ntoskrnl.h

一个 windows 内核级别的调试器

	DWORD NpxSavedCpu;
	DWORD Cr0NpxState;
};

enum _MEMORY_CACHING_TYPE {
	MmNonCached,
	MmCached,
	MmWriteCombined,
	MmHardwareCoherentCached,
	MmNonCachedUnordered,
	MmUSWCCached,
	MmMaximumCacheType,
};

enum _MI_PFN_CACHE_ATTRIBUTE {
	MiNonCached,
	MiCached,
	MiWriteCombined,
	MiNotMapped,
};

struct _EXCEPTION_RECORD64 {
	int ExceptionCode;
	DWORD ExceptionFlags;
	DWORD ExceptionRecord;
	DWORD ExceptionAddress;
	DWORD NumberParameters;
	DWORD __unusedAlignment;
	DWORD ExceptionInformation[15];
};

struct _EXCEPTION_RECORD64 {
	int ExceptionCode;
	DWORD ExceptionFlags;
	DWORD ExceptionRecord;
	DWORD ExceptionAddress;
	DWORD NumberParameters;
	DWORD __unusedAlignment;
	DWORD ExceptionInformation[15];
};

struct _EXCEPTION_RECORD32 {
	int ExceptionCode;
	DWORD ExceptionFlags;
	DWORD ExceptionRecord;
	DWORD ExceptionAddress;
	DWORD NumberParameters;
	DWORD ExceptionInformation[15];
};

struct _EXCEPTION_RECORD32 {
	int ExceptionCode;
	DWORD ExceptionFlags;
	DWORD ExceptionRecord;
	DWORD ExceptionAddress;
	DWORD NumberParameters;
	DWORD ExceptionInformation[15];
};

struct _DBGKM_EXCEPTION64 {
	_EXCEPTION_RECORD64 ExceptionRecord;
	DWORD FirstChance;
};

struct _DBGKM_EXCEPTION64 {
	_EXCEPTION_RECORD64 ExceptionRecord;
	DWORD FirstChance;
};

struct _DBGKM_EXCEPTION32 {
	_EXCEPTION_RECORD32 ExceptionRecord;
	DWORD FirstChance;
};

struct _DBGKM_EXCEPTION32 {
	_EXCEPTION_RECORD32 ExceptionRecord;
	DWORD FirstChance;
};

struct _DBGKD_LOAD_SYMBOLS64 {
	DWORD PathNameLength;
	DWORD BaseOfDll;
	DWORD ProcessId;
	DWORD CheckSum;
	DWORD SizeOfImage;
	DWORD UnloadSymbols;
};

struct _DBGKD_LOAD_SYMBOLS64 {
	DWORD PathNameLength;
	DWORD BaseOfDll;
	DWORD ProcessId;
	DWORD CheckSum;
	DWORD SizeOfImage;
	DWORD UnloadSymbols;
};

struct _DBGKD_LOAD_SYMBOLS32 {
	DWORD PathNameLength;
	DWORD BaseOfDll;
	DWORD ProcessId;
	DWORD CheckSum;
	DWORD SizeOfImage;
	DWORD UnloadSymbols;
};

struct _DBGKD_LOAD_SYMBOLS32 {
	DWORD PathNameLength;
	DWORD BaseOfDll;
	DWORD ProcessId;
	DWORD CheckSum;
	DWORD SizeOfImage;
	DWORD UnloadSymbols;
};

struct _DBGKD_READ_MEMORY64 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesRead;
};

struct _DBGKD_READ_MEMORY64 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesRead;
};

struct _DBGKD_READ_MEMORY32 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesRead;
};

struct _DBGKD_READ_MEMORY32 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesRead;
};

struct _DBGKD_WRITE_MEMORY64 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesWritten;
};

struct _DBGKD_WRITE_MEMORY64 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesWritten;
};

struct _DBGKD_WRITE_MEMORY32 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesWritten;
};

struct _DBGKD_WRITE_MEMORY32 {
	DWORD TargetBaseAddress;
	DWORD TransferCount;
	DWORD ActualBytesWritten;
};

struct _DBGKD_WRITE_BREAKPOINT64 {
	DWORD BreakPointAddress;
	DWORD BreakPointHandle;
};

struct _DBGKD_WRITE_BREAKPOINT64 {
	DWORD BreakPointAddress;
	DWORD BreakPointHandle;
};

struct _DBGKD_WRITE_BREAKPOINT32 {
	DWORD BreakPointAddress;
	DWORD BreakPointHandle;
};

struct _DBGKD_WRITE_BREAKPOINT32 {
	DWORD BreakPointAddress;
	DWORD BreakPointHandle;
};

struct _DBGKD_READ_WRITE_IO64 {
	DWORD IoAddress;
	DWORD DataSize;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO64 {
	DWORD IoAddress;
	DWORD DataSize;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO32 {
	DWORD DataSize;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO32 {
	DWORD DataSize;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO_EXTENDED64 {
	DWORD DataSize;
	DWORD InterfaceType;
	DWORD BusNumber;
	DWORD AddressSpace;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO_EXTENDED64 {
	DWORD DataSize;
	DWORD InterfaceType;
	DWORD BusNumber;
	DWORD AddressSpace;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO_EXTENDED32 {
	DWORD DataSize;
	DWORD InterfaceType;
	DWORD BusNumber;
	DWORD AddressSpace;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_READ_WRITE_IO_EXTENDED32 {
	DWORD DataSize;
	DWORD InterfaceType;
	DWORD BusNumber;
	DWORD AddressSpace;
	DWORD IoAddress;
	DWORD DataValue;
};

struct _DBGKD_SET_SPECIAL_CALL32 {
	DWORD SpecialCall;
};

struct _DBGKD_SET_SPECIAL_CALL32 {
	DWORD SpecialCall;
};

struct _DBGKD_SET_SPECIAL_CALL64 {
	DWORD SpecialCall;
};

struct _DBGKD_SET_SPECIAL_CALL64 {
	DWORD SpecialCall;
};

struct _DBGKD_SET_INTERNAL_BREAKPOINT32 {
	DWORD BreakpointAddress;
	DWORD Flags;
};

struct _DBGKD_SET_INTERNAL_BREAKPOINT32 {
	DWORD BreakpointAddress;
	DWORD Flags;
};

struct _DBGKD_SET_INTERNAL_BREAKPOINT64 {
	DWORD BreakpointAddress;
	DWORD Flags;
};

struct _DBGKD_SET_INTERNAL_BREAKPOINT64 {
	DWORD BreakpointAddress;
	DWORD Flags;
};

struct _DBGKD_GET_INTERNAL_BREAKPOINT64 {
	DWORD BreakpointAddress;
	DWORD Flags;
	DWORD Calls;
	DWORD MaxCallsPerPeriod;
	DWORD MinInstructions;
	DWORD MaxInstructions;
	DWORD TotalInstructions;
};

struct _DBGKD_GET_INTERNAL_BREAKPOINT64 {
	DWORD BreakpointAddress;
	DWORD Flags;
	DWORD Calls;
	DWORD MaxCallsPerPeriod;
	DWORD MinInstructions;
	DWORD MaxInstructions;
	DWORD TotalInstructions;
};

struct _DBGKD_GET_INTERNAL_BREAKPOINT32 {
	DWORD BreakpointAddress;
	DWORD Flags;
	DWORD Calls;
	DWORD MaxCallsPerPeriod;
	DWORD MinInstructions;
	DWORD MaxInstructions;
	DWORD TotalInstructions;
};

struct _DBGKD_GET_INTERNAL_BREAKPOINT32 {
	DWORD BreakpointAddress;
	DWORD Flags;
	DWORD Calls;
	DWORD MaxCallsPerPeriod;
	DWORD MinInstructions;
	DWORD MaxInstructions;
	DWORD TotalInstructions;
};

struct _DBGKD_MANIPULATE_STATE64 {
	DWORD ApiNumber;
	DWORD ProcessorLevel;
	DWORD Processor;
	int ReturnStatus;
	__unnamed u;
};

struct _DBGKD_GET_CONTEXT {
	DWORD Unused;
};

struct _DBGKD_SET_CONTEXT {
	DWORD ContextFlags;
};

struct _DBGKD_RESTORE_BREAKPOINT {
	DWORD BreakPointHandle;
};

struct _DBGKD_CONTINUE {
	int ContinueStatus;
};

struct _DBGKD_CONTINUE2 {
	int ContinueStatus;
	_X86_DBGKD_CONTROL_SET ControlSet;
	_DBGKD_ANY_CONTROL_SET AnyControlSet;
};

struct _DBGKD_QUERY_SPECIAL_CALLS {
	DWORD NumberOfSpecialCalls;
};

struct _DBGKD_GET_VERSION64 {
	DWORD MajorVersion;
	DWORD MinorVersion;
	DWORD ProtocolVersion;
	DWORD Flags;
	DWORD MachineType;
	DWORD MaxPacketType;
	DWORD MaxStateChange;
	DWORD MaxManipulate;
	DWORD Simulation;
	DWORD Unused[1];
	DWORD KernBase;
	DWORD PsLoadedModuleList;
	DWORD DebuggerDataList;
};

struct _DBGKD_BREAKPOINTEX {
	DWORD BreakPointCount;
	int ContinueStatus;
};

struct _DBGKD_READ_WRITE_MSR {
	DWORD Msr;
	DWORD DataValueLow;
	DWORD DataValueHigh;
};

struct _DBGKD_SEARCH_MEMORY {
	DWORD SearchAddress;
	DWORD FoundAddress;
	DWORD SearchLength;
	DWORD PatternLength;
};

struct _DBGKD_GET_SET_BUS_DATA {
	DWORD BusDataType;
	DWORD BusNumber;
	DWORD SlotNumber;
	DWORD Offset;
	DWORD Length;
};

struct _DBGKD_FILL_MEMORY {
	DWORD Address;
	DWORD Length;
	DWORD Flags;
	DWORD PatternLength;
};

struct _DBGKD_QUERY_MEMORY {
	DWORD Address;
	DWORD Reserved;
	DWORD AddressSpace;
	DWORD Flags;
};

struct __unnamed {
	_DBGKD_READ_MEMORY64 ReadMemory;
	_DBGKD_WRITE_MEMORY64 WriteMemory;
	_DBGKD_GET_CONTEXT GetContext;
	_DBGKD_SET_CONTEXT SetContext;
	_DBGKD_WRITE_BREAKPOINT64 WriteBreakPoint;
	_DBGKD_RESTORE_BREAKPOINT RestoreBreakPoint;
	_DBGKD_CONTINUE Continue;
	_DBGKD_CONTINUE2 Continue2;
	_DBGKD_READ_WRITE_IO64 ReadWriteIo;
	_DBGKD_READ_WRITE_IO_EXTENDED64 ReadWriteIoExtended;
	_DBGKD_QUERY_SPECIAL_CALLS QuerySpecialCalls;
	_DBGKD_SET_SPECIAL_CALL64 SetSpecialCall;
	_DBGKD_SET_INTERNAL_BREAKPOINT64 SetInternalBreakpoint;
	_DBGKD_GET_INTERNAL_BREAKPOINT64 GetInternalBreakpoint;
	_DBGKD_GET_VERSION64 GetVersion64;
	_DBGKD_BREAKPOINTEX BreakPointEx;
	_DBGKD_READ_WRITE_MSR ReadWriteMsr;
	_DBGKD_SEARCH_MEMORY SearchMemory;
	_DBGKD_GET_SET_BUS_DATA GetSetBusData;
	_DBGKD_FILL_MEMORY FillMemory;
	_DBGKD_QUERY_MEMORY QueryMemory;
};

struct _DBGKD_MANIPULATE_STATE64 {
	DWORD ApiNumber;
	DWORD ProcessorLevel;
	DWORD Processor;
	int ReturnStatus;
	__unnamed u;
};

struct _DBGKD_MANIPULATE_STATE32 {
	DWORD ApiNumber;
	DWORD ProcessorLevel;
	DWORD Processor;
	int ReturnStatus;
	__unnamed u;
};

struct _DBGKD_GET_VERSION32 {
	DWORD MajorVersion;
	DWORD MinorVersion;
	DWORD ProtocolVersion;
	DWORD Flags;
	DWORD KernBase;
	DWORD PsLoadedModuleList;
	DWORD MachineType;
	DWORD ThCallbackStack;
	DWORD NextCallback;
	DWORD FramePointer;
	DWORD KiCallUserMode;
	DWORD KeUserCallbackDispatcher;
	DWORD BreakpointWithStatus;
	DWORD DebuggerDataList;
};

struct __unnamed {
	_DBGKD_READ_MEMORY32 ReadMemory;
	_DBGKD_WRITE_MEMORY32 WriteMemory;
	_DBGKD_READ_MEMORY64 ReadMemory64;
	_DBGKD_WRITE_MEMORY64 WriteMemory64;
	_DBGKD_GET_CONTEXT GetContext;
	_DBGKD_SET_CONTEXT SetContext;
	_DBGKD_WRITE_BREAKPOINT32 WriteBreakPoint;
	_DBGKD_RESTORE_BREAKPOINT RestoreBreakPoint;
	_DBGKD_CONTINUE Continue;
	_DBGKD_CONTINUE2 Continue2;
	_DBGKD_READ_WRITE_IO32 ReadWriteIo;
	_DBGKD_READ_WRITE_IO_EXTENDED32 ReadWriteIoExtended;
	_DBGKD_QUERY_SPECIAL_CALLS QuerySpecialCalls;
	_DBGKD_SET_SPECIAL_CALL32 SetSpecialCall;
	_DBGKD_SET_INTERNAL_BREAKPOINT32 SetInternalBreakpoint;
	_DBGKD_GET_INTERNAL_BREAKPOINT32 GetInternalBreakpoint;
	_DBGKD_GET_VERSION32 GetVersion32;
	_DBGKD_BREAKPOINTEX BreakPointEx;
	_DBGKD_READ_WRITE_MSR ReadWriteMsr;
	_DBGKD_SEARCH_MEMORY SearchMemory;
};

struct _DBGKD_MANIPULATE_STATE32 {
	DWORD ApiNumber;
	DWORD ProcessorLevel;
	DWORD Processor;
	int ReturnStatus;
	__unnamed u;
};

struct _VACB {
	void* BaseAddress;
	_SHARED_CACHE_MAP* SharedCacheMap;
	__unnamed Overlay;
	_LIST_ENTRY LruList;
};

struct _SHARED_CACHE_MAP {
	int NodeTypeCode;
	int NodeByteSize;
	DWORD OpenCount;
	_LARGE_INTEGER FileSize;
	_LIST_ENTRY BcbList;
	_LARGE_INTEGER SectionSize;
	_LARGE_INTEGER ValidDataLength;
	_LARGE_INTEGER ValidDataGoal;
	_VACB* InitialVacbs[4];
	_VACB** Vacbs;
	_FILE_OBJECT* FileObject;
	_VACB* ActiveVacb;
	void* NeedToZero;
	DWORD ActivePage;
	DWORD NeedToZeroPage;
	DWORD ActiveVacbSpinLock;
	DWORD VacbActiveCount;
	DWORD DirtyPages;
	_LIST_ENTRY SharedCacheMapLinks;
	DWORD Flags;
	int Status;
	_MBCB* Mbcb;
	void* Section;
	_KEVENT* CreateEvent;
	_KEVENT* WaitOnActiveCount;
	DWORD PagesToWrite;
	int BeyondLastFlush;
	_CACHE_MANAGER_CALLBACKS* Callbacks;
	void* LazyWriteContext;
	_LIST_ENTRY PrivateList;
	void* LogHandle;
	void (*FlushToLsnRoutine)(void*, _LARGE_INTEGER);
	DWORD DirtyPageThreshold;
	DWORD LazyWritePassCount;
	_CACHE_UNINITIALIZE_EVENT* UninitializeEvent;
	_VACB* NeedToZeroVacb;
	DWORD BcbSpinLock;
	void* Reserved;
	_KEVENT Event;
	_EX_PUSH_LOCK VacbPushLock;
	_PRIVATE_CACHE_MAP PrivateCacheMap;
};

struct __unnamed {
	_LARGE_INTEGER FileOffset;
	DWORD ActiveCount;
};

struct _VACB {
	void* BaseAddress;
	_SHARED_CACHE_MAP* SharedCacheMap;
	__unnamed Overlay;
	_LIST_ENTRY LruList;
};

struct _FILE_OBJECT {
	int Type;