWORD (*FastIoQueryNetworkOpenInfo)(_FILE_OBJECT*, DWORD, _FILE_NETWORK_OPEN_INFORMATION*, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	int (*AcquireForModWrite)(_FILE_OBJECT*, _LARGE_INTEGER*, _ERESOURCE**, _DEVICE_OBJECT*);
	DWORD (*MdlRead)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, _MDL**, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*MdlReadComplete)(_FILE_OBJECT*, _MDL*, _DEVICE_OBJECT*);
	DWORD (*PrepareMdlWrite)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, _MDL**, _IO_STATUS_BLOCK*, _DEVICE_OBJECT*);
	DWORD (*MdlWriteComplete)(_FILE_OBJECT*, _LARGE_INTEGER*, _MDL*, _DEVICE_OBJECT*);
	DWORD (*FastIoReadCompressed)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, void*, _MDL**, _IO_STATUS_BLOCK*, _COMPRESSED_DATA_INFO*, DWORD, _DEVICE_OBJECT*);
	DWORD (*FastIoWriteCompressed)(_FILE_OBJECT*, _LARGE_INTEGER*, DWORD, DWORD, void*, _MDL**, _IO_STATUS_BLOCK*, _COMPRESSED_DATA_INFO*, DWORD, _DEVICE_OBJECT*);
	DWORD (*MdlReadCompleteCompressed)(_FILE_OBJECT*, _MDL*, _DEVICE_OBJECT*);
	DWORD (*MdlWriteCompleteCompressed)(_FILE_OBJECT*, _LARGE_INTEGER*, _MDL*, _DEVICE_OBJECT*);
	DWORD (*FastIoQueryOpen)(_IRP*, _FILE_NETWORK_OPEN_INFORMATION*, _DEVICE_OBJECT*);
	int (*ReleaseForModWrite)(_FILE_OBJECT*, _ERESOURCE*, _DEVICE_OBJECT*);
	int (*AcquireForCcFlush)(_FILE_OBJECT*, _DEVICE_OBJECT*);
	int (*ReleaseForCcFlush)(_FILE_OBJECT*, _DEVICE_OBJECT*);
};

struct _DRIVER_OBJECT {
	int Type;
	int Size;
	_DEVICE_OBJECT* DeviceObject;
	DWORD Flags;
	void* DriverStart;
	DWORD DriverSize;
	void* DriverSection;
	_DRIVER_EXTENSION* DriverExtension;
	_UNICODE_STRING DriverName;
	_UNICODE_STRING* HardwareDatabase;
	_FAST_IO_DISPATCH* FastIoDispatch;
	int (*DriverInit)(_DRIVER_OBJECT*, _UNICODE_STRING*);
	void (*DriverStartIo)(_DEVICE_OBJECT*, _IRP*);
	void (*DriverUnload)(_DRIVER_OBJECT*);
	int (*)(_DEVICE_OBJECT*, _IRP*) MajorFunction[28];
};

struct _DRIVER_EXTENSION {
	_DRIVER_OBJECT* DriverObject;
	int (*AddDevice)(_DRIVER_OBJECT*, _DEVICE_OBJECT*);
	DWORD Count;
	_UNICODE_STRING ServiceKeyName;
};

struct _KDEVICE_QUEUE_ENTRY {
	_LIST_ENTRY DeviceListEntry;
	DWORD SortKey;
	DWORD Inserted;
};

struct _SECTION_OBJECT_POINTERS {
	void* DataSectionObject;
	void* SharedCacheMap;
	void* ImageSectionObject;
};

struct _IO_SECURITY_CONTEXT {
	_SECURITY_QUALITY_OF_SERVICE* SecurityQos;
	_ACCESS_STATE* AccessState;
	DWORD DesiredAccess;
	DWORD FullCreateOptions;
};

struct __unnamed {
	_IO_SECURITY_CONTEXT* SecurityContext;
	DWORD Options;
	DWORD FileAttributes;
	DWORD ShareAccess;
	DWORD EaLength;
};

struct __unnamed {
	DWORD Length;
	DWORD Key;
	_LARGE_INTEGER ByteOffset;
};

enum _FILE_INFORMATION_CLASS {
	FileDirectoryInformation,
	FileFullDirectoryInformation,
	FileBothDirectoryInformation,
	FileBasicInformation,
	FileStandardInformation,
	FileInternalInformation,
	FileEaInformation,
	FileAccessInformation,
	FileNameInformation,
	FileRenameInformation,
	FileLinkInformation,
	FileNamesInformation,
	FileDispositionInformation,
	FilePositionInformation,
	FileFullEaInformation,
	FileModeInformation,
	FileAlignmentInformation,
	FileAllInformation,
	FileAllocationInformation,
	FileEndOfFileInformation,
	FileAlternateNameInformation,
	FileStreamInformation,
	FilePipeInformation,
	FilePipeLocalInformation,
	FilePipeRemoteInformation,
	FileMailslotQueryInformation,
	FileMailslotSetInformation,
	FileCompressionInformation,
	FileObjectIdInformation,
	FileCompletionInformation,
	FileMoveClusterInformation,
	FileQuotaInformation,
	FileReparsePointInformation,
	FileNetworkOpenInformation,
	FileAttributeTagInformation,
	FileTrackingInformation,
	FileIdBothDirectoryInformation,
	FileIdFullDirectoryInformation,
	FileValidDataLengthInformation,
	FileShortNameInformation,
	FileMaximumInformation,
};

struct __unnamed {
	DWORD Length;
	enum _FILE_INFORMATION_CLASS FileInformationClass;
};

struct __unnamed {
	DWORD Length;
	enum _FILE_INFORMATION_CLASS FileInformationClass;
	_FILE_OBJECT* FileObject;
	DWORD ReplaceIfExists;
	DWORD AdvanceOnly;
	DWORD ClusterCount;
	void* DeleteHandle;
};

enum _FSINFOCLASS {
	FileFsVolumeInformation,
	FileFsLabelInformation,
	FileFsSizeInformation,
	FileFsDeviceInformation,
	FileFsAttributeInformation,
	FileFsControlInformation,
	FileFsFullSizeInformation,
	FileFsObjectIdInformation,
	FileFsDriverPathInformation,
	FileFsMaximumInformation,
};

struct __unnamed {
	DWORD Length;
	enum _FSINFOCLASS FsInformationClass;
};

struct __unnamed {
	DWORD OutputBufferLength;
	DWORD InputBufferLength;
	DWORD IoControlCode;
	void* Type3InputBuffer;
};

struct __unnamed {
	DWORD SecurityInformation;
	DWORD Length;
};

struct __unnamed {
	DWORD SecurityInformation;
	void* SecurityDescriptor;
};

struct __unnamed {
	_VPB* Vpb;
	_DEVICE_OBJECT* DeviceObject;
};

struct _SCSI_REQUEST_BLOCK {
};

struct __unnamed {
	_SCSI_REQUEST_BLOCK* Srb;
};

enum _DEVICE_RELATION_TYPE {
	BusRelations,
	EjectionRelations,
	PowerRelations,
	RemovalRelations,
	TargetDeviceRelation,
	SingleBusRelations,
};

struct __unnamed {
	enum _DEVICE_RELATION_TYPE Type;
};

struct _INTERFACE {
	DWORD Size;
	DWORD Version;
	void* Context;
	void (*InterfaceReference)(void*);