From aac0d9c948f1775ab28f9a1052ea9b16295ca356 Mon Sep 17 00:00:00 2001 From: j Date: Sat, 25 Oct 2014 13:07:57 -0500 Subject: [PATCH 001/304] Linux - update mac convert.py to be cleaner and support latest 10.10 --- tools/mac/convert.py | 148 ++++++------------------------------------- 1 file changed, 21 insertions(+), 127 deletions(-) diff --git a/tools/mac/convert.py b/tools/mac/convert.py index 6c12f7ae9..398c03c51 100644 --- a/tools/mac/convert.py +++ b/tools/mac/convert.py @@ -419,20 +419,14 @@ def convert_file(mac_file, outfile): AT_type( {0x0000008b} ''' - level1_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{5}(\w+)\s') - level2_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{9}(\w+)\s') - level3_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{13}(\w+)\s') - level4_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{17}(\w+)\s') - level5_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{21}(\w+)\s') - level6_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{25}(\w+)\s') - level7_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{29}(\w+)\s') - level8_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{33}(\w+)\s') - level9_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{37}(\w+)\s') - level10_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{41}(\w+)\s') - level11_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{45}(\w+)\s') - level12_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{49}(\w+)\s') - level13_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{53}(\w+)\s') - level14_re = re.compile(r'^(0x[0-9a-fA-F]+):\s{57}(\w+)\s') + # skip the first (entry 0) + re_compiles = [""] + parse_depth = 27 + string_idx = 5 + for i in range(1, parse_depth): + s = r'^(0x[0-9a-fA-F]+):\s{' + "%d" % string_idx + r'}(\w+)\s' + re_compiles.append(re.compile(s)) + string_idx = string_idx + 4 at_re = re.compile(r'^\s+(\w+)\((.+)') @@ -440,7 +434,6 @@ def convert_file(mac_file, outfile): dontbreak = 0 for line in mac_file.readlines(): - if len(line) < 2: outfile.write("\n") level = 0 @@ -469,120 +462,22 @@ def convert_file(mac_file, outfile): # new declaration if level == 0: - m = level1_re.match(line) - t = level2_re.match(line) - r = level3_re.match(line) - f = level4_re.match(line) - z = level5_re.match(line) - s = level6_re.match(line) - y = level7_re.match(line) - b = level8_re.match(line) - j = level9_re.match(line) - a = level10_re.match(line) - c = level11_re.match(line) - d = level12_re.match(line) - e = level13_re.match(line) - g = level14_re.match(line) - - if m: - (id, name) = m.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 1, id, name) - - elif t: - (id, name) = t.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 2, id, name) - - elif r: - (id, name) = r.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 3, id, name) - - elif f: - (id, name) = f.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 4, id, name) - - elif z: - (id, name) = z.groups() - level = 1 - id = "%d" % int(id, 16) - - write_line(outfile, 5, id, name) - - elif s: - (id, name) = s.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 6, id, name) - - elif y: - (id, name) = y.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 7, id, name) - - elif b: - (id, name) = b.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 8, id, name) - - elif j: - (id, name) = j.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 9, id, name) - - elif a: - (id, name) = a.groups() - id = "%d" % int(id, 16) - level = 1 + line_wrote = False + for check_idx in range(1, parse_depth): + re_check = re_compiles[check_idx] - write_line(outfile, 10, id, name) + matchobj = re_check.match(line) + if matchobj: + (id, name) = matchobj.groups() - elif c: - (id, name) = c.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 11, id, name) - - elif d: - (id, name) = d.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 12, id, name) - - elif e: - (id, name) = e.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 13, id, name) + id = "%d" % int(id, 16) + level = 1 - elif g: - (id, name) = g.groups() - id = "%d" % int(id, 16) - level = 1 - - write_line(outfile, 14, id, name) + write_line(outfile, check_idx, id, name) + line_wrote = True + break - else: + if not line_wrote: print "State machine broken! level 0! %s" % line sys.exit(1) @@ -590,8 +485,7 @@ def convert_file(mac_file, outfile): # AT_xxxx # blank elif level == 1: - - m = level2_re.match(line) + m = re_compiles[2].match(line) a = at_re.match(line) if m: (id, name) = m.groups() From 678d310fdac7f3fe3268cd7324dedeb1fce35302 Mon Sep 17 00:00:00 2001 From: KevTheHermit Date: Fri, 6 May 2016 16:11:12 +0100 Subject: [PATCH 002/304] Add Unified Output to Notepad plugin --- volatility/plugins/notepad.py | 45 +++++++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/volatility/plugins/notepad.py b/volatility/plugins/notepad.py index 84e583757..ba7b87048 100644 --- a/volatility/plugins/notepad.py +++ b/volatility/plugins/notepad.py @@ -23,6 +23,7 @@ import volatility.obj as obj import volatility.utils as utils import volatility.plugins.taskmods as taskmods +from volatility.renderers import TreeGrid #-------------------------------------------------------------------------------- # object classes @@ -181,6 +182,42 @@ def is_valid_profile(profile): return (profile.metadata.get('os', 'unknown') == 'windows' and profile.metadata.get('major', 0) == 5) + def unified_output(self, data): + return TreeGrid([("Process", str), + ("PID", int), + ("Text", str), + ], self.generator(data)) + + def generator(self, data): + for task in data: + # only looking for notepad + if str(task.ImageFileName).lower() != "notepad.exe": + continue + process_id = task.UniqueProcessId + + entry_size = task.obj_vm.profile.get_obj_size("_HEAP_ENTRY") + heap = task.Peb.ProcessHeap.dereference_as("_HEAP") + + for segment in heap.segments(): + for entry in segment.heap_entries(): + + # the extra heap data is present + if "extra" not in str(entry.Flags): + continue + + text = obj.Object("String", + offset=entry.obj_offset + entry_size, + vm=task.get_process_address_space(), + length=entry.Size * entry_size, + encoding="utf16") + + if not text or len(text) == 0: + continue + else: + display_text = text + + yield(0, ['notepad.exe', int(process_id), str(display_text)]) + def render_text(self, outfd, data): for task in data: @@ -200,10 +237,10 @@ def render_text(self, outfd, data): continue text = obj.Object("String", - offset = entry.obj_offset + entry_size, - vm = task.get_process_address_space(), - length = entry.Size * entry_size, - encoding = "utf16") + offset=entry.obj_offset + entry_size, + vm=task.get_process_address_space(), + length=entry.Size * entry_size, + encoding="utf16") if not text or len(text) == 0: continue From ce30e392f0b038986d7101d9af2ae0c490eadc97 Mon Sep 17 00:00:00 2001 From: Bridgey the Geek Date: Sat, 21 May 2016 14:33:08 +0100 Subject: [PATCH 003/304] Added --pid option to windows plugin Added --pid option to windows plugin in order to facilitate only outputting windows objects for specific processes. --- volatility/plugins/gui/windows.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/volatility/plugins/gui/windows.py b/volatility/plugins/gui/windows.py index 8d4f469c9..97e37b27b 100644 --- a/volatility/plugins/gui/windows.py +++ b/volatility/plugins/gui/windows.py @@ -18,6 +18,7 @@ # along with Volatility. If not, see . # +import volatility.plugins.common as common import volatility.plugins.gui.messagehooks as messagehooks class WinTree(messagehooks.MessageHooks): @@ -42,8 +43,21 @@ def render_text(self, outfd, data): class Windows(messagehooks.MessageHooks): """Print Desktop Windows (verbose details)""" + + def __init__(self, config, *args, **kwargs): + common.AbstractWindowsCommand.__init__(self, config, *args, **kwargs) + + # Filter specific processes + config.add_option('PID', short_option='p', default=None, + help='Operate on these Process IDs (comma-separated)', + action='store', type='str') def render_text(self, outfd, data): + + if self._config.PID: + wanted_pids = [int(pid) for pid in self._config.PID.split(',')] + else: + wanted_pids = None for winsta, atom_tables in data: for desktop in winsta.desktops(): @@ -51,6 +65,11 @@ def render_text(self, outfd, data): outfd.write("Window context: {0}\\{1}\\{2}\n\n".format( winsta.dwSessionId, winsta.Name, desktop.Name)) for wnd, _level in desktop.windows(desktop.DeskInfo.spwnd): + + # Is this a process we want? + if wanted_pids and not wnd.Process.UniqueProcessId in wanted_pids: + continue + outfd.write("Window Handle: #{0:x} at {1:#x}, Name: {2}\n".format( wnd.head.h, wnd.obj_offset, str(wnd.strName or '') )) From 05c63014e142bb51efc9bbdaffa50059c0329514 Mon Sep 17 00:00:00 2001 From: gleeda Date: Mon, 1 Aug 2016 10:18:58 -0700 Subject: [PATCH 004/304] making LoadTime all macb --- volatility/plugins/timeliner.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/timeliner.py b/volatility/plugins/timeliner.py index 81e6e4a4e..a0f9a2afb 100644 --- a/volatility/plugins/timeliner.py +++ b/volatility/plugins/timeliner.py @@ -356,7 +356,7 @@ def calculate(self): yield self.getoutput(line2, mod.get_debug_directory().TimeDateStamp, body = body) if hasattr(mod, "LoadTime") and "LoadTime" in self._config.TYPE: temp = line.replace("[{0}PE HEADER ".format(self._config.MACHINE), "[{0}DLL LOADTIME ".format(self._config.MACHINE)) - yield self.getoutput(temp, mod.TimeDateStamp, end = mod.LoadTime, body = body) + yield self.getoutput(temp, mod.LoadTime, body = body) # Get Sockets and Evtlogs XP/2k3 only if version[0] == 5: From 1ab2a13016345ffaea11eb12d31d385a5ff08b71 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Sat, 13 Aug 2016 10:30:19 -0500 Subject: [PATCH 005/304] add a couple of missing big page table offsets for 6.3 and 6.4 --- volatility/plugins/bigpagepools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/bigpagepools.py b/volatility/plugins/bigpagepools.py index 5aabb40f8..bf12ee0d9 100644 --- a/volatility/plugins/bigpagepools.py +++ b/volatility/plugins/bigpagepools.py @@ -68,7 +68,7 @@ def modification(self, profile): (6, 2, '32bit') : [[92, 88]], (6, 2, '64bit') : [[-5200, -5224]], (6, 3, '32bit') : [[116, 120]], - (6, 4, '64bit') : [[208, 184], [168, 192]], + (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168]], (6, 4, '32bit') : [[-168, -164]], } @@ -80,7 +80,7 @@ def modification(self, profile): if m.get('build', 0) == 9601: distance = [[-5192, -5200], [-5224, -5232]] else: - distance = [[-5200, -5176], [-5224, -5232]] + distance = [[-5200, -5176], [-5224, -5232], [-5192, -5200]] profile.merge_overlay({ 'VOLATILITY_MAGIC': [ None, { From 4da0673e05bcc93742fb79665341b4d0e9c3254f Mon Sep 17 00:00:00 2001 From: atcuno Date: Sat, 13 Aug 2016 21:36:55 -0500 Subject: [PATCH 006/304] Mac - Add plugins from DFRWS 2015 --- volatility/plugins/mac/check_fop.py | 131 ++++++++++++++ volatility/plugins/mac/classes.py | 108 +++++++++++ volatility/plugins/mac/devfs.py | 88 +++++++++ volatility/plugins/mac/interest_handlers.py | 188 ++++++++++++++++++++ volatility/plugins/mac/kevents.py | 131 ++++++++++++++ volatility/plugins/mac/timers.py | 99 +++++++++++ volatility/plugins/mac/vfsevents.py | 76 ++++++++ 7 files changed, 821 insertions(+) create mode 100644 volatility/plugins/mac/check_fop.py create mode 100644 volatility/plugins/mac/classes.py create mode 100644 volatility/plugins/mac/devfs.py create mode 100644 volatility/plugins/mac/interest_handlers.py create mode 100644 volatility/plugins/mac/kevents.py create mode 100644 volatility/plugins/mac/timers.py create mode 100644 volatility/plugins/mac/vfsevents.py diff --git a/volatility/plugins/mac/check_fop.py b/volatility/plugins/mac/check_fop.py new file mode 100644 index 000000000..c869e6231 --- /dev/null +++ b/volatility/plugins/mac/check_fop.py @@ -0,0 +1,131 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.utils as utils +import volatility.debug as debug + +import volatility.plugins.mac.common as common + +class mac_check_fop(common.AbstractMacCommand): + """ Validate File Operation Pointers """ + + def _walk_vfstbllist(self, kaddr_info): + table_size_ptr = self.addr_space.profile.get_symbol("_maxvfsconf") + + if table_size_ptr == None: + table_size_ptr = self.addr_space.profile.get_symbol("_maxvfsslots") + + table_size = obj.Object("unsigned int", offset = table_size_ptr, vm = self.addr_space) + + table_ptr = self.addr_space.profile.get_symbol("_vfstbllist") + table = obj.Object(theType = "Array", targetType = "vfstable", offset = table_ptr, count = table_size, vm = self.addr_space) + vfs_op_members = self.profile.types['vfsops'].keywords["members"].keys() + vfs_op_members.remove("vfs_reserved") + + for vfs in table: + if not vfs.is_valid(): + continue + + name = self.addr_space.read(vfs.vfc_name.obj_offset, 16) + if name: + idx = name.find("\x00") + if idx != -1: + name = name[:idx] + else: + name = "" + + if name == "": + break + + ops = vfs.vfc_vfsops + + for member in vfs_op_members: + ptr = ops.__getattr__(member).v() + + if ptr == 0: + continue + + (module, handler_sym) = common.get_handler_name(kaddr_info, ptr) + + yield (vfs.v(), name, ptr, module, handler_sym) + + def _walk_opv_desc(self, kaddr_info): + table_addr = self.addr_space.profile.get_symbol("_vfs_opv_descs") + + table = obj.Object(targetType = "unsigned long", theType = "Array", count = 32, vm = self.addr_space, offset = table_addr) + + for desc in table: + if desc.v() == 0: + break + + table_name = self.addr_space.profile.get_symbol_by_address("kernel", desc.v()) + if not table_name: + table_name = "" + + vnodeopv_desc = obj.Object("vnodeopv_desc", offset = desc.v(), vm = self.addr_space) + + vdesc_arr = obj.Object(theType = "Array", targetType = "vnodeopv_entry_desc", offset = vnodeopv_desc.opv_desc_ops, count = 64, vm = self.addr_space) + + for vdesc in vdesc_arr: + ptr = vdesc.opve_impl.v() + if ptr == 0: + break + + name = self.addr_space.read(vdesc.opve_op.vdesc_name.v(), 64) + if name: + idx = name.find("\x00") + if idx != -1: + name = name[:idx] + else: + name = "" + + name = table_name + "/" + name + + (module, handler_sym) = common.get_handler_name(kaddr_info, ptr) + + yield (vdesc.v(), name, ptr, module, handler_sym) + + def calculate(self): + common.set_plugin_members(self) + + kaddr_info = common.get_handler_name_addrs(self) + + funcs = [self._walk_opv_desc, self._walk_vfstbllist] + + for func in funcs: + for (vfs_ptr, name, ptr, module, handler_sym) in func(kaddr_info): + yield (vfs_ptr, name, ptr, module, handler_sym) + + def render_text(self, outfd, data): + self.table_header(outfd, [("Offset", "[addrpad]"), + ("Name", "48"), + ("Handler", "[addrpad]"), + ("Module", "32"), + ("Handler Sym", "")]) + + for (vfs_addr, name, handler, module, handler_sym) in data: + self.table_row(outfd, vfs_addr, name, handler, module, handler_sym) + diff --git a/volatility/plugins/mac/classes.py b/volatility/plugins/mac/classes.py new file mode 100644 index 000000000..bf62ce1bd --- /dev/null +++ b/volatility/plugins/mac/classes.py @@ -0,0 +1,108 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.utils as utils +import volatility.debug as debug + +import volatility.plugins.mac.common as common + +class mac_kernel_classes(common.AbstractMacCommand): + """ Lists loaded c++ classes in the kernel """ + + def _struct_or_class(self, type_name): + """Return the name of a structure or class. + + More recent versions of OSX define some types as + classes instead of structures, so the naming is + a little different. + """ + if self.addr_space.profile.vtypes.has_key(type_name): + return type_name + else: + return type_name + "_class" + + def calculate(self): + common.set_plugin_members(self) + + kaddr_info = common.get_handler_name_addrs(self) + + dict_ptr_addr = common.get_cpp_sym("sAllClassesDict", self.addr_space.profile) + dict_addr = obj.Object("unsigned long", offset = dict_ptr_addr, vm = self.addr_space) + + fdict = obj.Object(self._struct_or_class("OSDictionary"), offset = dict_addr.v(), vm = self.addr_space) + + ents = obj.Object('Array', offset = fdict.dictionary, + vm = self.addr_space, + targetType = self._struct_or_class("dictEntry"), + count = fdict.count) + + for ent in ents: + if ent == None or not ent.is_valid(): + continue + + class_name = str(ent.key.dereference_as(self._struct_or_class("OSString"))) + + osmeta = obj.Object(self._struct_or_class("OSMetaClass"), offset = ent.value.v(), vm = self.addr_space) + + cname = str(osmeta.className.dereference_as(self._struct_or_class("OSString"))) + + offset = 0 + + if hasattr(osmeta, "metaClass"): + arr_start = osmeta.metaClass.v() + else: + arr_start = obj.Object("Pointer", offset = osmeta.obj_offset, vm = self.addr_space) + + vptr = obj.Object("unsigned long", offset = arr_start, vm = self.addr_space) + while vptr != 0: + (module, handler_sym) = common.get_handler_name(kaddr_info, vptr) + + yield (cname, vptr, module, handler_sym) + + offset = offset + vptr.size() + + vptr = obj.Object("unsigned long", offset = arr_start + offset, vm = self.addr_space) + + def render_text(self, outfd, data): + self.table_header(outfd, [("Class", "48"), + ("Address", "[addrpad]"), + ("Module", "48"), + ("Handler", "")]) + + for (cname, vptr, module, handler_sym) in data: + self.table_row(outfd, cname, vptr, module, handler_sym) + + + + + + + + + + + + diff --git a/volatility/plugins/mac/devfs.py b/volatility/plugins/mac/devfs.py new file mode 100644 index 000000000..a83449550 --- /dev/null +++ b/volatility/plugins/mac/devfs.py @@ -0,0 +1,88 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" + +import volatility.obj as obj +import volatility.plugins.mac.common as common +import volatility.plugins.mac.list_files as mac_list_files + +class mac_devfs(common.AbstractMacCommand): + """ Lists files in the file cache """ + + def calculate(self): + common.set_plugin_members(self) + + nchrdev_addr = self.addr_space.profile.get_symbol("_nchrdev") + nchrdev = obj.Object("unsigned int", offset = nchrdev_addr, vm = self.addr_space) + + cdevsw_addr = self.addr_space.profile.get_symbol("_cdevsw") + cdevsw = obj.Object(theType = "Array", targetType = "cdevsw", offset = cdevsw_addr, vm = self.addr_space, count = nchrdev) + + kaddr_info = common.get_handler_name_addrs(self) + + op_members = self.profile.types['cdevsw'].keywords["members"].keys() + + op_members.remove('d_ttys') + op_members.remove('d_type') + + files = mac_list_files.mac_list_files(self._config).calculate() + for vnode, path in files: + if vnode.v_type.v() not in [3, 4]: + continue + + if path.startswith("/Macintosh HD"): + path = path[13:] + + dn = vnode.v_data.dereference_as("devnode") + + dev = dn.dn_typeinfo.dev + major = (dev >> 24) & 0xff + + if not (0 <= major <= nchrdev): + continue + + cdev = cdevsw[major] + + for member in op_members: + ptr = cdev.__getattr__(member).v() + + if ptr != 0: + (module, handler_sym) = common.get_handler_name(kaddr_info, ptr) + + yield (cdev.v(), path, member, ptr, module, handler_sym) + + def render_text(self, outfd, data): + self.table_header(outfd, [("Offset (V)", "[addrpad]"), + ("Path", "16"), + ("Member", "16"), + ("Handler", "[addrpad]"), + ("Module", "32"), + ("Handler", "")]) + + for (cdev, path, member, handler, module, sym) in data: + self.table_row(outfd, cdev, path, member, handler, module, sym) + + + diff --git a/volatility/plugins/mac/interest_handlers.py b/volatility/plugins/mac/interest_handlers.py new file mode 100644 index 000000000..eb962c11d --- /dev/null +++ b/volatility/plugins/mac/interest_handlers.py @@ -0,0 +1,188 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.utils as utils +import volatility.debug as debug + +import volatility.plugins.mac.common as common + +kaddr_info = None + +class mac_interest_handlers(common.AbstractMacCommand): + """ Lists IOKit Interest Handlers """ + + def _struct_or_class(self, type_name): + """Return the name of a structure or class. + + More recent versions of OSX define some types as + classes instead of structures, so the naming is + a little different. + """ + if self.addr_space.profile.vtypes.has_key(type_name): + return type_name + else: + return type_name + "_class" + + def parse_properties(self, fdict): + props = {} + + ents = obj.Object('Array', offset = fdict.dictionary, + vm = self.addr_space, + targetType = self._struct_or_class("dictEntry"), + count = fdict.count) + + # walk the current set of notifications + for ent in ents: + if ent == None or not ent.is_valid(): + continue + + key = str(ent.key.dereference_as(self._struct_or_class("OSString"))) + val = ent.value + + props[key] = val + + return props + + def walk_reg_entry(self, reg_addr): + regroot = obj.Object(self._struct_or_class("IORegistryEntry"), offset = reg_addr, vm = self.addr_space) + + fdict = regroot.fRegistryTable + + props = self.parse_properties(regroot.fPropertyTable) + + ents = obj.Object('Array', offset = fdict.dictionary, + vm = self.addr_space, + targetType = self._struct_or_class("dictEntry"), + count = fdict.count) + + keys = [] + children = [] + current_name = "" + device_mem = False + + for ent in ents: + if ent == None or not ent.is_valid(): + continue + + key = str(ent.key.dereference_as(self._struct_or_class("OSString"))) + + keys.append(key) + + if key == "IODeviceMemory": + current_name = str(ent.value.dereference_as(self._struct_or_class("OSString"))) + device_mem = True + + if key == "IOName" and device_mem == False: + current_name = str(ent.value.dereference_as(self._struct_or_class("OSString"))) + + if key == "IOServiceChildLinks": + children.append(ent.value) + + if current_name == "": + if "IOClass" in props: + addr = props["IOClass"] + s = obj.Object(self._struct_or_class("OSString"), offset = addr, vm = self.addr_space) + current_name = "IOCLass: %s" % str(s) + + if current_name == "": + serv = obj.Object(self._struct_or_class("IOService"), offset = reg_addr, vm = self.addr_space) + buf = self.addr_space.read(serv.pwrMgt.Name, 128) + if buf: + idx = buf.find("\x00") + if idx != -1: + buf = buf[:idx] + + current_name = buf + + prop_string = "".join(["%s=%x, " % (k,v) for (k,v) in props.items()]) + + #print "%-20s | %s | %s" % (current_name, keys, prop_string) + + offset = self.addr_space.profile.get_obj_offset(self._struct_or_class("_IOServiceInterestNotifier"), "chain") + + for (k, v) in props.items(): + if k.find("nterest") != -1: + cmd = obj.Object(self._struct_or_class("IOCommand"), offset = v, vm = self.addr_space) + notifier_ptr = cmd.fCommandChain.next + first_ptr = notifier_ptr + + last = 0 + + while notifier_ptr.is_valid() and notifier_ptr != last: + notifier = obj.Object(self._struct_or_class("_IOServiceInterestNotifier"), offset = notifier_ptr - offset, vm = self.addr_space) + + if not notifier.handler.is_valid(): + break + + last = notifier_ptr + notifier_ptr = notifier.chain.next + + if notifier_ptr == first_ptr: + break + + handler = notifier.handler.v() + + (module, handler_sym) = common.get_handler_name(kaddr_info, handler) + + yield k, handler, module, handler_sym + + for child in children: + for k, handler, module, handler_sym in self.walk_child_links(child): + yield k, handler, module, handler_sym + + def walk_child_links(self, addr): + val = obj.Object(self._struct_or_class("OSArray"), offset = addr, vm = self.addr_space) + + arr_ptr = val.array + cnt = val.count + + arr = obj.Object(theType = "Array", targetType = "Pointer", offset = arr_ptr, count = cnt, vm = self.addr_space) + + for a in arr: + for key, handler, module, handler_sym in self.walk_reg_entry(a): + yield key, handler, module, handler_sym + + def calculate(self): + common.set_plugin_members(self) + + global kaddr_info + kaddr_info = common.get_handler_name_addrs(self) + + regroot_addr = common.get_cpp_sym("gRegistryRoot", self.addr_space.profile) + p = obj.Object("Pointer", offset = regroot_addr, vm = self.addr_space) + + for key, handler, module, handler_sym in self.walk_reg_entry(p): + yield key, handler, module, handler_sym + + def render_text(self, outfd, data): + self.table_header(outfd, [("Interest", "24"), + ("Handler", "[addrpad]"), + ("Module", "32"), + ("Symbol", "")]) + + for key, handler, module, handler_sym in data: + self.table_row(outfd, key, handler, module, handler_sym) + diff --git a/volatility/plugins/mac/kevents.py b/volatility/plugins/mac/kevents.py new file mode 100644 index 000000000..607b8b4ab --- /dev/null +++ b/volatility/plugins/mac/kevents.py @@ -0,0 +1,131 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.plugins.mac.common as common +import volatility.plugins.mac.pstasks as pstasks + +class mac_kevents(common.AbstractMacCommand): + """ Show parent/child relationship of processes """ + + def _walk_karray(self, address, count): + arr = obj.Object(theType = "Array", targetType = "klist", offset = address, vm = self.addr_space, count = count) + + for klist in arr: + kn = klist.slh_first + + while kn.is_valid(): + yield kn + + kn = kn.kn_link.sle_next + + def calculate(self): + common.set_plugin_members(self) + + for task in pstasks.mac_tasks(self._config).calculate(): + fdp = task.p_fd + + # for (i = 0; i < fdp->fd_knlistsize; i++) { + # kn = SLIST_FIRST(&fdp->fd_knlist[i]); + for kn in self._walk_karray(fdp.fd_knlist, fdp.fd_knlistsize): + yield task, kn + + # if (fdp->fd_knhashmask != 0) { + # for (i = 0; i < (int)fdp->fd_knhashmask + 1; i++) { + # kn = SLIST_FIRST(&fdp->fd_knhash[i]); + mask = fdp.fd_knhashmask + if mask != 0: + for kn in self._walk_karray(fdp.fd_knhash, mask + 1): + yield task, kn + + + kn = task.p_klist.slh_first + while kn.is_valid(): + + yield task, kn + + kn = kn.kn_link.sle_next + + def _get_flags(self, fflags, filters): + context = "" + + if fflags != 0: + for (flag, idx) in filters: + if fflags & idx == idx: + context = context + flag + ", " + + if len(context) > 2 and context[-2:] == ", ": + context = context[:-2] + + return context + + def render_text(self, outfd, data): + event_types = ["INVALID EVENT", "EVFILT_READ", "EVFILT_WRITE", "EVFILT_AIO", "EVFILT_VNODE", "EVFILT_PROC", "EVFILT_SIGNAL"] + event_types = event_types + ["EVFILT_TIMER", "EVFILT_MACHPORT", "EVFILT_FS", "EVFILT_USER", "INVALID EVENT", "EVFILT_VM"] + + vnode_filt = [("NOTE_DELETE", 1), ("NOTE_WRITE", 2), ("NOTE_EXTEND", 4), ("NOTE_ATTRIB", 8)] + vnode_filt = vnode_filt + [("NOTE_LINK", 0x10), ("NOTE_RENAME", 0x20), ("NOTE_REVOKE", 0x40)] + + proc_filt = [("NOTE_EXIT", 0x80000000), ("NOTE_EXITSTATUS", 0x04000000), ("NOTE_FORK", 0x40000000)] + proc_filt = proc_filt + [("NOTE_EXEC", 0x20000000), ("NOTE_SIGNAL", 0x08000000), ("NOTE_REAP", 0x10000000)] + + time_filt = [("NOTE_SECONDS", 1), ("NOTE_USECONDS", 2), ("NOTE_NSECONDS", 4), ("NOTE_ABSOLUTE", 8)] + + self.table_header(outfd, [("Offset", "[addrpad]"), + ("Name", "20"), + ("Pid", "8"), + ("Ident", "6"), + ("Filter", "20"), + ("Context", ""),]) + + for task, kn in data: + filt_idx = kn.kn_kevent.filter * -1 + if 0 < filt_idx < len(event_types): + fname = event_types[filt_idx] + else: + continue + + context = "" + fflags = kn.kn_sfflags + + # EVFILT_VNODE + if filt_idx == 4: + context = self._get_flags(fflags, vnode_filt) + + # EVFILT_PROC + elif filt_idx == 5: + context = self._get_flags(fflags, proc_filt) + + elif filt_idx == 7: + context = self._get_flags(fflags, time_filt) + + self.table_row(outfd, kn.v(), str(task.p_comm), task.p_pid, kn.kn_kevent.ident, fname, context) + + + + + + + diff --git a/volatility/plugins/mac/timers.py b/volatility/plugins/mac/timers.py new file mode 100644 index 000000000..b2747dbb4 --- /dev/null +++ b/volatility/plugins/mac/timers.py @@ -0,0 +1,99 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.plugins.mac.common as common + +class mac_timers(common.AbstractMacCommand): + """ Reports timers set by kernel drivers """ + + def calculate(self): + common.set_plugin_members(self) + + kaddr_info = common.get_handler_name_addrs(self) + + real_ncpus = obj.Object("int", offset = self.addr_space.profile.get_symbol("_real_ncpus"), vm = self.addr_space) + + ptr = self.addr_space.profile.get_symbol("_cpu_data_ptr") + cpu_data_ptrs = obj.Object(theType = 'Array', offset = ptr, vm = self.addr_space, targetType = "unsigned long long", count = real_ncpus) + + for i in range(real_ncpus): + cpu_data = obj.Object('cpu_data', offset = cpu_data_ptrs[i], vm = self.addr_space) + + c = cpu_data.rtclock_timer + q = c.queue + + ent = q.head.next + first = ent + seen = {} + + while ent.is_valid(): + seen[ent.v()] = 1 + + timer = obj.Object("call_entry", offset = ent.v(), vm = self.addr_space) + + func = timer.func.v() + + if func < 0x1000 or func == 0xffffffff00000000: + break + + (module, handler_sym) = common.get_handler_name(kaddr_info, func) + + if hasattr(timer, "entry_time"): + entry_time = timer.entry_time.v() + else: + entry_time = -1 + + yield func, timer.param0, timer.param1, timer.deadline, entry_time, module, handler_sym + + ent = timer.q_link.next + + if ent == first or ent.v() in seen: + break + + + def render_text(self, outfd, data): + self.table_header(outfd, [("Function", "[addrpad]"), + ("Param 0", "[addrpad]"), + ("Param 1", "[addrpad]"), + ("Deadline", "16"), + ("Entry Time", "16"), + ("Module", "16"), + ("Symbol", ""), + ]) + + for func, p0, p1, deadline, entry_time, module, sym in data: + self.table_row(outfd, func, p0, p1, deadline, entry_time, module, sym) + + + + + + + + + + + diff --git a/volatility/plugins/mac/vfsevents.py b/volatility/plugins/mac/vfsevents.py new file mode 100644 index 000000000..c220117bb --- /dev/null +++ b/volatility/plugins/mac/vfsevents.py @@ -0,0 +1,76 @@ +# Volatility +# Copyright (C) 2007-2013 Volatility Foundation +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" +import volatility.obj as obj +import volatility.debug as debug +import volatility.plugins.mac.common as common + +class mac_vfsevents(common.AbstractMacCommand): + """ Lists processes filtering file system events """ + + def calculate(self): + common.set_plugin_members(self) + + if not self.addr_space.profile.obj_has_member("fs_event_watcher", "proc_name"): + debug.error("This plugin only supports OS X >= 10.8.2. Please file a bug if you are running against a version matching this criteria.") + + event_types = ["CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", "CREATE_DIR", "CHOWN"] + event_types = event_types + ["XATTR_MODIFIED", "XATTR_REMOVED", "DOCID_CREATED", "DOCID_CHANGED"] + + table_addr = self.addr_space.profile.get_symbol("_watcher_table") + + arr = obj.Object(theType = "Array", targetType = "Pointer", count = 8, vm = self.addr_space, offset = table_addr) + + for watcher_addr in arr: + if not watcher_addr.is_valid(): + continue + + watcher = watcher_addr.dereference_as("fs_event_watcher") + + name = self.addr_space.read(watcher.proc_name.obj_offset, 33) + if name: + idx = name.find("\x00") + if idx != -1: + name = name[:idx] + + events = "" + event_arr = obj.Object(theType = "Array", targetType = "unsigned char", offset = watcher.event_list.v(), count = 13, vm = self.addr_space) + for (i, event) in enumerate(event_arr): + if event == 1: + events = events + event_types[i] + ", " + + if len(events) and events[-1] == " " and events[-2] == ",": + events = events[:-2] + + yield watcher_addr, name, watcher.pid, events + + def render_text(self, outfd, data): + self.table_header(outfd, [("Offset", "[addrpad]"), + ("Name", "20"), + ("Pid", "8"), + ("Events", "")]) + + for (addr, name, pid, events) in data: + self.table_row(outfd, addr, name, pid, events) From 62adbb1e9d6625b8c5f362a1e9f40185caeeb4de Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Tue, 31 May 2016 23:20:03 -0400 Subject: [PATCH 007/304] amd64.py:get_available_pages() optimize parsing of page tables - read each level with a single baselayer read() call - parse all entries with a single struct.unpack() call --- volatility/plugins/addrspaces/amd64.py | 55 ++++++++++++++++++-------- 1 file changed, 39 insertions(+), 16 deletions(-) diff --git a/volatility/plugins/addrspaces/amd64.py b/volatility/plugins/addrspaces/amd64.py index 5e54668a7..b9ddf21c8 100644 --- a/volatility/plugins/addrspaces/amd64.py +++ b/volatility/plugins/addrspaces/amd64.py @@ -254,16 +254,31 @@ def get_available_pages(self, with_pte = False): are accessible. ''' + # read the full pml4 + pml4 = self.base.read(self.dtb & 0xffffffffff000, 0x200 * 8) + if pml4 is None: + return + + # unpack all entries + pml4_entries = struct.unpack('<512Q', pml4) for pml4e in range(0, 0x200): vaddr = pml4e << 39 - pml4e_value = self.get_pml4e(vaddr) + pml4e_value = pml4_entries[pml4e] if not self.entry_present(pml4e_value): continue + + pdpt_base = (pml4e_value & 0xffffffffff000) + pdpt = self.base.read(pdpt_base, 0x200 * 8) + if pdpt is None: + continue + + pdpt_entries = struct.unpack('<512Q', pdpt) for pdpte in range(0, 0x200): vaddr = (pml4e << 39) | (pdpte << 30) - pdpte_value = self.get_pdpi(vaddr, pml4e_value) + pdpte_value = pdpt_entries[pdpte] if not self.entry_present(pdpte_value): continue + if self.page_size_flag(pdpte_value): if with_pte: yield (pdpte_value, vaddr, 0x40000000) @@ -271,26 +286,34 @@ def get_available_pages(self, with_pte = False): yield (vaddr, 0x40000000) continue - pgd_curr = self.pdba_base(pdpte_value) - for j in range(0, ptrs_per_pae_pgd): - soffset = vaddr + (j * ptrs_per_pae_pgd * ptrs_per_pae_pte * 8) - entry = self.read_long_long_phys(pgd_curr) - pgd_curr = pgd_curr + 8 + pd_base = self.pdba_base(pdpte_value) + pd = self.base.read(pd_base, 0x200 * 8) + if pd is None: + continue + + pd_entries = struct.unpack('<512Q', pd) + for j in range(0, 0x200): + soffset = (j * 0x200 * 0x200 * 8) + entry = pd_entries[j] if self.entry_present(entry) and self.page_size_flag(entry): if with_pte: - yield (entry, soffset, 0x200000) + yield (entry, vaddr + soffset, 0x200000) else: - yield (soffset, 0x200000) + yield (vaddr + soffset, 0x200000) + elif self.entry_present(entry): - pte_curr = entry & 0xFFFFFFFFFF000 - for k in range(0, ptrs_per_pae_pte): - pte_entry = self.read_long_long_phys(pte_curr) - pte_curr = pte_curr + 8 - if self.entry_present(pte_entry): + pt_base = entry & 0xFFFFFFFFFF000 + pt = self.base.read(pt_base, 0x200 * 8) + if pt is None: + continue + pt_entries = struct.unpack('<512Q', pt) + for k in range(0, 0x200): + pt_entry = pt_entries[k] + if self.entry_present(pt_entry): if with_pte: - yield (pte_entry, soffset + k * 0x1000, 0x1000) + yield (pt_entry, vaddr + soffset + k * 0x1000, 0x1000) else: - yield (soffset + k * 0x1000, 0x1000) + yield (vaddr + soffset + k * 0x1000, 0x1000) @classmethod def address_mask(cls, addr): From fadddc621b32181398f057b1fb21dc28010041e4 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sun, 10 Jul 2016 00:09:26 -0400 Subject: [PATCH 008/304] added latest win10 profiles --- volatility/plugins/overlays/windows/win10.py | 18 + .../windows/win10_x64_1AC738FB_vtypes.py | 13258 ++++++++++++++++ .../windows/win10_x86_44B89EEA_vtypes.py | 12767 +++++++++++++++ 3 files changed, 26043 insertions(+) create mode 100644 volatility/plugins/overlays/windows/win10_x64_1AC738FB_vtypes.py create mode 100644 volatility/plugins/overlays/windows/win10_x86_44B89EEA_vtypes.py diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index 818136ec6..c8dae58a2 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -335,6 +335,15 @@ class Win10x64(obj.Profile): _md_build = 9841 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_vtypes' +class Win10x64_1AC738FB(obj.Profile): + """ A Profile for Windows 10 x64 from PDB 1AC738FB""" + _md_memory_model = '64bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 4 + _md_build = 10240 + _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes' + class Win10x86(obj.Profile): """ A Profile for Windows 10 x86 """ _md_memory_model = '32bit' @@ -343,3 +352,12 @@ class Win10x86(obj.Profile): _md_minor = 4 _md_build = 9841 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_vtypes' + +class Win10x86_44B89EEA(obj.Profile): + """ A Profile for Windows 10 x86 from PDB 44B89EEA""" + _md_memory_model = '32bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 4 + _md_build = 10240 + _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_44B89EEA_vtypes' diff --git a/volatility/plugins/overlays/windows/win10_x64_1AC738FB_vtypes.py b/volatility/plugins/overlays/windows/win10_x64_1AC738FB_vtypes.py new file mode 100644 index 000000000..19868e643 --- /dev/null +++ b/volatility/plugins/overlays/windows/win10_x64_1AC738FB_vtypes.py @@ -0,0 +1,13258 @@ +ntkrnlmp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x708, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'NtBuildNumber' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'BootId' : [ 0x2c4, ['unsigned long']], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'Reserved12' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCall' : [ 0x308, ['unsigned long']], + 'SystemCallPad0' : [ 0x30c, ['unsigned long']], + 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], + 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], + 'Reserved8' : [ 0x37c, ['unsigned long']], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_1080' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_1080']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1098' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109a' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_1098']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], + 'RaceDll' : [ 0x20, ['pointer64', ['void']]], + 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], + 'u' : [ 0x38, ['__unnamed_109a']], + 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x40, ['unsigned long']], +} ], + '_TEB' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], + 'ClientId' : [ 0x40, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], + 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['pointer64', ['void']]]], + 'SystemReserved1' : [ 0x190, ['array', 38, ['pointer64', ['void']]]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], + 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], + 'glSection' : [ 0x1230, ['pointer64', ['void']]], + 'glTable' : [ 0x1238, ['pointer64', ['void']]], + 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], + 'glContext' : [ 0x1248, ['pointer64', ['void']]], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], + 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], + 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], + 'Vdm' : [ 0x1690, ['pointer64', ['void']]], + 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], + 'PerflibData' : [ 0x1728, ['pointer64', ['void']]], + 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], + 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], + 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], + 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], + 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], + 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], + 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], + 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], + 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], + 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], + 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], + 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], + 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], + 'ReservedForWdf' : [ 0x1818, ['pointer64', ['void']]], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_LIST_ENTRY' : [ 0x10, { + 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x8, { + 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0x18, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { + 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'CurEntry' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer64', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '__unnamed_1108' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1108']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '_RTL_BITMAP' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS64' : [ 0x108, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_RB_TREE' : [ 0x10, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0x18, { + 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_AVL_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x6a80, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], + 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], + 'UserRsp' : [ 0x10, ['unsigned long long']], + 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], + 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], + 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Used_Self' : [ 0x30, ['pointer64', ['void']]], + 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], + 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'Irql' : [ 0x50, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], + 'ObsoleteNumber' : [ 0x52, ['unsigned char']], + 'Fill0' : [ 0x53, ['unsigned char']], + 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], + 'MajorVersion' : [ 0x60, ['unsigned short']], + 'MinorVersion' : [ 0x62, ['unsigned short']], + 'StallScaleFactor' : [ 0x64, ['unsigned long']], + 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], + 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], + 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], + 'Unused2' : [ 0x100, ['unsigned long']], + 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], + 'Unused3' : [ 0x110, ['pointer64', ['void']]], + 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], + 'Prcb' : [ 0x180, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x6900, { + 'MxCsr' : [ 0x0, ['unsigned long']], + 'LegacyNumber' : [ 0x4, ['unsigned char']], + 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], + 'InterruptRequest' : [ 0x6, ['unsigned char']], + 'IdleHalt' : [ 0x7, ['unsigned char']], + 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NestingLevel' : [ 0x20, ['unsigned char']], + 'ClockOwner' : [ 0x21, ['unsigned char']], + 'PendingTickFlags' : [ 0x22, ['unsigned char']], + 'PendingTick' : [ 0x22, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x22, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IdleState' : [ 0x23, ['unsigned char']], + 'Number' : [ 0x24, ['unsigned long']], + 'RspBase' : [ 0x28, ['unsigned long long']], + 'PrcbLock' : [ 0x30, ['unsigned long long']], + 'PriorityState' : [ 0x38, ['pointer64', ['unsigned char']]], + 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], + 'CpuType' : [ 0x5f0, ['unsigned char']], + 'CpuID' : [ 0x5f1, ['unsigned char']], + 'CpuStep' : [ 0x5f2, ['unsigned short']], + 'CpuStepping' : [ 0x5f2, ['unsigned char']], + 'CpuModel' : [ 0x5f3, ['unsigned char']], + 'MHz' : [ 0x5f4, ['unsigned long']], + 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], + 'MinorVersion' : [ 0x638, ['unsigned short']], + 'MajorVersion' : [ 0x63a, ['unsigned short']], + 'BuildType' : [ 0x63c, ['unsigned char']], + 'CpuVendor' : [ 0x63d, ['unsigned char']], + 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], + 'ParentNode' : [ 0x640, ['pointer64', ['_KNODE']]], + 'GroupSetMember' : [ 0x648, ['unsigned long long']], + 'Group' : [ 0x650, ['unsigned char']], + 'GroupIndex' : [ 0x651, ['unsigned char']], + 'PrcbPad05' : [ 0x652, ['array', 2, ['unsigned char']]], + 'InitialApicId' : [ 0x654, ['unsigned long']], + 'ScbOffset' : [ 0x658, ['unsigned long']], + 'ApicMask' : [ 0x65c, ['unsigned long']], + 'AcpiReserved' : [ 0x660, ['pointer64', ['void']]], + 'CFlushSize' : [ 0x668, ['unsigned long']], + 'PrcbPad10' : [ 0x66c, ['unsigned long']], + 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x2080, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PrcbPad20' : [ 0x2c80, ['unsigned long long']], + 'DeferredReadyListHead' : [ 0x2c88, ['_SINGLE_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x2c90, ['long']], + 'MmCopyOnWriteCount' : [ 0x2c94, ['long']], + 'MmTransitionCount' : [ 0x2c98, ['long']], + 'MmDemandZeroCount' : [ 0x2c9c, ['long']], + 'MmPageReadCount' : [ 0x2ca0, ['long']], + 'MmPageReadIoCount' : [ 0x2ca4, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x2ca8, ['long']], + 'MmDirtyWriteIoCount' : [ 0x2cac, ['long']], + 'MmMappedPagesWriteCount' : [ 0x2cb0, ['long']], + 'MmMappedWriteIoCount' : [ 0x2cb4, ['long']], + 'KeSystemCalls' : [ 0x2cb8, ['unsigned long']], + 'KeContextSwitches' : [ 0x2cbc, ['unsigned long']], + 'LdtSelector' : [ 0x2cc0, ['unsigned short']], + 'PrcbPad40' : [ 0x2cc2, ['unsigned short']], + 'CcFastReadNoWait' : [ 0x2cc4, ['unsigned long']], + 'CcFastReadWait' : [ 0x2cc8, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x2ccc, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x2cd0, ['unsigned long']], + 'CcCopyReadWait' : [ 0x2cd4, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x2cd8, ['unsigned long']], + 'IoReadOperationCount' : [ 0x2cdc, ['long']], + 'IoWriteOperationCount' : [ 0x2ce0, ['long']], + 'IoOtherOperationCount' : [ 0x2ce4, ['long']], + 'IoReadTransferCount' : [ 0x2ce8, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x2cf0, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x2cf8, ['_LARGE_INTEGER']], + 'PacketBarrier' : [ 0x2d00, ['long']], + 'TargetCount' : [ 0x2d04, ['long']], + 'IpiFrozen' : [ 0x2d08, ['unsigned long']], + 'IsrDpcStats' : [ 0x2d10, ['pointer64', ['void']]], + 'DeviceInterrupts' : [ 0x2d18, ['unsigned long']], + 'LookasideIrpFloat' : [ 0x2d1c, ['long']], + 'InterruptLastCount' : [ 0x2d20, ['unsigned long']], + 'InterruptRate' : [ 0x2d24, ['unsigned long']], + 'PrcbPad41' : [ 0x2d28, ['array', 22, ['unsigned long']]], + 'DpcData' : [ 0x2d80, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2dd0, ['pointer64', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2dd8, ['long']], + 'DpcRequestRate' : [ 0x2ddc, ['unsigned long']], + 'MinimumDpcRate' : [ 0x2de0, ['unsigned long']], + 'DpcLastCount' : [ 0x2de4, ['unsigned long']], + 'ThreadDpcEnable' : [ 0x2de8, ['unsigned char']], + 'QuantumEnd' : [ 0x2de9, ['unsigned char']], + 'DpcRoutineActive' : [ 0x2dea, ['unsigned char']], + 'IdleSchedule' : [ 0x2deb, ['unsigned char']], + 'DpcRequestSummary' : [ 0x2dec, ['long']], + 'DpcRequestSlot' : [ 0x2dec, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x2dec, ['short']], + 'ThreadDpcState' : [ 0x2dee, ['short']], + 'DpcNormalProcessingActive' : [ 0x2dec, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x2dec, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x2dec, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x2dec, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x2dec, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x2dec, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x2dec, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x2dec, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x2dec, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x2dec, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2df0, ['unsigned long']], + 'LastTick' : [ 0x2df4, ['unsigned long']], + 'ClockInterrupts' : [ 0x2df8, ['unsigned long']], + 'ReadyScanTick' : [ 0x2dfc, ['unsigned long']], + 'InterruptObject' : [ 0x2e00, ['array', 256, ['pointer64', ['void']]]], + 'TimerTable' : [ 0x3600, ['_KTIMER_TABLE']], + 'DpcGate' : [ 0x5800, ['_KGATE']], + 'PrcbPad52' : [ 0x5818, ['pointer64', ['void']]], + 'CallDpc' : [ 0x5820, ['_KDPC']], + 'ClockKeepAlive' : [ 0x5860, ['long']], + 'PrcbPad60' : [ 0x5864, ['array', 2, ['unsigned char']]], + 'NmiActive' : [ 0x5866, ['unsigned short']], + 'DpcWatchdogPeriod' : [ 0x5868, ['long']], + 'DpcWatchdogCount' : [ 0x586c, ['long']], + 'KeSpinLockOrdering' : [ 0x5870, ['long']], + 'PrcbPad70' : [ 0x5874, ['array', 1, ['unsigned long']]], + 'CachedPtes' : [ 0x5878, ['pointer64', ['void']]], + 'WaitListHead' : [ 0x5880, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x5890, ['unsigned long long']], + 'ReadySummary' : [ 0x5898, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x589c, ['long']], + 'QueueIndex' : [ 0x58a0, ['unsigned long']], + 'PrcbPad75' : [ 0x58a4, ['array', 3, ['unsigned long']]], + 'TimerExpirationDpc' : [ 0x58b0, ['_KDPC']], + 'ScbQueue' : [ 0x58f0, ['_RTL_RB_TREE']], + 'DispatcherReadyListHead' : [ 0x5900, ['array', 32, ['_LIST_ENTRY']]], + 'InterruptCount' : [ 0x5b00, ['unsigned long']], + 'KernelTime' : [ 0x5b04, ['unsigned long']], + 'UserTime' : [ 0x5b08, ['unsigned long']], + 'DpcTime' : [ 0x5b0c, ['unsigned long']], + 'InterruptTime' : [ 0x5b10, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x5b14, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x5b18, ['unsigned char']], + 'GroupSchedulingOverQuota' : [ 0x5b19, ['unsigned char']], + 'DeepSleep' : [ 0x5b1a, ['unsigned char']], + 'PrcbPad80' : [ 0x5b1b, ['array', 5, ['unsigned char']]], + 'DpcTimeCount' : [ 0x5b20, ['unsigned long']], + 'DpcTimeLimit' : [ 0x5b24, ['unsigned long']], + 'PeriodicCount' : [ 0x5b28, ['unsigned long']], + 'PeriodicBias' : [ 0x5b2c, ['unsigned long']], + 'AvailableTime' : [ 0x5b30, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x5b34, ['unsigned long']], + 'StartCycles' : [ 0x5b38, ['unsigned long long']], + 'TaggedCyclesStart' : [ 0x5b40, ['unsigned long long']], + 'TaggedCycles' : [ 0x5b48, ['array', 2, ['unsigned long long']]], + 'GenerationTarget' : [ 0x5b58, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x5b60, ['unsigned long long']], + 'PrcbPad81' : [ 0x5b68, ['array', 29, ['unsigned long']]], + 'MmSpinLockOrdering' : [ 0x5bdc, ['long']], + 'PageColor' : [ 0x5be0, ['unsigned long']], + 'NodeColor' : [ 0x5be4, ['unsigned long']], + 'NodeShiftedColor' : [ 0x5be8, ['unsigned long']], + 'SecondaryColorMask' : [ 0x5bec, ['unsigned long']], + 'PrcbPad83' : [ 0x5bf0, ['unsigned long']], + 'CycleTime' : [ 0x5bf8, ['unsigned long long']], + 'Cycles' : [ 0x5c00, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'PrcbPad84' : [ 0x5c40, ['array', 16, ['unsigned long']]], + 'CcFastMdlReadNoWait' : [ 0x5c80, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x5c84, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x5c88, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x5c8c, ['unsigned long']], + 'CcMapDataWait' : [ 0x5c90, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x5c94, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x5c98, ['unsigned long']], + 'CcPinReadWait' : [ 0x5c9c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x5ca0, ['unsigned long']], + 'CcMdlReadWait' : [ 0x5ca4, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x5ca8, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x5cac, ['unsigned long']], + 'CcLazyWritePages' : [ 0x5cb0, ['unsigned long']], + 'CcDataFlushes' : [ 0x5cb4, ['unsigned long']], + 'CcDataPages' : [ 0x5cb8, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x5cbc, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x5cc0, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x5cc4, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x5cc8, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x5ccc, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x5cd0, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x5cd4, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x5cd8, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x5cdc, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x5ce0, ['unsigned long']], + 'CcReadAheadIos' : [ 0x5ce4, ['unsigned long']], + 'MmCacheTransitionCount' : [ 0x5ce8, ['long']], + 'MmCacheReadCount' : [ 0x5cec, ['long']], + 'MmCacheIoCount' : [ 0x5cf0, ['long']], + 'PrcbPad91' : [ 0x5cf4, ['array', 3, ['unsigned long']]], + 'PowerState' : [ 0x5d00, ['_PROCESSOR_POWER_STATE']], + 'ScbList' : [ 0x5ed0, ['_LIST_ENTRY']], + 'PrcbPad92' : [ 0x5ee0, ['array', 7, ['unsigned long']]], + 'KeAlignmentFixupCount' : [ 0x5efc, ['unsigned long']], + 'DpcWatchdogDpc' : [ 0x5f00, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x5f40, ['_KTIMER']], + 'Cache' : [ 0x5f80, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x5fbc, ['unsigned long']], + 'CachedCommit' : [ 0x5fc0, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x5fc4, ['unsigned long']], + 'HyperPte' : [ 0x5fc8, ['pointer64', ['void']]], + 'WheaInfo' : [ 0x5fd0, ['pointer64', ['void']]], + 'EtwSupport' : [ 0x5fd8, ['pointer64', ['void']]], + 'InterruptObjectPool' : [ 0x5fe0, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x5ff0, ['_SLIST_HEADER']], + 'HypercallCachedPages' : [ 0x6000, ['pointer64', ['void']]], + 'VirtualApicAssist' : [ 0x6008, ['pointer64', ['void']]], + 'StatisticsPage' : [ 0x6010, ['pointer64', ['unsigned long long']]], + 'PackageProcessorSet' : [ 0x6018, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x60c0, ['unsigned long long']], + 'SharedReadyQueue' : [ 0x60c8, ['pointer64', ['_KSHARED_READY_QUEUE']]], + 'SharedQueueScanOwner' : [ 0x60d0, ['unsigned long']], + 'ScanSiblingIndex' : [ 0x60d4, ['unsigned long']], + 'CoreProcessorSet' : [ 0x60d8, ['unsigned long long']], + 'ScanSiblingMask' : [ 0x60e0, ['unsigned long long']], + 'LLCMask' : [ 0x60e8, ['unsigned long long']], + 'CacheProcessorMask' : [ 0x60f0, ['array', 5, ['unsigned long long']]], + 'ProcessorProfileControlArea' : [ 0x6118, ['pointer64', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x6120, ['pointer64', ['void']]], + 'PrcbPad94' : [ 0x6128, ['array', 11, ['unsigned long long']]], + 'SynchCounters' : [ 0x6180, ['_SYNCH_COUNTERS']], + 'PteBitCache' : [ 0x6238, ['unsigned long long']], + 'PteBitOffset' : [ 0x6240, ['unsigned long']], + 'FsCounters' : [ 0x6248, ['_FILESYSTEM_DISK_COUNTERS']], + 'VendorString' : [ 0x6258, ['array', 13, ['unsigned char']]], + 'PrcbPad100' : [ 0x6265, ['array', 3, ['unsigned char']]], + 'FeatureBits' : [ 0x6268, ['unsigned long long']], + 'PrcbPad110' : [ 0x6270, ['unsigned long']], + 'UpdateSignature' : [ 0x6278, ['_LARGE_INTEGER']], + 'Context' : [ 0x6280, ['pointer64', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x6288, ['unsigned long']], + 'ExtendedState' : [ 0x6290, ['pointer64', ['_XSAVE_AREA']]], + 'IsrStack' : [ 0x6298, ['pointer64', ['void']]], + 'EntropyTimingState' : [ 0x62a0, ['_KENTROPY_TIMING_STATE']], + 'AbSelfIoBoostsList' : [ 0x63f0, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x63f8, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x6400, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x6440, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x6494, ['_IOP_IRP_STACK_PROFILER']], + 'LocalSharedReadyQueue' : [ 0x6500, ['_KSHARED_READY_QUEUE']], + 'TimerExpirationTrace' : [ 0x6760, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x6860, ['unsigned long']], + 'ExSaPageArray' : [ 0x6868, ['pointer64', ['void']]], + 'Mailbox' : [ 0x6880, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestMailbox' : [ 0x68c0, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KFLOATING_SAVE' : [ 0x4, { + 'Dummy' : [ 0x0, ['unsigned long']], +} ], + '_SINGLE_LIST_ENTRY32' : [ 0x4, { + 'Next' : [ 0x0, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { + 'TrustletIdentity' : [ 0x0, ['unsigned long long']], + 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { + 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], + 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { + 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], + 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { + 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { + 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_KPROCESS' : [ 0x2d8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x40, ['unsigned long']], + 'Spare0' : [ 0x44, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x48, ['unsigned long long']], + 'Affinity' : [ 0x50, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0xf8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x110, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x1b8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x1b8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x1b8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'DeepFreeze' : [ 0x1b8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x1b8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x1b8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SpareFlags0' : [ 0x1b8, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x1b8, ['BitField', dict(start_bit = 8, end_bit = 28, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x1b8, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x1b8, ['long']], + 'BasePriority' : [ 0x1bc, ['unsigned char']], + 'QuantumReset' : [ 0x1bd, ['unsigned char']], + 'Visited' : [ 0x1be, ['unsigned char']], + 'Flags' : [ 0x1bf, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x1c0, ['array', 20, ['unsigned long']]], + 'IdealNode' : [ 0x210, ['array', 20, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x238, ['unsigned short']], + 'Spare1' : [ 0x23a, ['unsigned short']], + 'StackCount' : [ 0x23c, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x240, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x250, ['unsigned long long']], + 'ContextSwitches' : [ 0x258, ['unsigned long long']], + 'SchedulingGroup' : [ 0x260, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'FreezeCount' : [ 0x268, ['unsigned long']], + 'KernelTime' : [ 0x26c, ['unsigned long']], + 'UserTime' : [ 0x270, ['unsigned long']], + 'LdtFreeSelectorHint' : [ 0x274, ['unsigned short']], + 'LdtTableLength' : [ 0x276, ['unsigned short']], + 'LdtSystemDescriptor' : [ 0x278, ['_KGDTENTRY64']], + 'LdtBaseAddress' : [ 0x288, ['pointer64', ['void']]], + 'LdtProcessLock' : [ 0x290, ['_FAST_MUTEX']], + 'InstrumentationCallback' : [ 0x2c8, ['pointer64', ['void']]], + 'SecurePid' : [ 0x2d0, ['unsigned long long']], +} ], + '_KTHREAD' : [ 0x5d8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x18, ['pointer64', ['void']]], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer64', ['void']]], + 'StackLimit' : [ 0x30, ['pointer64', ['void']]], + 'StackBase' : [ 0x38, ['pointer64', ['void']]], + 'ThreadLock' : [ 0x40, ['unsigned long long']], + 'CycleTime' : [ 0x48, ['unsigned long long']], + 'CurrentRunTime' : [ 0x50, ['unsigned long']], + 'ExpectedRunTime' : [ 0x54, ['unsigned long']], + 'KernelStack' : [ 0x58, ['pointer64', ['void']]], + 'StateSaveArea' : [ 0x60, ['pointer64', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x68, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x70, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x71, ['unsigned char']], + 'Alerted' : [ 0x72, ['array', 2, ['unsigned char']]], + 'AutoBoostActive' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitNext' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x74, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Alertable' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'TimerActive' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SystemThread' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x74, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CalloutActive' : [ 0x74, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x74, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x74, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x74, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x74, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x74, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SuspendSchedulerApcWait' : [ 0x74, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x74, ['long']], + 'AutoAlignment' : [ 0x78, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x78, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ThreadFlagsSpare0' : [ 0x78, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x78, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x78, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x78, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x78, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x78, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x78, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x78, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x78, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x78, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x78, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x78, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x78, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CommitFailTerminateRequest' : [ 0x78, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ProcessStackCountDecremented' : [ 0x78, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ThreadFlagsSpare' : [ 0x78, ['BitField', dict(start_bit = 19, end_bit = 24, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x78, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x78, ['long']], + 'Tag' : [ 0x7c, ['unsigned char']], + 'SystemHeteroCpuPolicy' : [ 0x7d, ['unsigned char']], + 'UserHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], + 'ExplicitSystemHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare0' : [ 0x7f, ['unsigned char']], + 'SystemCallNumber' : [ 0x80, ['unsigned long']], + 'Spare10' : [ 0x84, ['unsigned long']], + 'FirstArgument' : [ 0x88, ['pointer64', ['void']]], + 'TrapFrame' : [ 0x90, ['pointer64', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x98, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x98, ['array', 43, ['unsigned char']]], + 'Priority' : [ 0xc3, ['unsigned char']], + 'UserIdealProcessor' : [ 0xc4, ['unsigned long']], + 'WaitStatus' : [ 0xc8, ['long long']], + 'WaitBlockList' : [ 0xd0, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0xd8, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xe8, ['pointer64', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xf0, ['pointer64', ['void']]], + 'RelativeTimerBias' : [ 0xf8, ['unsigned long long']], + 'Timer' : [ 0x100, ['_KTIMER']], + 'WaitBlock' : [ 0x140, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill4' : [ 0x140, ['array', 20, ['unsigned char']]], + 'ContextSwitches' : [ 0x154, ['unsigned long']], + 'WaitBlockFill5' : [ 0x140, ['array', 68, ['unsigned char']]], + 'State' : [ 0x184, ['unsigned char']], + 'Spare13' : [ 0x185, ['unsigned char']], + 'WaitIrql' : [ 0x186, ['unsigned char']], + 'WaitMode' : [ 0x187, ['unsigned char']], + 'WaitBlockFill6' : [ 0x140, ['array', 116, ['unsigned char']]], + 'WaitTime' : [ 0x1b4, ['unsigned long']], + 'WaitBlockFill7' : [ 0x140, ['array', 164, ['unsigned char']]], + 'KernelApcDisable' : [ 0x1e4, ['short']], + 'SpecialApcDisable' : [ 0x1e6, ['short']], + 'CombinedApcDisable' : [ 0x1e4, ['unsigned long']], + 'WaitBlockFill8' : [ 0x140, ['array', 40, ['unsigned char']]], + 'ThreadCounters' : [ 0x168, ['pointer64', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0x140, ['array', 88, ['unsigned char']]], + 'XStateSave' : [ 0x198, ['pointer64', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0x140, ['array', 136, ['unsigned char']]], + 'Win32Thread' : [ 0x1c8, ['pointer64', ['void']]], + 'WaitBlockFill11' : [ 0x140, ['array', 176, ['unsigned char']]], + 'Ucb' : [ 0x1f0, ['pointer64', ['_UMS_CONTROL_BLOCK']]], + 'Uch' : [ 0x1f8, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], + 'TebMappedLowVa' : [ 0x200, ['pointer64', ['void']]], + 'QueueListEntry' : [ 0x208, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x218, ['unsigned long']], + 'NextProcessorNumber' : [ 0x218, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x218, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x21c, ['long']], + 'Process' : [ 0x220, ['pointer64', ['_KPROCESS']]], + 'UserAffinity' : [ 0x228, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x228, ['array', 10, ['unsigned char']]], + 'PreviousMode' : [ 0x232, ['unsigned char']], + 'BasePriority' : [ 0x233, ['unsigned char']], + 'PriorityDecrement' : [ 0x234, ['unsigned char']], + 'ForegroundBoost' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x235, ['unsigned char']], + 'AdjustReason' : [ 0x236, ['unsigned char']], + 'AdjustIncrement' : [ 0x237, ['unsigned char']], + 'AffinityVersion' : [ 0x238, ['unsigned long long']], + 'Affinity' : [ 0x240, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x240, ['array', 10, ['unsigned char']]], + 'ApcStateIndex' : [ 0x24a, ['unsigned char']], + 'WaitBlockCount' : [ 0x24b, ['unsigned char']], + 'IdealProcessor' : [ 0x24c, ['unsigned long']], + 'NpxState' : [ 0x250, ['unsigned long long']], + 'SavedApcState' : [ 0x258, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x258, ['array', 43, ['unsigned char']]], + 'WaitReason' : [ 0x283, ['unsigned char']], + 'SuspendCount' : [ 0x284, ['unsigned char']], + 'Saturation' : [ 0x285, ['unsigned char']], + 'SListFaultCount' : [ 0x286, ['unsigned short']], + 'SchedulerApc' : [ 0x288, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x288, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x289, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x288, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x28b, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x288, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x28c, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x288, ['array', 64, ['unsigned char']]], + 'WaitPrcb' : [ 0x2c8, ['pointer64', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x288, ['array', 72, ['unsigned char']]], + 'LegoData' : [ 0x2d0, ['pointer64', ['void']]], + 'SchedulerApcFill5' : [ 0x288, ['array', 83, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x2db, ['unsigned char']], + 'UserTime' : [ 0x2dc, ['unsigned long']], + 'SuspendEvent' : [ 0x2e0, ['_KEVENT']], + 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], + 'AbEntrySummary' : [ 0x318, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x319, ['unsigned char']], + 'Spare20' : [ 0x31a, ['unsigned short']], + 'SecureThreadCookie' : [ 0x31c, ['unsigned long']], + 'LockEntries' : [ 0x320, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x560, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x568, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x570, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x580, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x584, ['long']], + 'KeReferenceCount' : [ 0x588, ['short']], + 'AbOrphanedEntrySummary' : [ 0x58a, ['unsigned char']], + 'AbOwnedEntryCount' : [ 0x58b, ['unsigned char']], + 'ForegroundLossTime' : [ 0x58c, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x590, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x590, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x598, ['unsigned long long']], + 'ReadOperationCount' : [ 0x5a0, ['long long']], + 'WriteOperationCount' : [ 0x5a8, ['long long']], + 'OtherOperationCount' : [ 0x5b0, ['long long']], + 'ReadTransferCount' : [ 0x5b8, ['long long']], + 'WriteTransferCount' : [ 0x5c0, ['long long']], + 'OtherTransferCount' : [ 0x5c8, ['long long']], + 'QueuedScb' : [ 0x5d0, ['pointer64', ['_KSCB']]], +} ], + '_KSTACK_CONTROL' : [ 0x30, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'ActualLimit' : [ 0x8, ['unsigned long long']], + 'StackExpansion' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_FAST_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'OldIrql' : [ 0x30, ['unsigned long']], +} ], + '_KEVENT' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '__unnamed_1269' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SLIST_HEADER' : [ 0x10, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Region' : [ 0x8, ['unsigned long long']], + 'HeaderX64' : [ 0x0, ['__unnamed_1269']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x60, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_SLIST_ENTRY' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_IO_STATUS_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer64', ['void']]], + 'Information' : [ 0x8, ['unsigned long long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x20, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Parameter' : [ 0x18, ['pointer64', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer64', ['void']]], + 'DeleteContext' : [ 0x10, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x10, { + 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0x100, { + 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long long']], + 'IdleSmtSet' : [ 0x8, ['unsigned long long']], + 'IdleCpuSet' : [ 0x10, ['unsigned long long']], + 'DeepIdleSet' : [ 0x40, ['unsigned long long']], + 'IdleConstrainedSet' : [ 0x48, ['unsigned long long']], + 'NonParkedSet' : [ 0x50, ['unsigned long long']], + 'ParkLock' : [ 0x58, ['long']], + 'Seed' : [ 0x5c, ['unsigned long']], + 'SiblingMask' : [ 0x80, ['unsigned long']], + 'Affinity' : [ 0x88, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x88, ['array', 10, ['unsigned char']]], + 'NodeNumber' : [ 0x92, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x94, ['unsigned short']], + 'Stride' : [ 0x96, ['unsigned char']], + 'Spare0' : [ 0x97, ['unsigned char']], + 'SharedReadyQueueLeaders' : [ 0x98, ['unsigned long long']], + 'ProximityId' : [ 0xa0, ['unsigned long']], + 'Lowest' : [ 0xa4, ['unsigned long']], + 'Highest' : [ 0xa8, ['unsigned long']], + 'MaximumProcessors' : [ 0xac, ['unsigned char']], + 'Flags' : [ 0xad, ['_flags']], + 'Spare10' : [ 0xae, ['unsigned char']], + 'HeteroSets' : [ 0xb0, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], +} ], + '_ENODE' : [ 0x540, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0x100, ['array', 8, ['pointer64', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x140, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x410, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x428, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x468, ['_KEVENT']], + 'WaitBlocks' : [ 0x480, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x510, ['pointer64', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x518, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x51c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x51c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x51c, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x80, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long long']], + 'QuotaProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'HandleTableList' : [ 0x18, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'StrictFIFO' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x2c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x2c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x2c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x38, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x40, ['array', 32, ['unsigned char']]], + 'DebugInfo' : [ 0x60, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x10, { + 'VolatileLowValue' : [ 0x0, ['long long']], + 'LowValue' : [ 0x0, ['long long']], + 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'HighValue' : [ 0x8, ['long long']], + 'NextFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x8, ['_EXHANDLE']], + 'RefCountField' : [ 0x0, ['long long']], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 17, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 20, native_type='unsigned long long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 64, native_type='unsigned long long')]], + 'GrantedAccessBits' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Spare1' : [ 0x8, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], + 'Spare2' : [ 0xc, ['unsigned long']], +} ], + '_EX_FAST_REF' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_135c' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0xa0, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'AuxData' : [ 0x48, ['pointer64', ['void']]], + 'Privileges' : [ 0x50, ['__unnamed_135c']], + 'AuditPrivileges' : [ 0x7c, ['unsigned char']], + 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xe0, { + 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x18, ['unsigned long']], + 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], + 'TransactionId' : [ 0x20, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], + 'SDLock' : [ 0x50, ['pointer64', ['void']]], + 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xd8, ['unsigned char']], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x788, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x2d8, ['_EX_PUSH_LOCK']], + 'RundownProtect' : [ 0x2e0, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0x2e8, ['pointer64', ['void']]], + 'ActiveProcessLinks' : [ 0x2f0, ['_LIST_ENTRY']], + 'Flags2' : [ 0x300, ['unsigned long']], + 'JobNotReallyActive' : [ 0x300, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x300, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x300, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x300, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x300, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x300, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0x300, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x300, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x300, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x300, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0x300, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0x300, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x300, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x300, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x300, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x300, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x300, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x300, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x300, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x300, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0x300, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x300, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0x300, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0x300, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x300, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0x300, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0x300, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0x300, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0x304, ['unsigned long']], + 'CreateReported' : [ 0x304, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x304, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x304, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x304, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0x304, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x304, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x304, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x304, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FailFastOnCommitFail' : [ 0x304, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x304, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x304, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x304, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x304, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x304, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x304, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x304, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x304, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0x304, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x304, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x304, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x304, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x304, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0x304, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x304, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x304, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x304, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x304, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CreateTime' : [ 0x308, ['_LARGE_INTEGER']], + 'ProcessQuotaUsage' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'ProcessQuotaPeak' : [ 0x320, ['array', 2, ['unsigned long long']]], + 'PeakVirtualSize' : [ 0x330, ['unsigned long long']], + 'VirtualSize' : [ 0x338, ['unsigned long long']], + 'SessionProcessLinks' : [ 0x340, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0x350, ['pointer64', ['void']]], + 'ExceptionPortValue' : [ 0x350, ['unsigned long long']], + 'ExceptionPortState' : [ 0x350, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Token' : [ 0x358, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0x360, ['unsigned long long']], + 'AddressCreationLock' : [ 0x368, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x370, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x378, ['pointer64', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x380, ['pointer64', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x388, ['pointer64', ['_EJOB']]], + 'CloneRoot' : [ 0x390, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x398, ['unsigned long long']], + 'NumberOfLockedPages' : [ 0x3a0, ['unsigned long long']], + 'Win32Process' : [ 0x3a8, ['pointer64', ['void']]], + 'Job' : [ 0x3b0, ['pointer64', ['_EJOB']]], + 'SectionObject' : [ 0x3b8, ['pointer64', ['void']]], + 'SectionBaseAddress' : [ 0x3c0, ['pointer64', ['void']]], + 'Cookie' : [ 0x3c8, ['unsigned long']], + 'WorkingSetWatch' : [ 0x3d0, ['pointer64', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x3d8, ['pointer64', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x3e0, ['pointer64', ['void']]], + 'LdtInformation' : [ 0x3e8, ['pointer64', ['void']]], + 'OwnerProcessId' : [ 0x3f0, ['unsigned long long']], + 'Peb' : [ 0x3f8, ['pointer64', ['_PEB']]], + 'Session' : [ 0x400, ['pointer64', ['void']]], + 'AweInfo' : [ 0x408, ['pointer64', ['void']]], + 'QuotaBlock' : [ 0x410, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x418, ['pointer64', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x420, ['pointer64', ['void']]], + 'WoW64Process' : [ 0x428, ['pointer64', ['_EWOW64PROCESS']]], + 'DeviceMap' : [ 0x430, ['pointer64', ['void']]], + 'EtwDataSource' : [ 0x438, ['pointer64', ['void']]], + 'PageDirectoryPte' : [ 0x440, ['unsigned long long']], + 'ImageFilePointer' : [ 0x448, ['pointer64', ['_FILE_OBJECT']]], + 'ImageFileName' : [ 0x450, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x45f, ['unsigned char']], + 'SecurityPort' : [ 0x460, ['pointer64', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x468, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x470, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x480, ['pointer64', ['void']]], + 'ThreadListHead' : [ 0x488, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x498, ['unsigned long']], + 'ImagePathHash' : [ 0x49c, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x4a0, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x4a4, ['long']], + 'PrefetchTrace' : [ 0x4a8, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x4b0, ['pointer64', ['void']]], + 'ReadOperationCount' : [ 0x4b8, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x4c0, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x4c8, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x4d0, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x4d8, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x4e0, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x4e8, ['unsigned long long']], + 'CommitCharge' : [ 0x4f0, ['unsigned long long']], + 'CommitChargePeak' : [ 0x4f8, ['unsigned long long']], + 'Vm' : [ 0x500, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x5f8, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x608, ['unsigned long']], + 'ExitStatus' : [ 0x60c, ['long']], + 'VadRoot' : [ 0x610, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x618, ['pointer64', ['void']]], + 'VadCount' : [ 0x620, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x628, ['unsigned long long']], + 'VadPhysicalPagesLimit' : [ 0x630, ['unsigned long long']], + 'AlpcContext' : [ 0x638, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x658, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x668, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x670, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x674, ['unsigned long']], + 'ExitTime' : [ 0x678, ['_LARGE_INTEGER']], + 'InvertedFunctionTable' : [ 0x680, ['pointer64', ['_INVERTED_FUNCTION_TABLE']]], + 'InvertedFunctionTableLock' : [ 0x688, ['_EX_PUSH_LOCK']], + 'ActiveThreadsHighWatermark' : [ 0x690, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x694, ['unsigned long']], + 'ThreadListLock' : [ 0x698, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x6a0, ['pointer64', ['void']]], + 'Spare0' : [ 0x6a8, ['unsigned long long']], + 'SignatureLevel' : [ 0x6b0, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x6b1, ['unsigned char']], + 'Protection' : [ 0x6b2, ['_PS_PROTECTION']], + 'HangCount' : [ 0x6b3, ['unsigned char']], + 'Flags3' : [ 0x6b4, ['unsigned long']], + 'Minimal' : [ 0x6b4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReplacingPageRoot' : [ 0x6b4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DisableNonSystemFonts' : [ 0x6b4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AuditNonSystemFontLoading' : [ 0x6b4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Crashed' : [ 0x6b4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'JobVadsAreTracked' : [ 0x6b4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'VadTrackingDisabled' : [ 0x6b4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AuxiliaryProcess' : [ 0x6b4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SubsystemProcess' : [ 0x6b4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6b4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'InPrivate' : [ 0x6b4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProhibitRemoteImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProhibitLowILImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SignatureMitigationOptIn' : [ 0x6b4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeviceAsid' : [ 0x6b8, ['long']], + 'SvmData' : [ 0x6c0, ['pointer64', ['void']]], + 'SvmProcessLock' : [ 0x6c8, ['_EX_PUSH_LOCK']], + 'SvmLock' : [ 0x6d0, ['unsigned long long']], + 'SvmProcessDeviceListHead' : [ 0x6d8, ['_LIST_ENTRY']], + 'LastFreezeInterruptTime' : [ 0x6e8, ['unsigned long long']], + 'DiskCounters' : [ 0x6f0, ['pointer64', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x6f8, ['pointer64', ['void']]], + 'TrustletIdentity' : [ 0x700, ['unsigned long long']], + 'KeepAliveCounter' : [ 0x708, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x70c, ['unsigned long']], + 'HighPriorityFaultsAllowed' : [ 0x710, ['unsigned long']], + 'EnergyValues' : [ 0x718, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'VmContext' : [ 0x720, ['pointer64', ['void']]], + 'SequenceNumber' : [ 0x728, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x730, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x738, ['unsigned long long']], + 'TotalUnbiasedFrozenTime' : [ 0x740, ['unsigned long long']], + 'LastAppStateUpdateTime' : [ 0x748, ['unsigned long long']], + 'LastAppStateUptime' : [ 0x750, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'LastAppState' : [ 0x750, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SharedCommitCharge' : [ 0x758, ['unsigned long long']], + 'SharedCommitLock' : [ 0x760, ['_EX_PUSH_LOCK']], + 'SharedCommitLinks' : [ 0x768, ['_LIST_ENTRY']], + 'AllowedCpuSets' : [ 0x778, ['unsigned long long']], + 'DefaultCpuSets' : [ 0x780, ['unsigned long long']], + 'AllowedCpuSetsIndirect' : [ 0x778, ['pointer64', ['unsigned long long']]], + 'DefaultCpuSetsIndirect' : [ 0x780, ['pointer64', ['unsigned long long']]], +} ], + '_EWOW64PROCESS' : [ 0x10, { + 'Peb' : [ 0x0, ['pointer64', ['void']]], + 'Machine' : [ 0x8, ['unsigned short']], +} ], + '_ETHREAD' : [ 0x7c0, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x5d8, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x5e0, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x5e0, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x5f0, ['pointer64', ['void']]], + 'PostBlockList' : [ 0x5f8, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x5f8, ['pointer64', ['void']]], + 'StartAddress' : [ 0x600, ['pointer64', ['void']]], + 'TerminationPort' : [ 0x608, ['pointer64', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x608, ['pointer64', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x608, ['pointer64', ['void']]], + 'ActiveTimerListLock' : [ 0x610, ['unsigned long long']], + 'ActiveTimerListHead' : [ 0x618, ['_LIST_ENTRY']], + 'Cid' : [ 0x628, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x658, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x660, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x670, ['unsigned long long']], + 'DeviceToVerify' : [ 0x678, ['pointer64', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x680, ['pointer64', ['void']]], + 'LegacyPowerObject' : [ 0x688, ['pointer64', ['void']]], + 'ThreadListEntry' : [ 0x690, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x6a0, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x6a8, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x6b0, ['unsigned long']], + 'MmLockOrdering' : [ 0x6b4, ['long']], + 'CmLockOrdering' : [ 0x6b8, ['long']], + 'CrossThreadFlags' : [ 0x6bc, ['unsigned long']], + 'Terminated' : [ 0x6bc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x6bc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x6bc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x6bc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x6bc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x6bc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x6bc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x6bc, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x6bc, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x6bc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x6bc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6bc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x6bc, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x6c0, ['unsigned long']], + 'ActiveExWorker' : [ 0x6c0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x6c0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'StoreLockThread' : [ 0x6c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x6c0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x6c0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x6c0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'RespectIoPriority' : [ 0x6c0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'ReservedSameThreadPassiveFlags' : [ 0x6c0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x6c4, ['unsigned long']], + 'OwnsProcessAddressSpaceExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x6c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardFaultBehavior' : [ 0x6c4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x6c4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x6c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x6c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Prefetching' : [ 0x6c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x6c5, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x6c5, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x6c8, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x6c9, ['unsigned char']], + 'ActiveFaultCount' : [ 0x6ca, ['unsigned char']], + 'LockOrderState' : [ 0x6cb, ['unsigned char']], + 'AlpcMessageId' : [ 0x6d0, ['unsigned long long']], + 'AlpcMessage' : [ 0x6d8, ['pointer64', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x6d8, ['unsigned long']], + 'ExitStatus' : [ 0x6e0, ['long']], + 'AlpcWaitListEntry' : [ 0x6e8, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x6f8, ['unsigned long']], + 'IoBoostCount' : [ 0x6fc, ['unsigned long']], + 'BoostList' : [ 0x700, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x710, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x720, ['unsigned long long']], + 'IrpListLock' : [ 0x728, ['unsigned long long']], + 'ReservedForSynchTracking' : [ 0x730, ['pointer64', ['void']]], + 'CmCallbackListHead' : [ 0x738, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x740, ['pointer64', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x748, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x750, ['pointer64', ['void']]], + 'KernelStackReference' : [ 0x758, ['unsigned long']], + 'AdjustedClientToken' : [ 0x760, ['pointer64', ['void']]], + 'WorkingOnBehalfClient' : [ 0x768, ['pointer64', ['void']]], + 'PropertySet' : [ 0x770, ['_PS_PROPERTY_SET']], + 'PicoContext' : [ 0x788, ['pointer64', ['void']]], + 'UserFsBase' : [ 0x790, ['unsigned long']], + 'UserGsBase' : [ 0x798, ['unsigned long long']], + 'EnergyValues' : [ 0x7a0, ['pointer64', ['_THREAD_ENERGY_VALUES']]], + 'CmCellReferences' : [ 0x7a8, ['unsigned long']], + 'SelectedCpuSets' : [ 0x7b0, ['unsigned long long']], + 'SelectedCpuSetsIndirect' : [ 0x7b0, ['pointer64', ['unsigned long long']]], + 'Silo' : [ 0x7b8, ['pointer64', ['_EJOB']]], +} ], + '__unnamed_13c5' : [ 0x8, { + 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_13cb' : [ 0x10, { + 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], + 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_13cd' : [ 0x10, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_13cb']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_13d6' : [ 0x58, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], + 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x40, ['unsigned long']], + 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x50, ['pointer64', ['void']]], +} ], + '__unnamed_13d8' : [ 0x58, { + 'Overlay' : [ 0x0, ['__unnamed_13d6']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IRP' : [ 0xd0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'AllocationProcessorNumber' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'AssociatedIrp' : [ 0x18, ['__unnamed_13c5']], + 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x40, ['unsigned char']], + 'PendingReturned' : [ 0x41, ['unsigned char']], + 'StackCount' : [ 0x42, ['unsigned char']], + 'CurrentLocation' : [ 0x43, ['unsigned char']], + 'Cancel' : [ 0x44, ['unsigned char']], + 'CancelIrql' : [ 0x45, ['unsigned char']], + 'ApcEnvironment' : [ 0x46, ['unsigned char']], + 'AllocationFlags' : [ 0x47, ['unsigned char']], + 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Overlay' : [ 0x58, ['__unnamed_13cd']], + 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], + 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], + 'Tail' : [ 0x78, ['__unnamed_13d8']], +} ], + '__unnamed_13df' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'FileAttributes' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'EaLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13e3' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13e7' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13e9' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_13ed' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13ef' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13f1' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], +} ], + '__unnamed_13f3' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0x18, ['unsigned char']], + 'AdvanceOnly' : [ 0x19, ['unsigned char']], + 'ClusterCount' : [ 0x18, ['unsigned long']], + 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13f5' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x8, ['pointer64', ['void']]], + 'EaListLength' : [ 0x10, ['unsigned long']], + 'EaIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13f7' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13fb' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13fd' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'FsControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13ff' : [ 0x18, { + 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1401' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'IoControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1403' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1405' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_1409' : [ 0x10, { + 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_140d' : [ 0x8, { + 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_1411' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x8, ['pointer64', ['void']]], + 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1415' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_1419' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Version' : [ 0xa, ['unsigned short']], + 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_141d' : [ 0x8, { + 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_1421' : [ 0x8, { + 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_1423' : [ 0x20, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['void']]], + 'Offset' : [ 0x10, ['unsigned long']], + 'Length' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1425' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_1429' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_142d' : [ 0x10, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1431' : [ 0x10, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_1435' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_1439' : [ 0x8, { + 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1441' : [ 0x20, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x10, ['_POWER_STATE']], + 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], +} ], + '__unnamed_1445' : [ 0x10, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1447' : [ 0x20, { + 'ProviderId' : [ 0x0, ['unsigned long long']], + 'DataPath' : [ 0x8, ['pointer64', ['void']]], + 'BufferSize' : [ 0x10, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1449' : [ 0x20, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_144b' : [ 0x20, { + 'Create' : [ 0x0, ['__unnamed_13df']], + 'CreatePipe' : [ 0x0, ['__unnamed_13e3']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13e7']], + 'Read' : [ 0x0, ['__unnamed_13e9']], + 'Write' : [ 0x0, ['__unnamed_13e9']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13ed']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13ef']], + 'QueryFile' : [ 0x0, ['__unnamed_13f1']], + 'SetFile' : [ 0x0, ['__unnamed_13f3']], + 'QueryEa' : [ 0x0, ['__unnamed_13f5']], + 'SetEa' : [ 0x0, ['__unnamed_13f7']], + 'QueryVolume' : [ 0x0, ['__unnamed_13fb']], + 'SetVolume' : [ 0x0, ['__unnamed_13fb']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13fd']], + 'LockControl' : [ 0x0, ['__unnamed_13ff']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1401']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1403']], + 'SetSecurity' : [ 0x0, ['__unnamed_1405']], + 'MountVolume' : [ 0x0, ['__unnamed_1409']], + 'VerifyVolume' : [ 0x0, ['__unnamed_1409']], + 'Scsi' : [ 0x0, ['__unnamed_140d']], + 'QueryQuota' : [ 0x0, ['__unnamed_1411']], + 'SetQuota' : [ 0x0, ['__unnamed_13f7']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1415']], + 'QueryInterface' : [ 0x0, ['__unnamed_1419']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_141d']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1421']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1423']], + 'SetLock' : [ 0x0, ['__unnamed_1425']], + 'QueryId' : [ 0x0, ['__unnamed_1429']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_142d']], + 'UsageNotification' : [ 0x0, ['__unnamed_1431']], + 'WaitWake' : [ 0x0, ['__unnamed_1435']], + 'PowerSequence' : [ 0x0, ['__unnamed_1439']], + 'Power' : [ 0x0, ['__unnamed_1441']], + 'StartDevice' : [ 0x0, ['__unnamed_1445']], + 'WMI' : [ 0x0, ['__unnamed_1447']], + 'Others' : [ 0x0, ['__unnamed_1449']], +} ], + '_IO_STACK_LOCATION' : [ 0x48, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x8, ['__unnamed_144b']], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_1461' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], + 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'Characteristics' : [ 0x34, ['unsigned long']], + 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], + 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], + 'DeviceType' : [ 0x48, ['unsigned long']], + 'StackSize' : [ 0x4c, ['unsigned char']], + 'Queue' : [ 0x50, ['__unnamed_1461']], + 'AlignmentRequirement' : [ 0x98, ['unsigned long']], + 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0xc8, ['_KDPC']], + 'ActiveThreadCount' : [ 0x108, ['unsigned long']], + 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], + 'DeviceLock' : [ 0x118, ['_KEVENT']], + 'SectorSize' : [ 0x130, ['unsigned short']], + 'Spare1' : [ 0x132, ['unsigned short']], + 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0x140, ['pointer64', ['void']]], +} ], + '_KDPC' : [ 0x40, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x10, ['unsigned long long']], + 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], + 'DpcData' : [ 0x38, ['pointer64', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x28, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], + 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], + 'SiloContext' : [ 0x20, ['pointer64', ['_EJOB']]], +} ], + '_EJOB' : [ 0x528, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], + 'JobLock' : [ 0x38, ['_ERESOURCE']], + 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0xc0, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0xc8, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0xd0, ['unsigned long']], + 'TotalProcesses' : [ 0xd4, ['unsigned long']], + 'ActiveProcesses' : [ 0xd8, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0xdc, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0xe0, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xf0, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0xf8, ['unsigned long long']], + 'LimitFlags' : [ 0x100, ['unsigned long']], + 'ActiveProcessLimit' : [ 0x104, ['unsigned long']], + 'Affinity' : [ 0x108, ['_KAFFINITY_EX']], + 'AccessState' : [ 0x1b0, ['pointer64', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0x1b8, ['pointer64', ['void']]], + 'UIRestrictionsClass' : [ 0x1c0, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0x1c4, ['unsigned long']], + 'CompletionPort' : [ 0x1c8, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x1d0, ['pointer64', ['void']]], + 'CompletionCount' : [ 0x1d8, ['unsigned long long']], + 'SessionId' : [ 0x1e0, ['unsigned long']], + 'SchedulingClass' : [ 0x1e4, ['unsigned long']], + 'ReadOperationCount' : [ 0x1e8, ['unsigned long long']], + 'WriteOperationCount' : [ 0x1f0, ['unsigned long long']], + 'OtherOperationCount' : [ 0x1f8, ['unsigned long long']], + 'ReadTransferCount' : [ 0x200, ['unsigned long long']], + 'WriteTransferCount' : [ 0x208, ['unsigned long long']], + 'OtherTransferCount' : [ 0x210, ['unsigned long long']], + 'DiskIoInfo' : [ 0x218, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x240, ['unsigned long long']], + 'JobMemoryLimit' : [ 0x248, ['unsigned long long']], + 'JobTotalMemoryLimit' : [ 0x250, ['unsigned long long']], + 'PeakProcessMemoryUsed' : [ 0x258, ['unsigned long long']], + 'PeakJobMemoryUsed' : [ 0x260, ['unsigned long long']], + 'EffectiveAffinity' : [ 0x268, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x310, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x318, ['unsigned long long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x320, ['unsigned long long']], + 'EffectiveProcessMemoryLimit' : [ 0x328, ['unsigned long long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x330, ['pointer64', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x338, ['pointer64', ['_EJOB']]], + 'EffectiveDiskIoRateLimitJob' : [ 0x340, ['pointer64', ['_EJOB']]], + 'EffectiveNetIoRateLimitJob' : [ 0x348, ['pointer64', ['_EJOB']]], + 'EffectiveHeapAttributionJob' : [ 0x350, ['pointer64', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x358, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x35c, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x360, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x364, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x368, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x36c, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x370, ['unsigned char']], + 'PriorityClass' : [ 0x371, ['unsigned char']], + 'NestingDepth' : [ 0x372, ['unsigned char']], + 'Reserved1' : [ 0x373, ['array', 1, ['unsigned char']]], + 'CompletionFilter' : [ 0x374, ['unsigned long']], + 'WakeChannel' : [ 0x378, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x378, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x3b0, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x3b8, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x3bc, ['unsigned long']], + 'NotificationLink' : [ 0x3c0, ['pointer64', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x3c8, ['unsigned long long']], + 'NotificationInfo' : [ 0x3d0, ['pointer64', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x3d8, ['pointer64', ['void']]], + 'NotificationPacket' : [ 0x3e0, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x3e8, ['pointer64', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x3f0, ['pointer64', ['void']]], + 'ReadyTime' : [ 0x3f8, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x400, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x408, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x418, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x428, ['pointer64', ['_EJOB']]], + 'RootJob' : [ 0x430, ['pointer64', ['_EJOB']]], + 'IteratorListHead' : [ 0x438, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x448, ['unsigned long long']], + 'Ancestors' : [ 0x450, ['pointer64', ['pointer64', ['_EJOB']]]], + 'SessionObject' : [ 0x450, ['pointer64', ['void']]], + 'Accounting' : [ 0x458, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x4a8, ['unsigned long']], + 'ActiveAuxiliaryProcessCount' : [ 0x4ac, ['unsigned long']], + 'SequenceNumber' : [ 0x4b0, ['unsigned long']], + 'TimerListLock' : [ 0x4b8, ['unsigned long long']], + 'TimerListHead' : [ 0x4c0, ['_LIST_ENTRY']], + 'ContainerId' : [ 0x4d0, ['_GUID']], + 'Container' : [ 0x4e0, ['pointer64', ['_SILO_CONTEXT']]], + 'PropertySet' : [ 0x4e8, ['_PS_PROPERTY_SET']], + 'NetRateControl' : [ 0x500, ['pointer64', ['_JOB_NET_RATE_CONTROL']]], + 'IoRateControl' : [ 0x508, ['pointer64', ['_JOB_IO_RATE_CONTROL']]], + 'JobFlags' : [ 0x510, ['unsigned long']], + 'CloseDone' : [ 0x510, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x510, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x510, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x510, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x510, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x510, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x510, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x510, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x510, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x510, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x510, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x510, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x510, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x510, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x510, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x510, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x510, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x510, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x510, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'NetRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'OwnNetRateControl' : [ 0x510, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IoRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'OwnIoRateControl' : [ 0x510, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'DisallowNewProcesses' : [ 0x510, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'SpareJobFlags' : [ 0x510, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x514, ['unsigned long']], + 'EnergyValues' : [ 0x518, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'SharedCommitCharge' : [ 0x520, ['unsigned long long']], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_MDL' : [ 0x30, { + 'Next' : [ 0x0, ['pointer64', ['_MDL']]], + 'Size' : [ 0x8, ['short']], + 'MdlFlags' : [ 0xa, ['short']], + 'AllocationProcessorNumber' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], + 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'ByteCount' : [ 0x28, ['unsigned long']], + 'ByteOffset' : [ 0x2c, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x70, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer64', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x60, ['pointer64', ['void']]], + 'UserContext' : [ 0x68, ['pointer64', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0xd8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], + 'FsContext' : [ 0x18, ['pointer64', ['void']]], + 'FsContext2' : [ 0x20, ['pointer64', ['void']]], + 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], + 'FinalStatus' : [ 0x38, ['long']], + 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x48, ['unsigned char']], + 'DeletePending' : [ 0x49, ['unsigned char']], + 'ReadAccess' : [ 0x4a, ['unsigned char']], + 'WriteAccess' : [ 0x4b, ['unsigned char']], + 'DeleteAccess' : [ 0x4c, ['unsigned char']], + 'SharedRead' : [ 0x4d, ['unsigned char']], + 'SharedWrite' : [ 0x4e, ['unsigned char']], + 'SharedDelete' : [ 0x4f, ['unsigned char']], + 'Flags' : [ 0x50, ['unsigned long']], + 'FileName' : [ 0x58, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x70, ['unsigned long']], + 'Busy' : [ 0x74, ['unsigned long']], + 'LastLock' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['_KEVENT']], + 'Event' : [ 0x98, ['_KEVENT']], + 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0xb8, ['unsigned long long']], + 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], + 'CurrentFileIndex' : [ 0xc, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], + 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], + 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], + 'SessionId' : [ 0x40, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], + 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], + 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'Oplock' : [ 0x58, ['pointer64', ['void']]], + 'ReservedForRemote' : [ 0x58, ['pointer64', ['void']]], + 'ReservedContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_iobuf' : [ 0x30, { + '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], + '_cnt' : [ 0x8, ['long']], + '_base' : [ 0x10, ['pointer64', ['unsigned char']]], + '_flag' : [ 0x18, ['long']], + '_file' : [ 0x1c, ['long']], + '_charbuf' : [ 0x20, ['long']], + '_bufsiz' : [ 0x24, ['long']], + '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], +} ], + '_TlgProvider_t' : [ 0x40, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], + 'KeywordAny' : [ 0x10, ['unsigned long long']], + 'KeywordAll' : [ 0x18, ['unsigned long long']], + 'RegHandle' : [ 0x20, ['unsigned long long']], + 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], + 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '__unnamed_164b' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_164b']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0x10, { + 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'State' : [ 0x8, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], + 'Stats' : [ 0xc, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x68, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0x18, ['short']], + 'Flag' : [ 0x1a, ['unsigned short']], + 'ReservedLowFlags' : [ 0x1a, ['unsigned char']], + 'WaiterPriority' : [ 0x1b, ['unsigned char']], + 'SharedWaiters' : [ 0x20, ['_KWAIT_CHAIN']], + 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x40, ['unsigned long']], + 'ContentionCount' : [ 0x44, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], + 'Reserved2' : [ 0x50, ['pointer64', ['void']]], + 'Address' : [ 0x58, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], + 'SpinLock' : [ 0x60, ['unsigned long long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0x18, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x10, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x28, { + 'Total' : [ 0x0, ['unsigned long long']], + 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x10, ['unsigned long long']], + 'Blink' : [ 0x18, ['unsigned long long']], + 'Lock' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_1683' : [ 0x8, { + 'Flink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeFlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 64, native_type='unsigned long long')]], + 'WsIndex' : [ 0x0, ['unsigned long long']], + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1687' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], + 'VolatileShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_1689' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_1687']], +} ], + '__unnamed_1695' : [ 0x8, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'Channel' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 38, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'Partition' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 50, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 52, native_type='unsigned long long')]], + 'FileOnly' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'PfnExists' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], +} ], + '_MMPFN' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'u1' : [ 0x0, ['__unnamed_1683']], + 'PteAddress' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x8, ['pointer64', ['void']]], + 'PteLong' : [ 0x8, ['unsigned long long']], + 'OriginalPte' : [ 0x10, ['_MMPTE']], + 'u2' : [ 0x18, ['_MIPFNBLINK']], + 'u3' : [ 0x20, ['__unnamed_1689']], + 'NodeBlinkLow' : [ 0x24, ['unsigned short']], + 'Unused' : [ 0x26, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'VaType' : [ 0x26, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'ViewCount' : [ 0x27, ['unsigned char']], + 'NodeFlinkLow' : [ 0x27, ['unsigned char']], + 'u4' : [ 0x28, ['__unnamed_1695']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x60, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'BasePte' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'VaType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaMaximumType', 15: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], + 'PteFailures' : [ 0x28, ['unsigned long']], + 'SpinLock' : [ 0x30, ['unsigned long long']], + 'GlobalPushLock' : [ 0x30, ['pointer64', ['_EX_PUSH_LOCK']]], + 'Vm' : [ 0x38, ['pointer64', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x40, ['unsigned long long']], + 'Hint' : [ 0x48, ['unsigned long long']], + 'CachedPtes' : [ 0x50, ['pointer64', ['_MI_CACHED_PTES']]], + 'TotalFreeSystemPtes' : [ 0x58, ['unsigned long long']], +} ], + '_MMCLONE_DESCRIPTOR' : [ 0x50, { + 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Next' : [ 0x0, ['pointer64', ['_MMCLONE_DESCRIPTOR']]], + 'StartingCloneBlock' : [ 0x18, ['pointer64', ['_MMCLONE_BLOCK']]], + 'EndingCloneBlock' : [ 0x20, ['pointer64', ['_MMCLONE_BLOCK']]], + 'NumberOfPtes' : [ 0x28, ['unsigned long long']], + 'NumberOfReferences' : [ 0x30, ['unsigned long long']], + 'CloneHeader' : [ 0x38, ['pointer64', ['_MMCLONE_HEADER']]], + 'NonPagedPoolQuotaCharge' : [ 0x40, ['unsigned long long']], + 'NestingLevel' : [ 0x48, ['unsigned long long']], +} ], + '__unnamed_16c7' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_16c7']], +} ], + '_MMWSL' : [ 0x350, { + 'FirstFree' : [ 0x0, ['unsigned long long']], + 'FirstDynamic' : [ 0x8, ['unsigned long long']], + 'LastEntry' : [ 0x10, ['unsigned long long']], + 'NextSlot' : [ 0x18, ['unsigned long long']], + 'LastInitializedWsle' : [ 0x20, ['unsigned long long']], + 'NextAgingSlot' : [ 0x28, ['unsigned long long']], + 'NextAccessClearingSlot' : [ 0x30, ['unsigned long long']], + 'LastAccessClearingRemainder' : [ 0x38, ['unsigned long']], + 'LastAgingRemainder' : [ 0x3c, ['unsigned long']], + 'WsleSize' : [ 0x40, ['unsigned long']], + 'NonDirectCount' : [ 0x48, ['unsigned long long']], + 'LowestPagableAddress' : [ 0x50, ['pointer64', ['void']]], + 'NonDirectHash' : [ 0x58, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x60, ['pointer64', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x68, ['pointer64', ['_MMWSLE_HASH']]], + 'ActiveWsleCounts' : [ 0x70, ['array', 16, ['unsigned long long']]], + 'ActiveWsles' : [ 0xf0, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], + 'Wsle' : [ 0x1f0, ['pointer64', ['_MMWSLE']]], + 'UserVaInfo' : [ 0x1f8, ['_MI_USER_VA_INFO']], +} ], + '_MMSUPPORT' : [ 0xf8, { + 'WorkingSetLock' : [ 0x0, ['long']], + 'ExitOutswapGate' : [ 0x8, ['pointer64', ['_KGATE']]], + 'AccessLog' : [ 0x10, ['pointer64', ['void']]], + 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long long']]], + 'MinimumWorkingSetSize' : [ 0x60, ['unsigned long long']], + 'WorkingSetLeafSize' : [ 0x68, ['unsigned long long']], + 'WorkingSetLeafPrivateSize' : [ 0x70, ['unsigned long long']], + 'WorkingSetSize' : [ 0x78, ['unsigned long long']], + 'WorkingSetPrivateSize' : [ 0x80, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0x88, ['unsigned long long']], + 'ChargedWslePages' : [ 0x90, ['unsigned long long']], + 'ActualWslePages' : [ 0x98, ['unsigned long long']], + 'WorkingSetSizeOverhead' : [ 0xa0, ['unsigned long long']], + 'PeakWorkingSetSize' : [ 0xa8, ['unsigned long long']], + 'HardFaultCount' : [ 0xb0, ['unsigned long']], + 'PartitionId' : [ 0xb4, ['unsigned short']], + 'Pad0' : [ 0xb6, ['unsigned short']], + 'VmWorkingSetList' : [ 0xb8, ['pointer64', ['_MMWSL']]], + 'NextPageColor' : [ 0xc0, ['unsigned short']], + 'LastTrimStamp' : [ 0xc2, ['unsigned short']], + 'PageFaultCount' : [ 0xc4, ['unsigned long']], + 'TrimmedPageCount' : [ 0xc8, ['unsigned long long']], + 'Reserved0' : [ 0xd0, ['unsigned long long']], + 'Flags' : [ 0xd8, ['_MMSUPPORT_FLAGS']], + 'ReleasedCommitDebt' : [ 0xe0, ['unsigned long long']], + 'WsSwapSupport' : [ 0xe8, ['pointer64', ['void']]], + 'CommitReAcquireFailSupport' : [ 0xf0, ['pointer64', ['void']]], +} ], + '__unnamed_16e3' : [ 0x8, { + 'ImageCommitment' : [ 0x0, ['unsigned long long']], + 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_16e7' : [ 0x8, { + 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_SEGMENT' : [ 0x48, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x30, ['__unnamed_16e3']], + 'u2' : [ 0x38, ['__unnamed_16e7']], + 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], +} ], + '__unnamed_16ec' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_16ef' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS2']], +} ], + '__unnamed_16f9' : [ 0x10, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], + 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_16fb' : [ 0x10, { + 'e2' : [ 0x0, ['__unnamed_16f9']], +} ], + '_CONTROL_AREA' : [ 0x78, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], + 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], + 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16ec']], + 'u1' : [ 0x3c, ['__unnamed_16ef']], + 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x48, ['long']], + 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], + 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x58, ['__unnamed_16fb']], + 'LockedPages' : [ 0x68, ['unsigned long long']], + 'FileObjectLock' : [ 0x70, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1709' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_170c' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x40, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer64', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0x18, ['unsigned long']], + 'EndingVpn' : [ 0x1c, ['unsigned long']], + 'StartingVpnHigh' : [ 0x20, ['unsigned char']], + 'EndingVpnHigh' : [ 0x21, ['unsigned char']], + 'CommitChargeHigh' : [ 0x22, ['unsigned char']], + 'SpareNT64VadUChar' : [ 0x23, ['unsigned char']], + 'ReferenceCount' : [ 0x24, ['long']], + 'PushLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u' : [ 0x30, ['__unnamed_1709']], + 'u1' : [ 0x34, ['__unnamed_170c']], + 'EventList' : [ 0x38, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_MI_PARTITION' : [ 0x2740, { + 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], + 'Modwriter' : [ 0x158, ['_MI_PARTITION_MODWRITES']], + 'Store' : [ 0x430, ['_MI_PARTITION_STORES']], + 'Segments' : [ 0x4c0, ['_MI_PARTITION_SEGMENTS']], + 'PageLists' : [ 0x640, ['_MI_PARTITION_PAGE_LISTS']], + 'Commit' : [ 0x1380, ['_MI_PARTITION_COMMIT']], + 'Zeroing' : [ 0x1400, ['_MI_PARTITION_ZEROING']], + 'PageCombine' : [ 0x1468, ['_MI_PAGE_COMBINING_SUPPORT']], + 'WorkingSetControl' : [ 0x15f0, ['pointer64', ['void']]], + 'WorkingSetExpansionHead' : [ 0x15f8, ['_MMWORKING_SET_EXPANSION_HEAD']], + 'Vp' : [ 0x1640, ['_MI_VISIBLE_PARTITION']], +} ], + '_MM_STORE_KEY' : [ 0x8, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'EntireKey' : [ 0x0, ['unsigned long long']], +} ], + '_MMPAGING_FILE' : [ 0x120, { + 'Size' : [ 0x0, ['unsigned long long']], + 'MaximumSize' : [ 0x8, ['unsigned long long']], + 'MinimumSize' : [ 0x10, ['unsigned long long']], + 'FreeSpace' : [ 0x18, ['unsigned long long']], + 'PeakUsage' : [ 0x20, ['unsigned long long']], + 'HighestPage' : [ 0x28, ['unsigned long long']], + 'FreeReservationSpace' : [ 0x30, ['unsigned long long']], + 'File' : [ 0x38, ['pointer64', ['_FILE_OBJECT']]], + 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x50, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x60, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x70, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x78, ['unsigned long']], + 'LargestAllocationCluster' : [ 0x7c, ['unsigned long']], + 'RefreshAllocationCluster' : [ 0x80, ['unsigned long']], + 'LastRefreshAllocationCluster' : [ 0x84, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x88, ['unsigned long']], + 'MaximumRunLengthInBitmaps' : [ 0x8c, ['unsigned long']], + 'BitmapsCacheLengthTree' : [ 0x90, ['_RTL_RB_TREE']], + 'BitmapsCacheLocationTree' : [ 0xa0, ['_RTL_RB_TREE']], + 'BitmapsCacheFreeList' : [ 0xb0, ['_LIST_ENTRY']], + 'BitmapsCacheEntries' : [ 0xc0, ['pointer64', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], + 'ToBeEvictedCount' : [ 0xc8, ['unsigned long']], + 'HybridPriority' : [ 0xc8, ['unsigned long']], + 'PageFileNumber' : [ 0xcc, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0xcc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'NoReservations' : [ 0xcc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'VirtualStorePagefile' : [ 0xcc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SwapSupported' : [ 0xcc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'NodeInserted' : [ 0xcc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'StackNotified' : [ 0xcc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0xcc, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], + 'AdriftMdls' : [ 0xce, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0xce, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'IgnoreReservations' : [ 0xcf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare2' : [ 0xcf, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0xd0, ['unsigned long']], + 'PageHashPagesPeak' : [ 0xd4, ['unsigned long']], + 'PageHash' : [ 0xd8, ['pointer64', ['unsigned long']]], + 'FileHandle' : [ 0xe0, ['pointer64', ['void']]], + 'Lock' : [ 0xe8, ['unsigned long long']], + 'LockOwner' : [ 0xf0, ['pointer64', ['_ETHREAD']]], + 'FlowThroughReadRoot' : [ 0xf8, ['_RTL_AVL_TREE']], + 'Partition' : [ 0x100, ['pointer64', ['_MI_PARTITION']]], + 'FileObjectNode' : [ 0x108, ['_RTL_BALANCED_NODE']], +} ], + 'tagSWITCH_CONTEXT' : [ 0x68, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '_CMP_SILO_CONTEXT' : [ 0x20, { + 'LockEntryHead' : [ 0x0, ['_LIST_ENTRY']], + 'LockListUnderCleanup' : [ 0x10, ['unsigned char']], + 'ContextLock' : [ 0x18, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1756' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1759' : [ 0x18, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x8, ['pointer64', ['void']]], + 'Status' : [ 0x10, ['long']], +} ], + '__unnamed_175b' : [ 0x8, { + 'CheckStack' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_175f' : [ 0x20, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], + 'RootPoint' : [ 0x10, ['pointer64', ['void']]], + 'Index' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1761' : [ 0x18, { + 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], + 'Index' : [ 0x8, ['unsigned long']], + 'Cell' : [ 0xc, ['unsigned long']], + 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], +} ], + '__unnamed_1765' : [ 0x10, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], +} ], + '__unnamed_1769' : [ 0x10, { + 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], + 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], +} ], + '__unnamed_176b' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x160, { + 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], + 'Index' : [ 0x8, ['unsigned long']], + 'RecoverableIndex' : [ 0xc, ['unsigned long']], + 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1756']]], + 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1756']]], + 'RegistryIO' : [ 0xd0, ['__unnamed_1759']], + 'CheckRegistry2' : [ 0xe8, ['__unnamed_175b']], + 'CheckKey' : [ 0xf0, ['__unnamed_175f']], + 'CheckValueList' : [ 0x110, ['__unnamed_1761']], + 'CheckHive' : [ 0x128, ['__unnamed_1765']], + 'CheckHive1' : [ 0x138, ['__unnamed_1765']], + 'CheckBin' : [ 0x148, ['__unnamed_1769']], + 'RecoverData' : [ 0x158, ['__unnamed_176b']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x10, ['unsigned long']], + 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xc0, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'ParkingStatus' : [ 0x80, ['unsigned long']], + 'CurrentFrequency' : [ 0x84, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], + 'StateFlags' : [ 0x8c, ['unsigned long']], + 'NominalThroughput' : [ 0x90, ['unsigned long']], + 'ActiveThroughput' : [ 0x94, ['unsigned long']], + 'ScaledThroughput' : [ 0x98, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb8, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x10, { + 'Data' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_TEB32' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], + 'SystemReserved1' : [ 0x10c, ['array', 38, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_TEB64' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], + 'SystemReserved1' : [ 0x190, ['array', 38, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], + 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], + 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], + 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], + 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x2200, { + 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], + 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x20, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['_LIST_ENTRY']], + 'Time' : [ 0x18, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x38, { + 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Level' : [ 0x10, ['unsigned char']], + 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x260, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'ReadySummary' : [ 0x8, ['unsigned long']], + 'ReadyListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x210, ['array', 64, ['unsigned char']]], + 'Span' : [ 0x250, ['unsigned char']], + 'LowProcIndex' : [ 0x251, ['unsigned char']], + 'QueueIndex' : [ 0x252, ['unsigned char']], + 'ProcCount' : [ 0x253, ['unsigned char']], + 'ScanOwner' : [ 0x254, ['unsigned char']], + 'Spare' : [ 0x255, ['array', 3, ['unsigned char']]], + 'Affinity' : [ 0x258, ['unsigned long long']], +} ], + '_KEXCEPTION_FRAME' : [ 0x140, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'Spare1' : [ 0x28, ['unsigned long long']], + 'Xmm6' : [ 0x30, ['_M128A']], + 'Xmm7' : [ 0x40, ['_M128A']], + 'Xmm8' : [ 0x50, ['_M128A']], + 'Xmm9' : [ 0x60, ['_M128A']], + 'Xmm10' : [ 0x70, ['_M128A']], + 'Xmm11' : [ 0x80, ['_M128A']], + 'Xmm12' : [ 0x90, ['_M128A']], + 'Xmm13' : [ 0xa0, ['_M128A']], + 'Xmm14' : [ 0xb0, ['_M128A']], + 'Xmm15' : [ 0xc0, ['_M128A']], + 'TrapFrame' : [ 0xd0, ['unsigned long long']], + 'OutputBuffer' : [ 0xd8, ['unsigned long long']], + 'OutputLength' : [ 0xe0, ['unsigned long long']], + 'Spare2' : [ 0xe8, ['unsigned long long']], + 'MxCsr' : [ 0xf0, ['unsigned long long']], + 'Rbp' : [ 0xf8, ['unsigned long long']], + 'Rbx' : [ 0x100, ['unsigned long long']], + 'Rdi' : [ 0x108, ['unsigned long long']], + 'Rsi' : [ 0x110, ['unsigned long long']], + 'R12' : [ 0x118, ['unsigned long long']], + 'R13' : [ 0x120, ['unsigned long long']], + 'R14' : [ 0x128, ['unsigned long long']], + 'R15' : [ 0x130, ['unsigned long long']], + 'Return' : [ 0x138, ['unsigned long long']], +} ], + '_KTRAP_FRAME' : [ 0x190, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'PreviousMode' : [ 0x28, ['unsigned char']], + 'PreviousIrql' : [ 0x29, ['unsigned char']], + 'FaultIndicator' : [ 0x2a, ['unsigned char']], + 'ExceptionActive' : [ 0x2b, ['unsigned char']], + 'MxCsr' : [ 0x2c, ['unsigned long']], + 'Rax' : [ 0x30, ['unsigned long long']], + 'Rcx' : [ 0x38, ['unsigned long long']], + 'Rdx' : [ 0x40, ['unsigned long long']], + 'R8' : [ 0x48, ['unsigned long long']], + 'R9' : [ 0x50, ['unsigned long long']], + 'R10' : [ 0x58, ['unsigned long long']], + 'R11' : [ 0x60, ['unsigned long long']], + 'GsBase' : [ 0x68, ['unsigned long long']], + 'GsSwap' : [ 0x68, ['unsigned long long']], + 'Xmm0' : [ 0x70, ['_M128A']], + 'Xmm1' : [ 0x80, ['_M128A']], + 'Xmm2' : [ 0x90, ['_M128A']], + 'Xmm3' : [ 0xa0, ['_M128A']], + 'Xmm4' : [ 0xb0, ['_M128A']], + 'Xmm5' : [ 0xc0, ['_M128A']], + 'FaultAddress' : [ 0xd0, ['unsigned long long']], + 'ContextRecord' : [ 0xd0, ['unsigned long long']], + 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], + 'Dr0' : [ 0xd8, ['unsigned long long']], + 'Dr1' : [ 0xe0, ['unsigned long long']], + 'Dr2' : [ 0xe8, ['unsigned long long']], + 'Dr3' : [ 0xf0, ['unsigned long long']], + 'Dr6' : [ 0xf8, ['unsigned long long']], + 'Dr7' : [ 0x100, ['unsigned long long']], + 'DebugControl' : [ 0x108, ['unsigned long long']], + 'LastBranchToRip' : [ 0x110, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], + 'SegDs' : [ 0x130, ['unsigned short']], + 'SegEs' : [ 0x132, ['unsigned short']], + 'SegFs' : [ 0x134, ['unsigned short']], + 'SegGs' : [ 0x136, ['unsigned short']], + 'TrapFrame' : [ 0x138, ['unsigned long long']], + 'Rbx' : [ 0x140, ['unsigned long long']], + 'Rdi' : [ 0x148, ['unsigned long long']], + 'Rsi' : [ 0x150, ['unsigned long long']], + 'Rbp' : [ 0x158, ['unsigned long long']], + 'ErrorCode' : [ 0x160, ['unsigned long long']], + 'ExceptionFrame' : [ 0x160, ['unsigned long long']], + 'TimeStampKlog' : [ 0x160, ['unsigned long long']], + 'Rip' : [ 0x168, ['unsigned long long']], + 'SegCs' : [ 0x170, ['unsigned short']], + 'Fill0' : [ 0x172, ['unsigned char']], + 'Logging' : [ 0x173, ['unsigned char']], + 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], + 'EFlags' : [ 0x178, ['unsigned long']], + 'Fill2' : [ 0x17c, ['unsigned long']], + 'Rsp' : [ 0x180, ['unsigned long long']], + 'SegSs' : [ 0x188, ['unsigned short']], + 'Fill3' : [ 0x18a, ['unsigned short']], + 'Fill4' : [ 0x18c, ['unsigned long']], +} ], + '__unnamed_1866' : [ 0x8, { + 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1868' : [ 0x8, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], +} ], + '__unnamed_186c' : [ 0x20, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0x18, ['pointer64', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x2c8, { + 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x58, ['long']], + 'FxRemoveEvent' : [ 0x60, ['_KEVENT']], + 'FxActivationCount' : [ 0x78, ['long']], + 'FxSleepCount' : [ 0x7c, ['long']], + 'Plugin' : [ 0x80, ['pointer64', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x88, ['unsigned long']], + 'CurrentPowerState' : [ 0x8c, ['_POWER_STATE']], + 'Notify' : [ 0x90, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0xf8, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0x118, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0x128, ['unsigned long']], + 'State' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0x130, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0x134, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x184, ['unsigned long']], + 'CompletionStatus' : [ 0x188, ['long']], + 'Flags' : [ 0x18c, ['unsigned long']], + 'UserFlags' : [ 0x190, ['unsigned long']], + 'Problem' : [ 0x194, ['unsigned long']], + 'ProblemStatus' : [ 0x198, ['long']], + 'ResourceList' : [ 0x1a0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x1a8, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x1b0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x1b8, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x1c4, ['unsigned long']], + 'ChildInterfaceType' : [ 0x1c8, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x1cc, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x1d0, ['unsigned short']], + 'RemovalPolicy' : [ 0x1d2, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x1d3, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x1d8, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x1e8, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x1f8, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x208, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x20a, ['unsigned short']], + 'NoArbiterMask' : [ 0x20c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x20e, ['unsigned short']], + 'OverUsed1' : [ 0x210, ['__unnamed_1866']], + 'OverUsed2' : [ 0x218, ['__unnamed_1868']], + 'BootResources' : [ 0x220, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x228, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x230, ['unsigned long']], + 'DockInfo' : [ 0x238, ['__unnamed_186c']], + 'DisableableDepends' : [ 0x258, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x260, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x270, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x280, ['unsigned long']], + 'PreviousParent' : [ 0x288, ['pointer64', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x290, ['long']], + 'NumaNodeIndex' : [ 0x294, ['unsigned long']], + 'ContainerID' : [ 0x298, ['_GUID']], + 'OverrideFlags' : [ 0x2a8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x2ac, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x2b0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x2b8, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x2c0, ['unsigned long']], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x48, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x30, ['pointer64', ['unsigned long']]], + 'EnableKeyWords' : [ 0x38, ['pointer64', ['unsigned long long']]], + 'EnableLevel' : [ 0x40, ['pointer64', ['unsigned char']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x10, ['unsigned long']], + 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x48, ['unsigned long long']], +} ], + '_KSEMAPHORE' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x18, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x68, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x10, ['unsigned long']], + 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x20, ['unsigned long']], + 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], + 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x38, ['long']], + 'StartIoKey' : [ 0x3c, ['long']], + 'StartIoFlags' : [ 0x40, ['unsigned long']], + 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], + 'DependencyNode' : [ 0x50, ['pointer64', ['void']]], + 'InterruptContext' : [ 0x58, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_GROUP_AFFINITY' : [ 0x10, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Group' : [ 0x8, ['unsigned short']], + 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], +} ], + '_KAFFINITY_EX' : [ 0xa8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 20, ['unsigned long long']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x40, { + 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0x10, ['unsigned long']], + 'Position' : [ 0x14, ['unsigned long']], + 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x20, ['pointer64', ['void']]], + 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x38, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1969' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_1969']], +} ], + '__unnamed_1970' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_1970']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PEP_ACPI_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], + 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], + 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], + 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], + 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], + 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], + 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], +} ], + '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Information' : [ 0x4, ['unsigned char']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Alignment' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'Count' : [ 0x10, ['unsigned char']], + 'Pins' : [ 0x18, ['pointer64', ['unsigned long']]], +} ], + '_PEP_ACPI_GPIO_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], + 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], + 'DriveStrength' : [ 0x18, ['unsigned short']], + 'DebounceTimeout' : [ 0x1a, ['unsigned short']], + 'PinTable' : [ 0x20, ['pointer64', ['unsigned short']]], + 'PinCount' : [ 0x28, ['unsigned short']], + 'ResourceSourceIndex' : [ 0x2a, ['unsigned char']], + 'ResourceSourceName' : [ 0x30, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x38, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x40, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x30, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'SlaveAddress' : [ 0x2c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'BaudRate' : [ 0x28, ['unsigned long']], + 'RxBufferSize' : [ 0x2c, ['unsigned short']], + 'TxBufferSize' : [ 0x2e, ['unsigned short']], + 'Parity' : [ 0x30, ['unsigned char']], + 'LinesInUse' : [ 0x31, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'DataBitLength' : [ 0x2c, ['unsigned char']], + 'Phase' : [ 0x2d, ['unsigned char']], + 'Polarity' : [ 0x2e, ['unsigned char']], + 'DeviceSelection' : [ 0x30, ['unsigned short']], +} ], + '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'ResourceFlags' : [ 0x8, ['unsigned char']], + 'GeneralFlags' : [ 0x9, ['unsigned char']], + 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], + 'RevisionId' : [ 0xb, ['unsigned char']], + 'Reserved' : [ 0xc, ['unsigned char']], + 'Granularity' : [ 0x10, ['unsigned long long']], + 'MinimumAddress' : [ 0x18, ['unsigned long long']], + 'MaximumAddress' : [ 0x20, ['unsigned long long']], + 'TranslationAddress' : [ 0x28, ['unsigned long long']], + 'AddressLength' : [ 0x30, ['unsigned long long']], + 'TypeAttribute' : [ 0x38, ['unsigned long long']], + 'DescriptorName' : [ 0x40, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_PPM_PLATFORM_STATES' : [ 0x1c0, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'InterfaceVersion' : [ 0x4, ['unsigned long']], + 'ProcessorCount' : [ 0x8, ['unsigned long']], + 'CoordinatedInterface' : [ 0xc, ['unsigned char']], + 'IdleTest' : [ 0x10, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x18, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x20, ['pointer64', ['void']]], + 'QueryPlatformStateResidency' : [ 0x28, ['pointer64', ['void']]], + 'Accounting' : [ 0x30, ['pointer64', ['_PLATFORM_IDLE_ACCOUNTING']]], + 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_PPM_PROFILE' : [ 0xb30, { + 'Name' : [ 0x0, ['pointer64', ['unsigned short']]], + 'Id' : [ 0x8, ['unsigned char']], + 'Guid' : [ 0xc, ['_GUID']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Priority' : [ 0x20, ['unsigned char']], + 'Settings' : [ 0x28, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], + 'StartTime' : [ 0xb08, ['unsigned long long']], + 'Count' : [ 0xb10, ['unsigned long long']], + 'MaxDuration' : [ 0xb18, ['unsigned long long']], + 'MinDuration' : [ 0xb20, ['unsigned long long']], + 'TotalDuration' : [ 0xb28, ['unsigned long long']], +} ], + '_PPM_ENGINE_SETTINGS' : [ 0x570, { + 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], + 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], + 'PerfTimeCheck' : [ 0x14, ['unsigned long']], + 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], + 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], + 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], + 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], + 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], + 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], + 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], + 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], + 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], + 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], + 'PerfBoostMode' : [ 0x30, ['unsigned long']], + 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], + 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], + 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], + 'AutonomousPreference' : [ 0x40, ['unsigned char']], + 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], + 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], + 'DutyCycling' : [ 0x45, ['unsigned char']], + 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], + 'DistributeUtility' : [ 0x48, ['unsigned char']], + 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], + 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], + 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], + 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], + 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], + 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], + 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], + 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], + 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], + 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], + 'AllowScaling' : [ 0x5c, ['unsigned char']], + 'IdleDisabled' : [ 0x5d, ['unsigned char']], + 'IdleTimeCheck' : [ 0x60, ['unsigned long']], + 'IdleDemotePercent' : [ 0x64, ['unsigned char']], + 'IdlePromotePercent' : [ 0x65, ['unsigned char']], + 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], + 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], + 'HeteroDecreaseThreshold' : [ 0x68, ['array', 640, ['unsigned char']]], + 'HeteroIncreaseThreshold' : [ 0x2e8, ['array', 640, ['unsigned char']]], + 'Class0FloorPerformance' : [ 0x568, ['unsigned char']], + 'Class1InitialPerformance' : [ 0x569, ['unsigned char']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_PERF_FLAGS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], + 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], + 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0xd0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x20, ['unsigned long long']], + 'LogHandleContext' : [ 0x28, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0xc0, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0xc4, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0xc8, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x210, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], + 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x70, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], + 'Flags' : [ 0x98, ['unsigned long']], + 'Status' : [ 0x9c, ['long']], + 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], + 'Section' : [ 0xa8, ['pointer64', ['void']]], + 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], + 'PagesToWrite' : [ 0xc0, ['unsigned long']], + 'BeyondLastFlush' : [ 0xc8, ['long long']], + 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], + 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], + 'V1' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0x100, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0x108, ['unsigned long']], + 'LazyWritePassCount' : [ 0x10c, ['unsigned long']], + 'UninitializeEvent' : [ 0x110, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0x118, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0x150, ['_LARGE_INTEGER']], + 'Event' : [ 0x158, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0x170, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0x178, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x1f0, ['pointer64', ['void']]], + 'VolumeCacheMap' : [ 0x1f8, ['pointer64', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x200, ['unsigned long']], + 'WritesInProgress' : [ 0x204, ['unsigned long']], + 'AsyncReadRequestCount' : [ 0x208, ['unsigned long']], +} ], + '__unnamed_1a53' : [ 0x10, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x28, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x10, ['__unnamed_1a53']], + 'ArrayHead' : [ 0x20, ['pointer64', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1a77' : [ 0x8, { + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], +} ], + '__unnamed_1a79' : [ 0x8, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1a7b' : [ 0x8, { + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], +} ], + '__unnamed_1a7d' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1a7f' : [ 0x30, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x8, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x10, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x28, ['unsigned char']], +} ], + '__unnamed_1a83' : [ 0x58, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Length' : [ 0x18, ['unsigned long']], + 'PrefetchList' : [ 0x20, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'PrefetchPagePriority' : [ 0x28, ['unsigned long']], + 'Mdl' : [ 0x30, ['pointer64', ['_MDL']]], + 'IoStatusBlock' : [ 0x38, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallbackContext' : [ 0x40, ['pointer64', ['_CC_ASYNC_READ_CONTEXT']]], + 'OriginatingProcess' : [ 0x48, ['pointer64', ['_EPROCESS']]], + 'RequestorMode' : [ 0x50, ['unsigned char']], + 'NestingLevel' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1a85' : [ 0x58, { + 'Read' : [ 0x0, ['__unnamed_1a77']], + 'Write' : [ 0x0, ['__unnamed_1a79']], + 'Event' : [ 0x0, ['__unnamed_1a7b']], + 'Notification' : [ 0x0, ['__unnamed_1a7d']], + 'LowPriWrite' : [ 0x0, ['__unnamed_1a7f']], + 'AsyncRead' : [ 0x0, ['__unnamed_1a83']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x70, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x10, ['__unnamed_1a85']], + 'Function' : [ 0x68, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x30, { + 'Callback' : [ 0x0, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x8, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x98, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x10, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x18, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x30, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x68, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x6c, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x70, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x78, ['pointer64', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x80, ['unsigned long long']], + 'LastLWTimeStamp' : [ 0x88, ['_LARGE_INTEGER']], + 'Flags' : [ 0x90, ['unsigned long']], +} ], + '_MBCB' : [ 0xc0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x20, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], + 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x30, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x10, ['long long']], + 'FirstDirtyPage' : [ 0x18, ['unsigned long']], + 'LastDirtyPage' : [ 0x1c, ['unsigned long']], + 'DirtyPages' : [ 0x20, ['unsigned long']], + 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], + 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x38, { + 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x8, ['unsigned long']], + 'ExtraItem' : [ 0xc, ['unsigned long']], + 'ItemCount' : [ 0x10, ['unsigned long']], + 'OutOfRangeItems' : [ 0x14, ['unsigned long']], + 'BaseIndex' : [ 0x18, ['unsigned long']], + 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], + 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x298, { + 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], + 'Flags' : [ 0x70, ['unsigned long']], + 'ForceFlags' : [ 0x74, ['unsigned long']], + 'CompatibilityFlags' : [ 0x78, ['unsigned long']], + 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], + 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x90, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x94, ['unsigned long']], + 'Signature' : [ 0x98, ['unsigned long']], + 'SegmentReserve' : [ 0xa0, ['unsigned long long']], + 'SegmentCommit' : [ 0xa8, ['unsigned long long']], + 'DeCommitFreeBlockThreshold' : [ 0xb0, ['unsigned long long']], + 'DeCommitTotalFreeThreshold' : [ 0xb8, ['unsigned long long']], + 'TotalFreeSize' : [ 0xc0, ['unsigned long long']], + 'MaximumAllocationSize' : [ 0xc8, ['unsigned long long']], + 'ProcessHeapsListIndex' : [ 0xd0, ['unsigned short']], + 'HeaderValidateLength' : [ 0xd2, ['unsigned short']], + 'HeaderValidateCopy' : [ 0xd8, ['pointer64', ['void']]], + 'NextAvailableTagIndex' : [ 0xe0, ['unsigned short']], + 'MaximumTagIndex' : [ 0xe2, ['unsigned short']], + 'TagEntries' : [ 0xe8, ['pointer64', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0xf0, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x100, ['unsigned long long']], + 'AlignMask' : [ 0x108, ['unsigned long long']], + 'VirtualAllocdBlocks' : [ 0x110, ['_LIST_ENTRY']], + 'SegmentList' : [ 0x120, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0x130, ['unsigned short']], + 'NonDedicatedListLength' : [ 0x134, ['unsigned long']], + 'BlocksIndex' : [ 0x138, ['pointer64', ['void']]], + 'UCRIndex' : [ 0x140, ['pointer64', ['void']]], + 'PseudoTagEntries' : [ 0x148, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0x150, ['_LIST_ENTRY']], + 'LockVariable' : [ 0x160, ['pointer64', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0x168, ['pointer64', ['void']]], + 'FrontEndHeap' : [ 0x170, ['pointer64', ['void']]], + 'FrontHeapLockCount' : [ 0x178, ['unsigned short']], + 'FrontEndHeapType' : [ 0x17a, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0x17b, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0x180, ['pointer64', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0x188, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0x18a, ['array', 129, ['unsigned char']]], + 'Counters' : [ 0x210, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x288, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1af3' : [ 0x68, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x68, { + 'Lock' : [ 0x0, ['__unnamed_1af3']], +} ], + '_HEAP_ENTRY' : [ 0x10, { + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x70, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x20, ['unsigned long long']], + 'ReserveSize' : [ 0x28, ['unsigned long long']], + 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x20, { + 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], + 'FreeList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '__unnamed_1b46' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1b48' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b46']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1b4a' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1b4c' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1b4a']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_1b48']], + 'u2' : [ 0x4, ['__unnamed_1b4c']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x18, ['unsigned long']], + 'ClientViewSize' : [ 0x20, ['unsigned long long']], + 'CallbackId' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x30, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer64', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], + 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], + 'UsualSize' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_1b67' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1b69' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1b67']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x30, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_1b69']], + 'ResourceId' : [ 0x11, ['unsigned char']], + 'CachedReferences' : [ 0x12, ['short']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Lock' : [ 0x20, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1b7b' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1b7d' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b7b']], +} ], + '_KALPC_SECTION' : [ 0x48, { + 'SectionObject' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], + 'u1' : [ 0x30, ['__unnamed_1b7d']], + 'NumberOfRegions' : [ 0x34, ['unsigned long']], + 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], +} ], + '__unnamed_1b86' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1b88' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b86']], +} ], + '_KALPC_REGION' : [ 0x58, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], + 'Offset' : [ 0x18, ['unsigned long long']], + 'Size' : [ 0x20, ['unsigned long long']], + 'ViewSize' : [ 0x28, ['unsigned long long']], + 'u1' : [ 0x30, ['__unnamed_1b88']], + 'NumberOfViews' : [ 0x34, ['unsigned long']], + 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], +} ], + '__unnamed_1b8e' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1b90' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b8e']], +} ], + '_KALPC_VIEW' : [ 0x60, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'Address' : [ 0x28, ['pointer64', ['void']]], + 'Size' : [ 0x30, ['unsigned long long']], + 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], + 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], + 'u1' : [ 0x48, ['__unnamed_1b90']], + 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x48, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x40, ['pointer64', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1bae' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1bb0' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bae']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x1d8, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], + 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x38, ['pointer64', ['void']]], + 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x90, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0xa0, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0xb8, ['_LIST_ENTRY']], + 'DirectQueueLock' : [ 0xc8, ['_EX_PUSH_LOCK']], + 'DirectQueue' : [ 0xd0, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0xe8, ['_LIST_ENTRY']], + 'Semaphore' : [ 0xf8, ['pointer64', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0xf8, ['pointer64', ['_KEVENT']]], + 'PortAttributes' : [ 0x100, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0x148, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0x150, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0x168, ['pointer64', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0x170, ['pointer64', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0x178, ['pointer64', ['void']]], + 'CanceledQueue' : [ 0x180, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0x190, ['long']], + 'ReferenceNo' : [ 0x194, ['long']], + 'ReferenceNoWait' : [ 0x198, ['pointer64', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0x1a0, ['__unnamed_1bb0']], + 'TargetQueuePort' : [ 0x1a8, ['pointer64', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0x1b0, ['pointer64', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x1b8, ['pointer64', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x1c0, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x1c4, ['unsigned long']], + 'PendingQueueLength' : [ 0x1c8, ['unsigned long']], + 'DirectQueueLength' : [ 0x1cc, ['unsigned long']], + 'CanceledQueueLength' : [ 0x1d0, ['unsigned long']], + 'WaitQueueLength' : [ 0x1d4, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0xa0, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'CompletionListLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x20, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x28, ['pointer64', ['void']]], + 'UserLimit' : [ 0x30, ['pointer64', ['void']]], + 'DataUserVa' : [ 0x38, ['pointer64', ['void']]], + 'SystemVa' : [ 0x40, ['pointer64', ['void']]], + 'TotalSize' : [ 0x48, ['unsigned long long']], + 'Header' : [ 0x50, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x58, ['pointer64', ['void']]], + 'ListSize' : [ 0x60, ['unsigned long long']], + 'Bitmap' : [ 0x68, ['pointer64', ['void']]], + 'BitmapSize' : [ 0x70, ['unsigned long long']], + 'Data' : [ 0x78, ['pointer64', ['void']]], + 'DataSize' : [ 0x80, ['unsigned long long']], + 'BitmapLimit' : [ 0x88, ['unsigned long']], + 'BitmapNextHint' : [ 0x8c, ['unsigned long']], + 'ConcurrencyCount' : [ 0x90, ['unsigned long']], + 'AttributeFlags' : [ 0x94, ['unsigned long']], + 'AttributeSize' : [ 0x98, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'Attributes' : [ 0x18, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0xd8, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], + 'Index' : [ 0x28, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], + 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0xb8, ['_EX_PUSH_LOCK']], + 'Key' : [ 0xc0, ['unsigned long']], + 'CallbackList' : [ 0xc8, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x20, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x18, ['long']], +} ], + '_PORT_MESSAGE32' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1b48']], + 'u2' : [ 0x4, ['__unnamed_1b4c']], + 'ClientId' : [ 0x8, ['_CLIENT_ID32']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1bd6' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1bd8' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bd6']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x108, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'u1' : [ 0x28, ['__unnamed_1bd8']], + 'SequenceNo' : [ 0x2c, ['long']], + 'QuotaProcess' : [ 0x30, ['pointer64', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x30, ['pointer64', ['void']]], + 'CancelSequencePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x40, ['pointer64', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x48, ['long']], + 'CancelListEntry' : [ 0x50, ['_LIST_ENTRY']], + 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x68, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0xa8, ['pointer64', ['void']]], + 'CommunicationInfo' : [ 0xb0, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0xb8, ['pointer64', ['_ALPC_PORT']]], + 'ServerThread' : [ 0xc0, ['pointer64', ['_ETHREAD']]], + 'WakeReference' : [ 0xc8, ['pointer64', ['void']]], + 'ExtensionBuffer' : [ 0xd0, ['pointer64', ['void']]], + 'ExtensionBufferSize' : [ 0xd8, ['unsigned long long']], + 'PortMessage' : [ 0xe0, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x40, { + 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], + 'DirectEvent' : [ 0x28, ['_KALPC_DIRECT_EVENT']], + 'Flags' : [ 0x30, ['unsigned long']], + 'TotalLength' : [ 0x34, ['unsigned short']], + 'Type' : [ 0x36, ['unsigned short']], + 'DataInfoOffset' : [ 0x38, ['unsigned short']], + 'SignalCompletion' : [ 0x3a, ['unsigned char']], + 'PostedToCompletionList' : [ 0x3b, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x8, ['unsigned long long']], + 'ViewBase' : [ 0x10, ['pointer64', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x28, { + 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x20, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x30, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x40, { + 'ClientContext' : [ 0x0, ['pointer64', ['void']]], + 'ServerContext' : [ 0x8, ['pointer64', ['void']]], + 'PortContext' : [ 0x10, ['pointer64', ['void']]], + 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], + 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], + 'DirectEvent' : [ 0x38, ['_KALPC_DIRECT_EVENT']], +} ], + '__unnamed_1c1c' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1c1e' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c1c']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x70, { + 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], + 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x68, ['__unnamed_1c1e']], +} ], + '_KALPC_DIRECT_EVENT' : [ 0x8, { + 'Event' : [ 0x0, ['unsigned long long']], + 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x10, ['unsigned long']], + 'KeyContext' : [ 0x18, ['pointer64', ['void']]], + 'ApcContext' : [ 0x20, ['pointer64', ['void']]], + 'IoStatus' : [ 0x28, ['long']], + 'IoStatusInformation' : [ 0x30, ['unsigned long long']], + 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Allocated' : [ 0x48, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x30, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer64', ['void']]], + 'ActivityId' : [ 0x10, ['_GUID']], + 'Timestamp' : [ 0x20, ['_LARGE_INTEGER']], + 'ZeroingOffset' : [ 0x20, ['unsigned long']], + 'FsTrackOffsetBlob' : [ 0x20, ['pointer64', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], + 'FsTrackedOffset' : [ 0x28, ['long long']], +} ], + '_DRIVER_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'DriverStart' : [ 0x18, ['pointer64', ['void']]], + 'DriverSize' : [ 0x20, ['unsigned long']], + 'DriverSection' : [ 0x28, ['pointer64', ['void']]], + 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x38, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x58, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x20, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x50, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], + 'FoIoPriorityHint' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0xc0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x10, ['long']], + 'Information' : [ 0x18, ['unsigned long long']], + 'ParseCheck' : [ 0x20, ['unsigned long']], + 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x40, ['unsigned long']], + 'FileAttributes' : [ 0x44, ['unsigned short']], + 'ShareAccess' : [ 0x46, ['unsigned short']], + 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], + 'EaLength' : [ 0x50, ['unsigned long']], + 'Options' : [ 0x54, ['unsigned long']], + 'Disposition' : [ 0x58, ['unsigned long']], + 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], + 'Override' : [ 0x80, ['unsigned char']], + 'QueryOnly' : [ 0x81, ['unsigned char']], + 'DeleteOnly' : [ 0x82, ['unsigned char']], + 'FullAttributes' : [ 0x83, ['unsigned char']], + 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x90, ['unsigned long']], + 'AccessMode' : [ 0x94, ['unsigned char']], + 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1ce5' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x118, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1ce5']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer64', ['unsigned short']]], + 'LogFileName' : [ 0x40, ['pointer64', ['unsigned short']]], + 'TimeZone' : [ 0x48, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf8, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0x100, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x108, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x110, ['unsigned long']], + 'BuffersLost' : [ 0x114, ['unsigned long']], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x390, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 2, ['unsigned long']]], + 'ErrorMarker' : [ 0x1c, ['unsigned long']], + 'SizeMask' : [ 0x20, ['unsigned long']], + 'GetCpuClock' : [ 0x28, ['pointer64', ['void']]], + 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x38, ['long']], + 'FailureReason' : [ 0x3c, ['unsigned long']], + 'BufferQueue' : [ 0x40, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x58, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x70, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x80, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x90, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x90, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x98, ['_UNICODE_STRING']], + 'LogFileName' : [ 0xa8, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0xb8, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0xc8, ['_UNICODE_STRING']], + 'ClockType' : [ 0xd8, ['unsigned long']], + 'LastFlushedBuffer' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'FlushThreshold' : [ 0xe4, ['unsigned long']], + 'ByteOffset' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0xf0, ['unsigned long']], + 'BuffersAvailable' : [ 0xf4, ['long']], + 'NumberOfBuffers' : [ 0xf8, ['long']], + 'MaximumBuffers' : [ 0xfc, ['unsigned long']], + 'EventsLost' : [ 0x100, ['unsigned long']], + 'PeakBuffersCount' : [ 0x104, ['long']], + 'BuffersWritten' : [ 0x108, ['unsigned long']], + 'LogBuffersLost' : [ 0x10c, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0x110, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0x114, ['unsigned long']], + 'SequencePtr' : [ 0x118, ['pointer64', ['long']]], + 'LocalSequence' : [ 0x120, ['unsigned long']], + 'InstanceGuid' : [ 0x124, ['_GUID']], + 'MaximumFileSize' : [ 0x134, ['unsigned long']], + 'FileCounter' : [ 0x138, ['long']], + 'PoolType' : [ 0x13c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0x140, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0x150, ['long']], + 'ProviderInfoSize' : [ 0x154, ['unsigned long']], + 'Consumers' : [ 0x158, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x168, ['unsigned long']], + 'TransitionConsumer' : [ 0x170, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x178, ['pointer64', ['void']]], + 'RealtimeLogfileName' : [ 0x180, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x190, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x198, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x1a0, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x1a8, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x1b0, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x1b8, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x1c0, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x1d0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x1d8, ['_KEVENT']], + 'FlushEvent' : [ 0x1f0, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x208, ['_KTIMER']], + 'LoggerDpc' : [ 0x248, ['_KDPC']], + 'LoggerMutex' : [ 0x288, ['_KMUTANT']], + 'LoggerLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x2c8, ['unsigned long long']], + 'BufferListPushLock' : [ 0x2c8, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x2d0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x318, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x320, ['_EX_FAST_REF']], + 'StartTime' : [ 0x328, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x330, ['pointer64', ['void']]], + 'BufferSequenceNumber' : [ 0x338, ['long long']], + 'Flags' : [ 0x340, ['unsigned long']], + 'Persistent' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x340, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x340, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x340, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x340, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x340, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x340, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x340, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x340, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'StackLookasideListAllocated' : [ 0x340, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SecurityTrace' : [ 0x340, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x340, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x340, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x340, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x340, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x344, ['unsigned long']], + 'DbgRequestNewFile' : [ 0x344, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x344, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x344, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x344, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x344, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x344, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDeferredFlush' : [ 0x344, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDeferredFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x344, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x344, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x348, ['_RTL_BITMAP']], + 'StackCache' : [ 0x358, ['pointer64', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x360, ['pointer64', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x368, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x378, ['pointer64', ['pointer64', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x380, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x28, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer64', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_SILODRIVERSTATE' : [ 0x13a8, { + 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], + 'EtwpLoggerRundown' : [ 0x190, ['array', 64, ['pointer64', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], + 'WmipLoggerContext' : [ 0x390, ['array', 64, ['pointer64', ['_WMI_LOGGER_CONTEXT']]]], + 'EtwpGuidHashTable' : [ 0x590, ['array', 64, ['_ETW_HASH_BUCKET']]], + 'EtwpSecurityLoggers' : [ 0x1390, ['array', 8, ['unsigned short']]], + 'EtwpSecurityProviderEnableMask' : [ 0x13a0, ['unsigned char']], + 'EtwpShutdownInProgress' : [ 0x13a1, ['unsigned char']], + 'EtwpSecurityProviderPID' : [ 0x13a4, ['unsigned long']], +} ], + '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x18, { + 'RunRefs' : [ 0x0, ['pointer64', ['_EX_RUNDOWN_REF']]], + 'PoolToFree' : [ 0x8, ['pointer64', ['void']]], + 'RunRefSize' : [ 0x10, ['unsigned long']], + 'Number' : [ 0x14, ['unsigned long']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x480, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x38, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0xa0, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0xa8, ['pointer64', ['void']]], + 'DynamicPart' : [ 0xb0, ['pointer64', ['unsigned long']]], + 'DefaultDacl' : [ 0xb8, ['pointer64', ['_ACL']]], + 'TokenType' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xc8, ['unsigned long']], + 'TokenInUse' : [ 0xcc, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xd0, ['unsigned long']], + 'MandatoryPolicy' : [ 0xd4, ['unsigned long']], + 'LogonSession' : [ 0xd8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xe0, ['_LUID']], + 'SidHash' : [ 0xe8, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x1f8, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x308, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x310, ['pointer64', ['void']]], + 'Capabilities' : [ 0x318, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x320, ['unsigned long']], + 'CapabilitiesHash' : [ 0x328, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x438, ['pointer64', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x440, ['pointer64', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x448, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x450, ['pointer64', ['void']]], + 'TrustLinkedToken' : [ 0x458, ['pointer64', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x460, ['pointer64', ['void']]], + 'TokenSidValues' : [ 0x468, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'IndexEntry' : [ 0x470, ['pointer64', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], + 'VariablePart' : [ 0x478, ['unsigned long long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0xb0, { + 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x8, ['_LUID']], + 'BuddyLogonId' : [ 0x10, ['_LUID']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'pDeviceMap' : [ 0x28, ['pointer64', ['_DEVICE_MAP']]], + 'Token' : [ 0x30, ['pointer64', ['void']]], + 'AccountName' : [ 0x38, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x48, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x58, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x70, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x78, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'RevocationBlock' : [ 0x80, ['_OB_HANDLE_REVOCATION_BLOCK']], + 'ServerSilo' : [ 0xa0, ['pointer64', ['_EJOB']]], + 'SiblingAuthId' : [ 0xa8, ['_LUID']], +} ], + '_OBJECT_HEADER' : [ 0x38, { + 'PointerCount' : [ 0x0, ['long long']], + 'HandleCount' : [ 0x8, ['long long']], + 'NextToFree' : [ 0x8, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0x18, ['unsigned char']], + 'TraceFlags' : [ 0x19, ['unsigned char']], + 'DbgRefTrace' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0x1a, ['unsigned char']], + 'Flags' : [ 0x1b, ['unsigned char']], + 'NewObject' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0x1b, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0x1b, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0x1b, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0x1b, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare' : [ 0x1c, ['unsigned long']], + 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], + 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], + 'Body' : [ 0x30, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], + 'Reserved' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { + 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { + 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0x18, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], + 'Reserved' : [ 0x1a, ['unsigned short']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x10, { + 'SecurityDescriptor' : [ 0x0, ['pointer64', ['void']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_REVOCATION_INFO' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'RevocationBlock' : [ 0x10, ['pointer64', ['_OB_HANDLE_REVOCATION_BLOCK']]], + 'Padding1' : [ 0x18, ['array', 4, ['unsigned char']]], + 'Padding2' : [ 0x1c, ['array', 4, ['unsigned char']]], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x28, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'EntryLink' : [ 0x10, ['pointer64', ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0x18, ['unsigned long']], + 'HashIndex' : [ 0x1c, ['unsigned short']], + 'DirectoryLocked' : [ 0x1e, ['unsigned char']], + 'LockedExclusive' : [ 0x1f, ['unsigned char']], + 'LockStateSignature' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0x158, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x138, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0x140, ['unsigned long']], + 'NamespaceEntry' : [ 0x148, ['pointer64', ['void']]], + 'Flags' : [ 0x150, ['unsigned long']], +} ], + '_OBP_SILODRIVERSTATE' : [ 0x2e0, { + 'SystemDeviceMap' : [ 0x0, ['pointer64', ['_DEVICE_MAP']]], + 'SystemDosDeviceState' : [ 0x8, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], + 'DeviceMapLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'PrivateNamespaceLookupTable' : [ 0x80, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], +} ], + '_DEVICE_MAP' : [ 0x40, { + 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x18, ['long']], + 'DriveMap' : [ 0x1c, ['unsigned long']], + 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], +} ], + '_WHEAP_INFO_BLOCK' : [ 0x18, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x8, ['pointer64', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x10, ['pointer64', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x428, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x10, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x14, ['unsigned long']], + 'ErrorCount' : [ 0x18, ['long']], + 'RecordCount' : [ 0x1c, ['unsigned long']], + 'RecordLength' : [ 0x20, ['unsigned long']], + 'PoolTag' : [ 0x24, ['unsigned long']], + 'Type' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x30, ['pointer64', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x38, ['pointer64', ['void']]], + 'SectionCount' : [ 0x40, ['unsigned long']], + 'SectionLength' : [ 0x44, ['unsigned long']], + 'TickCountAtLastError' : [ 0x48, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x50, ['unsigned long']], + 'TotalErrors' : [ 0x54, ['unsigned long']], + 'Deferred' : [ 0x58, ['unsigned char']], + 'Descriptor' : [ 0x59, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xf0, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x10, ['unsigned long']], + 'ProcessorNumber' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x1c, ['long']], + 'ErrorSource' : [ 0x20, ['pointer64', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x28, ['_WHEA_ERROR_RECORD']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x30, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'ConnectLock' : [ 0x8, ['_KEVENT']], + 'LineMasked' : [ 0x20, ['unsigned char']], + 'InterruptList' : [ 0x28, ['pointer64', ['_KINTERRUPT']]], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { + 'ImpersonationData' : [ 0x0, ['unsigned long long']], + 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { + 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], +} ], + '_POP_FX_PLUGIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long long']], + 'WorkQueue' : [ 0x20, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x60, ['pointer64', ['void']]], + 'AcceptProcessorNotification' : [ 0x68, ['pointer64', ['void']]], + 'AcceptAcpiNotification' : [ 0x70, ['pointer64', ['void']]], + 'WorkOrderCount' : [ 0x78, ['unsigned long']], + 'WorkOrders' : [ 0x80, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x50, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x8, ['unsigned long']], + 'SenderPort' : [ 0x10, ['pointer64', ['void']]], + 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'PortContext' : [ 0x20, ['pointer64', ['void']]], + 'Request' : [ 0x28, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long long']], + 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], + 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], + 'MaxSectionSize' : [ 0x28, ['unsigned long long']], + 'MaxViewSize' : [ 0x30, ['unsigned long long']], + 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], + 'DupObjectTypes' : [ 0x40, ['unsigned long']], + 'Reserved' : [ 0x44, ['unsigned long']], +} ], + '_MI_PARTITION_SEGMENTS' : [ 0x180, { + 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], + 'UnusedSegmentCleanup' : [ 0x18, ['_KEVENT']], + 'SubsectionDeletePtes' : [ 0x30, ['unsigned long long']], + 'DereferenceSegmentHeader' : [ 0x38, ['_MMDEREFERENCE_SEGMENT_HEADER']], + 'DeleteOnCloseList' : [ 0x68, ['_LIST_ENTRY']], + 'DeleteOnCloseTimer' : [ 0x78, ['_KTIMER']], + 'DeleteOnCloseTimerActive' : [ 0xb8, ['unsigned char']], + 'DeleteOnCloseCount' : [ 0xbc, ['unsigned long']], + 'UnusedSegmentList' : [ 0xc0, ['_LIST_ENTRY']], + 'UnusedSubsectionList' : [ 0xd0, ['_LIST_ENTRY']], + 'DeleteSubsectionList' : [ 0xe0, ['_LIST_ENTRY']], + 'ControlAreaDeleteEvent' : [ 0xf0, ['_KEVENT']], + 'ControlAreaDeleteList' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'SegmentListLock' : [ 0x140, ['long']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { + 'Version' : [ 0x0, ['unsigned char']], + 'DataCount' : [ 0x1, ['unsigned char']], + 'SemanticType' : [ 0x2, ['unsigned char']], + 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], + 'AttributeType' : [ 0x0, ['unsigned long']], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x150, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x108, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x148, ['unsigned long']], +} ], + '_HEAP_UNPACKED_ENTRY' : [ 0x10, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], +} ], + '_PEP_ACPI_SPB_RESOURCE' : [ 0x28, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], + 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], + 'ResourceSourceName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x18, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x20, ['unsigned short']], +} ], + '_DISPATCHER_HEADER' : [ 0x18, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Minimal' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved4' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_ETW_GUID_ENTRY' : [ 0x190, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x10, ['long long']], + 'Guid' : [ 0x18, ['_GUID']], + 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x40, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x170, ['pointer64', ['_ETW_FILTER_HEADER']]], + 'HostSilo' : [ 0x178, ['unsigned char']], + 'Lock' : [ 0x180, ['_EX_PUSH_LOCK']], + 'LockOwner' : [ 0x188, ['pointer64', ['_ETHREAD']]], +} ], + '_VI_POOL_ENTRY' : [ 0x20, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'WaitResponse' : [ 0xc, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], +} ], + '_HEAP_COUNTERS' : [ 0x78, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], + 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], + 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], + 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], + 'TotalSegments' : [ 0x20, ['unsigned long']], + 'TotalUCRs' : [ 0x24, ['unsigned long']], + 'CommittOps' : [ 0x28, ['unsigned long']], + 'DeCommitOps' : [ 0x2c, ['unsigned long']], + 'LockAcquires' : [ 0x30, ['unsigned long']], + 'LockCollisions' : [ 0x34, ['unsigned long']], + 'CommitRate' : [ 0x38, ['unsigned long']], + 'DecommittRate' : [ 0x3c, ['unsigned long']], + 'CommitFailures' : [ 0x40, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], + 'PollIntervalCounter' : [ 0x48, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x4c, ['unsigned long']], + 'HeapPollInterval' : [ 0x50, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x54, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x58, ['unsigned long']], + 'InBlockDeccommits' : [ 0x5c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x60, ['unsigned long long']], + 'HighWatermarkSize' : [ 0x68, ['unsigned long long']], + 'LastPolledSize' : [ 0x70, ['unsigned long long']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_MI_VISIBLE_PARTITION' : [ 0x1100, { + 'LowestPhysicalPage' : [ 0x0, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x8, ['unsigned long long']], + 'NumberOfPhysicalPages' : [ 0x10, ['unsigned long long']], + 'NumberOfPagingFiles' : [ 0x18, ['unsigned long']], + 'PagingFile' : [ 0x20, ['array', 16, ['pointer64', ['_MMPAGING_FILE']]]], + 'AvailablePages' : [ 0xc0, ['unsigned long long']], + 'ResidentAvailablePages' : [ 0x100, ['unsigned long long']], + 'TotalCommittedPages' : [ 0x108, ['unsigned long long']], + 'ModifiedPageListHead' : [ 0x140, ['_MMPFNLIST']], + 'ModifiedNoWritePageListHead' : [ 0x180, ['_MMPFNLIST']], + 'TotalCommitLimit' : [ 0x1a8, ['unsigned long long']], + 'TotalPagesForPagingFile' : [ 0x1b0, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x1b8, ['unsigned long long']], + 'ProcessLockedFilePages' : [ 0x1c0, ['unsigned long long']], + 'ChargeCommitmentFailures' : [ 0x1c8, ['array', 4, ['unsigned long']]], + 'PageTableBitmapPages' : [ 0x1d8, ['unsigned long long']], + 'PageFileTraceIndex' : [ 0x1e0, ['long']], + 'PageFileTraces' : [ 0x1e8, ['array', 32, ['_MI_PAGEFILE_TRACES']]], +} ], + '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x20, { + 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'Rundown' : [ 0x18, ['_EX_RUNDOWN_REF']], +} ], + '_SYSPTES_HEADER' : [ 0x118, { + 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], + 'Count' : [ 0x100, ['unsigned long long']], + 'NumberOfEntries' : [ 0x108, ['unsigned long long']], + 'NumberOfEntriesPeak' : [ 0x110, ['unsigned long long']], +} ], + '_EXCEPTION_RECORD' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], + 'NumberParameters' : [ 0x18, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x54, ['unsigned long']], + 'ProfileChangingEject' : [ 0x58, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], + 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x68, ['unsigned char']], + 'DeleteType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_PPM_PLATFORM_STATE' : [ 0x180, { + 'Latency' : [ 0x0, ['unsigned long']], + 'BreakEvenDuration' : [ 0x4, ['unsigned long']], + 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], + 'TransitionDebugger' : [ 0x30, ['unsigned char']], + 'Platform' : [ 0x31, ['unsigned char']], + 'DependencyListCount' : [ 0x34, ['unsigned long']], + 'Processors' : [ 0x38, ['_KAFFINITY_EX']], + 'Name' : [ 0xe0, ['_UNICODE_STRING']], + 'DependencyLists' : [ 0xf0, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], + 'Synchronization' : [ 0xf8, ['_PPM_COORDINATED_SYNCHRONIZATION']], + 'EnterTime' : [ 0x100, ['unsigned long long']], + 'RefCount' : [ 0x140, ['long']], + 'CacheAlign0' : [ 0x140, ['array', 64, ['unsigned char']]], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x58, { + 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'AppContainerNumber' : [ 0x30, ['unsigned long']], + 'PackageSid' : [ 0x38, ['pointer64', ['void']]], + 'CapabilitiesHash' : [ 0x40, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x48, ['pointer64', ['void']]], + 'SecurityAttributes' : [ 0x50, ['pointer64', ['void']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x10, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { + 'Key' : [ 0x0, ['pointer64', ['void']]], + 'Index' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x20, ['long']], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'WatchdogTimerInfo' : [ 0x30, ['pointer64', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'FloppyMedia' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_KAPC' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], + 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], + 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Reserved' : [ 0x20, ['array', 3, ['pointer64', ['void']]]], + 'NormalContext' : [ 0x38, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], + 'ApcStateIndex' : [ 0x50, ['unsigned char']], + 'ApcMode' : [ 0x51, ['unsigned char']], + 'Inserted' : [ 0x52, ['unsigned char']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { + 'Va' : [ 0x0, ['unsigned long long']], + 'Key' : [ 0x8, ['unsigned long']], + 'Pattern' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolType' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], + 'SlushSize' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ulTargetPlatform' : [ 0x8, ['unsigned long']], + 'ullContextMinimum' : [ 0x10, ['unsigned long long']], + 'guPlatform' : [ 0x18, ['_GUID']], + 'guMinPlatform' : [ 0x28, ['_GUID']], + 'ulContextSource' : [ 0x38, ['unsigned long']], + 'ulElementCount' : [ 0x3c, ['unsigned long']], + 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x30, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x18, ['_KEVENT']], +} ], + '_ETW_HASH_BUCKET' : [ 0x38, { + 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], + 'BucketLock' : [ 0x30, ['_EX_PUSH_LOCK']], +} ], + '_TEB_ACTIVE_FRAME' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0x18, ['pointer64', ['void']]], + 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], + 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], + 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x30, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x10, ['unsigned char']], + 'BlockState' : [ 0x11, ['unsigned char']], + 'WaitKey' : [ 0x12, ['unsigned short']], + 'SpareLong' : [ 0x14, ['long']], + 'Thread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NotificationQueue' : [ 0x18, ['pointer64', ['_KQUEUE']]], + 'Object' : [ 0x20, ['pointer64', ['void']]], + 'SparePtr' : [ 0x28, ['pointer64', ['void']]], +} ], + '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { + 'Continue' : [ 0x0, ['unsigned long']], + 'TraceFlag' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], + 'MinimumThrottle' : [ 0x50, ['unsigned long']], + 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1ed8' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1eda' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1ed8']], + 'Private' : [ 0x0, ['__unnamed_1eda']], +} ], + '_KTIMER2' : [ 0x88, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'RbNodes' : [ 0x18, ['array', 2, ['_RTL_BALANCED_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'DueTime' : [ 0x48, ['array', 2, ['unsigned long long']]], + 'Period' : [ 0x58, ['long long']], + 'Callback' : [ 0x60, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x68, ['pointer64', ['void']]], + 'DisableCallback' : [ 0x70, ['pointer64', ['void']]], + 'DisableContext' : [ 0x78, ['pointer64', ['void']]], + 'AbsoluteSystemTime' : [ 0x80, ['unsigned char']], + 'TypeFlags' : [ 0x81, ['unsigned char']], + 'Unused' : [ 0x81, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IdleResilient' : [ 0x81, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HighResolution' : [ 0x81, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'NoWake' : [ 0x81, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Unused1' : [ 0x81, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CollectionIndex' : [ 0x82, ['array', 2, ['unsigned char']]], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x20, { + 'IssueType' : [ 0x0, ['unsigned long long']], + 'Address' : [ 0x8, ['pointer64', ['void']]], + 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x10, { + 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], +} ], + '_KMUTANT' : [ 0x38, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], + 'Abandoned' : [ 0x30, ['unsigned char']], + 'ApcDisable' : [ 0x31, ['unsigned char']], +} ], + '_OBJECT_REF_INFO' : [ 0x28, { + 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x20, ['unsigned short']], + 'MaxStacks' : [ 0x22, ['unsigned short']], + 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x18, { + 'DynamicRelocations' : [ 0x0, ['pointer64', ['void']]], + 'SecurityContext' : [ 0x8, ['_IMAGE_SECURITY_CONTEXT']], + 'StrongImageReference' : [ 0x10, ['unsigned long long']], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x260, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x10, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0x18, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x20, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x130, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x240, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x248, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x250, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x258, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x48, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], + 'TagIndex' : [ 0x10, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], + 'TagName' : [ 0x14, ['array', 24, ['wchar']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 28, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NT_TIB' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x8, ['pointer64', ['void']]], + 'StackLimit' : [ 0x10, ['pointer64', ['void']]], + 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], + 'FiberData' : [ 0x20, ['pointer64', ['void']]], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], + 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PPM_IDLE_STATES' : [ 0x418, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'UnaccountedTransition' : [ 0x5, ['unsigned char']], + 'IdleDurationLimited' : [ 0x6, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0xe0, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x188, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x190, ['pointer64', ['void']]], + 'IdleExecute' : [ 0x198, ['pointer64', ['void']]], + 'IdlePreselect' : [ 0x1a0, ['pointer64', ['void']]], + 'IdleTest' : [ 0x1a8, ['pointer64', ['void']]], + 'IdleAvailabilityCheck' : [ 0x1b0, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x1b8, ['pointer64', ['void']]], + 'IdleCancel' : [ 0x1c0, ['pointer64', ['void']]], + 'IdleIsHalted' : [ 0x1c8, ['pointer64', ['void']]], + 'IdleInitiateWake' : [ 0x1d0, ['pointer64', ['void']]], + 'PrepareInfo' : [ 0x1d8, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'DeepIdleSnapshot' : [ 0x230, ['_KAFFINITY_EX']], + 'Tracing' : [ 0x2d8, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'CoordinatedTracing' : [ 0x2e0, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'ProcessorMenu' : [ 0x2e8, ['_PPM_SELECTION_MENU']], + 'CoordinatedMenu' : [ 0x2f8, ['_PPM_SELECTION_MENU']], + 'CoordinatedSelection' : [ 0x308, ['_PPM_COORDINATED_SELECTION']], + 'State' : [ 0x320, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x28, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x8, ['_LIST_ENTRY']], + 'CsAccountingBlocks' : [ 0x18, ['unsigned char']], + 'BlocksDrips' : [ 0x19, ['unsigned char']], + 'PreallocatedVetoCount' : [ 0x1c, ['unsigned long']], + 'PreallocatedVetoList' : [ 0x20, ['pointer64', ['_PPM_VETO_ENTRY']]], +} ], + '_PEB' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['pointer64', ['void']]], + 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], + 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], + 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], + 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], + 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], + 'SparePvoid0' : [ 0x90, ['pointer64', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], + 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], + 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], + 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], + 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], + 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], + 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], + 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], + 'pUnused' : [ 0x368, ['pointer64', ['void']]], + 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['_LIST_ENTRY']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['pointer64', ['void']]]], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Address' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x98, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], + 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], + 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], + 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], + 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], + 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x50, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], + 'LoggerId' : [ 0x58, ['unsigned short']], + 'Flags' : [ 0x5a, ['unsigned char']], + 'ShutDownRequested' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x5a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x5a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Wow' : [ 0x5a, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], + 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], + 'UserPagesReused' : [ 0x80, ['unsigned long']], + 'EventsLostCount' : [ 0x88, ['pointer64', ['unsigned long']]], + 'BuffersLostCount' : [ 0x90, ['pointer64', ['unsigned long']]], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x8, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x8, ['unsigned long long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'PendingFreeDepth' : [ 0x108, ['long']], + 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_KGATE' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x20, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], +} ], + '_DRIVER_EXTENSION' : [ 0x50, { + 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x8, ['pointer64', ['void']]], + 'Count' : [ 0x10, ['unsigned long']], + 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x38, ['pointer64', ['void']]], + 'DvCallbacks' : [ 0x40, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x48, ['pointer64', ['void']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x88, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x10, ['unsigned long long']], + 'ItemCount' : [ 0x18, ['long']], + 'Dpc' : [ 0x20, ['_KDPC']], + 'WorkItem' : [ 0x60, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x80, ['pointer64', ['void']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x58, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_KINTERRUPT' : [ 0x100, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], + 'MessageIndex' : [ 0x28, ['unsigned long']], + 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], + 'SpinLock' : [ 0x38, ['unsigned long long']], + 'TickCount' : [ 0x40, ['unsigned long']], + 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], + 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], + 'Vector' : [ 0x58, ['unsigned long']], + 'Irql' : [ 0x5c, ['unsigned char']], + 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], + 'FloatingSave' : [ 0x5e, ['unsigned char']], + 'Connected' : [ 0x5f, ['unsigned char']], + 'Number' : [ 0x60, ['unsigned long']], + 'ShareVector' : [ 0x64, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x65, ['unsigned char']], + 'ActiveCount' : [ 0x66, ['unsigned short']], + 'InternalState' : [ 0x68, ['long']], + 'Mode' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x74, ['unsigned long']], + 'DispatchCount' : [ 0x78, ['unsigned long']], + 'PassiveEvent' : [ 0x80, ['pointer64', ['_KEVENT']]], + 'TrapFrame' : [ 0x88, ['pointer64', ['_KTRAP_FRAME']]], + 'DisconnectData' : [ 0x90, ['pointer64', ['void']]], + 'ServiceThread' : [ 0x98, ['pointer64', ['_KTHREAD']]], + 'ConnectionData' : [ 0xa0, ['pointer64', ['_INTERRUPT_CONNECTION_DATA']]], + 'IntTrackEntry' : [ 0xa8, ['pointer64', ['void']]], + 'IsrDpcStats' : [ 0xb0, ['_ISRDPCSTATS']], + 'RedirectObject' : [ 0xf0, ['pointer64', ['void']]], + 'Padding' : [ 0xf8, ['array', 8, ['unsigned char']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x98, { + 'FileName' : [ 0x0, ['pointer64', ['unsigned short']]], + 'BaseName' : [ 0x8, ['pointer64', ['unsigned short']]], + 'RegRootName' : [ 0x10, ['pointer64', ['unsigned short']]], + 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x20, ['unsigned long']], + 'CmHiveFlags' : [ 0x24, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], + 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'HiveMounted' : [ 0x38, ['unsigned char']], + 'ThreadFinished' : [ 0x39, ['unsigned char']], + 'ThreadStarted' : [ 0x3a, ['unsigned char']], + 'Allocate' : [ 0x3b, ['unsigned char']], + 'WinPERequired' : [ 0x3c, ['unsigned char']], + 'StartEvent' : [ 0x40, ['_KEVENT']], + 'FinishedEvent' : [ 0x58, ['_KEVENT']], + 'MountLock' : [ 0x70, ['_KEVENT']], + 'FilePath' : [ 0x88, ['_UNICODE_STRING']], +} ], + '_HMAP_DIRECTORY' : [ 0x2000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], +} ], + '_CONTEXT' : [ 0x4d0, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5Home' : [ 0x20, ['unsigned long long']], + 'P6Home' : [ 0x28, ['unsigned long long']], + 'ContextFlags' : [ 0x30, ['unsigned long']], + 'MxCsr' : [ 0x34, ['unsigned long']], + 'SegCs' : [ 0x38, ['unsigned short']], + 'SegDs' : [ 0x3a, ['unsigned short']], + 'SegEs' : [ 0x3c, ['unsigned short']], + 'SegFs' : [ 0x3e, ['unsigned short']], + 'SegGs' : [ 0x40, ['unsigned short']], + 'SegSs' : [ 0x42, ['unsigned short']], + 'EFlags' : [ 0x44, ['unsigned long']], + 'Dr0' : [ 0x48, ['unsigned long long']], + 'Dr1' : [ 0x50, ['unsigned long long']], + 'Dr2' : [ 0x58, ['unsigned long long']], + 'Dr3' : [ 0x60, ['unsigned long long']], + 'Dr6' : [ 0x68, ['unsigned long long']], + 'Dr7' : [ 0x70, ['unsigned long long']], + 'Rax' : [ 0x78, ['unsigned long long']], + 'Rcx' : [ 0x80, ['unsigned long long']], + 'Rdx' : [ 0x88, ['unsigned long long']], + 'Rbx' : [ 0x90, ['unsigned long long']], + 'Rsp' : [ 0x98, ['unsigned long long']], + 'Rbp' : [ 0xa0, ['unsigned long long']], + 'Rsi' : [ 0xa8, ['unsigned long long']], + 'Rdi' : [ 0xb0, ['unsigned long long']], + 'R8' : [ 0xb8, ['unsigned long long']], + 'R9' : [ 0xc0, ['unsigned long long']], + 'R10' : [ 0xc8, ['unsigned long long']], + 'R11' : [ 0xd0, ['unsigned long long']], + 'R12' : [ 0xd8, ['unsigned long long']], + 'R13' : [ 0xe0, ['unsigned long long']], + 'R14' : [ 0xe8, ['unsigned long long']], + 'R15' : [ 0xf0, ['unsigned long long']], + 'Rip' : [ 0xf8, ['unsigned long long']], + 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], + 'Header' : [ 0x100, ['array', 2, ['_M128A']]], + 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], + 'Xmm0' : [ 0x1a0, ['_M128A']], + 'Xmm1' : [ 0x1b0, ['_M128A']], + 'Xmm2' : [ 0x1c0, ['_M128A']], + 'Xmm3' : [ 0x1d0, ['_M128A']], + 'Xmm4' : [ 0x1e0, ['_M128A']], + 'Xmm5' : [ 0x1f0, ['_M128A']], + 'Xmm6' : [ 0x200, ['_M128A']], + 'Xmm7' : [ 0x210, ['_M128A']], + 'Xmm8' : [ 0x220, ['_M128A']], + 'Xmm9' : [ 0x230, ['_M128A']], + 'Xmm10' : [ 0x240, ['_M128A']], + 'Xmm11' : [ 0x250, ['_M128A']], + 'Xmm12' : [ 0x260, ['_M128A']], + 'Xmm13' : [ 0x270, ['_M128A']], + 'Xmm14' : [ 0x280, ['_M128A']], + 'Xmm15' : [ 0x290, ['_M128A']], + 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], + 'VectorControl' : [ 0x4a0, ['unsigned long long']], + 'DebugControl' : [ 0x4a8, ['unsigned long long']], + 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x18, { + 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1fa4' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1fa4']], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x10, { + 'Port' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['pointer64', ['void']]], +} ], + '_EX_WORK_QUEUE' : [ 0x2d0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x2b0, ['pointer64', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x2b8, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x2bc, ['unsigned long']], + 'ThreadCount' : [ 0x2c0, ['long']], + 'MinThreads' : [ 0x2c4, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x2c4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x2c8, ['long']], + 'QueueIndex' : [ 0x2cc, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x20, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], + 'Tag' : [ 0x18, ['unsigned long long']], +} ], + '_MI_FLAGS' : [ 0x4, { + 'EntireFlags' : [ 0x0, ['long']], + 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ZeroNonCachedByConverting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ZeroWriteCombinedByConverting' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], +} ], + '_INTERFACE' : [ 0x20, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_PS_PROPERTY_SET' : [ 0x18, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['unsigned long long']], +} ], + '_LAZY_WRITER' : [ 0x88, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x40, ['_KTIMER']], + 'ScanActive' : [ 0x80, ['unsigned char']], + 'OtherWork' : [ 0x81, ['unsigned char']], + 'PendingTeardownScan' : [ 0x82, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], + 'PendingPowerScan' : [ 0x85, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x86, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x70, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], + 'DataPortMapped' : [ 0x10, ['unsigned char']], + 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], + 'AddrPortMapped' : [ 0x20, ['unsigned char']], + 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], + 'CmdPortMapped' : [ 0x30, ['unsigned char']], + 'NextSlotNumber' : [ 0x34, ['unsigned long']], + 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x60, ['unsigned long']], + 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { + 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'AccessRights' : [ 0x0, ['unsigned char']], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x10, { + 'Sid' : [ 0x0, ['pointer64', ['void']]], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_IO_WORKITEM' : [ 0x58, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x20, ['pointer64', ['void']]], + 'IoObject' : [ 0x28, ['pointer64', ['void']]], + 'Context' : [ 0x30, ['pointer64', ['void']]], + 'WorkingOnBehalfClient' : [ 0x38, ['pointer64', ['void']]], + 'Type' : [ 0x40, ['unsigned long']], + 'ActivityId' : [ 0x44, ['_GUID']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMWSLE_HASH' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long long']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_UNEXPECTED_INTERRUPT' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x88, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x40, ['_KDPC']], + 'WorkOrder' : [ 0x80, ['pointer64', ['_POP_FX_WORK_ORDER']]], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], + 'SecureInfo' : [ 0x10, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x10, ['_RTL_BITMAP_EX']], + 'InPageSupport' : [ 0x10, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'LargePage' : [ 0x10, ['pointer64', ['_MI_LARGEPAGE_MEMORY_INFO']]], + 'CreatingThread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'PebTeb' : [ 0x10, ['_MI_SUB64K_FREE_RANGES']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x30, { + 'AllocAddress' : [ 0x0, ['unsigned long long']], + 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x10, ['unsigned long long']], + 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x20, ['unsigned long long']], + 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], + 'CallCount' : [ 0x20, ['unsigned long']], +} ], + '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Luid' : [ 0x20, ['unsigned long long']], + 'IndexIntoGlobalSingletonTable' : [ 0x28, ['unsigned long long']], + 'MarkedForDeletion' : [ 0x30, ['unsigned char']], +} ], + '_KTIMER2_COLLECTION' : [ 0x18, { + 'Tree' : [ 0x0, ['_RTL_RB_TREE']], + 'NextDueTime' : [ 0x10, ['unsigned long long']], +} ], + '_MIPFNBLINK' : [ 0x8, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeBlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 56, native_type='unsigned long long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 60, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 62, native_type='unsigned long long')]], + 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], + 'Lock' : [ 0x0, ['long long']], + 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VF_TRACKER_STAMP' : [ 0x10, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'OldIrql' : [ 0x8, ['unsigned char']], + 'NewIrql' : [ 0x9, ['unsigned char']], + 'Processor' : [ 0xa, ['unsigned short']], + 'TickCount' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], +} ], + '_MMCLONE_HEADER' : [ 0x18, { + 'NumberOfPtes' : [ 0x0, ['unsigned long long']], + 'NumberOfProcessReferences' : [ 0x8, ['unsigned long long']], + 'ClonePtes' : [ 0x10, ['pointer64', ['_MMCLONE_BLOCK']]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x10, ['unsigned long']], + 'LowboxMap' : [ 0x18, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_PEB_LDR_DATA' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer64', ['void']]], + 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], + 'ShutdownInProgress' : [ 0x48, ['unsigned char']], + 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0xb8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x10, ['unsigned long']], + 'ArgumentStatus' : [ 0x14, ['long']], + 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'Lock' : [ 0x44, ['unsigned long']], + 'Cancel' : [ 0x48, ['unsigned char']], + 'Parent' : [ 0x50, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'ActivityId' : [ 0x58, ['_GUID']], + 'Data' : [ 0x68, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_RH_OP_CONTEXT' : [ 0x48, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x10, ['pointer64', ['_IRP']]], + 'OplockRequestFileObject' : [ 0x18, ['pointer64', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x28, ['pointer64', ['_ETHREAD']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'AtomicLinks' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_KWAIT_CHAIN' : [ 0x8, { + 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_RTL_BITMAP_EX' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_MI_PARTITION_PAGE_LISTS' : [ 0xd40, { + 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer64', ['_MMPFNLIST']]]], + 'FreePageSlist' : [ 0x10, ['array', 2, ['pointer64', ['_SLIST_HEADER']]]], + 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], + 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], + 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], + 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], + 'ModifiedPageListNoReservation' : [ 0x240, ['_MMPFNLIST']], + 'ModifiedPageListByReservation' : [ 0x280, ['array', 16, ['_MMPFNLIST']]], + 'MappedPageListHead' : [ 0x500, ['array', 16, ['_MMPFNLIST']]], + 'BadPageListHead' : [ 0x780, ['_MMPFNLIST']], + 'EnclavePageListHead' : [ 0x7c0, ['_MMPFNLIST']], + 'PageLocationList' : [ 0x7e8, ['array', 8, ['pointer64', ['_MMPFNLIST']]]], + 'StandbyRepurposedByPriority' : [ 0x828, ['array', 8, ['unsigned long']]], + 'MappedPageListHeadEvent' : [ 0x848, ['array', 16, ['_KEVENT']]], + 'DecayClusterTimerHeads' : [ 0x9c8, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], + 'DecayHand' : [ 0x9e8, ['unsigned long']], + 'LastDecayHandUpdateTime' : [ 0x9f0, ['unsigned long long']], + 'LastChanceLdwContext' : [ 0x9f8, ['_MI_LDW_WORK_CONTEXT']], + 'AvailableEventsLock' : [ 0xa40, ['unsigned long long']], + 'AvailablePageWaitStates' : [ 0xa48, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], + 'LowMemoryThreshold' : [ 0xaa8, ['unsigned long long']], + 'HighMemoryThreshold' : [ 0xab0, ['unsigned long long']], + 'TransitionPrivatePages' : [ 0xac0, ['unsigned long long']], + 'StandbyListDiscard' : [ 0xac8, ['unsigned long']], + 'FreeListDiscard' : [ 0xacc, ['unsigned char']], + 'RebuildLargePagesInitialized' : [ 0xacd, ['unsigned char']], + 'RebuildLargePagesItem' : [ 0xad0, ['_MI_REBUILD_LARGE_PAGES']], + 'AddMemoryNotifyList' : [ 0xcf8, ['_LIST_ENTRY']], + 'MirrorListLocks' : [ 0xd08, ['pointer64', ['void']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x330, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], + 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], + 'AlignedFeatures' : [ 0x220, ['unsigned long long']], + 'AllFeatureSize' : [ 0x228, ['unsigned long']], + 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x10, ['unsigned long']], + 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x20, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x28, ['unsigned long']], + 'KcbPushlock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x38, ['pointer64', ['_KTHREAD']]], + 'SharedCount' : [ 0x38, ['long']], + 'SlotHint' : [ 0x40, ['unsigned long']], + 'ParentKcb' : [ 0x48, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x50, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x58, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x60, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x70, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x70, ['unsigned long']], + 'SubKeyCount' : [ 0x70, ['unsigned long']], + 'KeyBodyListHead' : [ 0x78, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x88, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], + 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], + 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_KLOCK_ENTRY' : [ 0x60, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'EntryFlags' : [ 0x18, ['unsigned long']], + 'EntryOffset' : [ 0x18, ['unsigned char']], + 'ThreadLocalFlags' : [ 0x19, ['unsigned char']], + 'WaitingBit' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare0' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'AcquiredByte' : [ 0x1a, ['unsigned char']], + 'AcquiredBit' : [ 0x1a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadFlags' : [ 0x1b, ['unsigned char']], + 'HeadNodeBit' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IoPriorityBit' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare1' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'StaticState' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'AllFlags' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'SpareFlags' : [ 0x1c, ['unsigned long']], + 'LockState' : [ 0x20, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x20, ['pointer64', ['void']]], + 'CrossThreadReleasableAndBusyByte' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x21, ['array', 6, ['unsigned char']]], + 'InTreeByte' : [ 0x27, ['unsigned char']], + 'SessionState' : [ 0x28, ['pointer64', ['void']]], + 'SessionId' : [ 0x28, ['unsigned long']], + 'SessionPad' : [ 0x2c, ['unsigned long']], + 'OwnerTree' : [ 0x30, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x40, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x30, ['unsigned char']], + 'EntryLock' : [ 0x50, ['unsigned long long']], + 'AllBoosts' : [ 0x58, ['unsigned short']], + 'IoBoost' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'CpuBoostsBitmap' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x5a, ['unsigned short']], + 'SparePad' : [ 0x5c, ['unsigned short']], +} ], + '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { + 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], + 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 24, native_type='unsigned long long')]], + 'LocalPartition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2080' : [ 0x10, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0x108, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x10, ['__unnamed_2080']], + 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], + 'u1' : [ 0x28, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x2c, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x30, ['_KAPC']], + 'ByteCount' : [ 0x88, ['unsigned long']], + 'ChargedPages' : [ 0x8c, ['unsigned long']], + 'PagingFile' : [ 0x90, ['pointer64', ['_MMPAGING_FILE']]], + 'File' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xa0, ['pointer64', ['_CONTROL_AREA']]], + 'FileResource' : [ 0xa8, ['pointer64', ['_ERESOURCE']]], + 'WriteOffset' : [ 0xb0, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'Partition' : [ 0xc0, ['pointer64', ['_MI_PARTITION']]], + 'PointerMdl' : [ 0xc8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0xd0, ['_MDL']], + 'Page' : [ 0x100, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PARTITION_COMMIT' : [ 0x80, { + 'PeakCommitment' : [ 0x0, ['unsigned long long']], + 'TotalCommitLimitMaximum' : [ 0x8, ['unsigned long long']], + 'Popups' : [ 0x10, ['array', 2, ['long']]], + 'LowCommitThreshold' : [ 0x18, ['unsigned long long']], + 'HighCommitThreshold' : [ 0x20, ['unsigned long long']], + 'EventLock' : [ 0x28, ['unsigned long long']], + 'SystemCommitReserve' : [ 0x30, ['unsigned long long']], + 'OverCommit' : [ 0x40, ['unsigned long long']], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_CM_RESOURCE_LIST' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x28, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0x10, ['unsigned long long']], + 'PagedAllocs' : [ 0x18, ['unsigned long']], + 'PagedFrees' : [ 0x1c, ['unsigned long']], + 'PagedBytes' : [ 0x20, ['unsigned long long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer64', ['void']]], + 'Pointer1' : [ 0x40, ['pointer64', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x50, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'CycleTime' : [ 0x10, ['unsigned long long']], + 'ContextSwitches' : [ 0x18, ['unsigned long long']], + 'ReadOperationCount' : [ 0x20, ['long long']], + 'WriteOperationCount' : [ 0x28, ['long long']], + 'OtherOperationCount' : [ 0x30, ['long long']], + 'ReadTransferCount' : [ 0x38, ['long long']], + 'WriteTransferCount' : [ 0x40, ['long long']], + 'OtherTransferCount' : [ 0x48, ['long long']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x1d0, { + 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x8, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x10, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x18, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x20, ['unsigned long long']], + 'IdleTimeExpiration' : [ 0x28, ['unsigned long long']], + 'NonInterruptibleTransition' : [ 0x30, ['unsigned char']], + 'PepWokenTransition' : [ 0x31, ['unsigned char']], + 'Class' : [ 0x32, ['unsigned char']], + 'TargetIdleState' : [ 0x34, ['unsigned long']], + 'IdlePolicy' : [ 0x38, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x40, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x48, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xd8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], + 'LastSysTime' : [ 0xdc, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xe0, ['unsigned long long']], + 'WmiInterfaceEnabled' : [ 0xe8, ['long']], + 'FFHThrottleStateInfo' : [ 0xf0, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0x110, ['_KDPC']], + 'PerfActionMask' : [ 0x150, ['long']], + 'HvIdleCheck' : [ 0x158, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x168, ['pointer64', ['_PROC_PERF_CHECK']]], + 'Domain' : [ 0x170, ['pointer64', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x178, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x180, ['pointer64', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x188, ['pointer64', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x190, ['pointer64', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x198, ['unsigned char']], + 'HvTargetState' : [ 0x199, ['unsigned char']], + 'Parked' : [ 0x19a, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x19c, ['unsigned long']], + 'AveragePerformancePercent' : [ 0x1a0, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x1a4, ['unsigned long']], + 'RelativePerformance' : [ 0x1a8, ['unsigned long']], + 'Utility' : [ 0x1ac, ['unsigned long']], + 'AffinitizedUtility' : [ 0x1b0, ['unsigned long']], + 'SnapTimeLast' : [ 0x1b8, ['unsigned long long']], + 'EnergyConsumed' : [ 0x1b8, ['unsigned long long']], + 'ActiveTime' : [ 0x1c0, ['unsigned long long']], + 'TotalTime' : [ 0x1c8, ['unsigned long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SystemChargedPage' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_THREAD_ENERGY_VALUES' : [ 0x40, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x28, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_CC_ASYNC_READ_CONTEXT' : [ 0x20, { + 'CompletionRoutine' : [ 0x0, ['pointer64', ['void']]], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'RequestorMode' : [ 0x18, ['unsigned char']], + 'NestingLevel' : [ 0x1c, ['unsigned long']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_CMHIVE' : [ 0x17a8, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0xa68, ['array', 6, ['pointer64', ['void']]]], + 'NotifyList' : [ 0xa98, ['_LIST_ENTRY']], + 'HiveList' : [ 0xaa8, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0xab8, ['_LIST_ENTRY']], + 'FailedUnloadList' : [ 0xac8, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0xad8, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0xae0, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0xaf0, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0xaf8, ['unsigned long']], + 'DeletedKcbTable' : [ 0xb00, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0xb08, ['unsigned long']], + 'Identity' : [ 0xb0c, ['unsigned long']], + 'HiveLock' : [ 0xb10, ['pointer64', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0xb18, ['pointer64', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0xb20, ['pointer64', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0xb28, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0xb38, ['unsigned long']], + 'FlushLogEntry' : [ 0xb40, ['pointer64', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0xb48, ['unsigned long']], + 'FlushHiveTruncated' : [ 0xb4c, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0xb50, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0xb58, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0xb68, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0xb70, ['pointer64', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0xb78, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0xb80, ['pointer64', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0xb88, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0xb90, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0xb94, ['unsigned long']], + 'ActualFileSize' : [ 0xb98, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0xba0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0xbb0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0xbc0, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0xbd0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0xbe0, ['unsigned long']], + 'SecurityCacheSize' : [ 0xbe4, ['unsigned long']], + 'SecurityHitHint' : [ 0xbe8, ['long']], + 'SecurityCache' : [ 0xbf0, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0xbf8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0xff8, ['unsigned long']], + 'UnloadEventArray' : [ 0x1000, ['pointer64', ['pointer64', ['_KEVENT']]]], + 'RootKcb' : [ 0x1008, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x1010, ['unsigned char']], + 'UnloadWorkItem' : [ 0x1018, ['pointer64', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x1020, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0x1048, ['unsigned char']], + 'GrowOffset' : [ 0x104c, ['unsigned long']], + 'KcbConvertListHead' : [ 0x1050, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0x1060, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0x1068, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0x14f0, ['unsigned long']], + 'TrustClassEntry' : [ 0x14f8, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0x1508, ['unsigned long long']], + 'UnreconciledTime' : [ 0x1510, ['unsigned long long']], + 'CmRm' : [ 0x1518, ['pointer64', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0x1520, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0x1524, ['long']], + 'CreatorOwner' : [ 0x1528, ['pointer64', ['_KTHREAD']]], + 'RundownThread' : [ 0x1530, ['pointer64', ['_KTHREAD']]], + 'LastWriteTime' : [ 0x1538, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0x1540, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0x1558, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0x1570, ['unsigned long']], + 'FlushActive' : [ 0x1570, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0x1570, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0x1570, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0x1570, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0x1574, ['unsigned long']], + 'ReferenceCount' : [ 0x1578, ['long']], + 'UnloadHistoryIndex' : [ 0x157c, ['long']], + 'UnloadHistory' : [ 0x1580, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0x1780, ['unsigned long']], + 'UnaccessedStart' : [ 0x1784, ['unsigned long']], + 'UnaccessedEnd' : [ 0x1788, ['unsigned long']], + 'LoadedKeyCount' : [ 0x178c, ['unsigned long']], + 'HandleClosePending' : [ 0x1790, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0x1798, ['_EX_PUSH_LOCK']], + 'FinalFlushSucceeded' : [ 0x17a0, ['unsigned char']], + 'FailedUnload' : [ 0x17a1, ['unsigned char']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x38, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long long']], + 'DirtyPageThresholdTop' : [ 0x8, ['unsigned long long']], + 'DirtyPageThresholdBottom' : [ 0x10, ['unsigned long long']], + 'DirtyPageTarget' : [ 0x18, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x20, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x28, ['unsigned long long']], + 'AvailableHistory' : [ 0x30, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], + 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0x18, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], + 'DataLength' : [ 0x10, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], +} ], + '_PPM_VETO_ENTRY' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'VetoReason' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'HitCount' : [ 0x18, ['unsigned long long']], + 'LastActivationTime' : [ 0x20, ['unsigned long long']], + 'TotalActiveTime' : [ 0x28, ['unsigned long long']], + 'CsActivationTime' : [ 0x30, ['unsigned long long']], + 'CsActiveTime' : [ 0x38, ['unsigned long long']], +} ], + '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], + 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], + 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], + 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], + 'LoaderFlags' : [ 0x68, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], + 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'ActiveCount' : [ 0xc, ['unsigned long']], + 'PendingNullCount' : [ 0x10, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], + 'PendingDelete' : [ 0x18, ['unsigned long']], + 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], + 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_TERMINATION_PORT' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], + 'Port' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderMaximum'})]], + 'BasePage' : [ 0x18, ['unsigned long long']], + 'PageCount' : [ 0x20, ['unsigned long long']], +} ], + '_CM_INTENT_LOCK' : [ 0x10, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x408, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['unsigned long long']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x28, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x8, ['_RTL_BITMAP']], + 'HashTable' : [ 0x18, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x20, ['unsigned char']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0xa8, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long long']], + 'NonPagedBytes' : [ 0x58, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], + 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], + 'SessionTrims' : [ 0x74, ['unsigned long']], + 'OptionChanges' : [ 0x78, ['unsigned long']], + 'VerifyMode' : [ 0x7c, ['unsigned long']], + 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], + 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], + 'ExecutePageProtections' : [ 0x94, ['unsigned long']], + 'ExecutePageMappings' : [ 0x98, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE' : [ 0x1810, { + 'CurrentSize' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'Epoch' : [ 0x8, ['unsigned long']], + 'Overflow' : [ 0xc, ['unsigned char']], + 'TableEntry' : [ 0x10, ['array', 256, ['_INVERTED_FUNCTION_TABLE_ENTRY']]], +} ], + '_VF_DRIVER_IO_CALLBACKS' : [ 0x100, { + 'DriverInit' : [ 0x0, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x8, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x10, ['pointer64', ['void']]], + 'AddDevice' : [ 0x18, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x20, ['array', 28, ['pointer64', ['void']]]], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0x18, { + 'ActiveThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'WaitList' : [ 0x8, ['pointer64', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x10, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x10, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_UMS_CONTROL_BLOCK' : [ 0x90, { + 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], + 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], + 'UmsQueue' : [ 0x20, ['_KQUEUE']], + 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], + 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], + 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], + 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], + 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], + 'UmsWaitEvent' : [ 0x30, ['_KEVENT']], + 'StagingArea' : [ 0x48, ['pointer64', ['void']]], + 'UmsPrimaryDeliveredContext' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsFlags' : [ 0x50, ['unsigned long']], + 'TebSelector' : [ 0x88, ['unsigned short']], +} ], + '_OWNER_ENTRY' : [ 0x10, { + 'OwnerThread' : [ 0x0, ['unsigned long long']], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x8, ['unsigned long']], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_ETIMER' : [ 0x138, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x40, ['unsigned long long']], + 'TimerApc' : [ 0x48, ['_KAPC']], + 'TimerDpc' : [ 0xa0, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0xe0, ['_LIST_ENTRY']], + 'Period' : [ 0xf0, ['unsigned long']], + 'TimerFlags' : [ 0xf4, ['unsigned char']], + 'ApcAssociated' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0xf5, ['unsigned char']], + 'Spare2' : [ 0xf6, ['unsigned short']], + 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x110, ['pointer64', ['void']]], + 'VirtualizedTimerLinks' : [ 0x118, ['_LIST_ENTRY']], + 'DueTime' : [ 0x128, ['unsigned long long']], + 'CoalescingWindow' : [ 0x130, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { + 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x90, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'Count' : [ 0x28, ['unsigned long long']], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'StackTrace' : [ 0x40, ['array', 8, ['pointer64', ['void']]]], + 'Who' : [ 0x80, ['unsigned long']], + 'Process' : [ 0x88, ['pointer64', ['_EPROCESS']]], +} ], + '_MI_CACHED_PTES' : [ 0x48, { + 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], + 'CachedPteCount' : [ 0x40, ['long']], +} ], + '_EXHANDLE' : [ 0x8, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_2155' : [ 0x8, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x10, { + 'u1' : [ 0x0, ['__unnamed_2155']], + 'EndVa' : [ 0x8, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { + 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_ARBITER_INSTANCE' : [ 0x150, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], + 'Name' : [ 0x10, ['pointer64', ['unsigned short']]], + 'OrderingName' : [ 0x18, ['pointer64', ['unsigned short']]], + 'ResourceType' : [ 0x20, ['long']], + 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x58, ['long']], + 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], + 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], + 'PackResource' : [ 0x80, ['pointer64', ['void']]], + 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], + 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], + 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], + 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], + 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], + 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], + 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], + 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], + 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], + 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], + 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], + 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], + 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], + 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], + 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], + 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], + 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], + 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], + 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], + 'TransactionInProgress' : [ 0x120, ['unsigned char']], + 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], + 'Extension' : [ 0x130, ['pointer64', ['void']]], + 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], + 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SYSTEM_INFORMATION' : [ 0x1bc0, { + 'Pools' : [ 0x0, ['_MI_POOL_STATE']], + 'Sections' : [ 0x100, ['_MI_SECTION_STATE']], + 'SystemImages' : [ 0x380, ['_MI_SYSTEM_IMAGE_STATE']], + 'Sessions' : [ 0x440, ['_MI_SESSION_STATE']], + 'Processes' : [ 0x4d0, ['_MI_PROCESS_STATE']], + 'Hardware' : [ 0x530, ['_MI_HARDWARE_STATE']], + 'SystemVa' : [ 0x600, ['_MI_SYSTEM_VA_STATE']], + 'PageCombines' : [ 0x8c0, ['_MI_COMBINE_STATE']], + 'Partitions' : [ 0xa60, ['_MI_PARTITION_STATE']], + 'Shutdowns' : [ 0xac0, ['_MI_SHUTDOWN_STATE']], + 'Errors' : [ 0xb40, ['_MI_ERROR_STATE']], + 'AccessLog' : [ 0xc00, ['_MI_ACCESS_LOG_STATE']], + 'Debugger' : [ 0xc80, ['_MI_DEBUGGER_STATE']], + 'Standby' : [ 0xdc0, ['_MI_STANDBY_STATE']], + 'SystemPtes' : [ 0xe80, ['_MI_SYSTEM_PTE_STATE']], + 'IoPages' : [ 0x1000, ['_MI_IO_PAGE_STATE']], + 'PagingIo' : [ 0x1060, ['_MI_PAGING_IO_STATE']], + 'CommonPages' : [ 0x10b0, ['_MI_COMMON_PAGE_STATE']], + 'Trims' : [ 0x1180, ['_MI_SYSTEM_TRIM_STATE']], + 'ResTrack' : [ 0x11c0, ['_MI_RESAVAIL_TRACKER']], + 'Cookie' : [ 0x1540, ['unsigned long long']], + 'ZeroingDisabled' : [ 0x1548, ['long']], + 'BootRegistryRuns' : [ 0x1550, ['pointer64', ['pointer64', ['void']]]], + 'FullyInitialized' : [ 0x1558, ['unsigned char']], + 'SafeBooted' : [ 0x1559, ['unsigned char']], + 'LargePfnBitMap' : [ 0x1560, ['_RTL_BITMAP_EX']], + 'TraceLogging' : [ 0x1570, ['pointer64', ['_TlgProvider_t']]], + 'Vs' : [ 0x1580, ['_MI_VISIBLE_STATE']], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x10, ['unsigned long']], + 'Inserted' : [ 0x14, ['unsigned char']], +} ], + '_PPM_SELECTION_DEPENDENCY' : [ 0x18, { + 'Processor' : [ 0x0, ['unsigned long']], + 'Menu' : [ 0x8, ['_PPM_SELECTION_MENU']], +} ], + '__unnamed_21cf' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_21d1' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_21cf']], +} ], + '__unnamed_21d3' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_21d1']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_21d3']], +} ], + '_MI_VISIBLE_STATE' : [ 0x640, { + 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], + 'SessionWsList' : [ 0x50, ['_LIST_ENTRY']], + 'SessionIdBitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'PagedPoolInfo' : [ 0x68, ['_MM_PAGED_POOL_INFO']], + 'MaximumNonPagedPoolInPages' : [ 0xa0, ['unsigned long long']], + 'SizeOfPagedPoolInPages' : [ 0xa8, ['unsigned long long']], + 'SystemPteInfo' : [ 0xb0, ['_MI_SYSTEM_PTE_TYPE']], + 'NonPagedPoolCommit' : [ 0x110, ['unsigned long long']], + 'BootCommit' : [ 0x118, ['unsigned long long']], + 'MdlPagesAllocated' : [ 0x120, ['unsigned long long']], + 'SystemPageTableCommit' : [ 0x128, ['unsigned long long']], + 'SpecialPagesInUse' : [ 0x130, ['unsigned long long']], + 'WsOverheadPages' : [ 0x138, ['unsigned long long']], + 'VadBitmapPages' : [ 0x140, ['unsigned long long']], + 'ProcessCommit' : [ 0x148, ['unsigned long long']], + 'SharedCommit' : [ 0x150, ['unsigned long long']], + 'DriverCommit' : [ 0x158, ['long']], + 'SystemWs' : [ 0x180, ['array', 3, ['_MMSUPPORT']]], + 'MapCacheFailures' : [ 0x468, ['unsigned long']], + 'PagefileHashPages' : [ 0x470, ['unsigned long long']], + 'PteHeader' : [ 0x478, ['_SYSPTES_HEADER']], + 'SessionSpecialPool' : [ 0x590, ['pointer64', ['_MI_SPECIAL_POOL']]], + 'SystemVaTypeCount' : [ 0x598, ['array', 14, ['unsigned long long']]], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_HMAP_TABLE' : [ 0x5000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'HandleCount' : [ 0x28, ['unsigned long']], + 'Handles' : [ 0x30, ['pointer64', ['pointer64', ['void']]]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x58, { + 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], + 'PerfContext' : [ 0x8, ['unsigned long long']], + 'ProcCap' : [ 0x10, ['unsigned long']], + 'ProcFloor' : [ 0x14, ['unsigned long']], + 'PlatformCap' : [ 0x18, ['unsigned long']], + 'ThermalCap' : [ 0x1c, ['unsigned long']], + 'LimitReasons' : [ 0x20, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x28, ['unsigned long long']], + 'TargetPercent' : [ 0x30, ['unsigned long']], + 'SelectedPercent' : [ 0x34, ['unsigned long']], + 'SelectedFrequency' : [ 0x38, ['unsigned long']], + 'PreviousFrequency' : [ 0x3c, ['unsigned long']], + 'PreviousPercent' : [ 0x40, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x44, ['unsigned long']], + 'SelectedState' : [ 0x48, ['unsigned long long']], + 'Force' : [ 0x50, ['unsigned char']], +} ], + '__unnamed_21ef' : [ 0x20, { + 'CallerCompletion' : [ 0x0, ['pointer64', ['void']]], + 'CallerContext' : [ 0x8, ['pointer64', ['void']]], + 'CallerDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_21f2' : [ 0x10, { + 'NotifyDevice' : [ 0x0, ['pointer64', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x8, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0xf8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x30, ['unsigned long long']], + 'WatchdogTimer' : [ 0x38, ['_KTIMER']], + 'WatchdogDpc' : [ 0x78, ['_KDPC']], + 'MinorFunction' : [ 0xb8, ['unsigned char']], + 'PowerStateType' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0xc0, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0xc4, ['unsigned char']], + 'FxDevice' : [ 0xc8, ['pointer64', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0xd0, ['unsigned char']], + 'NotifyPEP' : [ 0xd1, ['unsigned char']], + 'Device' : [ 0xd8, ['__unnamed_21ef']], + 'System' : [ 0xd8, ['__unnamed_21f2']], +} ], + '_MI_ERROR_STATE' : [ 0xb8, { + 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], + 'ProbeRaises' : [ 0x38, ['_MI_PROBE_RAISE_TRACKER']], + 'ForcedCommits' : [ 0x78, ['_MI_FORCED_COMMITS']], + 'WsleFailures' : [ 0x80, ['array', 2, ['unsigned long']]], + 'WsLinear' : [ 0x88, ['unsigned long']], + 'PageHashErrors' : [ 0x8c, ['unsigned long']], + 'CheckZeroCount' : [ 0x90, ['unsigned long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x94, ['long']], + 'BadPagesDetected' : [ 0x98, ['long']], + 'ScrubPasses' : [ 0x9c, ['long']], + 'ScrubBadPagesFound' : [ 0xa0, ['long']], + 'UserViewFailures' : [ 0xa4, ['unsigned long']], + 'UserViewCollisionFailures' : [ 0xa8, ['unsigned long']], + 'ResavailFailures' : [ 0xac, ['_MI_RESAVAIL_FAILURES']], + 'PendingBadPages' : [ 0xb4, ['unsigned char']], + 'InitFailure' : [ 0xb5, ['unsigned char']], + 'StopBadMaps' : [ 0xb6, ['unsigned char']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_MI_USER_VA_INFO' : [ 0x158, { + 'NumberOfCommittedPageTables' : [ 0x0, ['unsigned long']], + 'HighestTopDownAllocationAddress' : [ 0x8, ['pointer64', ['void']]], + 'VadCell' : [ 0x10, ['array', 2, ['_MI_VAD_ALLOCATION_CELL']]], + 'VadBitMapCommitment' : [ 0x60, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x64, ['unsigned long']], + 'VadsBeingDeleted' : [ 0x68, ['long']], + 'NumberOfDebugEnclaves' : [ 0x6c, ['long']], + 'PhysicalMappingCount' : [ 0x70, ['unsigned long long']], + 'LastVadDeletionEvent' : [ 0x78, ['pointer64', ['_KEVENT']]], + 'SubVadRanges' : [ 0x80, ['array', 3, ['_LIST_ENTRY']]], + 'NumaAware' : [ 0xb0, ['unsigned char']], + 'CloneNestingLevel' : [ 0xb8, ['unsigned long long']], + 'PrivateFixupVadCount' : [ 0xc0, ['unsigned long long']], + 'CfgBitMap' : [ 0xc8, ['array', 2, ['_MI_CFG_BITMAP_INFO']]], + 'CommittedPageTableBufferForTopLevel' : [ 0xf8, ['array', 8, ['unsigned long']]], + 'CommittedPageTableBitmaps' : [ 0x118, ['array', 3, ['_RTL_BITMAP']]], + 'PageTableBitmapPages' : [ 0x148, ['array', 3, ['unsigned long']]], +} ], + '_PROC_FEEDBACK' : [ 0x90, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer64', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x28, ['unsigned long long']], + 'UnscaledTime' : [ 0x30, ['unsigned long long']], + 'UnaccountedTime' : [ 0x38, ['long long']], + 'ScaledTime' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x50, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x58, ['unsigned long long']], + 'UserTimeLast' : [ 0x60, ['unsigned long']], + 'KernelTimeLast' : [ 0x64, ['unsigned long']], + 'IdleGenerationNumberLast' : [ 0x68, ['unsigned long long']], + 'HvActiveTimeLast' : [ 0x70, ['unsigned long long']], + 'StallCyclesLast' : [ 0x78, ['unsigned long long']], + 'StallTime' : [ 0x80, ['unsigned long long']], + 'KernelTimesIndex' : [ 0x88, ['unsigned char']], +} ], + '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x38, { + 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'LocationTreeNode' : [ 0x18, ['_RTL_BALANCED_NODE']], + 'StartingIndex' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_220f' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2213' : [ 0x18, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_2215' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2217' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_2219' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_221b' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_221d' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_221f' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2221' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2223' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2225' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2227' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_220f']], + 'Memory' : [ 0x0, ['__unnamed_220f']], + 'Interrupt' : [ 0x0, ['__unnamed_2213']], + 'Dma' : [ 0x0, ['__unnamed_2215']], + 'DmaV3' : [ 0x0, ['__unnamed_2217']], + 'Generic' : [ 0x0, ['__unnamed_220f']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], + 'BusNumber' : [ 0x0, ['__unnamed_221b']], + 'ConfigData' : [ 0x0, ['__unnamed_221d']], + 'Memory40' : [ 0x0, ['__unnamed_221f']], + 'Memory48' : [ 0x0, ['__unnamed_2221']], + 'Memory64' : [ 0x0, ['__unnamed_2223']], + 'Connection' : [ 0x0, ['__unnamed_2225']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_2227']], +} ], + '_POP_THERMAL_ZONE' : [ 0x348, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], + 'State' : [ 0x40, ['unsigned char']], + 'Flags' : [ 0x41, ['unsigned char']], + 'Removing' : [ 0x42, ['unsigned char']], + 'Mode' : [ 0x43, ['unsigned char']], + 'PendingMode' : [ 0x44, ['unsigned char']], + 'ActivePoint' : [ 0x45, ['unsigned char']], + 'PendingActivePoint' : [ 0x46, ['unsigned char']], + 'Critical' : [ 0x47, ['unsigned char']], + 'ThermalStandby' : [ 0x48, ['unsigned char']], + 'OverThrottled' : [ 0x49, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x4c, ['long']], + 'Throttle' : [ 0x50, ['long']], + 'PendingThrottle' : [ 0x54, ['long']], + 'ThrottleReasons' : [ 0x58, ['unsigned long']], + 'LastTime' : [ 0x60, ['unsigned long long']], + 'SampleRate' : [ 0x68, ['unsigned long']], + 'LastTemp' : [ 0x6c, ['unsigned long']], + 'PassiveTimer' : [ 0x70, ['_KTIMER']], + 'PassiveDpc' : [ 0xb0, ['_KDPC']], + 'Info' : [ 0xf0, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0x148, ['_LARGE_INTEGER']], + 'Policy' : [ 0x150, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x168, ['unsigned char']], + 'LastActiveStartTime' : [ 0x170, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x178, ['unsigned long long']], + 'WorkItem' : [ 0x180, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x1a0, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x1b0, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x1c8, ['_KEVENT']], + 'InstanceId' : [ 0x1e0, ['unsigned long']], + 'TelemetryTracker' : [ 0x1e8, ['_POP_THERMAL_TELEMETRY_TRACKER']], + 'Description' : [ 0x338, ['_UNICODE_STRING']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 28, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0x18, { + 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], + 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_MI_REBUILD_LARGE_PAGES' : [ 0x228, { + 'Active' : [ 0x0, ['long']], + 'Timer' : [ 0x4, ['array', 64, ['array', 4, ['_MI_REBUILD_LARGE_PAGE_COUNTDOWN']]]], + 'WorkItem' : [ 0x208, ['_WORK_QUEUE_ITEM']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x48, ['unsigned long']], + 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_HHIVE' : [ 0xa68, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], + 'ReleaseCellRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Allocate' : [ 0x18, ['pointer64', ['void']]], + 'Free' : [ 0x20, ['pointer64', ['void']]], + 'FileWrite' : [ 0x28, ['pointer64', ['void']]], + 'FileRead' : [ 0x30, ['pointer64', ['void']]], + 'HiveLoadFailure' : [ 0x38, ['pointer64', ['void']]], + 'BaseBlock' : [ 0x40, ['pointer64', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x48, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x58, ['unsigned long']], + 'DirtyAlloc' : [ 0x5c, ['unsigned long']], + 'UnreconciledVector' : [ 0x60, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x70, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x74, ['unsigned long']], + 'Cluster' : [ 0x78, ['unsigned long']], + 'Flat' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SystemCacheBacked' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x7d, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x80, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x84, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x88, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x8c, ['unsigned long']], + 'HiveFlags' : [ 0x90, ['unsigned long']], + 'CurrentLog' : [ 0x94, ['unsigned long']], + 'CurrentLogSequence' : [ 0x98, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x9c, ['unsigned long']], + 'CurrentLogOffset' : [ 0xa0, ['unsigned long']], + 'MinimumLogSequence' : [ 0xa4, ['unsigned long']], + 'LogFileSizeCap' : [ 0xa8, ['unsigned long']], + 'LogDataPresent' : [ 0xac, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0xae, ['unsigned char']], + 'BaseBlockDirty' : [ 0xaf, ['unsigned char']], + 'LastLogSwapTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'FirstLogFile' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0xb8, ['unsigned short']], + 'LogEntriesRecovered' : [ 0xba, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0xbc, ['unsigned long']], + 'StorageTypeCount' : [ 0xc0, ['unsigned long']], + 'Version' : [ 0xc4, ['unsigned long']], + 'ViewMap' : [ 0xc8, ['_HVIEW_MAP']], + 'Storage' : [ 0x578, ['array', 2, ['_DUAL']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_ETW_FILTER_HEADER' : [ 0x48, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x8, ['pointer64', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x10, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0x18, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x20, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x28, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x30, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x38, ['pointer64', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x40, ['pointer64', ['_EVENT_FILTER_HEADER']]], +} ], + '_CM_WORKITEM' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x10, ['unsigned long']], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Parameter' : [ 0x20, ['pointer64', ['void']]], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_CM_TRANS' : [ 0xa8, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x30, ['pointer64', ['void']]], + 'CmRm' : [ 0x38, ['pointer64', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x40, ['pointer64', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x48, ['pointer64', ['void']]], + 'KtmUow' : [ 0x50, ['_GUID']], + 'StartLsn' : [ 0x60, ['unsigned long long']], + 'TransState' : [ 0x68, ['unsigned long']], + 'HiveCount' : [ 0x6c, ['unsigned long']], + 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x20, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Count' : [ 0x14, ['unsigned long']], + 'Stamp' : [ 0x18, ['unsigned long']], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x150, { + 'AccountingDisabled' : [ 0x0, ['unsigned char']], + 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], + 'TotalPassiveTime' : [ 0x10, ['array', 20, ['unsigned long long']]], + 'PassiveTimeSnap' : [ 0xb0, ['array', 20, ['unsigned long long']]], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x40, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ProbeMode' : [ 0x10, ['unsigned char']], + 'PagedPoolCharge' : [ 0x14, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_HVIEW_MAP' : [ 0x4b0, { + 'MappedLength' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Directory' : [ 0x18, ['pointer64', ['_HVIEW_MAP_DIRECTORY']]], + 'PagesCharged' : [ 0x20, ['unsigned long']], + 'PinLog' : [ 0x28, ['_HVIEW_MAP_PIN_LOG']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_DISALLOWED_GUIDS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], +} ], + '_HVIEW_MAP_DIRECTORY' : [ 0x400, { + 'Tables' : [ 0x0, ['array', 128, ['pointer64', ['_HVIEW_MAP_TABLE']]]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x10, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0x18, { + 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], + 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1f, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1e, ['unsigned char']], +} ], + '__unnamed_229f' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_22a1' : [ 0x20, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_229f']], +} ], + '_VF_TARGET_DRIVER' : [ 0x38, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x10, ['__unnamed_22a1']], + 'VerifiedData' : [ 0x30, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '__unnamed_22aa' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ac' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ae' : [ 0x10, { + 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], + 'DeviceId' : [ 0x8, ['array', 1, ['wchar']]], +} ], + '__unnamed_22b0' : [ 0x8, { + 'Notification' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_22b2' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_22b4' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_22b6' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_22b8' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ba' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_22bc' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_22aa']], + 'TargetDevice' : [ 0x0, ['__unnamed_22ac']], + 'InstallDevice' : [ 0x0, ['__unnamed_22ac']], + 'CustomNotification' : [ 0x0, ['__unnamed_22ae']], + 'ProfileNotification' : [ 0x0, ['__unnamed_22b0']], + 'PowerNotification' : [ 0x0, ['__unnamed_22b2']], + 'VetoNotification' : [ 0x0, ['__unnamed_22b4']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_22b6']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_22b8']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_22ba']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_22ac']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_22ac']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], + 'u' : [ 0x30, ['__unnamed_22bc']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x10, ['unsigned long']], + 'Unloads' : [ 0x14, ['unsigned long']], + 'BaseName' : [ 0x18, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x58, { + 'Context' : [ 0x0, ['pointer64', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x38, ['unsigned long']], + 'DependencyUsed' : [ 0x3c, ['unsigned long']], + 'DependencyArray' : [ 0x40, ['pointer64', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x48, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x4c, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x50, ['unsigned long']], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], + 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], +} ], + '__unnamed_22d8' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_22d8']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x8, ['unsigned long long']], + 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x28, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x18, ['unsigned long long']], + 'Busy' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_MI_HARDWARE_STATE' : [ 0xa8, { + 'NodeMask' : [ 0x0, ['unsigned long']], + 'NodeGraph' : [ 0x8, ['pointer64', ['unsigned short']]], + 'SystemNodeInformation' : [ 0x10, ['pointer64', ['_MI_SYSTEM_NODE_INFORMATION']]], + 'NumaLastRangeIndex' : [ 0x18, ['unsigned long']], + 'NumaMemoryRanges' : [ 0x20, ['pointer64', ['_HAL_NODE_RANGE']]], + 'NumaTableCaptured' : [ 0x28, ['unsigned char']], + 'NodeShift' : [ 0x29, ['unsigned char']], + 'ChannelMemoryRanges' : [ 0x30, ['pointer64', ['_HAL_CHANNEL_MEMORY_RANGES']]], + 'ChannelShift' : [ 0x38, ['unsigned char']], + 'SecondLevelCacheSize' : [ 0x3c, ['unsigned long']], + 'FirstLevelCacheSize' : [ 0x40, ['unsigned long']], + 'PhysicalAddressBits' : [ 0x44, ['unsigned long']], + 'AllMainMemoryMustBeCached' : [ 0x48, ['unsigned char']], + 'TotalPagesAllowed' : [ 0x50, ['unsigned long long']], + 'SecondaryColorMask' : [ 0x58, ['unsigned long']], + 'SecondaryColors' : [ 0x5c, ['unsigned long']], + 'FlushTbForAttributeChange' : [ 0x60, ['unsigned long']], + 'FlushCacheForAttributeChange' : [ 0x64, ['unsigned long']], + 'FlushCacheForPageAttributeChange' : [ 0x68, ['unsigned long']], + 'CacheFlushPromoteThreshold' : [ 0x6c, ['unsigned long']], + 'FlushTbThreshold' : [ 0x70, ['unsigned long long']], + 'ZeroCostCounts' : [ 0x78, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], + 'PrimaryPfns' : [ 0x98, ['unsigned long long']], + 'HighestPossiblePhysicalPage' : [ 0xa0, ['unsigned long long']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x78, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], + 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], + 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], + 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], + 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], + 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], + 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], + 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], + 'WaitObjectFlagMask' : [ 0x70, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x74, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x76, ['unsigned short']], +} ], + '__unnamed_231c' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], +} ], + '_MI_DECAY_TIMER_LINK' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_231c']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_KPROCESSOR_STATE' : [ 0x5b0, { + 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], + 'ContextFrame' : [ 0xe0, ['_CONTEXT']], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x10, { + 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_HEAP_EXTENDED_ENTRY' : [ 0x10, { + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], +} ], + '_MI_SYSTEM_VA_STATE' : [ 0x2c0, { + 'SystemTablesLock' : [ 0x0, ['unsigned long long']], + 'AvailableSystemCacheVa' : [ 0x8, ['unsigned long long']], + 'DynamicBitMapSystemPtes' : [ 0x10, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapDriverImages' : [ 0x60, ['array', 2, ['_MI_DYNAMIC_BITMAP']]], + 'DynamicBitMapPagedPool' : [ 0x100, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSpecialPool' : [ 0x150, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSystemCache' : [ 0x1a0, ['_MI_DYNAMIC_BITMAP']], + 'WorkingSetListHashStart' : [ 0x1f0, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListHashEnd' : [ 0x1f8, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListIndirectHashStart' : [ 0x200, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'FreeSystemCacheVa' : [ 0x208, ['_KEVENT']], + 'SystemVaLock' : [ 0x220, ['unsigned long long']], + 'DeleteKvaLock' : [ 0x228, ['long']], + 'FreeSystemCache' : [ 0x230, ['_MI_PTE_CHAIN_HEAD']], + 'SystemCacheViewLock' : [ 0x248, ['unsigned long long']], + 'UnusableWsles' : [ 0x250, ['array', 5, ['unsigned long long']]], + 'PossibleWsles' : [ 0x278, ['array', 5, ['unsigned long long']]], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0x18, { + 'DirtyPages' : [ 0x0, ['unsigned long long']], + 'DirtyPagesLastScan' : [ 0x8, ['unsigned long long']], + 'DirtyPagesScheduledLastScan' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], + 'BreakPointHandle' : [ 0x10, ['unsigned long']], + 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], + 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'StackLimit' : [ 0x8, ['unsigned long long']], + 'KernelStack' : [ 0x10, ['unsigned long long']], + 'InitialStack' : [ 0x18, ['unsigned long long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_MI_DEBUGGER_STATE' : [ 0x118, { + 'TransientWrite' : [ 0x0, ['unsigned char']], + 'CodePageEdited' : [ 0x1, ['unsigned char']], + 'DebugPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'PoisonedTb' : [ 0x10, ['unsigned long']], + 'InDebugger' : [ 0x14, ['long']], + 'Pfns' : [ 0x18, ['array', 32, ['pointer64', ['void']]]], +} ], + '_MI_PROCESS_STATE' : [ 0x60, { + 'ColorSeed' : [ 0x0, ['unsigned long']], + 'CloneDereferenceEvent' : [ 0x8, ['_KEVENT']], + 'CloneProtosSListHead' : [ 0x20, ['_SLIST_HEADER']], + 'SystemDllBase' : [ 0x30, ['pointer64', ['void']]], + 'RotatingUniprocessorNumber' : [ 0x38, ['long']], + 'CriticalSectionTimeout' : [ 0x40, ['_LARGE_INTEGER']], + 'ProcessList' : [ 0x48, ['_LIST_ENTRY']], + 'SharedUserDataPte' : [ 0x58, ['pointer64', ['_MMPTE']]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x50, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x30, ['unsigned long']], + 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x40, ['unsigned short']], + 'RangeAttributes' : [ 0x42, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], + 'WorkSpace' : [ 0x48, ['unsigned long long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'HighActiveFlink' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'HighActiveBlink' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 56, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'HiberFileType' : [ 0x16, ['unsigned char']], + 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], + 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_MI_REBUILD_LARGE_PAGE_COUNTDOWN' : [ 0x2, { + 'SecondsLeft' : [ 0x0, ['unsigned char']], + 'SecondsAssigned' : [ 0x1, ['unsigned char']], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_REQUEST_MAILBOX' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x8, ['unsigned long long']], + 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x30, ['pointer64', ['long']]], + 'NodeTargetCount' : [ 0x38, ['long']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_PEB32' : [ 0x460, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['unsigned long']], + 'ImageBaseAddress' : [ 0x8, ['unsigned long']], + 'Ldr' : [ 0xc, ['unsigned long']], + 'ProcessParameters' : [ 0x10, ['unsigned long']], + 'SubSystemData' : [ 0x14, ['unsigned long']], + 'ProcessHeap' : [ 0x18, ['unsigned long']], + 'FastPebLock' : [ 0x1c, ['unsigned long']], + 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], + 'IFEOKey' : [ 0x24, ['unsigned long']], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], + 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['unsigned long']], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['unsigned long']], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], + 'SparePvoid0' : [ 0x50, ['unsigned long']], + 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], + 'AnsiCodePageData' : [ 0x58, ['unsigned long']], + 'OemCodePageData' : [ 0x5c, ['unsigned long']], + 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['unsigned long']], + 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], + 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['unsigned long']], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], + 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['unsigned long']], + 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], + 'CSDVersion' : [ 0x1f0, ['_STRING32']], + 'ActivationContextData' : [ 0x1f8, ['unsigned long']], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], + 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], + 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['unsigned long']], + 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], + 'FlsBitmap' : [ 0x218, ['unsigned long']], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['unsigned long']], + 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], + 'pUnused' : [ 0x238, ['unsigned long']], + 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], + 'TppWorkerpList' : [ 0x254, ['LIST_ENTRY32']], + 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['unsigned long']]], +} ], + '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x10, { + 'Validation' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'TrackedOffsetCallback' : [ 0x8, ['pointer64', ['void']]], +} ], + '_VPB' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], +} ], + '_MI_SESSION_STATE' : [ 0x88, { + 'SystemSession' : [ 0x0, ['_MMSESSION']], + 'CodePageEdited' : [ 0x20, ['unsigned char']], + 'DynamicVaBitBuffer' : [ 0x28, ['pointer64', ['unsigned long']]], + 'DynamicVaBitBufferPages' : [ 0x30, ['unsigned long long']], + 'DynamicPoolBitBuffer' : [ 0x38, ['pointer64', ['unsigned long']]], + 'DynamicVaStart' : [ 0x40, ['pointer64', ['void']]], + 'DynamicPtesBitBuffer' : [ 0x48, ['pointer64', ['unsigned long']]], + 'IdLock' : [ 0x50, ['_EX_PUSH_LOCK']], + 'DetachTimeStamp' : [ 0x58, ['unsigned long']], + 'LeaderProcess' : [ 0x60, ['pointer64', ['_EPROCESS']]], + 'InitializeLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'WorkingSetList' : [ 0x70, ['pointer64', ['_MMWSL']]], + 'WsHashStart' : [ 0x78, ['pointer64', ['_MMWSLE_HASH']]], + 'WsHashEnd' : [ 0x80, ['pointer64', ['_MMWSLE_HASH']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_MMSESSION' : [ 0x20, { + 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'SystemSpaceViewLockPointer' : [ 0x8, ['pointer64', ['_EX_PUSH_LOCK']]], + 'ViewRoot' : [ 0x10, ['_RTL_AVL_TREE']], + 'ViewCount' : [ 0x18, ['unsigned long']], + 'BitmapFailures' : [ 0x1c, ['unsigned long']], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x260, { + 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], + 'Lock' : [ 0x250, ['_EX_PUSH_LOCK']], + 'NumberOfPrivateSpaces' : [ 0x258, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { + 'ClientToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], + 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], +} ], + '_MI_DECAY_TIMER_LINKAGE' : [ 0x8, { + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x60, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], + 'AccessBufferMax' : [ 0x28, ['unsigned long']], + 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x50, ['long']], + 'Flags' : [ 0x54, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x58, ['long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '__unnamed_23a3' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], +} ], + '_MI_PARTITION_CORE' : [ 0x158, { + 'PartitionId' : [ 0x0, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_23a3']], + 'ReferenceCount' : [ 0x8, ['unsigned long long']], + 'ParentPartition' : [ 0x10, ['pointer64', ['_MI_PARTITION']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeInformation' : [ 0x28, ['pointer64', ['_MI_NODE_INFORMATION']]], + 'MdlPhysicalMemoryBlock' : [ 0x30, ['pointer64', ['_MDL']]], + 'MemoryNodeRuns' : [ 0x38, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'MemoryBlockReferences' : [ 0x40, ['unsigned long long']], + 'PfnUnmapWorkItem' : [ 0x48, ['_WORK_QUEUE_ITEM']], + 'PfnUnmapActive' : [ 0x68, ['unsigned char']], + 'PfnUnmapCount' : [ 0x70, ['unsigned long long']], + 'PfnUnmapWaitList' : [ 0x78, ['pointer64', ['void']]], + 'MemoryRuns' : [ 0x80, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'ExitEvent' : [ 0x88, ['_KEVENT']], + 'SystemThreadHandles' : [ 0xa0, ['array', 5, ['pointer64', ['void']]]], + 'PartitionObject' : [ 0xc8, ['pointer64', ['void']]], + 'PartitionObjectHandle' : [ 0xd0, ['pointer64', ['void']]], + 'DynamicMemoryPushLock' : [ 0xd8, ['_EX_PUSH_LOCK']], + 'DynamicMemoryLock' : [ 0xe0, ['long']], + 'TemporaryMemoryEvent' : [ 0xe8, ['_KEVENT']], + 'MemoryEvents' : [ 0x100, ['array', 11, ['pointer64', ['_KEVENT']]]], +} ], + '_MI_PARTITION_MODWRITES' : [ 0x2d0, { + 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], + 'PageFileContract' : [ 0x60, ['_MMPAGE_FILE_EXPANSION']], + 'NumberOfMappedMdls' : [ 0xc0, ['unsigned long long']], + 'NumberOfMappedMdlsInUse' : [ 0xc8, ['long']], + 'NumberOfMappedMdlsInUsePeak' : [ 0xcc, ['unsigned long']], + 'MappedFileHeader' : [ 0xd0, ['_MMMOD_WRITER_LISTHEAD']], + 'NeedMappedMdl' : [ 0xf8, ['unsigned char']], + 'NeedPageFileMdl' : [ 0xf9, ['unsigned char']], + 'TransitionInserted' : [ 0xfa, ['unsigned char']], + 'LastModifiedWriteError' : [ 0xfc, ['long']], + 'LastMappedWriteError' : [ 0x100, ['long']], + 'MappedFileWriteSucceeded' : [ 0x104, ['unsigned long']], + 'MappedWriteBurstCount' : [ 0x108, ['unsigned long']], + 'LowPriorityModWritesOutstanding' : [ 0x10c, ['unsigned long']], + 'BoostModWriteIoPriorityEvent' : [ 0x110, ['_KEVENT']], + 'ModifiedWriterThreadPriority' : [ 0x128, ['long']], + 'ModifiedPagesLowPriorityGoal' : [ 0x130, ['unsigned long long']], + 'ModifiedPageWriterEvent' : [ 0x138, ['_KEVENT']], + 'ModifiedWriterExitedEvent' : [ 0x150, ['_KEVENT']], + 'WriteAllPagefilePages' : [ 0x168, ['long']], + 'WriteAllMappedPages' : [ 0x16c, ['long']], + 'MappedPageWriterEvent' : [ 0x170, ['_KEVENT']], + 'ModWriteData' : [ 0x188, ['_MI_MODWRITE_DATA']], + 'RescanPageFilesEvent' : [ 0x1c8, ['_KEVENT']], + 'PagingFileHeader' : [ 0x1e0, ['_MMMOD_WRITER_LISTHEAD']], + 'ModifiedPageWriterThread' : [ 0x208, ['pointer64', ['_ETHREAD']]], + 'ModifiedPageWriterRundown' : [ 0x210, ['_EX_RUNDOWN_REF']], + 'PagefileScanWorkItem' : [ 0x218, ['_WORK_QUEUE_ITEM']], + 'PagefileScanCount' : [ 0x238, ['unsigned long']], + 'ClusterWritesDisabled' : [ 0x23c, ['array', 2, ['long']]], + 'NotifyStoreMemoryConditions' : [ 0x248, ['_KEVENT']], + 'DelayMappedWrite' : [ 0x260, ['unsigned char']], + 'PagefileReservationsEnabled' : [ 0x264, ['unsigned long']], + 'PageFileCreationLock' : [ 0x268, ['_EX_PUSH_LOCK']], + 'TrimPagefileWorkItem' : [ 0x270, ['_WORK_QUEUE_ITEM']], + 'LastTrimPagefileTime' : [ 0x290, ['unsigned long long']], + 'WsSwapPagefileContractWorkItem' : [ 0x298, ['_WORK_QUEUE_ITEM']], + 'WsSwapPageFileContractionInProgress' : [ 0x2b8, ['long']], + 'WorkingSetSwapLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'WorkingSetInswapLock' : [ 0x2c8, ['long']], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_KPRIQUEUE' : [ 0x2b0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x218, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x298, ['unsigned long']], + 'ThreadListHead' : [ 0x2a0, ['_LIST_ENTRY']], +} ], + '__unnamed_23c0' : [ 0x4, { + 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_NODE_INFORMATION' : [ 0x538, { + 'LargePageFreeCount' : [ 0x0, ['array', 2, ['unsigned long long']]], + 'LargePages' : [ 0x10, ['array', 2, ['array', 2, ['array', 4, ['_LIST_ENTRY']]]]], + 'LargePagesCount' : [ 0x110, ['array', 2, ['array', 2, ['array', 4, ['unsigned long long']]]]], + 'StandbyPageList' : [ 0x190, ['array', 4, ['array', 8, ['_MMPFNLIST_SHORT']]]], + 'FreeCount' : [ 0x490, ['array', 2, ['unsigned long long']]], + 'TotalPages' : [ 0x4a0, ['array', 4, ['unsigned long long']]], + 'TotalPagesEntireNode' : [ 0x4c0, ['unsigned long long']], + 'MmShiftedColor' : [ 0x4c8, ['unsigned long']], + 'Color' : [ 0x4cc, ['unsigned long']], + 'ChannelFreeCount' : [ 0x4d0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'Flags' : [ 0x510, ['__unnamed_23c0']], + 'NodeLock' : [ 0x518, ['_EX_PUSH_LOCK']], + 'ChannelStatus' : [ 0x520, ['unsigned char']], + 'ChannelOrdering' : [ 0x521, ['array', 4, ['unsigned char']]], + 'LockedChannelOrdering' : [ 0x525, ['array', 4, ['unsigned char']]], + 'PowerAttribute' : [ 0x529, ['array', 4, ['unsigned char']]], + 'LargePageLock' : [ 0x530, ['unsigned long long']], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WAITING_IRP' : [ 0x38, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'CompletionRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'Information' : [ 0x30, ['unsigned long']], + 'BreakAllRH' : [ 0x34, ['unsigned char']], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_PPM_SELECTION_MENU' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Entries' : [ 0x8, ['pointer64', ['_PPM_SELECTION_MENU_ENTRY']]], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x20, { + 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0x18, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_KSCHEDULING_GROUP' : [ 0x240, { + 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], + 'RelativeWeight' : [ 0x8, ['unsigned long']], + 'ChildMinRate' : [ 0xc, ['unsigned long']], + 'ChildMinWeight' : [ 0x10, ['unsigned long']], + 'ChildTotalWeight' : [ 0x14, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], + 'NotificationCycles' : [ 0x20, ['long long']], + 'SchedulingGroupList' : [ 0x28, ['_LIST_ENTRY']], + 'Sibling' : [ 0x28, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x38, ['pointer64', ['_KDPC']]], + 'ChildList' : [ 0x40, ['_LIST_ENTRY']], + 'Parent' : [ 0x50, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'PerProcessor' : [ 0x80, ['array', 1, ['_KSCB']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { + 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], + 'Object' : [ 0x10, ['pointer64', ['void']]], + 'TargetAccess' : [ 0x18, ['unsigned long']], + 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x20, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 15, native_type='unsigned long long')]], + 'ExecutePrivilege' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x30, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'Irp' : [ 0x18, ['pointer64', ['_IRP']]], + 'Device' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x28, ['unsigned char']], +} ], + '_POP_POLICY_DEVICE' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], +} ], + '__unnamed_23f3' : [ 0x8, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], + 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], +} ], + '_SECTION' : [ 0x40, { + 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u1' : [ 0x28, ['__unnamed_23f3']], + 'SizeOfSection' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16ec']], + 'InitialPageProtection' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'SessionId' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x3c, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SECTION_STATE' : [ 0x280, { + 'SectionObjectPointersLock' : [ 0x0, ['long']], + 'SectionExtendLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'SectionExtendSetLock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'SectionBasedRoot' : [ 0x18, ['_RTL_AVL_TREE']], + 'SectionBasedLock' : [ 0x20, ['_EX_PUSH_LOCK']], + 'UnusedSubsectionPagedPool' : [ 0x28, ['unsigned long long']], + 'UnusedSegmentForceFree' : [ 0x30, ['unsigned long']], + 'DataSectionProtectionMask' : [ 0x34, ['unsigned long']], + 'HighSectionBase' : [ 0x38, ['pointer64', ['void']]], + 'PhysicalSubsection' : [ 0x40, ['_MSUBSECTION']], + 'PhysicalControlArea' : [ 0xb0, ['_CONTROL_AREA']], + 'DanglingExtentsPages' : [ 0x128, ['pointer64', ['_MMPFN']]], + 'DanglingExtentsLock' : [ 0x130, ['long']], + 'DanglingExtentsWorkItem' : [ 0x138, ['_WORK_QUEUE_ITEM']], + 'DanglingExtentsWorkerActive' : [ 0x158, ['unsigned char']], + 'PageFileSectionHead' : [ 0x160, ['_RTL_AVL_TREE']], + 'PageFileSectionListSpinLock' : [ 0x168, ['long']], + 'SharedSegmentCharges' : [ 0x170, ['_MI_CROSS_PARTITION_CHARGES']], + 'SharedPageCombineCharges' : [ 0x198, ['_MI_CROSS_PARTITION_CHARGES']], + 'ImageBias' : [ 0x1c0, ['unsigned long']], + 'RelocateBitmapsLock' : [ 0x1c8, ['_EX_PUSH_LOCK']], + 'ImageBitMap' : [ 0x1d0, ['_RTL_BITMAP']], + 'ImageBias64Low' : [ 0x1e0, ['unsigned long']], + 'ImageBias64High' : [ 0x1e4, ['unsigned long']], + 'ImageBitMap64Low' : [ 0x1e8, ['_RTL_BITMAP']], + 'ImageBitMap64High' : [ 0x1f8, ['_RTL_BITMAP']], + 'ImageBitMapWow64Dll' : [ 0x208, ['_RTL_BITMAP']], + 'ApiSetSection' : [ 0x218, ['pointer64', ['void']]], + 'ApiSetSchema' : [ 0x220, ['pointer64', ['void']]], + 'ApiSetSchemaSize' : [ 0x228, ['unsigned long long']], + 'LostDataFiles' : [ 0x230, ['unsigned long']], + 'LostDataPages' : [ 0x234, ['unsigned long']], + 'ImageFailureReason' : [ 0x238, ['unsigned long']], + 'CfgBitMapSection32' : [ 0x240, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea32' : [ 0x248, ['pointer64', ['_CONTROL_AREA']]], + 'CfgBitMapSection64' : [ 0x250, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea64' : [ 0x258, ['pointer64', ['_CONTROL_AREA']]], + 'ImageCfgFailure' : [ 0x260, ['unsigned long']], + 'ImageValidationFailed' : [ 0x264, ['long']], +} ], + '_MI_PARTITION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], +} ], + '__unnamed_2400' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2402' : [ 0x10, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2404' : [ 0x10, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2406' : [ 0x10, { + 'Raw' : [ 0x0, ['__unnamed_2404']], + 'Translated' : [ 0x0, ['__unnamed_2402']], +} ], + '__unnamed_2408' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_240a' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_240c' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_240e' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2410' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2412' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2414' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2416' : [ 0x10, { + 'Generic' : [ 0x0, ['__unnamed_2400']], + 'Port' : [ 0x0, ['__unnamed_2400']], + 'Interrupt' : [ 0x0, ['__unnamed_2402']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_2406']], + 'Memory' : [ 0x0, ['__unnamed_2400']], + 'Dma' : [ 0x0, ['__unnamed_2408']], + 'DmaV3' : [ 0x0, ['__unnamed_240a']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], + 'BusNumber' : [ 0x0, ['__unnamed_240c']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_240e']], + 'Memory40' : [ 0x0, ['__unnamed_2410']], + 'Memory48' : [ 0x0, ['__unnamed_2412']], + 'Memory64' : [ 0x0, ['__unnamed_2414']], + 'Connection' : [ 0x0, ['__unnamed_2225']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_2416']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_241e' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_241e']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE_ENTRY' : [ 0x18, { + 'FunctionTable' : [ 0x0, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'DynamicTable' : [ 0x0, ['pointer64', ['_DYNAMIC_FUNCTION_TABLE']]], + 'ImageBase' : [ 0x8, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'SizeOfTable' : [ 0x14, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { + 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x38, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'PagedPoolAllocationMap' : [ 0x8, ['_RTL_BITMAP_EX']], + 'FirstPteForPagedPool' : [ 0x18, ['pointer64', ['_MMPTE']]], + 'MaximumSize' : [ 0x20, ['unsigned long long']], + 'PagedPoolHint' : [ 0x28, ['unsigned long long']], + 'AllocatedPagedPool' : [ 0x30, ['unsigned long long']], +} ], + '__unnamed_2430' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x58, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x8, ['__unnamed_2430']], +} ], + '_PPM_COORDINATED_SELECTION' : [ 0x18, { + 'MaximumStates' : [ 0x0, ['unsigned long']], + 'SelectedStates' : [ 0x4, ['unsigned long']], + 'DefaultSelection' : [ 0x8, ['unsigned long']], + 'Selection' : [ 0x10, ['pointer64', ['unsigned long']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_MI_PAGE_COMBINING_SUPPORT' : [ 0x188, { + 'Partition' : [ 0x0, ['pointer64', ['_MI_PARTITION']]], + 'ArbitraryPfnMapList' : [ 0x8, ['_LIST_ENTRY']], + 'FreeCombinePoolItem' : [ 0x18, ['_MI_COMBINE_WORKITEM']], + 'CombiningThreadCount' : [ 0x40, ['unsigned long']], + 'CombinePageFreeList' : [ 0x48, ['_LIST_ENTRY']], + 'CombineFreeListLock' : [ 0x58, ['unsigned long long']], + 'CombinePageListHeads' : [ 0x60, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], + 'PageCombineStats' : [ 0x160, ['_MI_PAGE_COMBINE_STATISTICS']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x10, { + 'p' : [ 0x0, ['pointer64', ['void']]], + 'RangeSize' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_DEVICE' : [ 0x278, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DevNode' : [ 0x30, ['pointer64', ['_DEVICE_NODE']]], + 'DpmContext' : [ 0x38, ['pointer64', ['PEPHANDLE__']]], + 'Plugin' : [ 0x40, ['pointer64', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x48, ['pointer64', ['PEPHANDLE__']]], + 'AcpiPlugin' : [ 0x50, ['pointer64', ['_POP_FX_PLUGIN']]], + 'AcpiPluginHandle' : [ 0x58, ['pointer64', ['PEPHANDLE__']]], + 'DeviceObject' : [ 0x60, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x68, ['pointer64', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x70, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0xa8, ['pointer64', ['void']]], + 'AcpiLink' : [ 0xb0, ['_LIST_ENTRY']], + 'DeviceId' : [ 0xc0, ['_UNICODE_STRING']], + 'RemoveLock' : [ 0xd0, ['_IO_REMOVE_LOCK']], + 'AcpiRemoveLock' : [ 0xf0, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0x110, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0x148, ['unsigned long long']], + 'IdleTimer' : [ 0x150, ['_KTIMER']], + 'IdleDpc' : [ 0x190, ['_KDPC']], + 'IdleTimeout' : [ 0x1d0, ['unsigned long long']], + 'IdleStamp' : [ 0x1d8, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x1e0, ['array', 2, ['pointer64', ['_DEVICE_OBJECT']]]], + 'NextIrpPowerState' : [ 0x1f0, ['array', 2, ['_POWER_STATE']]], + 'NextIrpCallerCompletion' : [ 0x1f8, ['array', 2, ['pointer64', ['void']]]], + 'NextIrpCallerContext' : [ 0x208, ['array', 2, ['pointer64', ['void']]]], + 'IrpCompleteEvent' : [ 0x218, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x230, ['pointer64', ['void']]], + 'Accounting' : [ 0x238, ['_POP_FX_ACCOUNTING']], + 'Flags' : [ 0x268, ['unsigned long']], + 'ComponentCount' : [ 0x26c, ['unsigned long']], + 'Components' : [ 0x270, ['pointer64', ['pointer64', ['_POP_FX_COMPONENT']]]], +} ], + '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { + 'AsULong' : [ 0x0, ['unsigned long']], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2458' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_245a' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_2458']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x60, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x20, ['_LIST_ENTRY']], + 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CoolingExtension' : [ 0x40, ['pointer64', ['_POP_COOLING_EXTENSION']]], + 'Volume' : [ 0x48, ['_LIST_ENTRY']], + 'Specific' : [ 0x58, ['__unnamed_245a']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MI_COMBINE_STATE' : [ 0x1a0, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'CombiningThreadCount' : [ 0x4, ['unsigned long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], + 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], + 'CrossPartition' : [ 0x18, ['_MI_PAGE_COMBINING_SUPPORT']], +} ], + '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x30, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'ListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { + 'BadPageCount' : [ 0x0, ['unsigned long long']], + 'BadPagesDetected' : [ 0x8, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0xc, ['long']], + 'ScrubPasses' : [ 0x10, ['long']], + 'ScrubBadPagesFound' : [ 0x14, ['long']], + 'PageHashErrors' : [ 0x18, ['unsigned long']], + 'FeatureBits' : [ 0x20, ['unsigned long long']], + 'TimeZoneId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['_MI_FLAGS']], + 'VsmConnection' : [ 0x30, ['pointer64', ['void']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x68, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], + 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], + 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], + 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], + 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KENLISTMENT' : [ 0x1e0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x30, ['_GUID']], + 'Mutex' : [ 0x40, ['_KMUTANT']], + 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], + 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0xac, ['unsigned long']], + 'NotificationMask' : [ 0xb0, ['unsigned long']], + 'Key' : [ 0xb8, ['pointer64', ['void']]], + 'KeyRefCount' : [ 0xc0, ['unsigned long']], + 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], + 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], + 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], + 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], + 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], + 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], + 'NextHistory' : [ 0x138, ['unsigned long']], + 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['unsigned long']], +} ], + '_DELAY_ACK_FO' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_MI_CROSS_PARTITION_CHARGES' : [ 0x28, { + 'CurrentCharges' : [ 0x0, ['unsigned long long']], + 'ChargeFailures' : [ 0x8, ['unsigned long long']], + 'ChargePeak' : [ 0x10, ['unsigned long long']], + 'ChargeMinimum' : [ 0x18, ['unsigned long long']], + 'ChargeMaximum' : [ 0x20, ['unsigned long long']], +} ], + '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x38, { + 'BugCheckCode' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['long']], + 'Data' : [ 0x8, ['unsigned long']], + 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { + 'ExpansionLock' : [ 0x0, ['unsigned long long']], + 'TrimInProgressCount' : [ 0x8, ['long']], + 'PeriodicWorkingSetEvent' : [ 0x10, ['_KEVENT']], + 'TrimAllPageFaultCount' : [ 0x28, ['array', 3, ['unsigned long']]], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_MI_ZERO_COST_COUNTS' : [ 0x10, { + 'NativeSum' : [ 0x0, ['unsigned long long']], + 'CachedSum' : [ 0x8, ['unsigned long long']], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MI_RESAVAIL_TRACKER' : [ 0x380, { + 'AllocateKernelStack' : [ 0x0, ['unsigned long long']], + 'AllocateGrowKernelStack' : [ 0x8, ['unsigned long long']], + 'FreeKernelStack' : [ 0x10, ['unsigned long long']], + 'FreeKernelStackError' : [ 0x18, ['unsigned long long']], + 'FreeGrowKernelStackError' : [ 0x20, ['unsigned long long']], + 'AllocateCreateProcess' : [ 0x28, ['unsigned long long']], + 'FreeCreateProcessError' : [ 0x30, ['unsigned long long']], + 'FreeDeleteProcess' : [ 0x38, ['unsigned long long']], + 'FreeCleanProcess' : [ 0x40, ['unsigned long long']], + 'FreeCleanProcessError' : [ 0x48, ['unsigned long long']], + 'AllocateAddProcessWsMetaPage' : [ 0x50, ['unsigned long long']], + 'AllocateWsIncrease' : [ 0x58, ['unsigned long long']], + 'FreeWsIncreaseError' : [ 0x60, ['unsigned long long']], + 'FreeWsIncreaseErrorMax' : [ 0x68, ['unsigned long long']], + 'FreeWsDecrease' : [ 0x70, ['unsigned long long']], + 'AllocateWorkingSetPage' : [ 0x78, ['unsigned long long']], + 'FreeWorkingSetPageError' : [ 0x80, ['unsigned long long']], + 'FreeDeletePteRange' : [ 0x88, ['unsigned long long']], + 'AllocatePageTablesForProcessMetadata' : [ 0x90, ['unsigned long long']], + 'FreePageTablesForProcessMetadataError2' : [ 0x98, ['unsigned long long']], + 'AllocatePageTablesForSystem' : [ 0xa0, ['unsigned long long']], + 'FreePageTablesExcess' : [ 0xa8, ['unsigned long long']], + 'FreeSystemVaPageTables' : [ 0xb0, ['unsigned long long']], + 'FreeSessionVaPageTables' : [ 0xb8, ['unsigned long long']], + 'AllocateCreateSession' : [ 0xc0, ['unsigned long long']], + 'FreeSessionWsDereference' : [ 0xc8, ['unsigned long long']], + 'FreeSessionDereference' : [ 0xd0, ['unsigned long long']], + 'AllocateLockedSessionImage' : [ 0xd8, ['unsigned long long']], + 'FreeLockedSessionImage' : [ 0xe0, ['unsigned long long']], + 'FreeSessionImageConversion' : [ 0xe8, ['unsigned long long']], + 'AllocateWsAdjustPageTable' : [ 0xf0, ['unsigned long long']], + 'FreeWsAdjustPageTable' : [ 0xf8, ['unsigned long long']], + 'FreeWsAdjustPageTableError' : [ 0x100, ['unsigned long long']], + 'AllocateNoLowMemory' : [ 0x108, ['unsigned long long']], + 'AllocatePagedPoolLockedDown' : [ 0x110, ['unsigned long long']], + 'FreePagedPoolLockedDown' : [ 0x118, ['unsigned long long']], + 'AllocateSystemBitmaps' : [ 0x120, ['unsigned long long']], + 'FreeSystemBitmapsError' : [ 0x128, ['unsigned long long']], + 'AllocateForMdl' : [ 0x130, ['unsigned long long']], + 'FreeFromMdl' : [ 0x138, ['unsigned long long']], + 'AllocateForMdlPartition' : [ 0x140, ['unsigned long long']], + 'FreeFromMdlPartition' : [ 0x148, ['unsigned long long']], + 'FreeMdlExcess' : [ 0x150, ['unsigned long long']], + 'AllocateExpansionNonPagedPool' : [ 0x158, ['unsigned long long']], + 'FreeExpansionNonPagedPool' : [ 0x160, ['unsigned long long']], + 'AllocateVad' : [ 0x168, ['unsigned long long']], + 'RemoveVad' : [ 0x170, ['unsigned long long']], + 'FreeVad' : [ 0x178, ['unsigned long long']], + 'AllocateContiguous' : [ 0x180, ['unsigned long long']], + 'FreeContiguousPages' : [ 0x188, ['unsigned long long']], + 'FreeContiguousError' : [ 0x190, ['unsigned long long']], + 'FreeLargePageMemory' : [ 0x198, ['unsigned long long']], + 'AllocateSystemWsles' : [ 0x1a0, ['unsigned long long']], + 'FreeSystemWsles' : [ 0x1a8, ['unsigned long long']], + 'AllocateSystemInitWs' : [ 0x1b0, ['unsigned long long']], + 'AllocateSessionInitWs' : [ 0x1b8, ['unsigned long long']], + 'FreeSessionInitWsError' : [ 0x1c0, ['unsigned long long']], + 'AllocateSystemImage' : [ 0x1c8, ['unsigned long long']], + 'AllocateSystemImageLoad' : [ 0x1d0, ['unsigned long long']], + 'AllocateSessionSharedImage' : [ 0x1d8, ['unsigned long long']], + 'FreeSystemImageInitCode' : [ 0x1e0, ['unsigned long long']], + 'FreeSystemImageLargePageConversion' : [ 0x1e8, ['unsigned long long']], + 'FreeSystemImageError' : [ 0x1f0, ['unsigned long long']], + 'FreeSystemImageLoadExcess' : [ 0x1f8, ['unsigned long long']], + 'FreeUnloadSystemImage' : [ 0x200, ['unsigned long long']], + 'FreeReloadBootImageLarge' : [ 0x208, ['unsigned long long']], + 'FreeIndependent' : [ 0x210, ['unsigned long long']], + 'AllocateHotRemove' : [ 0x218, ['unsigned long long']], + 'FreeHotAdd' : [ 0x220, ['unsigned long long']], + 'AllocateBoot' : [ 0x228, ['unsigned long long']], + 'FreeLoaderBlock' : [ 0x230, ['unsigned long long']], + 'AllocateNonPagedSpecialPool' : [ 0x238, ['unsigned long long']], + 'FreeNonPagedSpecialPoolError' : [ 0x240, ['unsigned long long']], + 'FreeNonPagedSpecialPool' : [ 0x248, ['unsigned long long']], + 'AllocateSharedSegmentPage' : [ 0x250, ['unsigned long long']], + 'FreeSharedSegmentPage' : [ 0x258, ['unsigned long long']], + 'AllocateZeroPage' : [ 0x260, ['unsigned long long']], + 'FreeZeroPage' : [ 0x268, ['unsigned long long']], + 'AllocateForPo' : [ 0x270, ['unsigned long long']], + 'AllocateForPoForce' : [ 0x278, ['unsigned long long']], + 'FreeForPo' : [ 0x280, ['unsigned long long']], + 'AllocateThreadHardFaultBehavior' : [ 0x288, ['unsigned long long']], + 'FreeThreadHardFaultBehavior' : [ 0x290, ['unsigned long long']], + 'ObtainFaultCharges' : [ 0x298, ['unsigned long long']], + 'FreeFaultCharges' : [ 0x2a0, ['unsigned long long']], + 'AllocateStoreCharges' : [ 0x2a8, ['unsigned long long']], + 'FreeStoreCharges' : [ 0x2b0, ['unsigned long long']], + 'ObtainLockedPageCharge' : [ 0x2c0, ['unsigned long long']], + 'FreeLockedPageCharge' : [ 0x300, ['unsigned long long']], + 'AllocateStore' : [ 0x308, ['unsigned long long']], + 'FreeStore' : [ 0x310, ['unsigned long long']], + 'AllocateSystemImageProtos' : [ 0x318, ['unsigned long long']], + 'FreeSystemImageProtos' : [ 0x320, ['unsigned long long']], + 'AllocateModWriterCharge' : [ 0x328, ['unsigned long long']], + 'FreeModWriterCharge' : [ 0x330, ['unsigned long long']], + 'AllocateMappedWriterCharge' : [ 0x338, ['unsigned long long']], + 'FreeMappedWriterCharge' : [ 0x340, ['unsigned long long']], + 'AllocateRegistryCharges' : [ 0x348, ['unsigned long long']], + 'FreeRegistryCharges' : [ 0x350, ['unsigned long long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'CompactionMask' : [ 0x8, ['unsigned long long']], + 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x28, { + 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x8, ['long']], + 'RecursionCount' : [ 0xc, ['long']], + 'OwningThread' : [ 0x10, ['pointer64', ['void']]], + 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], + 'SpinCount' : [ 0x20, ['unsigned long long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'Context' : [ 0x18, ['pointer64', ['void']]], + 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x24, ['unsigned long']], + 'Status' : [ 0x28, ['long']], + 'Information' : [ 0x30, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x38, ['long']], +} ], + '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x10, { + 'Table' : [ 0x0, ['_RTL_AVL_TREE']], + 'Lock' : [ 0x8, ['long']], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x8, ['unsigned long long']], + 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '_KTSS64' : [ 0x68, { + 'Reserved0' : [ 0x0, ['unsigned long']], + 'Rsp0' : [ 0x4, ['unsigned long long']], + 'Rsp1' : [ 0xc, ['unsigned long long']], + 'Rsp2' : [ 0x14, ['unsigned long long']], + 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], + 'Reserved1' : [ 0x5c, ['unsigned long long']], + 'Reserved2' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], +} ], + '__unnamed_24ce' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d0' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d2' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d4' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_24ce']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_24d0']], + 'Raw' : [ 0x0, ['__unnamed_24d2']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'Operation' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0xc, ['__unnamed_24d4']], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '_MI_SYSTEM_NODE_INFORMATION' : [ 0x1a0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x10, ['array', 3, ['_SLIST_HEADER']]], + 'NonPagedPoolSListHeadNx' : [ 0x40, ['array', 3, ['_SLIST_HEADER']]], + 'CachedKernelStacks' : [ 0x70, ['array', 2, ['_CACHED_KSTACK_LIST']]], + 'NonPagedBitMapMaximum' : [ 0xb0, ['unsigned long long']], + 'DynamicBitMapNonPagedPool' : [ 0xb8, ['_MI_DYNAMIC_BITMAP']], + 'NonPagedPoolLowestPage' : [ 0x108, ['unsigned long long']], + 'NonPagedPoolHighestPage' : [ 0x110, ['unsigned long long']], + 'AllocatedNonPagedPool' : [ 0x118, ['unsigned long long']], + 'PartialLargePoolRegions' : [ 0x120, ['unsigned long long']], + 'PagesInPartialLargePoolRegions' : [ 0x128, ['unsigned long long']], + 'CachedNonPagedPoolCount' : [ 0x130, ['unsigned long long']], + 'NonPagedPoolSpinLock' : [ 0x138, ['unsigned long long']], + 'CachedNonPagedPool' : [ 0x140, ['pointer64', ['_MMPFN']]], + 'NonPagedPoolFirstVa' : [ 0x148, ['pointer64', ['void']]], + 'NonPagedPoolLastVa' : [ 0x150, ['pointer64', ['void']]], + 'NonPagedBitMap' : [ 0x158, ['array', 3, ['_RTL_BITMAP_EX']]], + 'NonPagedHint' : [ 0x188, ['array', 2, ['unsigned long long']]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x10, { + 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 63, native_type='unsigned long long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'LockState' : [ 0x0, ['pointer64', ['void']]], + 'SessionState' : [ 0x8, ['pointer64', ['void']]], + 'SessionId' : [ 0x8, ['unsigned long']], + 'SessionPad' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_24e4' : [ 0x4, { + 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], + 'Long' : [ 0x0, ['long']], +} ], + '_MI_PARTITION_STORES' : [ 0x80, { + 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_24e4']], + 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], + 'Registered' : [ 0x8, ['unsigned long']], + 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], + 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], + 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], + 'WriteIssueFailures' : [ 0x18, ['unsigned long']], + 'EvictionThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'EvictEvent' : [ 0x28, ['_KEVENT']], + 'EvictFlushCompleteEvent' : [ 0x40, ['_KEVENT']], + 'WriteSupportSListHead' : [ 0x60, ['_SLIST_HEADER']], + 'EvictFlushLock' : [ 0x70, ['long']], + 'ModifiedWriteFailedBitmap' : [ 0x78, ['pointer64', ['_RTL_BITMAP']]], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x48, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x10, ['unsigned long']], + 'SyncCallback' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x14, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], + 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], + 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], + 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], + 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x8, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0x18, ['unsigned short']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_MI_SUB64K_FREE_RANGES' : [ 0x30, { + 'BitMap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Vad' : [ 0x20, ['pointer64', ['_MMVAD_SHORT']]], + 'SubListIndex' : [ 0x28, ['unsigned short']], + 'Hint' : [ 0x2a, ['unsigned short']], + 'SetBits' : [ 0x2c, ['unsigned long']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x40, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'LastTotalAllocates' : [ 0x24, ['unsigned long']], + 'LastAllocateMisses' : [ 0x28, ['unsigned long']], + 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], +} ], + '_KTIMER' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], + 'Processor' : [ 0x38, ['unsigned long']], + 'Period' : [ 0x3c, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0x10, ['pointer64', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'NumberOfBuckets' : [ 0x1c, ['unsigned long']], + 'Buckets' : [ 0x20, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '__unnamed_2522' : [ 0x18, { + 'RequestedTime' : [ 0x0, ['unsigned long long']], + 'ProgrammedTime' : [ 0x8, ['unsigned long long']], + 'TimerInfo' : [ 0x10, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0x110, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x48, ['unsigned long long']], + 'SleepTime' : [ 0x50, ['unsigned long long']], + 'WakeFirstUnattendedTime' : [ 0x58, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x68, ['array', 3, ['__unnamed_2522']]], + 'WakeAlarmPaused' : [ 0xb0, ['unsigned char']], + 'WakeAlarmLastTime' : [ 0xb8, ['unsigned long long']], + 'FilteredCapabilities' : [ 0xc0, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_CM_KEY_HASH' : [ 0x20, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_KAPC_STATE' : [ 0x30, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x28, ['unsigned char']], + 'KernelApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x29, ['unsigned char']], + 'UserApcPending' : [ 0x2a, ['unsigned char']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x38, ['unsigned char']], + 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x48, ['pointer64', ['unsigned short']]], + 'DriverName' : [ 0x50, ['pointer64', ['unsigned short']]], + 'ChildCount' : [ 0x58, ['unsigned long']], + 'ActiveChild' : [ 0x5c, ['unsigned long']], + 'ParentCount' : [ 0x60, ['unsigned long']], + 'ActiveParent' : [ 0x64, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { + 'PageHashes' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0xe0, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], + 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], + 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], + 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], + 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], + 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], + 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], + 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], + 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], + 'MdlRead' : [ 0x80, ['pointer64', ['void']]], + 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], + 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], + 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], + 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], + 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], + 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], + 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], + 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], + 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], + 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KIDTENTRY64' : [ 0x10, { + 'OffsetLow' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'OffsetMiddle' : [ 0x6, ['unsigned short']], + 'OffsetHigh' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x10, ['unsigned char']], + 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], + 'State' : [ 0x68, ['unsigned char']], + 'ResourcesChanged' : [ 0x69, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x28, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Group' : [ 0x10, ['pointer64', ['void']]], + 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], + 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer64', ['_MMPTE']]], +} ], + '_PPM_SELECTION_MENU_ENTRY' : [ 0x18, { + 'StrictDependency' : [ 0x0, ['unsigned char']], + 'InitiatingState' : [ 0x1, ['unsigned char']], + 'DependentState' : [ 0x2, ['unsigned char']], + 'StateIndex' : [ 0x4, ['unsigned long']], + 'Dependencies' : [ 0x8, ['unsigned long']], + 'DependencyList' : [ 0x10, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x28, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x8, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0x18, ['_RTL_BITMAP']], + 'EvictedBitmap' : [ 0x18, ['_RTL_BITMAP']], +} ], + '_KQUEUE' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x28, ['unsigned long']], + 'MaximumCount' : [ 0x2c, ['unsigned long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], +} ], + '_MI_COMBINE_WORKITEM' : [ 0x28, { + 'NextEntry' : [ 0x0, ['pointer64', ['void']]], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x410, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], + 'ConsoleFlags' : [ 0x18, ['unsigned long']], + 'StandardInput' : [ 0x20, ['pointer64', ['void']]], + 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], + 'StandardError' : [ 0x30, ['pointer64', ['void']]], + 'CurrentDirectory' : [ 0x38, ['_CURDIR']], + 'DllPath' : [ 0x50, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], + 'Environment' : [ 0x80, ['pointer64', ['void']]], + 'StartingX' : [ 0x88, ['unsigned long']], + 'StartingY' : [ 0x8c, ['unsigned long']], + 'CountX' : [ 0x90, ['unsigned long']], + 'CountY' : [ 0x94, ['unsigned long']], + 'CountCharsX' : [ 0x98, ['unsigned long']], + 'CountCharsY' : [ 0x9c, ['unsigned long']], + 'FillAttribute' : [ 0xa0, ['unsigned long']], + 'WindowFlags' : [ 0xa4, ['unsigned long']], + 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], + 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], + 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], + 'PackageDependencyData' : [ 0x400, ['pointer64', ['void']]], + 'ProcessGroupId' : [ 0x408, ['unsigned long']], + 'LoaderThreads' : [ 0x40c, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x10, { + 'BasePage' : [ 0x0, ['unsigned long long']], + 'PageCount' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_SRWLOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x20, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], + 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], + 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer64', ['void']]], + 'Owner' : [ 0x18, ['pointer64', ['void']]], + 'Attributes' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], +} ], + '_LOCK_HEADER' : [ 0x20, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x8, ['unsigned long long']], + 'Lock' : [ 0x10, ['unsigned long long']], + 'Valid' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MMSECTION_FLAGS2' : [ 0x4, { + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'NumberOfChildViews' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_KSPECIAL_REGISTERS' : [ 0xe0, { + 'Cr0' : [ 0x0, ['unsigned long long']], + 'Cr2' : [ 0x8, ['unsigned long long']], + 'Cr3' : [ 0x10, ['unsigned long long']], + 'Cr4' : [ 0x18, ['unsigned long long']], + 'KernelDr0' : [ 0x20, ['unsigned long long']], + 'KernelDr1' : [ 0x28, ['unsigned long long']], + 'KernelDr2' : [ 0x30, ['unsigned long long']], + 'KernelDr3' : [ 0x38, ['unsigned long long']], + 'KernelDr6' : [ 0x40, ['unsigned long long']], + 'KernelDr7' : [ 0x48, ['unsigned long long']], + 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], + 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], + 'Tr' : [ 0x70, ['unsigned short']], + 'Ldtr' : [ 0x72, ['unsigned short']], + 'MxCsr' : [ 0x74, ['unsigned long']], + 'DebugControl' : [ 0x78, ['unsigned long long']], + 'LastBranchToRip' : [ 0x80, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], + 'Cr8' : [ 0xa0, ['unsigned long long']], + 'MsrGsBase' : [ 0xa8, ['unsigned long long']], + 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], + 'MsrStar' : [ 0xb8, ['unsigned long long']], + 'MsrLStar' : [ 0xc0, ['unsigned long long']], + 'MsrCStar' : [ 0xc8, ['unsigned long long']], + 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], + 'Xcr0' : [ 0xd8, ['unsigned long long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_PEB64' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['unsigned long long']], + 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], + 'Ldr' : [ 0x18, ['unsigned long long']], + 'ProcessParameters' : [ 0x20, ['unsigned long long']], + 'SubSystemData' : [ 0x28, ['unsigned long long']], + 'ProcessHeap' : [ 0x30, ['unsigned long long']], + 'FastPebLock' : [ 0x38, ['unsigned long long']], + 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], + 'IFEOKey' : [ 0x48, ['unsigned long long']], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], + 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['unsigned long long']], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['unsigned long long']], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], + 'SparePvoid0' : [ 0x90, ['unsigned long long']], + 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], + 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], + 'OemCodePageData' : [ 0xa8, ['unsigned long long']], + 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], + 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], + 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['unsigned long long']], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], + 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['unsigned long long']], + 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], + 'CSDVersion' : [ 0x2e8, ['_STRING64']], + 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], + 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], + 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], + 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['unsigned long long']], + 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], + 'FlsBitmap' : [ 0x338, ['unsigned long long']], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['unsigned long long']], + 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], + 'pUnused' : [ 0x368, ['unsigned long long']], + 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['LIST_ENTRY64']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['unsigned long long']]], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_MSUBSECTION' : [ 0x70, { + 'Core' : [ 0x0, ['_SUBSECTION']], + 'SubsectionNode' : [ 0x38, ['_RTL_BALANCED_NODE']], + 'DereferenceList' : [ 0x50, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x60, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x68, ['unsigned long']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { + 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x10, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x8, ['unsigned long long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], + 'ZeroInit1' : [ 0x8, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x80, { + 'Address' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '__unnamed_25ee' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x1f40, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_25ee']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long long']], + 'NonPagablePages' : [ 0x28, ['unsigned long long']], + 'CommittedPages' : [ 0x30, ['unsigned long long']], + 'PagedPoolStart' : [ 0x38, ['pointer64', ['void']]], + 'PagedPoolEnd' : [ 0x40, ['pointer64', ['void']]], + 'SessionObject' : [ 0x48, ['pointer64', ['void']]], + 'SessionObjectHandle' : [ 0x50, ['pointer64', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x58, ['array', 4, ['unsigned long']]], + 'ImageTree' : [ 0x68, ['_RTL_AVL_TREE']], + 'LocaleId' : [ 0x70, ['unsigned long']], + 'AttachCount' : [ 0x74, ['unsigned long']], + 'AttachGate' : [ 0x78, ['_KGATE']], + 'WsListEntry' : [ 0x90, ['_LIST_ENTRY']], + 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xb40, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xb60, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xb98, ['_MMSUPPORT']], + 'Wsle' : [ 0xc90, ['pointer64', ['_MMWSLE']]], + 'DriverUnload' : [ 0xc98, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xcc0, ['_POOL_DESCRIPTOR']], + 'PageDirectory' : [ 0x1e00, ['_MMPTE']], + 'SessionVaLock' : [ 0x1e08, ['_EX_PUSH_LOCK']], + 'DynamicVaBitMap' : [ 0x1e10, ['_RTL_BITMAP']], + 'DynamicVaHint' : [ 0x1e20, ['unsigned long']], + 'SpecialPool' : [ 0x1e28, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1e78, ['_EX_PUSH_LOCK']], + 'PoolBigEntriesInUse' : [ 0x1e80, ['long']], + 'PagedPoolPdeCount' : [ 0x1e84, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1e88, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1e8c, ['unsigned long']], + 'SystemPteInfo' : [ 0x1e90, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1ef0, ['pointer64', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1ef8, ['unsigned long long']], + 'PoolTrackBigPages' : [ 0x1f00, ['pointer64', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1f08, ['unsigned long long']], + 'IoState' : [ 0x1f10, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1f14, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1f18, ['_KEVENT']], + 'ServerSilo' : [ 0x1f30, ['pointer64', ['_EJOB']]], + 'CreateTime' : [ 0x1f38, ['unsigned long long']], +} ], + '_MMPAGE_FILE_EXPANSION' : [ 0x60, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'DereferenceList' : [ 0x8, ['_LIST_ENTRY']], + 'Partition' : [ 0x18, ['pointer64', ['_MI_PARTITION']]], + 'RequestedExpansionSize' : [ 0x20, ['unsigned long long']], + 'ActualExpansion' : [ 0x28, ['unsigned long long']], + 'Event' : [ 0x30, ['_KEVENT']], + 'InProgress' : [ 0x48, ['long']], + 'u' : [ 0x4c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], + 'ActiveEntry' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'AttemptForCantExtend' : [ 0x58, ['unsigned char']], + 'PageFileContract' : [ 0x59, ['unsigned char']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '__unnamed_25ff' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_2603' : [ 0x8, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x88, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x40, ['__unnamed_25ff']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], + 'u4' : [ 0x78, ['__unnamed_2603']], + 'FileObject' : [ 0x80, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x20, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x8, ['long long']], + 'SidCount' : [ 0x10, ['unsigned long']], + 'SidValuesStart' : [ 0x18, ['unsigned long long']], +} ], + '_MI_PARTITION_STATE' : [ 0x60, { + 'PartitionLock' : [ 0x0, ['unsigned long long']], + 'PartitionIdLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'InitialPartitionIdBits' : [ 0x10, ['unsigned long long']], + 'PartitionList' : [ 0x18, ['_LIST_ENTRY']], + 'PartitionIdBitmap' : [ 0x28, ['pointer64', ['_RTL_BITMAP']]], + 'InitialPartitionIdBitmap' : [ 0x30, ['_RTL_BITMAP']], + 'TempPartitionPointers' : [ 0x40, ['array', 1, ['pointer64', ['_MI_PARTITION']]]], + 'Partition' : [ 0x48, ['pointer64', ['pointer64', ['_MI_PARTITION']]]], + 'TotalPagesInChildPartitions' : [ 0x50, ['unsigned long long']], + 'CrossPartitionDenials' : [ 0x58, ['unsigned long']], +} ], + '_MMMOD_WRITER_LISTHEAD' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Gate' : [ 0x10, ['_KGATE']], + 'Event' : [ 0x10, ['_KEVENT']], +} ], + '_CM_RM' : [ 0x88, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x20, ['pointer64', ['void']]], + 'Tm' : [ 0x28, ['pointer64', ['void']]], + 'RmHandle' : [ 0x30, ['pointer64', ['void']]], + 'KtmRm' : [ 0x38, ['pointer64', ['void']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'ContainerNum' : [ 0x44, ['unsigned long']], + 'ContainerSize' : [ 0x48, ['unsigned long long']], + 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], + 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], + 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], + 'RmFlags' : [ 0x68, ['unsigned long']], + 'LogStartStatus1' : [ 0x6c, ['long']], + 'LogStartStatus2' : [ 0x70, ['long']], + 'BaseLsn' : [ 0x78, ['unsigned long long']], + 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0xa0, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer64', ['_IRP']]], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x20, ['unsigned char']], + 'IrpOplocksR' : [ 0x28, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x38, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x48, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x58, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x68, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x78, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x88, ['pointer64', ['_GUID']]], + 'OplockState' : [ 0x90, ['unsigned long']], + 'FastMutex' : [ 0x98, ['pointer64', ['_FAST_MUTEX']]], +} ], + '_MI_LARGEPAGE_MEMORY_INFO' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ColoredPageInfoBase' : [ 0x10, ['pointer64', ['_COLORED_PAGE_INFO']]], + 'PagesNeedZeroing' : [ 0x18, ['unsigned long']], + 'LargeImageBias' : [ 0x1c, ['unsigned char']], + 'Spare' : [ 0x1d, ['array', 3, ['unsigned char']]], + 'ActualImageViewSize' : [ 0x20, ['unsigned long long']], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { + 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PROCESS_ENERGY_VALUES' : [ 0x90, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'DiskEnergy' : [ 0x40, ['unsigned long long']], + 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], + 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], + 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], + 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], + 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'WindowInformation' : [ 0x68, ['unsigned long']], + 'PixelArea' : [ 0x6c, ['unsigned long']], + 'PixelReportTimestamp' : [ 0x70, ['long long']], + 'PixelTime' : [ 0x78, ['unsigned long long']], + 'ForegroundReportTimestamp' : [ 0x80, ['long long']], + 'ForegroundTime' : [ 0x88, ['unsigned long long']], +} ], + '_CLIENT_ID' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], + 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_MI_COMMON_PAGE_STATE' : [ 0x98, { + 'PageOfOnesPfn' : [ 0x0, ['pointer64', ['_MMPFN']]], + 'PageOfOnes' : [ 0x8, ['unsigned long long']], + 'DummyPagePfn' : [ 0x10, ['pointer64', ['_MMPFN']]], + 'DummyPage' : [ 0x18, ['unsigned long long']], + 'PageOfZeroes' : [ 0x20, ['unsigned long long']], + 'ZeroMapping' : [ 0x28, ['pointer64', ['void']]], + 'OnesMapping' : [ 0x30, ['pointer64', ['void']]], + 'BitmapGapFrames' : [ 0x38, ['array', 4, ['unsigned long long']]], + 'PfnGapFrames' : [ 0x58, ['array', 4, ['unsigned long long']]], + 'PageTableOfZeroes' : [ 0x78, ['unsigned long long']], + 'PdeOfZeroes' : [ 0x80, ['_MMPTE']], + 'PageTableOfOnes' : [ 0x88, ['unsigned long long']], + 'PdeOfOnes' : [ 0x90, ['_MMPTE']], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], + 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], + 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], + 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_MMPFNLIST_SHORT' : [ 0x18, { + 'Total' : [ 0x0, ['unsigned long long']], + 'Flink' : [ 0x8, ['unsigned long long']], + 'Blink' : [ 0x10, ['unsigned long long']], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0x10, ['pointer64', ['void']]], + 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], + 'ServerIsRemote' : [ 0x1a, ['unsigned char']], + 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], +} ], + '_MI_VAD_ALLOCATION_CELL' : [ 0x28, { + 'AllocationBitMap' : [ 0x0, ['_RTL_BITMAP']], + 'BitMapHint' : [ 0x10, ['unsigned long']], + 'LastAllocationSize' : [ 0x14, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0x18, ['unsigned long']], + 'LowestBottomUpVadBit' : [ 0x1c, ['unsigned long']], + 'LowestBottomUpAllocationAddress' : [ 0x20, ['pointer64', ['void']]], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x28, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x10, ['pointer64', ['void']]], + 'SessionViewVa' : [ 0x10, ['pointer64', ['void']]], + 'VadsProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'Type' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionType' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SectionOffset' : [ 0x20, ['unsigned long long']], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x18, { + 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x10, ['unsigned long']], + 'FullCreateOptions' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_2647' : [ 0x38, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x30, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x78, { + 'Status' : [ 0x0, ['long']], + 'PartitionId' : [ 0x4, ['unsigned short']], + 'Priority' : [ 0x6, ['unsigned char']], + 'IrpPriority' : [ 0x7, ['unsigned char']], + 'ReservationWrite' : [ 0x8, ['unsigned char']], + 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x18, ['unsigned long long']], + 'ModifiedPagesTotal' : [ 0x20, ['unsigned long long']], + 'ModifiedPagefilePages' : [ 0x28, ['unsigned long long']], + 'ModifiedNoWritePages' : [ 0x30, ['unsigned long long']], + 'ModifiedPagefileNoReservationPages' : [ 0x38, ['unsigned long long']], + 'MdlHack' : [ 0x40, ['__unnamed_2647']], +} ], + '_PROC_PERF_DOMAIN' : [ 0x190, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], + 'Members' : [ 0x18, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0xc0, ['unsigned long']], + 'Class' : [ 0xc4, ['unsigned char']], + 'Spare' : [ 0xc5, ['array', 3, ['unsigned char']]], + 'Processors' : [ 0xc8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0xd0, ['pointer64', ['void']]], + 'TimeWindowHandler' : [ 0xd8, ['pointer64', ['void']]], + 'BoostPolicyHandler' : [ 0xe0, ['pointer64', ['void']]], + 'BoostModeHandler' : [ 0xe8, ['pointer64', ['void']]], + 'EnergyPerfPreferenceHandler' : [ 0xf0, ['pointer64', ['void']]], + 'AutonomousActivityWindowHandler' : [ 0xf8, ['pointer64', ['void']]], + 'AutonomousModeHandler' : [ 0x100, ['pointer64', ['void']]], + 'ReinitializeHandler' : [ 0x108, ['pointer64', ['void']]], + 'PerfSelectionHandler' : [ 0x110, ['pointer64', ['void']]], + 'PerfControlHandler' : [ 0x118, ['pointer64', ['void']]], + 'MaxFrequency' : [ 0x120, ['unsigned long']], + 'NominalFrequency' : [ 0x124, ['unsigned long']], + 'MaxPercent' : [ 0x128, ['unsigned long']], + 'MinPerfPercent' : [ 0x12c, ['unsigned long']], + 'MinThrottlePercent' : [ 0x130, ['unsigned long']], + 'MinimumRelativePerformance' : [ 0x138, ['unsigned long long']], + 'NominalRelativePerformance' : [ 0x140, ['unsigned long long']], + 'Coordination' : [ 0x148, ['unsigned char']], + 'HardPlatformCap' : [ 0x149, ['unsigned char']], + 'AffinitizeControl' : [ 0x14a, ['unsigned char']], + 'EfficientThrottle' : [ 0x14b, ['unsigned char']], + 'AutonomousMode' : [ 0x14c, ['unsigned char']], + 'SelectedPercent' : [ 0x150, ['unsigned long']], + 'SelectedFrequency' : [ 0x154, ['unsigned long']], + 'DesiredPercent' : [ 0x158, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x15c, ['unsigned long']], + 'MinPolicyPercent' : [ 0x160, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x164, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x168, ['unsigned long']], + 'GuaranteedPercent' : [ 0x16c, ['unsigned long']], + 'TolerancePercent' : [ 0x170, ['unsigned long']], + 'SelectedState' : [ 0x178, ['unsigned long long']], + 'PerfChangeTime' : [ 0x180, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0x188, ['unsigned long']], + 'Force' : [ 0x18c, ['unsigned char']], + 'ProvideGuidance' : [ 0x18d, ['unsigned char']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_TABLE' : [ 0x800, { + 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Type' : [ 0x18, ['unsigned long']], + 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0x110, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], +} ], + '_TRIAGE_9F_PNP' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'CompletionQueue' : [ 0x8, ['pointer64', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], + 'DelayedWorkQueue' : [ 0x10, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_RELATION_LIST' : [ 0x10, { + 'DeviceObjectList' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT_LIST']]], + 'Sorted' : [ 0x8, ['unsigned char']], +} ], + '_IO_TIMER' : [ 0x30, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x8, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_MI_STANDBY_STATE' : [ 0xc0, { + 'TransitionSharedPages' : [ 0x0, ['unsigned long long']], + 'TransitionSharedPagesPeak' : [ 0x8, ['array', 3, ['unsigned long long']]], + 'FirstDecayPage' : [ 0x20, ['unsigned long long']], + 'PfnDecayFreeSList' : [ 0x30, ['_SLIST_HEADER']], + 'PfnRepurposeLog' : [ 0x40, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'AllocatePfnRepurposeDpc' : [ 0x48, ['_KDPC']], +} ], + '_MI_ACCESS_LOG_STATE' : [ 0x80, { + 'CcAccessLog' : [ 0x0, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'Enabled' : [ 0x8, ['unsigned long']], + 'DisableAccessLogging' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'MinLoggingPriority' : [ 0x30, ['unsigned long']], + 'AccessLoggingLock' : [ 0x40, ['unsigned long long']], +} ], + '_ETW_BUFFER_QUEUE' : [ 0x18, { + 'QueueHead' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueTail' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x10, ['_SINGLE_LIST_ENTRY']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0x40, ['_RTL_BITMAP']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x8, { + 'LogHandleContext' : [ 0x0, ['pointer64', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], + 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x18, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'DeviceState' : [ 0x10, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '__unnamed_2691' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHigh' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_2695' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_KGDTENTRY64' : [ 0x10, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'Bytes' : [ 0x4, ['__unnamed_2691']], + 'Bits' : [ 0x4, ['__unnamed_2695']], + 'BaseUpper' : [ 0x8, ['unsigned long']], + 'MustBeZero' : [ 0xc, ['unsigned long']], + 'DataLow' : [ 0x0, ['long long']], + 'DataHigh' : [ 0x8, ['long long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], + 'Lock' : [ 0x40, ['_FAST_MUTEX']], + 'List' : [ 0x78, ['_LIST_ENTRY']], +} ], + '_IOV_IRP_TRACE' : [ 0x80, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x10, ['short']], + 'SpecialApcDisable' : [ 0x12, ['short']], + 'CombinedApcDisable' : [ 0x10, ['unsigned long']], + 'Irql' : [ 0x14, ['unsigned char']], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x20, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], +} ], + '_DYNAMIC_FUNCTION_TABLE' : [ 0x58, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FunctionTable' : [ 0x10, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'TimeStamp' : [ 0x18, ['_LARGE_INTEGER']], + 'MinimumAddress' : [ 0x20, ['unsigned long long']], + 'MaximumAddress' : [ 0x28, ['unsigned long long']], + 'BaseAddress' : [ 0x30, ['unsigned long long']], + 'Callback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'OutOfProcessCallbackDll' : [ 0x48, ['pointer64', ['unsigned short']]], + 'Type' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'RF_SORTED', 1: 'RF_UNSORTED', 2: 'RF_CALLBACK', 3: 'RF_KERNEL_DYNAMIC'})]], + 'EntryCount' : [ 0x54, ['unsigned long']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x8, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_PROC_IDLE_POLICY' : [ 0x6, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], + 'ForceLightIdle' : [ 0x5, ['unsigned char']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_26b7' : [ 0x4, { + 'PercentLevel' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_26b9' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0x10, ['__unnamed_26b7']], + 'Button' : [ 0x10, ['__unnamed_26b9']], +} ], + '_KDPC_DATA' : [ 0x28, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x10, ['unsigned long long']], + 'DpcQueueDepth' : [ 0x18, ['long']], + 'DpcCount' : [ 0x1c, ['unsigned long']], + 'ActiveDpc' : [ 0x20, ['pointer64', ['_KDPC']]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_KSCB' : [ 0x198, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], + 'RankCycleTarget' : [ 0x18, ['unsigned long long']], + 'LongTermCycles' : [ 0x20, ['unsigned long long']], + 'LastReportedCycles' : [ 0x28, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], + 'ReadyTime' : [ 0x38, ['unsigned long long']], + 'InsertTime' : [ 0x40, ['unsigned long long']], + 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x58, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x70, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'MaxOverQuota' : [ 0x70, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'MinOverQuota' : [ 0x70, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x70, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SoftCap' : [ 0x70, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Spare1' : [ 0x70, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Depth' : [ 0x71, ['unsigned char']], + 'ReadySummary' : [ 0x72, ['unsigned short']], + 'Rank' : [ 0x74, ['unsigned long']], + 'ReadyListHead' : [ 0x78, ['array', 16, ['_LIST_ENTRY']]], + 'ChildScbQueue' : [ 0x178, ['_RTL_RB_TREE']], + 'Parent' : [ 0x188, ['pointer64', ['_KSCB']]], + 'Root' : [ 0x190, ['pointer64', ['_KSCB']]], +} ], + '__unnamed_26c8' : [ 0x10, { + 'UserData' : [ 0x0, ['pointer64', ['void']]], + 'Owner' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_26c9' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_26c8']], + 'Merged' : [ 0x10, ['__unnamed_26c9']], + 'Attributes' : [ 0x20, ['unsigned char']], + 'PublicFlags' : [ 0x21, ['unsigned char']], + 'PrivateFlags' : [ 0x22, ['unsigned short']], + 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'UtilityTotal' : [ 0x8, ['unsigned long']], + 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], + 'FrequencyTotal' : [ 0x10, ['unsigned long']], + 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], + 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_MI_PARTITION_ZEROING' : [ 0x68, { + 'PageEvent' : [ 0x0, ['_KEVENT']], + 'ThreadActive' : [ 0x18, ['unsigned char']], + 'ZeroFreePageSlistMinimum' : [ 0x1c, ['long']], + 'FirstReservedZeroingPte' : [ 0x20, ['pointer64', ['_MMPTE']]], + 'RebalanceZeroFreeWorkItem' : [ 0x28, ['_WORK_QUEUE_ITEM']], + 'ThreadCount' : [ 0x48, ['long']], + 'Gate' : [ 0x50, ['_KGATE']], +} ], + '_IMAGE_RUNTIME_FUNCTION_ENTRY' : [ 0xc, { + 'BeginAddress' : [ 0x0, ['unsigned long']], + 'EndAddress' : [ 0x4, ['unsigned long']], + 'UnwindInfoAddress' : [ 0x8, ['unsigned long']], + 'UnwindData' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_26d8' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_26d8']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { + 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], + 'StackId' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Processors' : [ 0x8, ['unsigned long']], + 'ActiveProcessors' : [ 0xc, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x20, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0x18, ['unsigned long long']], +} ], + '__unnamed_26f0' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_26f2' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_26f0']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x110, { + 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x8, ['pointer64', ['void']]], + 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], + 'u1' : [ 0x20, ['__unnamed_26f2']], + 'Signature' : [ 0x28, ['unsigned long long']], + 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], + 'PagedBytes' : [ 0x60, ['unsigned long long']], + 'NonPagedBytes' : [ 0x68, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], + 'RaiseIrqls' : [ 0x80, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], + 'AllocationsFailed' : [ 0x90, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], + 'LockedBytes' : [ 0x98, ['unsigned long long']], + 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], + 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], + 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], + 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], + 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], + 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], + 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], + 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], + 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], + 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], + 'ExecutePoolTypes' : [ 0xf8, ['unsigned long']], + 'ExecutePageProtections' : [ 0xfc, ['unsigned long']], + 'ExecutePageMappings' : [ 0x100, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x104, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0x108, ['unsigned long']], +} ], + '_TRIAGE_DEVICE_NODE' : [ 0x58, { + 'Sibling' : [ 0x0, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_TRIAGE_POP_FX_DEVICE']]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x78, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long long']], + 'PipelinedReadAheadRequestSize' : [ 0x58, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x5c, ['unsigned long']], + 'PrivateLinks' : [ 0x60, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x70, ['pointer64', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MI_SYSTEM_IMAGE_STATE' : [ 0xc0, { + 'FixupLock' : [ 0x0, ['long']], + 'FixupList' : [ 0x8, ['_LIST_ENTRY']], + 'LoadLock' : [ 0x18, ['_KMUTANT']], + 'FirstLoadEver' : [ 0x50, ['unsigned char']], + 'LargePageAll' : [ 0x51, ['unsigned char']], + 'LastPage' : [ 0x58, ['unsigned long long']], + 'LargePageList' : [ 0x60, ['_LIST_ENTRY']], + 'BeingDeleted' : [ 0x70, ['pointer64', ['_KLDR_DATA_TABLE_ENTRY']]], + 'MappingRangesPushLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'MappingRanges' : [ 0x80, ['array', 2, ['pointer64', ['_MI_DRIVER_VA']]]], + 'PageCount' : [ 0x90, ['unsigned long long']], + 'PageCounts' : [ 0x98, ['_MM_SYSTEM_PAGE_COUNTS']], + 'CollidedLock' : [ 0xa8, ['_EX_PUSH_LOCK']], + 'ErrataPte' : [ 0xb0, ['pointer64', ['_MMPTE']]], + 'ErrataPteMapped' : [ 0xb8, ['unsigned long']], +} ], + '_PTE_TRACKER' : [ 0x80, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'Count' : [ 0x18, ['unsigned long long']], + 'SystemVa' : [ 0x20, ['pointer64', ['void']]], + 'StartVa' : [ 0x28, ['pointer64', ['void']]], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'GuardPte' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x48, ['array', 7, ['pointer64', ['void']]]], +} ], + '_HV_GET_CELL_CONTEXT' : [ 0x4, { + 'Cell' : [ 0x0, ['unsigned long']], + 'IsInTempBin' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ContextSwitches' : [ 0x14, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_2724' : [ 0x2, { + 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'EntireField' : [ 0x0, ['unsigned short']], +} ], + '_KLDR_DATA_TABLE_ENTRY' : [ 0xa0, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'ExceptionTable' : [ 0x10, ['pointer64', ['void']]], + 'ExceptionTableSize' : [ 0x18, ['unsigned long']], + 'GpValue' : [ 0x20, ['pointer64', ['void']]], + 'NonPagedDebugInfo' : [ 0x28, ['pointer64', ['_NON_PAGED_DEBUG_INFO']]], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'Flags' : [ 0x68, ['unsigned long']], + 'LoadCount' : [ 0x6c, ['unsigned short']], + 'u1' : [ 0x6e, ['__unnamed_2724']], + 'SectionPointer' : [ 0x70, ['pointer64', ['void']]], + 'CheckSum' : [ 0x78, ['unsigned long']], + 'CoverageSectionSize' : [ 0x7c, ['unsigned long']], + 'CoverageSection' : [ 0x80, ['pointer64', ['void']]], + 'LoadedImports' : [ 0x88, ['pointer64', ['void']]], + 'Spare' : [ 0x90, ['pointer64', ['void']]], + 'SizeOfImageNotRounded' : [ 0x98, ['unsigned long']], + 'TimeDateStamp' : [ 0x9c, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x30, { + 'InstantaneousRead' : [ 0x0, ['pointer64', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer64', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'Scaling' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x28, ['unsigned long long']], +} ], + '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], + 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PAGING_IO_STATE' : [ 0x50, { + 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], + 'PageFileHeadSpinLock' : [ 0x8, ['long']], + 'PrefetchSeekThreshold' : [ 0xc, ['long']], + 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], + 'InPageSupportSListMinimum' : [ 0x30, ['array', 2, ['unsigned char']]], + 'InPageSinglePages' : [ 0x34, ['unsigned long']], + 'DelayPageFaults' : [ 0x38, ['long']], + 'FileCompressionBoundary' : [ 0x3c, ['unsigned long']], + 'MdlsAdjusted' : [ 0x40, ['unsigned char']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_MI_FORCED_COMMITS' : [ 0x8, { + 'Regular' : [ 0x0, ['unsigned long']], + 'Wrap' : [ 0x4, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x28, { + 'BlockOffset' : [ 0x0, ['unsigned long long']], + 'PermanentBinAddress' : [ 0x8, ['unsigned long long']], + 'TemporaryBinAddress' : [ 0x10, ['unsigned long long']], + 'TemporaryBinRundown' : [ 0x18, ['_EX_RUNDOWN_REF']], + 'MemAlloc' : [ 0x20, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x30, { + 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x8, ['unsigned short']], + 'Atom' : [ 0xa, ['unsigned short']], + 'Reference' : [ 0x10, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x28, ['unsigned char']], + 'Name' : [ 0x2a, ['array', 1, ['wchar']]], +} ], + '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { + 'ResetCount' : [ 0x0, ['unsigned long']], + 'StateCount' : [ 0x4, ['unsigned long']], + 'DeepSleepCount' : [ 0x8, ['unsigned long']], + 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DUAL' : [ 0x278, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], + 'Guard' : [ 0x18, ['unsigned long']], + 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x260, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x270, ['unsigned long']], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x8, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2753' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2756' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0x1b0, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Event' : [ 0x20, ['_KEVENT']], + 'CollidedEvent' : [ 0x38, ['_KEVENT']], + 'IoStatus' : [ 0x50, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x60, ['_LARGE_INTEGER']], + 'ApcState' : [ 0x68, ['_KAPC_STATE']], + 'Thread' : [ 0x98, ['pointer64', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0xa0, ['pointer64', ['_MMPFN']]], + 'PteContents' : [ 0xa8, ['_MMPTE']], + 'WaitCount' : [ 0xb0, ['long']], + 'ByteCount' : [ 0xb4, ['unsigned long']], + 'u3' : [ 0xb8, ['__unnamed_2753']], + 'u1' : [ 0xbc, ['__unnamed_2756']], + 'FilePointer' : [ 0xc0, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xc8, ['pointer64', ['_CONTROL_AREA']]], + 'Subsection' : [ 0xc8, ['pointer64', ['_SUBSECTION']]], + 'Autoboost' : [ 0xd0, ['pointer64', ['void']]], + 'FaultingAddress' : [ 0xd8, ['pointer64', ['void']]], + 'PointerPte' : [ 0xe0, ['pointer64', ['_MMPTE']]], + 'BasePte' : [ 0xe8, ['pointer64', ['_MMPTE']]], + 'Pfn' : [ 0xf0, ['pointer64', ['_MMPFN']]], + 'PrefetchMdl' : [ 0xf8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0x100, ['_MDL']], + 'Page' : [ 0x130, ['array', 16, ['unsigned long long']]], + 'FlowThrough' : [ 0x130, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], +} ], + '_HAL_NODE_RANGE' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'Node' : [ 0x8, ['unsigned long']], +} ], + '_MMCLONE_BLOCK' : [ 0x20, { + 'ProtoPte' : [ 0x0, ['_MMPTE']], + 'PaddingFor16ByteAlignment' : [ 0x8, ['unsigned long long']], + 'CloneCommitCount' : [ 0x10, ['unsigned long long']], + 'u1' : [ 0x10, ['_MI_CLONE_BLOCK_FLAGS']], + 'CloneRefCount' : [ 0x18, ['unsigned long long']], +} ], + '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { + 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], + 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], + 'RequestArgument' : [ 0x20, ['unsigned long long']], + 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], + 'ActivityId' : [ 0x38, ['_GUID']], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'LowboxNumber' : [ 0x28, ['unsigned long']], + 'AtomTable' : [ 0x30, ['pointer64', ['void']]], +} ], + '_MI_LDW_WORK_CONTEXT' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'FileObject' : [ 0x20, ['pointer64', ['_FILE_OBJECT']]], + 'ErrorStatus' : [ 0x28, ['long']], + 'Active' : [ 0x2c, ['long']], + 'FreeWhenDone' : [ 0x30, ['unsigned char']], +} ], + '_MI_CFG_BITMAP_INFO' : [ 0x18, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'RegionSize' : [ 0x8, ['unsigned long long']], + 'BitmapVad' : [ 0x10, ['pointer64', ['_MMVAD']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MI_SHUTDOWN_STATE' : [ 0x80, { + 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], + 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], + 'SystemShutdown' : [ 0x4, ['unsigned long']], + 'ShutdownFlushInProgress' : [ 0x8, ['long']], + 'ResumeItem' : [ 0x10, ['_MI_RESUME_WORKITEM']], + 'MirrorHoldsPfn' : [ 0x48, ['pointer64', ['_ETHREAD']]], + 'MirroringActive' : [ 0x50, ['unsigned long']], + 'MirrorBitMaps' : [ 0x58, ['array', 2, ['_RTL_BITMAP_EX']]], + 'CrashDumpPte' : [ 0x78, ['pointer64', ['_MMPTE']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x40, { + 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], + 'ZeroBits' : [ 0x8, ['unsigned long']], + 'MaximumStackSize' : [ 0x10, ['unsigned long long']], + 'CommittedStackSize' : [ 0x18, ['unsigned long long']], + 'SubSystemType' : [ 0x20, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], + 'SubSystemVersion' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'OperatingSystemVersion' : [ 0x28, ['unsigned long']], + 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], + 'DllCharacteristics' : [ 0x2e, ['unsigned short']], + 'Machine' : [ 0x30, ['unsigned short']], + 'ImageContainsCode' : [ 0x32, ['unsigned char']], + 'ImageFlags' : [ 0x33, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ComPlusPrefer32bit' : [ 0x33, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x34, ['unsigned long']], + 'ImageFileSize' : [ 0x38, ['unsigned long']], + 'CheckSum' : [ 0x3c, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x70, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x30, ['pointer64', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x30, ['array', 4, ['pointer64', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x30, ['pointer64', ['void']]], + 'SessionId' : [ 0x38, ['unsigned long']], + 'Process' : [ 0x50, ['pointer64', ['_EPROCESS']]], + 'CallbackContext' : [ 0x50, ['pointer64', ['void']]], + 'Callback' : [ 0x58, ['pointer64', ['void']]], + 'Index' : [ 0x60, ['unsigned short']], + 'Flags' : [ 0x62, ['unsigned char']], + 'DbgKernelRegistration' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgUserRegistration' : [ 0x62, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DbgReplyRegistration' : [ 0x62, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'DbgClassicRegistration' : [ 0x62, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'DbgSessionSpaceRegistration' : [ 0x62, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DbgModernRegistration' : [ 0x62, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DbgClosed' : [ 0x62, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DbgInserted' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'EnableMask' : [ 0x63, ['unsigned char']], + 'GroupEnableMask' : [ 0x64, ['unsigned char']], + 'UseDescriptorType' : [ 0x65, ['unsigned char']], + 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0x100, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x30, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], + 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], + 'PortContext' : [ 0x50, ['pointer64', ['void']]], + 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0xe0, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], + 'Flags' : [ 0xe4, ['unsigned long']], + 'WaitEvent' : [ 0xe8, ['_KEVENT']], +} ], + '_HVIEW_MAP_PIN_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x60, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x10, ['unsigned long']], + 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x2c, ['unsigned long']], + 'WorkSpace' : [ 0x30, ['long long']], + 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x3c, ['unsigned long']], + 'BusNumber' : [ 0x40, ['unsigned long']], + 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { + 'UserRangeInKernel' : [ 0x0, ['unsigned long']], + 'FaultFailed' : [ 0x4, ['unsigned long']], + 'WriteFaultFailed' : [ 0x8, ['unsigned long']], + 'LargePageFailed' : [ 0xc, ['unsigned long']], + 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], + 'BadPageLocation' : [ 0x14, ['unsigned long']], + 'InsufficientCharge' : [ 0x18, ['unsigned long']], + 'PageTableCharge' : [ 0x1c, ['unsigned long']], + 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], + 'NoIoReference' : [ 0x24, ['unsigned long']], + 'ProbeFailed' : [ 0x28, ['unsigned long']], + 'PteIsZero' : [ 0x2c, ['unsigned long']], + 'StrongCodeWrite' : [ 0x30, ['unsigned long']], + 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], + 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], + 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x20, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0x60, { + 'Count' : [ 0x0, ['unsigned long']], + 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_MI_CLONE_BLOCK_FLAGS' : [ 0x8, { + 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 59, native_type='unsigned long long')]], + 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0x118, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x68, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x68, ['unsigned long']], + 'PackagedBinary' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x68, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x68, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LoadConfigProcessed' : [ 0x68, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x68, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x68, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x68, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x68, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x68, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x68, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x68, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x68, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x68, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x68, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x68, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x68, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x6c, ['unsigned short']], + 'TlsIndex' : [ 0x6e, ['unsigned short']], + 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x80, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x90, ['pointer64', ['void']]], + 'DdagNode' : [ 0x98, ['pointer64', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0xa0, ['_LIST_ENTRY']], + 'LoadContext' : [ 0xb0, ['pointer64', ['_LDRP_LOAD_CONTEXT']]], + 'ParentDllBase' : [ 0xb8, ['pointer64', ['void']]], + 'SwitchBackContext' : [ 0xc0, ['pointer64', ['void']]], + 'BaseAddressIndexNode' : [ 0xc8, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0xe0, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0xf8, ['unsigned long long']], + 'LoadTime' : [ 0x100, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x108, ['unsigned long']], + 'LoadReason' : [ 0x10c, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x110, ['unsigned long']], + 'ReferenceCount' : [ 0x114, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x20, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x10, ['long']], + 'Misses' : [ 0x14, ['unsigned long']], + 'MissesLast' : [ 0x18, ['unsigned long']], + 'AllStacksInUse' : [ 0x1c, ['unsigned long']], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_DRIVER_VA' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_DRIVER_VA']]], + 'PointerPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'BitMap' : [ 0x10, ['_RTL_BITMAP']], + 'Hint' : [ 0x20, ['unsigned long']], +} ], + '_LDR_DDAG_NODE' : [ 0x50, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x10, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0x18, ['unsigned long']], + 'LoadWhileUnloadingCount' : [ 0x1c, ['unsigned long']], + 'LowestLink' : [ 0x20, ['unsigned long']], + 'Dependencies' : [ 0x28, ['_LDRP_CSLIST']], + 'IncomingDependencies' : [ 0x30, ['_LDRP_CSLIST']], + 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x48, ['unsigned long']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x1d0, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], + 'Order' : [ 0x30, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x1a8, ['_LIST_ENTRY']], + 'Status' : [ 0x1b8, ['long']], + 'FailedDevice' : [ 0x1c0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x1c8, ['unsigned char']], + 'Cancelled' : [ 0x1c9, ['unsigned char']], + 'IgnoreErrors' : [ 0x1ca, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x1cb, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x1cc, ['unsigned char']], +} ], + '_KHETERO_PROCESSOR_SET' : [ 0x10, { + 'PreferredMask' : [ 0x0, ['unsigned long long']], + 'AvailableMask' : [ 0x8, ['unsigned long long']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x10, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x28, { + 'Size' : [ 0x0, ['unsigned long long']], + 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], + 'ProcessId' : [ 0x18, ['unsigned long']], + 'ServiceTag' : [ 0x1c, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], + 'DevicePathOffset' : [ 0x18, ['unsigned long long']], + 'ReasonOffset' : [ 0x20, ['unsigned long long']], +} ], + '_KWAIT_CHAIN_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '__unnamed_27d1' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '__unnamed_27d3' : [ 0x4, { + 'NumberOfChildViews' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_27d5' : [ 0x4, { + 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SUBSECTION' : [ 0x38, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'GlobalPerSessionHead' : [ 0x18, ['_RTL_AVL_TREE']], + 'CreationWaitList' : [ 0x18, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'SessionDriverProtos' : [ 0x18, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], + 'u' : [ 0x20, ['__unnamed_27d1']], + 'StartingSector' : [ 0x24, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x28, ['unsigned long']], + 'PtesInSubsection' : [ 0x2c, ['unsigned long']], + 'u1' : [ 0x30, ['__unnamed_27d3']], + 'UnusedPtes' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u2' : [ 0x34, ['__unnamed_27d5']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x28, ['unsigned long']], + 'PagingCount' : [ 0x2c, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0xf8, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Name' : [ 0xa8, ['_UNICODE_STRING']], + 'Latency' : [ 0xb8, ['unsigned long']], + 'BreakEvenDuration' : [ 0xbc, ['unsigned long']], + 'Power' : [ 0xc0, ['unsigned long']], + 'StateFlags' : [ 0xc4, ['unsigned long']], + 'VetoAccounting' : [ 0xc8, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0xf0, ['unsigned char']], + 'InterruptsEnabled' : [ 0xf1, ['unsigned char']], + 'Interruptible' : [ 0xf2, ['unsigned char']], + 'ContextRetained' : [ 0xf3, ['unsigned char']], + 'CacheCoherent' : [ 0xf4, ['unsigned char']], + 'WakesSpuriously' : [ 0xf5, ['unsigned char']], + 'PlatformOnly' : [ 0xf6, ['unsigned char']], + 'NoCState' : [ 0xf7, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x250, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x20, ['unsigned long']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x88, ['_GUID']], + 'NotificationQueue' : [ 0x98, ['_KQUEUE']], + 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], + 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x120, ['unsigned long']], + 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], + 'Key' : [ 0x130, ['pointer64', ['void']]], + 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], + 'Description' : [ 0x170, ['_UNICODE_STRING']], + 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_MI_SYSTEM_PTE_STATE' : [ 0x180, { + 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'PteTrackerLock' : [ 0x10, ['unsigned long long']], + 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], + 'PteTrackingBitmap' : [ 0xc0, ['_RTL_BITMAP_EX']], + 'CachedPteHeads' : [ 0xd0, ['pointer64', ['_MI_CACHED_PTES']]], + 'SystemViewPteInfo' : [ 0xd8, ['_MI_SYSTEM_PTE_TYPE']], + 'KernelStackPages' : [ 0x138, ['unsigned char']], + 'QueuedStacks' : [ 0x140, ['_SLIST_HEADER']], + 'StackGrowthFailures' : [ 0x150, ['unsigned long']], + 'TrackPtesAborted' : [ 0x154, ['unsigned char']], + 'AdjustCounter' : [ 0x155, ['unsigned char']], + 'QueuedStacksWorkItem' : [ 0x158, ['_MI_QUEUED_DEADSTACK_WORKITEM']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x10, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x18, ['long']], + 'HighWaterMark' : [ 0x1c, ['unsigned long']], + 'Reserved' : [ 0x20, ['array', 8, ['unsigned long']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long long']], + 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2805' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x20, { + 'NodeRangeSize' : [ 0x0, ['unsigned long long']], + 'NodeCount' : [ 0x8, ['unsigned long long']], + 'Tables' : [ 0x10, ['pointer64', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x18, ['unsigned long']], + 'u1' : [ 0x1c, ['__unnamed_2805']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned char']], + 'DripsRequiredState' : [ 0xc, ['unsigned long']], + 'Level' : [ 0x10, ['long']], + 'ActiveStamp' : [ 0x18, ['long long']], + 'CsActiveTime' : [ 0x20, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x28, ['long long']], +} ], + '_MI_RESUME_WORKITEM' : [ 0x38, { + 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x38, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Link' : [ 0x20, ['_LIST_ENTRY']], + 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ISR_THUNK' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_TRIAGE_EX_WORK_QUEUE' : [ 0x2b0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], +} ], + '_POP_FX_COMPONENT' : [ 0x100, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x18, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x58, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x60, ['long']], + 'ActiveEvent' : [ 0x68, ['_KEVENT']], + 'IdleLock' : [ 0x80, ['unsigned long long']], + 'IdleConditionComplete' : [ 0x88, ['long']], + 'IdleStateComplete' : [ 0x8c, ['long']], + 'IdleStamp' : [ 0x90, ['unsigned long long']], + 'CurrentIdleState' : [ 0x98, ['unsigned long']], + 'IdleStateCount' : [ 0x9c, ['unsigned long']], + 'IdleStates' : [ 0xa0, ['pointer64', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0xa8, ['unsigned long']], + 'ProviderCount' : [ 0xac, ['unsigned long']], + 'Providers' : [ 0xb0, ['pointer64', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0xb8, ['unsigned long']], + 'DependentCount' : [ 0xbc, ['unsigned long']], + 'Dependents' : [ 0xc0, ['pointer64', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0xc8, ['_POP_FX_ACCOUNTING']], + 'Performance' : [ 0xf8, ['pointer64', ['_POP_FX_PERF_INFO']]], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x10, { + 'DeviceHandle' : [ 0x0, ['pointer64', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x38, { + 'ComponentActive' : [ 0x0, ['pointer64', ['void']]], + 'ComponentIdle' : [ 0x8, ['pointer64', ['void']]], + 'ComponentIdleState' : [ 0x10, ['pointer64', ['void']]], + 'DevicePowerRequired' : [ 0x18, ['pointer64', ['void']]], + 'DevicePowerNotRequired' : [ 0x20, ['pointer64', ['void']]], + 'PowerControl' : [ 0x28, ['pointer64', ['void']]], + 'ComponentCriticalTransition' : [ 0x30, ['pointer64', ['void']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x10, ['unsigned char']], + 'Spare' : [ 0x11, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0x14, ['unsigned long']], + 'DebugId' : [ 0x18, ['_CVDD']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x8180, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], + 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], + 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x8010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], + 'NodesSearched' : [ 0x801c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], + 'SequenceNumber' : [ 0x8024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], + 'DepthLimitHits' : [ 0x8030, ['unsigned long']], + 'SearchLimitHits' : [ 0x8034, ['unsigned long']], + 'StackLimitHits' : [ 0x8038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x803c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x8040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x8044, ['unsigned long']], + 'TotalReleases' : [ 0x8048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x804c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x8050, ['unsigned long']], + 'Instigator' : [ 0x8058, ['pointer64', ['void']]], + 'NumberOfParticipants' : [ 0x8060, ['unsigned long']], + 'Participant' : [ 0x8068, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x8168, ['long']], + 'StackType' : [ 0x816c, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x8170, ['unsigned long long']], + 'StackHighLimit' : [ 0x8178, ['unsigned long long']], +} ], + '_KTM' : [ 0x3c0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x8, ['_KMUTANT']], + 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x70, ['_GUID']], + 'Flags' : [ 0x80, ['unsigned long']], + 'VolatileFlags' : [ 0x84, ['unsigned long']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], + 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], + 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x288, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], + 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], + 'LogFlags' : [ 0x378, ['unsigned long']], + 'LogFullStatus' : [ 0x37c, ['long']], + 'RecoveryStatus' : [ 0x380, ['long']], + 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], +} ], + '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { + 'SystemCodePage' : [ 0x0, ['unsigned long']], + 'SystemDriverPage' : [ 0x4, ['unsigned long']], + 'TotalSystemCodePages' : [ 0x8, ['long']], + 'TotalSystemDriverPages' : [ 0xc, ['long']], +} ], + '_MI_MODWRITE_DATA' : [ 0x40, { + 'PagesLoad' : [ 0x0, ['long long']], + 'PagesAverage' : [ 0x8, ['unsigned long long']], + 'AverageAvailablePages' : [ 0x10, ['unsigned long long']], + 'PagesWritten' : [ 0x18, ['unsigned long long']], + 'WritesIssued' : [ 0x20, ['unsigned long']], + 'IgnoredReservationsCount' : [ 0x24, ['unsigned long']], + 'FreedReservationsCount' : [ 0x28, ['unsigned long']], + 'WriteBurstCount' : [ 0x2c, ['unsigned long']], + 'IgnoreReservationsStartTime' : [ 0x30, ['unsigned long long']], + 'ReservationClusterInfo' : [ 0x38, ['_MI_RESERVATION_CLUSTER_INFO']], + 'IgnoreReservations' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'Spare1' : [ 0x3e, ['unsigned short']], +} ], + '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { + 'CancelCount' : [ 0x0, ['unsigned long']], + 'FailureCount' : [ 0x4, ['unsigned long']], + 'SuccessCount' : [ 0x8, ['unsigned long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'TotalTime' : [ 0x20, ['unsigned long long']], + 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], + 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_KTRANSACTION' : [ 0x2d8, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x20, ['_KMUTANT']], + 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0xb0, ['_GUID']], + 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xd8, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], + 'PendingResponses' : [ 0xec, ['unsigned long']], + 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xf8, ['_CLS_LSN']], + 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], + 'IsolationLevel' : [ 0x120, ['unsigned long']], + 'IsolationFlags' : [ 0x124, ['unsigned long']], + 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], + 'Description' : [ 0x130, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0x168, ['_KDPC']], + 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], + 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], + 'CommitReservation' : [ 0x208, ['long long']], + 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], + 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], + 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x60, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], + 'UoWState' : [ 0x40, ['unsigned long']], + 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x50, ['unsigned long']], + 'OldValueCell' : [ 0x50, ['unsigned long']], + 'NewValueCell' : [ 0x54, ['unsigned long']], + 'UserFlags' : [ 0x50, ['unsigned long']], + 'LastWriteTime' : [ 0x50, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x50, ['unsigned long']], + 'OldChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], +} ], + '_KREQUEST_PACKET' : [ 0x20, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], +} ], + '_VF_WATCHDOG_IRP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'DueTickCount' : [ 0x18, ['unsigned long']], + 'Inserted' : [ 0x1c, ['unsigned char']], + 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_2880' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2882' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_2880']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2882']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x38, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x18, ['unsigned long']], + 'RealRefCount' : [ 0x1c, ['unsigned long']], + 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_CM_NAME_HASH' : [ 0x18, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x10, ['unsigned short']], + 'Name' : [ 0x12, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_PO_IRP_QUEUE' : [ 0x10, { + 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_2897' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0xd0, { + 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x48, ['__unnamed_2897']], + 'ChildrenCount' : [ 0x4c, ['long']], + 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], + 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0xa8, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x68, ['_KMUTANT']], + 'LinksOffset' : [ 0xa0, ['unsigned short']], + 'GuidOffset' : [ 0xa2, ['unsigned short']], + 'Expired' : [ 0xa4, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x20, { + 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x10, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_HVIEW_MAP_ENTRY' : [ 0x20, { + 'ViewStart' : [ 0x0, ['pointer64', ['void']]], + 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Bcb' : [ 0x8, ['pointer64', ['void']]], + 'PinnedPages' : [ 0x10, ['unsigned long long']], + 'Size' : [ 0x18, ['unsigned long']], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x10, { + 'Stream' : [ 0x0, ['pointer64', ['void']]], + 'Detail' : [ 0x8, ['unsigned long']], +} ], + '_POP_COOLING_EXTENSION' : [ 0x90, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'RequestListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Lock' : [ 0x20, ['_POP_RW_LOCK']], + 'DeviceObject' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'NotificationEntry' : [ 0x38, ['pointer64', ['void']]], + 'Enabled' : [ 0x40, ['unsigned char']], + 'ActiveEngaged' : [ 0x41, ['unsigned char']], + 'ThrottleLimit' : [ 0x42, ['unsigned char']], + 'UpdatingToCurrent' : [ 0x43, ['unsigned char']], + 'RemovalFlushEvent' : [ 0x48, ['pointer64', ['_KEVENT']]], + 'PnpFlushEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Interface' : [ 0x58, ['_THERMAL_COOLING_INTERFACE']], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_CM_INDEX' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], + 'HashKey' : [ 0x4, ['unsigned long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x10, { + 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], + 'End' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], +} ], + '_THERMAL_POLICY' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ThermalStandby' : [ 0x7, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], + 'OverThrottled' : [ 0x14, ['unsigned char']], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x10, ['pointer64', ['void']]], + 'Key' : [ 0x18, ['unsigned long long']], + 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x408, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_RTL_UMS_CONTEXT' : [ 0x520, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Context' : [ 0x10, ['_CONTEXT']], + 'Teb' : [ 0x4e0, ['pointer64', ['void']]], + 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Flags' : [ 0x4f0, ['long']], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], + 'ContextLock' : [ 0x4f8, ['unsigned long long']], + 'PrimaryUmsContext' : [ 0x500, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'SwitchCount' : [ 0x508, ['unsigned long']], + 'KernelYieldCount' : [ 0x50c, ['unsigned long']], + 'MixedYieldCount' : [ 0x510, ['unsigned long']], + 'YieldCount' : [ 0x514, ['unsigned long']], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x40, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], +} ], + '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'EventSets' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_COLORED_PAGE_INFO' : [ 0x18, { + 'BeingZeroed' : [ 0x0, ['long']], + 'Processor' : [ 0x4, ['unsigned long']], + 'PagesQueued' : [ 0x8, ['unsigned long long']], + 'PfnAllocation' : [ 0x10, ['pointer64', ['_MMPFN']]], +} ], + '_TRIAGE_9F_POWER' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'IrpList' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadList' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'DelayedWorkQueue' : [ 0x18, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_MI_POOL_STATE' : [ 0xf8, { + 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long long']], + 'NonPagedPoolSListMaximum' : [ 0x8, ['array', 3, ['unsigned long']]], + 'AllocatedNonPagedPool' : [ 0x18, ['unsigned long long']], + 'BadPoolHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'HighEventSets' : [ 0x28, ['unsigned long']], + 'HighEventSetsValid' : [ 0x2c, ['unsigned char']], + 'PoolFailures' : [ 0x30, ['array', 3, ['array', 3, ['unsigned long']]]], + 'PoolFailureReasons' : [ 0x54, ['_MI_POOL_FAILURE_REASONS']], + 'LowPagedPoolThreshold' : [ 0x80, ['unsigned long long']], + 'HighPagedPoolThreshold' : [ 0x88, ['unsigned long long']], + 'PagedPoolSListMaximum' : [ 0x90, ['unsigned long']], + 'PreemptiveTrims' : [ 0x94, ['array', 4, ['unsigned long']]], + 'SpecialPagesInUsePeak' : [ 0xa8, ['unsigned long long']], + 'SpecialPoolRejected' : [ 0xb0, ['array', 9, ['unsigned long']]], + 'SpecialPagesNonPaged' : [ 0xd8, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0xe0, ['long']], + 'SessionSpecialPoolPdesMax' : [ 0xe4, ['unsigned long']], + 'TotalPagedPoolQuota' : [ 0xe8, ['unsigned long long']], + 'TotalNonPagedPoolQuota' : [ 0xf0, ['unsigned long long']], +} ], + '_STACK_TABLE' : [ 0x8088, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], +} ], + '_POP_POWER_SETTING_VALUES' : [ 0x13c, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], + 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], + 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], + 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], + 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], + 'AwayModeIgnoreAction' : [ 0xf8, ['long']], + 'DisableFastS4' : [ 0xfc, ['unsigned char']], + 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], + 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], + 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], + 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], + 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], + 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], + 'VideoDimBrightness' : [ 0x114, ['unsigned long']], + 'AlsOffset' : [ 0x118, ['unsigned long']], + 'AlsEnabled' : [ 0x11c, ['unsigned long']], + 'EsBrightness' : [ 0x120, ['unsigned long']], + 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], + 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], + 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], + 'OffloadedAudio' : [ 0x12d, ['unsigned char']], + 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], + 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], + 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], + 'EsUserAwaySetting' : [ 0x134, ['unsigned char']], + 'WiFiInStandby' : [ 0x138, ['unsigned long']], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_KUMS_CONTEXT_HEADER' : [ 0x70, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'StackTop' : [ 0x20, ['pointer64', ['void']]], + 'StackSize' : [ 0x28, ['unsigned long long']], + 'RspOffset' : [ 0x30, ['unsigned long long']], + 'Rip' : [ 0x38, ['unsigned long long']], + 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], + 'Flags' : [ 0x48, ['unsigned long long']], + 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], + 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], + 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], + 'Return' : [ 0x68, ['unsigned long long']], +} ], + '_DEFERRED_WRITE' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x10, ['unsigned long']], + 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Context1' : [ 0x38, ['pointer64', ['void']]], + 'Context2' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_2911' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2913' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2911']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2913']], +} ], + '_MI_RESAVAIL_FAILURES' : [ 0x8, { + 'Wrap' : [ 0x0, ['unsigned long']], + 'NoCharge' : [ 0x4, ['unsigned long']], +} ], + '_MI_IO_PAGE_STATE' : [ 0x58, { + 'IoPfnLock' : [ 0x0, ['unsigned long long']], + 'IoPfnRoot' : [ 0x8, ['array', 3, ['_RTL_AVL_TREE']]], + 'UnusedCachedMaps' : [ 0x20, ['_LIST_ENTRY']], + 'OldestCacheFlushTimeStamp' : [ 0x30, ['unsigned long']], + 'IoCacheStats' : [ 0x38, ['_MI_IO_CACHE_STATS']], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], +} ], + '_VF_AVL_TABLE' : [ 0xc0, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x70, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1e, { + 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], +} ], + '_TRIAGE_POP_FX_DEVICE' : [ 0x38, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_TRIAGE_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['long']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DeviceNode' : [ 0x30, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '__unnamed_292f' : [ 0x10, { + 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], +} ], + '__unnamed_2931' : [ 0x8, { + 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], +} ], + '__unnamed_2937' : [ 0x10, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], + 'OutputInformation' : [ 0x8, ['pointer64', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], +} ], + '__unnamed_293b' : [ 0x10, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x8, ['unsigned char']], +} ], + '__unnamed_293d' : [ 0x28, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], + 'Argument5' : [ 0x20, ['pointer64', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x28, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_292f']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2931']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2937']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_293b']], + 'Others' : [ 0x0, ['__unnamed_293d']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x8, { + 'Function' : [ 0x0, ['pointer64', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long long']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x78, { + 'SelectedCount' : [ 0x0, ['unsigned long long']], + 'VetoCount' : [ 0x8, ['unsigned long long']], + 'PreVetoCount' : [ 0x10, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'IdleDurationCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], + 'InterruptibleCount' : [ 0x48, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], + 'CstateCheckCount' : [ 0x58, ['unsigned long long']], + 'NoCStateCount' : [ 0x60, ['unsigned long long']], + 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], + 'PreVetoAccounting' : [ 0x70, ['pointer64', ['_PPM_VETO_ACCOUNTING']]], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { + 'PagesScannedActive' : [ 0x0, ['unsigned long long']], + 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], + 'PagesCombined' : [ 0x10, ['unsigned long long']], + 'CombineScanCount' : [ 0x18, ['unsigned long']], + 'CombinedBlocksInUse' : [ 0x1c, ['long']], + 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], +} ], + '_THERMAL_COOLING_INTERFACE' : [ 0x38, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'ActiveCooling' : [ 0x28, ['pointer64', ['void']]], + 'PassiveCooling' : [ 0x30, ['pointer64', ['void']]], +} ], + '_HIVE_WAIT_PACKET' : [ 0x28, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Next' : [ 0x20, ['pointer64', ['_HIVE_WAIT_PACKET']]], +} ], + '_PROC_PERF_CHECK' : [ 0xc0, { + 'LastActive' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'LastStall' : [ 0x10, ['unsigned long long']], + 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], + 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], + 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], + 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], + 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], +} ], + '__unnamed_2956' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2958' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_295a' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_2956']], + 'Interrupt' : [ 0x0, ['__unnamed_2958']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_2958']], + 'Sci' : [ 0x0, ['__unnamed_2958']], + 'Nmi' : [ 0x0, ['__unnamed_2958']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_295a']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x1d0, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'VerifyKernelPhaseOnResume' : [ 0x3, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x4, ['unsigned char']], + 'InitializationFinished' : [ 0x5, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'HvCaptureReadyBarrier' : [ 0x14, ['long']], + 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], + 'MapFrozen' : [ 0x1c, ['unsigned char']], + 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x30, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x40, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x50, ['unsigned long']], + 'ClonedPageCount' : [ 0x58, ['unsigned long long']], + 'CurrentMap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x68, ['pointer64', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x70, ['unsigned long long']], + 'LoaderMdl' : [ 0x78, ['pointer64', ['_MDL']]], + 'AllocatedMdl' : [ 0x80, ['pointer64', ['_MDL']]], + 'PagesOut' : [ 0x88, ['unsigned long long']], + 'IoPages' : [ 0x90, ['pointer64', ['void']]], + 'IoPagesCount' : [ 0x98, ['unsigned long']], + 'CurrentMcb' : [ 0xa0, ['pointer64', ['void']]], + 'DumpStack' : [ 0xa8, ['pointer64', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0xb0, ['pointer64', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0xb8, ['unsigned long']], + 'Status' : [ 0xbc, ['long']], + 'GraphicsProc' : [ 0xc0, ['unsigned long']], + 'MemoryImage' : [ 0xc8, ['pointer64', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0xd0, ['pointer64', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0xd8, ['pointer64', ['_MDL']]], + 'SiLogOffset' : [ 0xe0, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0xe8, ['pointer64', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0xf0, ['pointer64', ['void']]], + 'ResumeContext' : [ 0xf8, ['pointer64', ['void']]], + 'ResumeContextPages' : [ 0x100, ['unsigned long']], + 'SecurePages' : [ 0x104, ['unsigned long']], + 'ProcessorCount' : [ 0x108, ['unsigned long']], + 'ProcessorContext' : [ 0x110, ['pointer64', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0x118, ['pointer64', ['unsigned char']]], + 'ProdConsSize' : [ 0x120, ['unsigned long']], + 'MaxDataPages' : [ 0x124, ['unsigned long']], + 'ExtraBuffer' : [ 0x128, ['pointer64', ['void']]], + 'ExtraBufferSize' : [ 0x130, ['unsigned long long']], + 'ExtraMapVa' : [ 0x138, ['pointer64', ['void']]], + 'BitlockerKeyPFN' : [ 0x140, ['unsigned long long']], + 'IoInfo' : [ 0x148, ['_POP_IO_INFO']], + 'IoChecksums' : [ 0x1b8, ['pointer64', ['unsigned short']]], + 'IoChecksumsSize' : [ 0x1c0, ['unsigned long long']], + 'HardwareConfigurationSignature' : [ 0x1c8, ['unsigned long']], + 'IumEnabled' : [ 0x1cc, ['unsigned char']], +} ], + '_OBJECT_REF_TRACE' : [ 0x80, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x10, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_POP_FX_PERF_INFO' : [ 0xa0, { + 'Component' : [ 0x0, ['pointer64', ['_POP_FX_COMPONENT']]], + 'CompletedEvent' : [ 0x8, ['_KEVENT']], + 'ComponentPerfState' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['_POP_FX_PERF_FLAGS']], + 'LastChange' : [ 0x30, ['pointer64', ['_PO_FX_PERF_STATE_CHANGE']]], + 'LastChangeCount' : [ 0x38, ['unsigned long']], + 'LastChangeStamp' : [ 0x40, ['unsigned long long']], + 'LastChangeNominal' : [ 0x48, ['unsigned char']], + 'PepRegistered' : [ 0x49, ['unsigned char']], + 'QueryOnIdleStates' : [ 0x4a, ['unsigned char']], + 'RequestDriverContext' : [ 0x50, ['pointer64', ['void']]], + 'WorkOrder' : [ 0x58, ['_POP_FX_WORK_ORDER']], + 'SetsCount' : [ 0x90, ['unsigned long']], + 'Sets' : [ 0x98, ['pointer64', ['_POP_FX_PERF_SET']]], +} ], + '_KDESCRIPTOR' : [ 0x10, { + 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], + 'Limit' : [ 0x6, ['unsigned short']], + 'Base' : [ 0x8, ['pointer64', ['void']]], +} ], + '_HAL_CHANNEL_MEMORY_RANGES' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'MpnId' : [ 0x8, ['unsigned short']], + 'Node' : [ 0xa, ['unsigned short']], + 'Channel' : [ 0xc, ['unsigned short']], + 'IsPowerManageable' : [ 0xe, ['unsigned char']], + 'DeepPowerState' : [ 0xf, ['unsigned char']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x178, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0x108, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0x110, ['pointer64', ['void']]], + 'PointersLength' : [ 0x118, ['unsigned long']], + 'ModulePrefix' : [ 0x120, ['pointer64', ['unsigned short']]], + 'DriverList' : [ 0x128, ['_LIST_ENTRY']], + 'InitMsg' : [ 0x138, ['_STRING']], + 'ProgMsg' : [ 0x148, ['_STRING']], + 'DoneMsg' : [ 0x158, ['_STRING']], + 'FileObject' : [ 0x168, ['pointer64', ['void']]], + 'UsageType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x8, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x48, { + 'InitiatingThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ThreadId' : [ 0x10, ['pointer64', ['void']]], + 'ProcessId' : [ 0x18, ['pointer64', ['void']]], + 'Code' : [ 0x20, ['unsigned long']], + 'Parameter1' : [ 0x28, ['unsigned long long']], + 'Parameter2' : [ 0x30, ['unsigned long long']], + 'Parameter3' : [ 0x38, ['unsigned long long']], + 'Parameter4' : [ 0x40, ['unsigned long long']], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_PCW_MASK_INFORMATION' : [ 0x28, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0x10, ['unsigned long']], + 'CollectMultiple' : [ 0x14, ['unsigned char']], + 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'SizeReturned' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x48, { + 'ViewOffset' : [ 0x0, ['unsigned long']], + 'Pinned' : [ 0x4, ['unsigned char']], + 'PinMask' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '__unnamed_299a' : [ 0x20, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x20, { + 'Parameters' : [ 0x0, ['__unnamed_299a']], +} ], + '__unnamed_299e' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_299e']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SUBSECTION_WAIT_BLOCK' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'Gate' : [ 0x8, ['_KGATE']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long']], + 'Weight' : [ 0x0, ['unsigned short']], + 'MinRate' : [ 0x0, ['unsigned short']], + 'MaxRate' : [ 0x2, ['unsigned short']], + 'AllFlags' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x3b0, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long long']], + 'PageSize' : [ 0x18, ['unsigned long']], + 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x28, ['unsigned long long']], + 'FeatureFlags' : [ 0x30, ['unsigned long long']], + 'HiberFlags' : [ 0x38, ['unsigned char']], + 'spare' : [ 0x39, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x3c, ['unsigned long']], + 'HiberVa' : [ 0x40, ['unsigned long long']], + 'NoFreePages' : [ 0x48, ['unsigned long']], + 'FreeMapCheck' : [ 0x4c, ['unsigned long']], + 'WakeCheck' : [ 0x50, ['unsigned long']], + 'NumPagesForLoader' : [ 0x58, ['unsigned long long']], + 'FirstSecureRestorePage' : [ 0x60, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x68, ['unsigned long long']], + 'FirstKernelRestorePage' : [ 0x70, ['unsigned long long']], + 'FirstChecksumRestorePage' : [ 0x78, ['unsigned long long']], + 'NoChecksumEntries' : [ 0x80, ['unsigned long long']], + 'PerfInfo' : [ 0x88, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x268, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x270, ['array', 1, ['unsigned long long']]], + 'SiLogOffset' : [ 0x278, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x27c, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x280, ['array', 24, ['unsigned long long']]], + 'NotUsed' : [ 0x340, ['unsigned long']], + 'ResumeContextCheck' : [ 0x344, ['unsigned long']], + 'ResumeContextPages' : [ 0x348, ['unsigned long']], + 'Hiberboot' : [ 0x34c, ['unsigned char']], + 'HvCr3' : [ 0x350, ['unsigned long long']], + 'HvEntryPoint' : [ 0x358, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x360, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x368, ['unsigned long long']], + 'BootFlags' : [ 0x370, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x378, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x380, ['unsigned long long']], + 'BitlockerKeyPfns' : [ 0x388, ['array', 4, ['unsigned long long']]], + 'HardwareSignature' : [ 0x3a8, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x18, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned short']], + 'Flags' : [ 0x16, ['unsigned short']], +} ], + '_CURDIR' : [ 0x18, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x1e0, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], + 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x48, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x4c, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x50, ['unsigned long']], + 'ResumeAppTicks' : [ 0x58, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x60, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x68, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x70, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x78, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x80, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x88, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x90, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0x98, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeMapTicks' : [ 0xa8, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xb0, ['unsigned long long']], + 'ResumeChecksumTicks' : [ 0xb8, ['unsigned long long']], + 'ResumeChecksumIoTicks' : [ 0xc0, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xc8, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xd0, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xd8, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xe0, ['unsigned long long']], + 'HalTscOffset' : [ 0xe8, ['unsigned long long']], + 'HvlTscOffset' : [ 0xf0, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0xf8, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0x100, ['unsigned long long']], + 'IoBoundedness' : [ 0x108, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0x110, ['unsigned long long']], + 'KernelIoTicks' : [ 0x118, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x120, ['unsigned long long']], + 'ReadCheckCount' : [ 0x128, ['unsigned long long']], + 'KernelInitTicks' : [ 0x130, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x138, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x140, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x148, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x150, ['unsigned long long']], + 'KernelChecksumTicks' : [ 0x158, ['unsigned long long']], + 'KernelChecksumIoTicks' : [ 0x160, ['unsigned long long']], + 'AnimationStart' : [ 0x168, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x170, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x178, ['unsigned long']], + 'SecurePagesProcessed' : [ 0x180, ['unsigned long long']], + 'BootPagesProcessed' : [ 0x188, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x190, ['unsigned long long']], + 'BootBytesWritten' : [ 0x198, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x1a0, ['unsigned long long']], + 'BootPagesWritten' : [ 0x1a8, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x1b0, ['unsigned long long']], + 'BytesWritten' : [ 0x1b8, ['unsigned long long']], + 'PagesWritten' : [ 0x1c0, ['unsigned long']], + 'FileRuns' : [ 0x1c4, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x1c8, ['unsigned long']], + 'MaxHuffRatio' : [ 0x1cc, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x1d0, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1d8, ['unsigned long long']], +} ], + '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x28, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Active' : [ 0x20, ['long']], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_RTL_BALANCED_LINKS' : [ 0x20, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0x18, ['unsigned char']], + 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], +} ], + '_FREE_DISPLAY' : [ 0x18, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x38, { + 'Page' : [ 0x0, ['array', 1, ['unsigned long long']]], + 'InitialInPageSupport' : [ 0x8, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'PagingFile' : [ 0x10, ['pointer64', ['_MMPAGING_FILE']]], + 'PageFileOffset' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['_RTL_BALANCED_NODE']], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x80, { + 'UncompressedData' : [ 0x0, ['pointer64', ['unsigned char']]], + 'MappingVa' : [ 0x8, ['pointer64', ['void']]], + 'XpressEncodeWorkspace' : [ 0x10, ['pointer64', ['void']]], + 'CompressedDataBuffer' : [ 0x18, ['pointer64', ['unsigned char']]], + 'CopyTicks' : [ 0x20, ['unsigned long long']], + 'CompressTicks' : [ 0x28, ['unsigned long long']], + 'BytesCopied' : [ 0x30, ['unsigned long long']], + 'PagesProcessed' : [ 0x38, ['unsigned long long']], + 'DecompressTicks' : [ 0x40, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x48, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x50, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x68, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x78, ['unsigned long']], + 'HuffCompressCount' : [ 0x7c, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK' : [ 0x20, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_MI_DYNAMIC_BITMAP' : [ 0x50, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'MaximumSize' : [ 0x10, ['unsigned long long']], + 'Hint' : [ 0x18, ['unsigned long long']], + 'BaseVa' : [ 0x20, ['pointer64', ['void']]], + 'SizeTopDown' : [ 0x28, ['unsigned long long']], + 'HintTopDown' : [ 0x30, ['unsigned long long']], + 'BaseVaTopDown' : [ 0x38, ['pointer64', ['void']]], + 'SpinLock' : [ 0x40, ['unsigned long long']], + 'Vm' : [ 0x48, ['pointer64', ['_MMSUPPORT']]], +} ], + '_POP_IO_INFO' : [ 0x70, { + 'DumpMdl' : [ 0x0, ['pointer64', ['_MDL']]], + 'IoStatus' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x10, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x18, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x20, ['unsigned long long']], + 'RequestSize' : [ 0x28, ['unsigned long long']], + 'IoLocation' : [ 0x30, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x38, ['unsigned long long']], + 'Buffer' : [ 0x40, ['pointer64', ['void']]], + 'AsyncCapable' : [ 0x48, ['unsigned char']], + 'BytesToRead' : [ 0x50, ['unsigned long long']], + 'Pages' : [ 0x58, ['unsigned long']], + 'HighestChecksumIndex' : [ 0x60, ['unsigned long long']], + 'PreviousChecksum' : [ 0x68, ['unsigned short']], +} ], + '_LDRP_CSLIST' : [ 0x8, { + 'Tail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_NON_PAGED_DEBUG_INFO' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Machine' : [ 0x8, ['unsigned short']], + 'Characteristics' : [ 0xa, ['unsigned short']], + 'TimeDateStamp' : [ 0xc, ['unsigned long']], + 'CheckSum' : [ 0x10, ['unsigned long']], + 'SizeOfImage' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], +} ], + '_POP_FX_PERF_SET' : [ 0x20, { + 'PerfSet' : [ 0x0, ['pointer64', ['_PO_FX_COMPONENT_PERF_SET']]], + 'CurrentPerf' : [ 0x8, ['unsigned long long']], + 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], + 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'Flags' : [ 0x28, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], + 'SpareUSHORT' : [ 0x2e, ['unsigned short']], +} ], + '__unnamed_29dd' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_29df' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_29e2' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_29e6' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x58, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x18, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x28, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x38, ['__unnamed_29dd']], + 'HvDeviceId' : [ 0x40, ['unsigned long long']], + 'XapicMessage' : [ 0x48, ['__unnamed_29df']], + 'Hypertransport' : [ 0x48, ['__unnamed_29e2']], + 'GenericMessage' : [ 0x48, ['__unnamed_29df']], + 'MessageRequest' : [ 0x48, ['__unnamed_29e6']], +} ], + '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { + 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_29f4' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['pointer64', ['_PO_FX_PERF_STATE']]], +} ], + '__unnamed_29f6' : [ 0x10, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], +} ], + '_PO_FX_COMPONENT_PERF_SET' : [ 0x30, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], + 'Flags' : [ 0x10, ['unsigned long long']], + 'Unit' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], + 'Discrete' : [ 0x20, ['__unnamed_29f4']], + 'Range' : [ 0x20, ['__unnamed_29f6']], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2a07' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a09' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2a0b' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2a07']], + 'Gpt' : [ 0x0, ['__unnamed_2a09']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0x108, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], + 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], + 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], + 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], + 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], + 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], + 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], + 'CrashDump' : [ 0x68, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x69, ['unsigned char']], + 'HiberResume' : [ 0x6a, ['unsigned char']], + 'Reserved1' : [ 0x6b, ['unsigned char']], + 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], + 'CommonBufferSize' : [ 0x70, ['unsigned long']], + 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], + 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], + 'PartitionStyle' : [ 0x88, ['unsigned long']], + 'DiskInfo' : [ 0x8c, ['__unnamed_2a0b']], + 'ReadRoutine' : [ 0xa0, ['pointer64', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0xa8, ['pointer64', ['void']]], + 'LogSectionTruncateSize' : [ 0xb0, ['unsigned long']], + 'Parameters' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xf8, ['pointer64', ['void']]], + 'DumpNotifyRoutine' : [ 0x100, ['pointer64', ['void']]], +} ], + '_MI_IO_CACHE_STATS' : [ 0x20, { + 'UnusedBlocks' : [ 0x0, ['unsigned long long']], + 'ActiveCacheMatch' : [ 0x8, ['unsigned long']], + 'ActiveCacheOverride' : [ 0xc, ['unsigned long']], + 'UnmappedCacheFlush' : [ 0x10, ['unsigned long']], + 'UnmappedCacheMatch' : [ 0x14, ['unsigned long']], + 'UnmappedCacheConflict' : [ 0x18, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x10, ['pointer64', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0x18, ['pointer64', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x20, ['pointer64', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x28, ['pointer64', ['void']]], + 'RegIndex' : [ 0x30, ['unsigned short']], + 'ReplyIndex' : [ 0x32, ['unsigned short']], + 'Flags' : [ 0x34, ['unsigned long']], +} ], + '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { + 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'EntireInfo' : [ 0x0, ['long']], +} ], + '_TRIAGE_POP_IRP_DATA' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_KDPC_LIST' : [ 0x10, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x178, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x10, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { + 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], + 'PriorityTooLow' : [ 0x4, ['unsigned long']], + 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], + 'PagedNoPtes' : [ 0xc, ['unsigned long']], + 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], + 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], + 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], + 'PagedNoCommit' : [ 0x1c, ['unsigned long']], + 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], + 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], + 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x20, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer64', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '__unnamed_2a42' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2a44' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2a42']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2a47' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2a49' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2a47']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_2a44']], + 'HighPart' : [ 0x4, ['__unnamed_2a49']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x48, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x40, ['long']], +} ], + '_PROC_PERF_CHECK_SNAP' : [ 0x50, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned long long']], + 'Stall' : [ 0x10, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], + 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '__unnamed_2a57' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned long']], + 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], +} ], + '_MI_PER_SESSION_PROTOS' : [ 0x30, { + 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'DriverAddress' : [ 0x0, ['pointer64', ['void']]], + 'SessionId' : [ 0x18, ['unsigned long']], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionBase' : [ 0x20, ['pointer64', ['_MMPTE']]], + 'u2' : [ 0x28, ['__unnamed_2a57']], +} ], + '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { + 'Set' : [ 0x0, ['unsigned long']], + 'StateIndex' : [ 0x8, ['unsigned long']], + 'StateValue' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2a5d' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_2a5f' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_2a5d']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_2a5f']], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { + 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_AVL_TABLE' : [ 0x68, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], + 'WhichOrderedElement' : [ 0x28, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], + 'DepthOfTree' : [ 0x30, ['unsigned long']], + 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x40, ['unsigned long']], + 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], + 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], + 'TableContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_PO_FX_PERF_STATE' : [ 0x10, { + 'Value' : [ 0x0, ['unsigned long long']], + 'Context' : [ 0x8, ['pointer64', ['void']]], +} ], +} diff --git a/volatility/plugins/overlays/windows/win10_x86_44B89EEA_vtypes.py b/volatility/plugins/overlays/windows/win10_x86_44B89EEA_vtypes.py new file mode 100644 index 000000000..c81b1a604 --- /dev/null +++ b/volatility/plugins/overlays/windows/win10_x86_44B89EEA_vtypes.py @@ -0,0 +1,12767 @@ +ntkrpamp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x708, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'NtBuildNumber' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'BootId' : [ 0x2c4, ['unsigned long']], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'Reserved12' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCall' : [ 0x308, ['unsigned long']], + 'SystemCallPad0' : [ 0x30c, ['unsigned long']], + 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], + 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], + 'Reserved8' : [ 0x37c, ['unsigned long']], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_107d' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_107d']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1081' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1081']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '__unnamed_109c' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109e' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_109c']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x4, ['pointer', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x8, ['pointer', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0xc, ['pointer', ['void']]], + 'RaceDll' : [ 0x10, ['pointer', ['void']]], + 'ActivationContext' : [ 0x14, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x18, ['pointer', ['void']]], + 'u' : [ 0x1c, ['__unnamed_109e']], + 'CallbackPriority' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x24, ['unsigned long']], +} ], + '_TEB' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x1c, ['pointer', ['void']]], + 'ClientId' : [ 0x20, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x28, ['pointer', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x2c, ['pointer', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x30, ['pointer', ['_PEB']]], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['pointer', ['void']]], + 'Win32ThreadInfo' : [ 0x40, ['pointer', ['void']]], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['pointer', ['void']]], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['pointer', ['void']]]], + 'SystemReserved1' : [ 0x10c, ['array', 38, ['pointer', ['void']]]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['pointer', ['_ACTIVATION_CONTEXT_STACK']]], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['pointer', ['void']]], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['pointer', ['void']]], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['pointer', ['void']]]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['pointer', ['void']]], + 'glSectionInfo' : [ 0xbe0, ['pointer', ['void']]], + 'glSection' : [ 0xbe4, ['pointer', ['void']]], + 'glTable' : [ 0xbe8, ['pointer', ['void']]], + 'glCurrentRC' : [ 0xbec, ['pointer', ['void']]], + 'glContext' : [ 0xbf0, ['pointer', ['void']]], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['pointer', ['void']]], + 'TlsSlots' : [ 0xe10, ['array', 64, ['pointer', ['void']]]], + 'TlsLinks' : [ 0xf10, ['_LIST_ENTRY']], + 'Vdm' : [ 0xf18, ['pointer', ['void']]], + 'ReservedForNtRpc' : [ 0xf1c, ['pointer', ['void']]], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['pointer', ['void']]]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['pointer', ['void']]]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['pointer', ['void']]], + 'PerflibData' : [ 0xf64, ['pointer', ['void']]], + 'EtwTraceData' : [ 0xf68, ['pointer', ['void']]], + 'WinSockData' : [ 0xf6c, ['pointer', ['void']]], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['pointer', ['void']]], + 'ReservedForOle' : [ 0xf80, ['pointer', ['void']]], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['pointer', ['void']]], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['pointer', ['void']]], + 'TlsExpansionSlots' : [ 0xf94, ['pointer', ['pointer', ['void']]]], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['pointer', ['void']]], + 'pShimData' : [ 0xfa4, ['pointer', ['void']]], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['pointer', ['void']]], + 'ActiveFrame' : [ 0xfb0, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0xfb4, ['pointer', ['void']]], + 'PreferredLanguages' : [ 0xfb8, ['pointer', ['void']]], + 'UserPrefLanguages' : [ 0xfbc, ['pointer', ['void']]], + 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], + 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], + 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['pointer', ['void']]], + 'ReservedForWdf' : [ 0xfe4, ['pointer', ['void']]], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_LIST_ENTRY' : [ 0x8, { + 'Flink' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'Blink' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x4, { + 'Next' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0xc, { + 'Parent' : [ 0x0, ['pointer', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x4, ['pointer', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x8, ['pointer', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0xc, { + 'ChainHead' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x14, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'CurEntry' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'ChainHead' : [ 0xc, ['pointer', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x10, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x24, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned short']]], +} ], + '_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS' : [ 0xf8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_RB_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0xc, { + 'Children' : [ 0x0, ['array', 2, ['pointer', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x8, ['unsigned long']], +} ], + '_RTL_AVL_TREE' : [ 0x4, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x4a20, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'Used_ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Used_StackBase' : [ 0x4, ['pointer', ['void']]], + 'MxCsr' : [ 0x8, ['unsigned long']], + 'TssCopy' : [ 0xc, ['pointer', ['void']]], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'SetMemberCopy' : [ 0x14, ['unsigned long']], + 'Used_Self' : [ 0x18, ['pointer', ['void']]], + 'SelfPcr' : [ 0x1c, ['pointer', ['_KPCR']]], + 'Prcb' : [ 0x20, ['pointer', ['_KPRCB']]], + 'Irql' : [ 0x24, ['unsigned char']], + 'IRR' : [ 0x28, ['unsigned long']], + 'IrrActive' : [ 0x2c, ['unsigned long']], + 'IDR' : [ 0x30, ['unsigned long']], + 'KdVersionBlock' : [ 0x34, ['pointer', ['void']]], + 'IDT' : [ 0x38, ['pointer', ['_KIDTENTRY']]], + 'GDT' : [ 0x3c, ['pointer', ['_KGDTENTRY']]], + 'TSS' : [ 0x40, ['pointer', ['_KTSS']]], + 'MajorVersion' : [ 0x44, ['unsigned short']], + 'MinorVersion' : [ 0x46, ['unsigned short']], + 'SetMember' : [ 0x48, ['unsigned long']], + 'StallScaleFactor' : [ 0x4c, ['unsigned long']], + 'SpareUnused' : [ 0x50, ['unsigned char']], + 'Number' : [ 0x51, ['unsigned char']], + 'Spare0' : [ 0x52, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x53, ['unsigned char']], + 'VdmAlert' : [ 0x54, ['unsigned long']], + 'KernelReserved' : [ 0x58, ['array', 14, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0x90, ['unsigned long']], + 'HalReserved' : [ 0x94, ['array', 16, ['unsigned long']]], + 'InterruptMode' : [ 0xd4, ['unsigned long']], + 'Spare1' : [ 0xd8, ['unsigned char']], + 'KernelReserved2' : [ 0xdc, ['array', 17, ['unsigned long']]], + 'PrcbData' : [ 0x120, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x4900, { + 'MinorVersion' : [ 0x0, ['unsigned short']], + 'MajorVersion' : [ 0x2, ['unsigned short']], + 'CurrentThread' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'NextThread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'IdleThread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'LegacyNumber' : [ 0x10, ['unsigned char']], + 'NestingLevel' : [ 0x11, ['unsigned char']], + 'BuildType' : [ 0x12, ['unsigned short']], + 'CpuType' : [ 0x14, ['unsigned char']], + 'CpuID' : [ 0x15, ['unsigned char']], + 'CpuStep' : [ 0x16, ['unsigned short']], + 'CpuStepping' : [ 0x16, ['unsigned char']], + 'CpuModel' : [ 0x17, ['unsigned char']], + 'ProcessorState' : [ 0x18, ['_KPROCESSOR_STATE']], + 'ParentNode' : [ 0x338, ['pointer', ['_KNODE']]], + 'PriorityState' : [ 0x33c, ['pointer', ['unsigned char']]], + 'KernelReserved' : [ 0x340, ['array', 14, ['unsigned long']]], + 'HalReserved' : [ 0x378, ['array', 16, ['unsigned long']]], + 'CFlushSize' : [ 0x3b8, ['unsigned long']], + 'CoresPerPhysicalProcessor' : [ 0x3bc, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x3bd, ['unsigned char']], + 'CpuVendor' : [ 0x3be, ['unsigned char']], + 'PrcbPad0' : [ 0x3bf, ['array', 1, ['unsigned char']]], + 'MHz' : [ 0x3c0, ['unsigned long']], + 'GroupIndex' : [ 0x3c4, ['unsigned char']], + 'Group' : [ 0x3c5, ['unsigned char']], + 'PrcbPad05' : [ 0x3c6, ['array', 2, ['unsigned char']]], + 'GroupSetMember' : [ 0x3c8, ['unsigned long']], + 'Number' : [ 0x3cc, ['unsigned long']], + 'ClockOwner' : [ 0x3d0, ['unsigned char']], + 'PendingTickFlags' : [ 0x3d1, ['unsigned char']], + 'PendingTick' : [ 0x3d1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x3d1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'PrcbPad10' : [ 0x3d2, ['array', 70, ['unsigned char']]], + 'LockQueue' : [ 0x418, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'InterruptCount' : [ 0x4a0, ['unsigned long']], + 'KernelTime' : [ 0x4a4, ['unsigned long']], + 'UserTime' : [ 0x4a8, ['unsigned long']], + 'DpcTime' : [ 0x4ac, ['unsigned long']], + 'DpcTimeCount' : [ 0x4b0, ['unsigned long']], + 'InterruptTime' : [ 0x4b4, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x4b8, ['unsigned long']], + 'PageColor' : [ 0x4bc, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x4c0, ['unsigned char']], + 'NodeColor' : [ 0x4c1, ['unsigned char']], + 'DeepSleep' : [ 0x4c2, ['unsigned char']], + 'PrcbPad20' : [ 0x4c3, ['array', 5, ['unsigned char']]], + 'NodeShiftedColor' : [ 0x4c8, ['unsigned long']], + 'SecondaryColorMask' : [ 0x4cc, ['unsigned long']], + 'DpcTimeLimit' : [ 0x4d0, ['unsigned long']], + 'PrcbPad21' : [ 0x4d4, ['array', 3, ['unsigned long']]], + 'CcFastReadNoWait' : [ 0x4e0, ['unsigned long']], + 'CcFastReadWait' : [ 0x4e4, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x4e8, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x4ec, ['unsigned long']], + 'CcCopyReadWait' : [ 0x4f0, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x4f4, ['unsigned long']], + 'MmSpinLockOrdering' : [ 0x4f8, ['long']], + 'IoReadOperationCount' : [ 0x4fc, ['long']], + 'IoWriteOperationCount' : [ 0x500, ['long']], + 'IoOtherOperationCount' : [ 0x504, ['long']], + 'IoReadTransferCount' : [ 0x508, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x510, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x518, ['_LARGE_INTEGER']], + 'CcFastMdlReadNoWait' : [ 0x520, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x524, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x528, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x52c, ['unsigned long']], + 'CcMapDataWait' : [ 0x530, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x534, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x538, ['unsigned long']], + 'CcPinReadWait' : [ 0x53c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x540, ['unsigned long']], + 'CcMdlReadWait' : [ 0x544, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x548, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x54c, ['unsigned long']], + 'CcLazyWritePages' : [ 0x550, ['unsigned long']], + 'CcDataFlushes' : [ 0x554, ['unsigned long']], + 'CcDataPages' : [ 0x558, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x55c, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x560, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x564, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x568, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x56c, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x570, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x574, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x578, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x57c, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x580, ['unsigned long']], + 'CcReadAheadIos' : [ 0x584, ['unsigned long']], + 'KeAlignmentFixupCount' : [ 0x588, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x58c, ['unsigned long']], + 'KeSystemCalls' : [ 0x590, ['unsigned long']], + 'AvailableTime' : [ 0x594, ['unsigned long']], + 'PrcbPad22' : [ 0x598, ['array', 2, ['unsigned long']]], + 'PPLookasideList' : [ 0x5a0, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x620, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0xf20, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x1820, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PacketBarrier' : [ 0x2120, ['long']], + 'ReverseStall' : [ 0x2124, ['long']], + 'IpiFrame' : [ 0x2128, ['pointer', ['void']]], + 'PrcbPad3' : [ 0x212c, ['array', 52, ['unsigned char']]], + 'CurrentPacket' : [ 0x2160, ['array', 3, ['pointer', ['void']]]], + 'TargetSet' : [ 0x216c, ['unsigned long']], + 'WorkerRoutine' : [ 0x2170, ['pointer', ['void']]], + 'IpiFrozen' : [ 0x2174, ['unsigned long']], + 'PrcbPad4' : [ 0x2178, ['array', 40, ['unsigned char']]], + 'RequestSummary' : [ 0x21a0, ['unsigned long']], + 'TargetCount' : [ 0x21a4, ['long']], + 'PrcbPad50' : [ 0x21a8, ['array', 40, ['unsigned char']]], + 'InterruptLastCount' : [ 0x21d0, ['unsigned long']], + 'InterruptRate' : [ 0x21d4, ['unsigned long']], + 'DeviceInterrupts' : [ 0x21d8, ['unsigned long']], + 'IsrDpcStats' : [ 0x21dc, ['pointer', ['void']]], + 'DpcData' : [ 0x21e0, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2210, ['pointer', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2214, ['long']], + 'DpcRequestRate' : [ 0x2218, ['unsigned long']], + 'MinimumDpcRate' : [ 0x221c, ['unsigned long']], + 'DpcLastCount' : [ 0x2220, ['unsigned long']], + 'PrcbLock' : [ 0x2224, ['unsigned long']], + 'DpcGate' : [ 0x2228, ['_KGATE']], + 'IdleState' : [ 0x2238, ['unsigned char']], + 'QuantumEnd' : [ 0x2239, ['unsigned char']], + 'DpcRoutineActive' : [ 0x223a, ['unsigned char']], + 'IdleSchedule' : [ 0x223b, ['unsigned char']], + 'DpcRequestSummary' : [ 0x223c, ['long']], + 'DpcRequestSlot' : [ 0x223c, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x223c, ['short']], + 'ThreadDpcState' : [ 0x223e, ['short']], + 'DpcNormalProcessingActive' : [ 0x223c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x223c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x223c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x223c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x223c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x223c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x223c, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x223c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x223c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x223c, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2240, ['unsigned long']], + 'LastTick' : [ 0x2244, ['unsigned long']], + 'PeriodicCount' : [ 0x2248, ['unsigned long']], + 'PeriodicBias' : [ 0x224c, ['unsigned long']], + 'ClockInterrupts' : [ 0x2250, ['unsigned long']], + 'ReadyScanTick' : [ 0x2254, ['unsigned long']], + 'GroupSchedulingOverQuota' : [ 0x2258, ['unsigned char']], + 'ThreadDpcEnable' : [ 0x2259, ['unsigned char']], + 'PrcbPad41' : [ 0x225a, ['array', 2, ['unsigned char']]], + 'TimerTable' : [ 0x2260, ['_KTIMER_TABLE']], + 'CallDpc' : [ 0x3aa0, ['_KDPC']], + 'ClockKeepAlive' : [ 0x3ac0, ['long']], + 'PrcbPad6' : [ 0x3ac4, ['array', 4, ['unsigned char']]], + 'DpcWatchdogPeriod' : [ 0x3ac8, ['long']], + 'DpcWatchdogCount' : [ 0x3acc, ['long']], + 'KeSpinLockOrdering' : [ 0x3ad0, ['long']], + 'PrcbPad70' : [ 0x3ad4, ['array', 1, ['unsigned long']]], + 'QueueIndex' : [ 0x3ad8, ['unsigned long']], + 'DeferredReadyListHead' : [ 0x3adc, ['_SINGLE_LIST_ENTRY']], + 'ReadySummary' : [ 0x3ae0, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x3ae4, ['long']], + 'WaitLock' : [ 0x3ae8, ['unsigned long']], + 'WaitListHead' : [ 0x3aec, ['_LIST_ENTRY']], + 'ScbOffset' : [ 0x3af4, ['unsigned long']], + 'StartCycles' : [ 0x3af8, ['unsigned long long']], + 'TaggedCyclesStart' : [ 0x3b00, ['unsigned long long']], + 'TaggedCycles' : [ 0x3b08, ['array', 2, ['unsigned long long']]], + 'GenerationTarget' : [ 0x3b18, ['unsigned long long']], + 'CycleTime' : [ 0x3b20, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x3b28, ['unsigned long long']], + 'HighCycleTime' : [ 0x3b30, ['unsigned long']], + 'Cycles' : [ 0x3b38, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'PrcbPad71' : [ 0x3b78, ['array', 10, ['unsigned long']]], + 'DispatcherReadyListHead' : [ 0x3ba0, ['array', 32, ['_LIST_ENTRY']]], + 'ChainedInterruptList' : [ 0x3ca0, ['pointer', ['void']]], + 'LookasideIrpFloat' : [ 0x3ca4, ['long']], + 'ScbQueue' : [ 0x3ca8, ['_RTL_RB_TREE']], + 'ScbList' : [ 0x3cb0, ['_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x3cb8, ['long']], + 'MmCopyOnWriteCount' : [ 0x3cbc, ['long']], + 'MmTransitionCount' : [ 0x3cc0, ['long']], + 'MmCacheTransitionCount' : [ 0x3cc4, ['long']], + 'MmDemandZeroCount' : [ 0x3cc8, ['long']], + 'MmPageReadCount' : [ 0x3ccc, ['long']], + 'MmPageReadIoCount' : [ 0x3cd0, ['long']], + 'MmCacheReadCount' : [ 0x3cd4, ['long']], + 'MmCacheIoCount' : [ 0x3cd8, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x3cdc, ['long']], + 'MmDirtyWriteIoCount' : [ 0x3ce0, ['long']], + 'MmMappedPagesWriteCount' : [ 0x3ce4, ['long']], + 'MmMappedWriteIoCount' : [ 0x3ce8, ['long']], + 'CachedCommit' : [ 0x3cec, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x3cf0, ['unsigned long']], + 'HyperPte' : [ 0x3cf4, ['pointer', ['void']]], + 'PrcbPad8' : [ 0x3cf8, ['array', 4, ['unsigned char']]], + 'VendorString' : [ 0x3cfc, ['array', 13, ['unsigned char']]], + 'InitialApicId' : [ 0x3d09, ['unsigned char']], + 'LogicalProcessorsPerPhysicalProcessor' : [ 0x3d0a, ['unsigned char']], + 'PrcbPad9' : [ 0x3d0b, ['array', 1, ['unsigned char']]], + 'FeatureBits' : [ 0x3d10, ['unsigned long long']], + 'UpdateSignature' : [ 0x3d18, ['_LARGE_INTEGER']], + 'IsrTime' : [ 0x3d20, ['unsigned long long']], + 'PrcbPad90' : [ 0x3d28, ['array', 2, ['unsigned long']]], + 'PowerState' : [ 0x3d30, ['_PROCESSOR_POWER_STATE']], + 'PrcbPad91' : [ 0x3eb0, ['array', 17, ['unsigned long']]], + 'DpcWatchdogDpc' : [ 0x3ef4, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x3f18, ['_KTIMER']], + 'HypercallPageList' : [ 0x3f40, ['_SLIST_HEADER']], + 'HypercallCachedPages' : [ 0x3f48, ['pointer', ['void']]], + 'VirtualApicAssist' : [ 0x3f4c, ['pointer', ['void']]], + 'StatisticsPage' : [ 0x3f50, ['pointer', ['unsigned long long']]], + 'Cache' : [ 0x3f54, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x3f90, ['unsigned long']], + 'PackageProcessorSet' : [ 0x3f94, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x3fa0, ['unsigned long']], + 'SharedReadyQueue' : [ 0x3fa4, ['pointer', ['_KSHARED_READY_QUEUE']]], + 'SharedQueueScanOwner' : [ 0x3fa8, ['unsigned long']], + 'CoreProcessorSet' : [ 0x3fac, ['unsigned long']], + 'ScanSiblingMask' : [ 0x3fb0, ['unsigned long']], + 'LLCMask' : [ 0x3fb4, ['unsigned long']], + 'CacheProcessorMask' : [ 0x3fb8, ['array', 5, ['unsigned long']]], + 'ScanSiblingIndex' : [ 0x3fcc, ['unsigned long']], + 'WheaInfo' : [ 0x3fd0, ['pointer', ['void']]], + 'EtwSupport' : [ 0x3fd4, ['pointer', ['void']]], + 'InterruptObjectPool' : [ 0x3fd8, ['_SLIST_HEADER']], + 'PrcbPad92' : [ 0x3fe0, ['array', 3, ['unsigned long']]], + 'PteBitCache' : [ 0x3fec, ['unsigned long']], + 'PteBitOffset' : [ 0x3ff0, ['unsigned long']], + 'PrcbPad93' : [ 0x3ff4, ['unsigned long']], + 'ProcessorProfileControlArea' : [ 0x3ff8, ['pointer', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x3ffc, ['pointer', ['void']]], + 'TimerExpirationDpc' : [ 0x4000, ['_KDPC']], + 'SynchCounters' : [ 0x4020, ['_SYNCH_COUNTERS']], + 'FsCounters' : [ 0x40d8, ['_FILESYSTEM_DISK_COUNTERS']], + 'Context' : [ 0x40e8, ['pointer', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x40ec, ['unsigned long']], + 'ExtendedState' : [ 0x40f0, ['pointer', ['_XSAVE_AREA']]], + 'EntropyTimingState' : [ 0x40f4, ['_KENTROPY_TIMING_STATE']], + 'IsrStack' : [ 0x421c, ['pointer', ['void']]], + 'VectorToInterruptObject' : [ 0x4220, ['array', 208, ['pointer', ['_KINTERRUPT']]]], + 'AbSelfIoBoostsList' : [ 0x4560, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x4564, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x4568, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x4588, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x45dc, ['_IOP_IRP_STACK_PROFILER']], + 'TimerExpirationTrace' : [ 0x4630, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x4730, ['unsigned long']], + 'ExSaPageArray' : [ 0x4734, ['pointer', ['void']]], + 'PrcbPad100' : [ 0x4738, ['array', 10, ['unsigned long']]], + 'LocalSharedReadyQueue' : [ 0x4760, ['_KSHARED_READY_QUEUE']], + 'PrcbPad95' : [ 0x4894, ['array', 12, ['unsigned char']]], + 'Mailbox' : [ 0x48a0, ['pointer', ['_REQUEST_MAILBOX']]], + 'PrcbPad' : [ 0x48a4, ['array', 60, ['unsigned char']]], + 'RequestMailbox' : [ 0x48e0, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KAPC' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'ApcListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x14, ['pointer', ['void']]], + 'RundownRoutine' : [ 0x18, ['pointer', ['void']]], + 'NormalRoutine' : [ 0x1c, ['pointer', ['void']]], + 'Reserved' : [ 0x14, ['array', 3, ['pointer', ['void']]]], + 'NormalContext' : [ 0x20, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x24, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x28, ['pointer', ['void']]], + 'ApcStateIndex' : [ 0x2c, ['unsigned char']], + 'ApcMode' : [ 0x2d, ['unsigned char']], + 'Inserted' : [ 0x2e, ['unsigned char']], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { + 'TrustletIdentity' : [ 0x0, ['unsigned long long']], + 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { + 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], + 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { + 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], + 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { + 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { + 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_KPROCESS' : [ 0xa8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x10, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x18, ['unsigned long']], + 'LdtDescriptor' : [ 0x1c, ['_KGDTENTRY']], + 'Int21Descriptor' : [ 0x24, ['_KIDTENTRY']], + 'ThreadListHead' : [ 0x2c, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x34, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x38, ['unsigned long long']], + 'Affinity' : [ 0x40, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0x4c, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x54, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x58, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x64, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x64, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x64, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'DeepFreeze' : [ 0x64, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x64, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x64, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SpareFlags0' : [ 0x64, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x64, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x64, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x64, ['long']], + 'BasePriority' : [ 0x68, ['unsigned char']], + 'QuantumReset' : [ 0x69, ['unsigned char']], + 'Visited' : [ 0x6a, ['unsigned char']], + 'Flags' : [ 0x6b, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x6c, ['array', 1, ['unsigned long']]], + 'IdealNode' : [ 0x70, ['array', 1, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x72, ['unsigned short']], + 'Spare1' : [ 0x74, ['unsigned short']], + 'IopmOffset' : [ 0x76, ['unsigned short']], + 'SchedulingGroup' : [ 0x78, ['pointer', ['_KSCHEDULING_GROUP']]], + 'StackCount' : [ 0x7c, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x80, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x88, ['unsigned long long']], + 'ContextSwitches' : [ 0x90, ['unsigned long long']], + 'FreezeCount' : [ 0x98, ['unsigned long']], + 'KernelTime' : [ 0x9c, ['unsigned long']], + 'UserTime' : [ 0xa0, ['unsigned long']], + 'VdmTrapcHandler' : [ 0xa4, ['pointer', ['void']]], +} ], + '_KTHREAD' : [ 0x348, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x10, ['pointer', ['void']]], + 'QuantumTarget' : [ 0x18, ['unsigned long long']], + 'InitialStack' : [ 0x20, ['pointer', ['void']]], + 'StackLimit' : [ 0x24, ['pointer', ['void']]], + 'StackBase' : [ 0x28, ['pointer', ['void']]], + 'ThreadLock' : [ 0x2c, ['unsigned long']], + 'CycleTime' : [ 0x30, ['unsigned long long']], + 'HighCycleTime' : [ 0x38, ['unsigned long']], + 'ServiceTable' : [ 0x3c, ['pointer', ['void']]], + 'CurrentRunTime' : [ 0x40, ['unsigned long']], + 'ExpectedRunTime' : [ 0x44, ['unsigned long']], + 'KernelStack' : [ 0x48, ['pointer', ['void']]], + 'StateSaveArea' : [ 0x4c, ['pointer', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x50, ['pointer', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x54, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x55, ['unsigned char']], + 'Alerted' : [ 0x56, ['array', 2, ['unsigned char']]], + 'AutoBoostActive' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitNext' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Alertable' : [ 0x58, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x58, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x58, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x58, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x58, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'TimerActive' : [ 0x58, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SystemThread' : [ 0x58, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x58, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CalloutActive' : [ 0x58, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x58, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x58, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x58, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x58, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x58, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x58, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SuspendSchedulerApcWait' : [ 0x58, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x58, ['long']], + 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ThreadFlagsSpare0' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x5c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x5c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x5c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x5c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x5c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x5c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x5c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x5c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x5c, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x5c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x5c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CommitFailTerminateRequest' : [ 0x5c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ProcessStackCountDecremented' : [ 0x5c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ThreadFlagsSpare' : [ 0x5c, ['BitField', dict(start_bit = 19, end_bit = 24, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x5c, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x5c, ['long']], + 'Tag' : [ 0x60, ['unsigned char']], + 'SystemHeteroCpuPolicy' : [ 0x61, ['unsigned char']], + 'UserHeteroCpuPolicy' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], + 'ExplicitSystemHeteroCpuPolicy' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare0' : [ 0x63, ['unsigned char']], + 'SystemCallNumber' : [ 0x64, ['unsigned long']], + 'FirstArgument' : [ 0x68, ['pointer', ['void']]], + 'TrapFrame' : [ 0x6c, ['pointer', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x70, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x70, ['array', 23, ['unsigned char']]], + 'Priority' : [ 0x87, ['unsigned char']], + 'UserIdealProcessor' : [ 0x88, ['unsigned long']], + 'ContextSwitches' : [ 0x8c, ['unsigned long']], + 'State' : [ 0x90, ['unsigned char']], + 'Spare12' : [ 0x91, ['unsigned char']], + 'WaitIrql' : [ 0x92, ['unsigned char']], + 'WaitMode' : [ 0x93, ['unsigned char']], + 'WaitStatus' : [ 0x94, ['long']], + 'WaitBlockList' : [ 0x98, ['pointer', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0x9c, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x9c, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xa4, ['pointer', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xa8, ['pointer', ['void']]], + 'RelativeTimerBias' : [ 0xb0, ['unsigned long long']], + 'Timer' : [ 0xb8, ['_KTIMER']], + 'WaitBlock' : [ 0xe0, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill8' : [ 0xe0, ['array', 20, ['unsigned char']]], + 'ThreadCounters' : [ 0xf4, ['pointer', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0xe0, ['array', 44, ['unsigned char']]], + 'XStateSave' : [ 0x10c, ['pointer', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0xe0, ['array', 68, ['unsigned char']]], + 'Win32Thread' : [ 0x124, ['pointer', ['void']]], + 'WaitBlockFill11' : [ 0xe0, ['array', 88, ['unsigned char']]], + 'WaitTime' : [ 0x138, ['unsigned long']], + 'KernelApcDisable' : [ 0x13c, ['short']], + 'SpecialApcDisable' : [ 0x13e, ['short']], + 'CombinedApcDisable' : [ 0x13c, ['unsigned long']], + 'QueueListEntry' : [ 0x140, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x148, ['unsigned long']], + 'NextProcessorNumber' : [ 0x148, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x148, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x14c, ['long']], + 'Process' : [ 0x150, ['pointer', ['_KPROCESS']]], + 'UserAffinity' : [ 0x154, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x154, ['array', 6, ['unsigned char']]], + 'PreviousMode' : [ 0x15a, ['unsigned char']], + 'BasePriority' : [ 0x15b, ['unsigned char']], + 'PriorityDecrement' : [ 0x15c, ['unsigned char']], + 'ForegroundBoost' : [ 0x15c, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x15c, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x15d, ['unsigned char']], + 'AdjustReason' : [ 0x15e, ['unsigned char']], + 'AdjustIncrement' : [ 0x15f, ['unsigned char']], + 'AffinityVersion' : [ 0x160, ['unsigned long']], + 'Affinity' : [ 0x164, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x164, ['array', 6, ['unsigned char']]], + 'ApcStateIndex' : [ 0x16a, ['unsigned char']], + 'WaitBlockCount' : [ 0x16b, ['unsigned char']], + 'IdealProcessor' : [ 0x16c, ['unsigned long']], + 'Spare15' : [ 0x170, ['array', 1, ['unsigned long']]], + 'SavedApcState' : [ 0x174, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x174, ['array', 23, ['unsigned char']]], + 'WaitReason' : [ 0x18b, ['unsigned char']], + 'SuspendCount' : [ 0x18c, ['unsigned char']], + 'Saturation' : [ 0x18d, ['unsigned char']], + 'SListFaultCount' : [ 0x18e, ['unsigned short']], + 'SchedulerApc' : [ 0x190, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x190, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x191, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x190, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x193, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x190, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x194, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x190, ['array', 36, ['unsigned char']]], + 'WaitPrcb' : [ 0x1b4, ['pointer', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x190, ['array', 40, ['unsigned char']]], + 'LegoData' : [ 0x1b8, ['pointer', ['void']]], + 'SchedulerApcFill5' : [ 0x190, ['array', 47, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x1bf, ['unsigned char']], + 'UserTime' : [ 0x1c0, ['unsigned long']], + 'SuspendEvent' : [ 0x1c4, ['_KEVENT']], + 'ThreadListEntry' : [ 0x1d4, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x1dc, ['_LIST_ENTRY']], + 'AbEntrySummary' : [ 0x1e4, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x1e5, ['unsigned char']], + 'Spare20' : [ 0x1e6, ['unsigned short']], + 'LockEntries' : [ 0x1e8, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x308, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x30c, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x310, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x320, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x324, ['long']], + 'KeReferenceCount' : [ 0x328, ['short']], + 'AbOrphanedEntrySummary' : [ 0x32a, ['unsigned char']], + 'AbOwnedEntryCount' : [ 0x32b, ['unsigned char']], + 'ForegroundLossTime' : [ 0x32c, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x330, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x330, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x334, ['unsigned long']], + 'QueuedScb' : [ 0x338, ['pointer', ['_KSCB']]], + 'NpxState' : [ 0x340, ['unsigned long long']], +} ], + '_KSTACK_CONTROL' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long']], + 'ActualLimit' : [ 0x4, ['unsigned long']], + 'StackExpansion' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousTrapFrame' : [ 0x8, ['pointer', ['_KTRAP_FRAME']]], + 'PreviousExceptionList' : [ 0xc, ['pointer', ['void']]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '_FAST_MUTEX' : [ 0x20, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x4, ['pointer', ['void']]], + 'Contention' : [ 0x8, ['unsigned long']], + 'Event' : [ 0xc, ['_KEVENT']], + 'OldIrql' : [ 0x1c, ['unsigned long']], +} ], + '_KEVENT' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_SLIST_HEADER' : [ 0x8, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x4, ['unsigned short']], + 'CpuId' : [ 0x6, ['unsigned short']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x48, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], +} ], + '_IO_STATUS_BLOCK' : [ 0x8, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer', ['void']]], + 'Information' : [ 0x4, ['unsigned long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x10, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x8, ['pointer', ['void']]], + 'Parameter' : [ 0xc, ['pointer', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer', ['void']]], + 'DeleteContext' : [ 0xc, ['pointer', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x8, { + 'P' : [ 0x0, ['pointer', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x4, ['pointer', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0x100, { + 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long']], + 'IdleSmtSet' : [ 0x4, ['unsigned long']], + 'IdleCpuSet' : [ 0x8, ['unsigned long']], + 'DeepIdleSet' : [ 0x40, ['unsigned long']], + 'IdleConstrainedSet' : [ 0x44, ['unsigned long']], + 'NonParkedSet' : [ 0x48, ['unsigned long']], + 'ParkLock' : [ 0x4c, ['long']], + 'Seed' : [ 0x50, ['unsigned long']], + 'SiblingMask' : [ 0x80, ['unsigned long']], + 'Affinity' : [ 0x84, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x84, ['array', 6, ['unsigned char']]], + 'NodeNumber' : [ 0x8a, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x8c, ['unsigned short']], + 'Stride' : [ 0x8e, ['unsigned char']], + 'Spare0' : [ 0x8f, ['unsigned char']], + 'SharedReadyQueueLeaders' : [ 0x90, ['unsigned long']], + 'ProximityId' : [ 0x94, ['unsigned long']], + 'Lowest' : [ 0x98, ['unsigned long']], + 'Highest' : [ 0x9c, ['unsigned long']], + 'MaximumProcessors' : [ 0xa0, ['unsigned char']], + 'Flags' : [ 0xa1, ['_flags']], + 'Spare10' : [ 0xa2, ['unsigned char']], + 'HeteroSets' : [ 0xa4, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], +} ], + '_ENODE' : [ 0x380, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0x100, ['array', 8, ['pointer', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x120, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x2d8, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x2e8, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x310, ['_KEVENT']], + 'WaitBlocks' : [ 0x320, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x368, ['pointer', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x36c, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x370, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x5c, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long']], + 'QuotaProcess' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'HandleTableList' : [ 0x10, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'StrictFIFO' : [ 0x1c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x1c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x1c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x1c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x1c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x20, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x24, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x28, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x28, ['array', 20, ['unsigned char']]], + 'DebugInfo' : [ 0x3c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x8, { + 'VolatileLowValue' : [ 0x0, ['long']], + 'LowValue' : [ 0x0, ['long']], + 'InfoTable' : [ 0x0, ['pointer', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'HighValue' : [ 0x4, ['long']], + 'NextFreeHandleEntry' : [ 0x4, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x4, ['_EXHANDLE']], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'RefCountField' : [ 0x4, ['long']], + 'GrantedAccessBits' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'ProtectFromClose' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'RefCnt' : [ 0x4, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_EX_FAST_REF' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1336' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0x74, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'AuxData' : [ 0x30, ['pointer', ['void']]], + 'Privileges' : [ 0x34, ['__unnamed_1336']], + 'AuditPrivileges' : [ 0x60, ['unsigned char']], + 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xc4, { + 'PrivilegesUsed' : [ 0x0, ['pointer', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x4, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x14, ['unsigned long']], + 'MaximumAuditMask' : [ 0x18, ['unsigned long']], + 'TransactionId' : [ 0x1c, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x30, ['pointer', ['void']]], + 'ParentSecurityDescriptor' : [ 0x34, ['pointer', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x38, ['pointer', ['void']]], + 'SDLock' : [ 0x3c, ['pointer', ['void']]], + 'AccessReasons' : [ 0x40, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xc0, ['unsigned char']], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_ETHREAD' : [ 0x458, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x348, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x350, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x350, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x358, ['pointer', ['void']]], + 'PostBlockList' : [ 0x35c, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x35c, ['pointer', ['void']]], + 'StartAddress' : [ 0x360, ['pointer', ['void']]], + 'TerminationPort' : [ 0x364, ['pointer', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x364, ['pointer', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x364, ['pointer', ['void']]], + 'ActiveTimerListLock' : [ 0x368, ['unsigned long']], + 'ActiveTimerListHead' : [ 0x36c, ['_LIST_ENTRY']], + 'Cid' : [ 0x374, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x37c, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x37c, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x390, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x394, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x39c, ['unsigned long']], + 'DeviceToVerify' : [ 0x3a0, ['pointer', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x3a4, ['pointer', ['void']]], + 'LegacyPowerObject' : [ 0x3a8, ['pointer', ['void']]], + 'ThreadListEntry' : [ 0x3ac, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x3b4, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x3b8, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x3bc, ['unsigned long']], + 'MmLockOrdering' : [ 0x3c0, ['long']], + 'CmLockOrdering' : [ 0x3c4, ['long']], + 'CrossThreadFlags' : [ 0x3c8, ['unsigned long']], + 'Terminated' : [ 0x3c8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x3c8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x3c8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x3c8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x3c8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x3c8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x3c8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x3c8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x3c8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x3c8, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x3c8, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x3c8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x3c8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x3c8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x3c8, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x3cc, ['unsigned long']], + 'ActiveExWorker' : [ 0x3cc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x3cc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'StoreLockThread' : [ 0x3cc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x3cc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x3cc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x3cc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'RespectIoPriority' : [ 0x3cc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'ReservedSameThreadPassiveFlags' : [ 0x3cc, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x3d0, ['unsigned long']], + 'OwnsProcessAddressSpaceExclusive' : [ 0x3d0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x3d0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardFaultBehavior' : [ 0x3d0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x3d0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x3d0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x3d0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Prefetching' : [ 0x3d0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x3d0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x3d1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x3d1, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x3d4, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x3d5, ['unsigned char']], + 'ActiveFaultCount' : [ 0x3d6, ['unsigned char']], + 'LockOrderState' : [ 0x3d7, ['unsigned char']], + 'AlpcMessageId' : [ 0x3d8, ['unsigned long']], + 'AlpcMessage' : [ 0x3dc, ['pointer', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x3dc, ['unsigned long']], + 'ExitStatus' : [ 0x3e0, ['long']], + 'AlpcWaitListEntry' : [ 0x3e4, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x3ec, ['unsigned long']], + 'IoBoostCount' : [ 0x3f0, ['unsigned long']], + 'BoostList' : [ 0x3f4, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x3fc, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x404, ['unsigned long']], + 'IrpListLock' : [ 0x408, ['unsigned long']], + 'ReservedForSynchTracking' : [ 0x40c, ['pointer', ['void']]], + 'CmCallbackListHead' : [ 0x410, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x414, ['pointer', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x418, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x41c, ['pointer', ['void']]], + 'KernelStackReference' : [ 0x420, ['unsigned long']], + 'AdjustedClientToken' : [ 0x424, ['pointer', ['void']]], + 'WorkingOnBehalfClient' : [ 0x428, ['pointer', ['void']]], + 'PropertySet' : [ 0x42c, ['_PS_PROPERTY_SET']], + 'PicoContext' : [ 0x438, ['pointer', ['void']]], + 'UserFsBase' : [ 0x43c, ['unsigned long']], + 'UserGsBase' : [ 0x440, ['unsigned long']], + 'EnergyValues' : [ 0x444, ['pointer', ['_THREAD_ENERGY_VALUES']]], + 'CmCellReferences' : [ 0x448, ['unsigned long']], + 'SelectedCpuSets' : [ 0x44c, ['unsigned long']], + 'SelectedCpuSetsIndirect' : [ 0x44c, ['pointer', ['unsigned long']]], + 'Silo' : [ 0x450, ['pointer', ['_EJOB']]], +} ], + '_EPROCESS' : [ 0x370, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0xa8, ['_EX_PUSH_LOCK']], + 'RundownProtect' : [ 0xac, ['_EX_RUNDOWN_REF']], + 'VdmObjects' : [ 0xb0, ['pointer', ['void']]], + 'UniqueProcessId' : [ 0xb4, ['pointer', ['void']]], + 'ActiveProcessLinks' : [ 0xb8, ['_LIST_ENTRY']], + 'Flags2' : [ 0xc0, ['unsigned long']], + 'JobNotReallyActive' : [ 0xc0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0xc0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0xc0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0xc0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0xc0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0xc0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0xc0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0xc0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0xc0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0xc0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0xc0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0xc0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0xc0, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0xc0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0xc0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0xc0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0xc0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0xc0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0xc0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0xc0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0xc0, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0xc0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0xc0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0xc0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0xc0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0xc0, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0xc0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0xc0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'CreateReported' : [ 0xc4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0xc4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0xc4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0xc4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0xc4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0xc4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0xc4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0xc4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FailFastOnCommitFail' : [ 0xc4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0xc4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0xc4, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0xc4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0xc4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0xc4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0xc4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0xc4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0xc4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0xc4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0xc4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0xc4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0xc4, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0xc4, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0xc4, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0xc4, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0xc4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0xc4, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0xc4, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0xc4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0xc4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CreateTime' : [ 0xc8, ['_LARGE_INTEGER']], + 'ProcessQuotaUsage' : [ 0xd0, ['array', 2, ['unsigned long']]], + 'ProcessQuotaPeak' : [ 0xd8, ['array', 2, ['unsigned long']]], + 'PeakVirtualSize' : [ 0xe0, ['unsigned long']], + 'VirtualSize' : [ 0xe4, ['unsigned long']], + 'SessionProcessLinks' : [ 0xe8, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0xf0, ['pointer', ['void']]], + 'ExceptionPortValue' : [ 0xf0, ['unsigned long']], + 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Token' : [ 0xf4, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0xf8, ['unsigned long']], + 'AddressCreationLock' : [ 0xfc, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x100, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x104, ['pointer', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x108, ['pointer', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x10c, ['pointer', ['_EJOB']]], + 'CloneRoot' : [ 0x110, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x114, ['unsigned long']], + 'NumberOfLockedPages' : [ 0x118, ['unsigned long']], + 'Win32Process' : [ 0x11c, ['pointer', ['void']]], + 'Job' : [ 0x120, ['pointer', ['_EJOB']]], + 'SectionObject' : [ 0x124, ['pointer', ['void']]], + 'SectionBaseAddress' : [ 0x128, ['pointer', ['void']]], + 'Cookie' : [ 0x12c, ['unsigned long']], + 'WorkingSetWatch' : [ 0x130, ['pointer', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x134, ['pointer', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x138, ['pointer', ['void']]], + 'LdtInformation' : [ 0x13c, ['pointer', ['void']]], + 'OwnerProcessId' : [ 0x140, ['unsigned long']], + 'Peb' : [ 0x144, ['pointer', ['_PEB']]], + 'Session' : [ 0x148, ['pointer', ['void']]], + 'AweInfo' : [ 0x14c, ['pointer', ['void']]], + 'QuotaBlock' : [ 0x150, ['pointer', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x154, ['pointer', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x158, ['pointer', ['void']]], + 'PaeTop' : [ 0x15c, ['pointer', ['void']]], + 'DeviceMap' : [ 0x160, ['pointer', ['void']]], + 'EtwDataSource' : [ 0x164, ['pointer', ['void']]], + 'PageDirectoryPte' : [ 0x168, ['unsigned long long']], + 'ImageFilePointer' : [ 0x170, ['pointer', ['_FILE_OBJECT']]], + 'ImageFileName' : [ 0x174, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x183, ['unsigned char']], + 'SecurityPort' : [ 0x184, ['pointer', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x188, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x18c, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x194, ['pointer', ['void']]], + 'ThreadListHead' : [ 0x198, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x1a0, ['unsigned long']], + 'ImagePathHash' : [ 0x1a4, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x1a8, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x1ac, ['long']], + 'PrefetchTrace' : [ 0x1b0, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x1b4, ['pointer', ['void']]], + 'ReadOperationCount' : [ 0x1b8, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x1c0, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x1c8, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x1d0, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x1d8, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x1e0, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x1e8, ['unsigned long']], + 'CommitCharge' : [ 0x1ec, ['unsigned long']], + 'CommitChargePeak' : [ 0x1f0, ['unsigned long']], + 'Vm' : [ 0x1f4, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x274, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x27c, ['unsigned long']], + 'ExitStatus' : [ 0x280, ['long']], + 'VadRoot' : [ 0x284, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x288, ['pointer', ['void']]], + 'VadCount' : [ 0x28c, ['unsigned long']], + 'VadPhysicalPages' : [ 0x290, ['unsigned long']], + 'VadPhysicalPagesLimit' : [ 0x294, ['unsigned long']], + 'AlpcContext' : [ 0x298, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x2a8, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x2b0, ['pointer', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x2b4, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x2b8, ['unsigned long']], + 'ExitTime' : [ 0x2c0, ['_LARGE_INTEGER']], + 'ActiveThreadsHighWatermark' : [ 0x2c8, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x2cc, ['unsigned long']], + 'ThreadListLock' : [ 0x2d0, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x2d4, ['pointer', ['void']]], + 'Spare0' : [ 0x2d8, ['unsigned long']], + 'SignatureLevel' : [ 0x2dc, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x2dd, ['unsigned char']], + 'Protection' : [ 0x2de, ['_PS_PROTECTION']], + 'HangCount' : [ 0x2df, ['unsigned char']], + 'Flags3' : [ 0x2e0, ['unsigned long']], + 'Minimal' : [ 0x2e0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReplacingPageRoot' : [ 0x2e0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DisableNonSystemFonts' : [ 0x2e0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AuditNonSystemFontLoading' : [ 0x2e0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Crashed' : [ 0x2e0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'JobVadsAreTracked' : [ 0x2e0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'VadTrackingDisabled' : [ 0x2e0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AuxiliaryProcess' : [ 0x2e0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SubsystemProcess' : [ 0x2e0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x2e0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'InPrivate' : [ 0x2e0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProhibitRemoteImageMap' : [ 0x2e0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProhibitLowILImageMap' : [ 0x2e0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SignatureMitigationOptIn' : [ 0x2e0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeviceAsid' : [ 0x2e4, ['long']], + 'SvmData' : [ 0x2e8, ['pointer', ['void']]], + 'SvmProcessLock' : [ 0x2ec, ['_EX_PUSH_LOCK']], + 'SvmLock' : [ 0x2f0, ['unsigned long']], + 'SvmProcessDeviceListHead' : [ 0x2f4, ['_LIST_ENTRY']], + 'LastFreezeInterruptTime' : [ 0x300, ['unsigned long long']], + 'DiskCounters' : [ 0x308, ['pointer', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x30c, ['pointer', ['void']]], + 'KeepAliveCounter' : [ 0x310, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x314, ['unsigned long']], + 'HighPriorityFaultsAllowed' : [ 0x318, ['unsigned long']], + 'InstrumentationCallback' : [ 0x31c, ['pointer', ['void']]], + 'EnergyValues' : [ 0x320, ['pointer', ['_PROCESS_ENERGY_VALUES']]], + 'VmContext' : [ 0x324, ['pointer', ['void']]], + 'SequenceNumber' : [ 0x328, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x330, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x338, ['unsigned long long']], + 'TotalUnbiasedFrozenTime' : [ 0x340, ['unsigned long long']], + 'LastAppStateUpdateTime' : [ 0x348, ['unsigned long long']], + 'LastAppStateUptime' : [ 0x350, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'LastAppState' : [ 0x350, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SharedCommitCharge' : [ 0x358, ['unsigned long']], + 'SharedCommitLock' : [ 0x35c, ['_EX_PUSH_LOCK']], + 'SharedCommitLinks' : [ 0x360, ['_LIST_ENTRY']], + 'AllowedCpuSets' : [ 0x368, ['unsigned long']], + 'DefaultCpuSets' : [ 0x36c, ['unsigned long']], + 'AllowedCpuSetsIndirect' : [ 0x368, ['pointer', ['unsigned long']]], + 'DefaultCpuSetsIndirect' : [ 0x36c, ['pointer', ['unsigned long']]], +} ], + '__unnamed_1390' : [ 0x4, { + 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1396' : [ 0x8, { + 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer', ['void']]], + 'UserApcContext' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_1398' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_1396']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_13a1' : [ 0x2c, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], + 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x14, ['pointer', ['unsigned char']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x20, ['pointer', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x20, ['unsigned long']], + 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x28, ['pointer', ['void']]], +} ], + '__unnamed_13a3' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_13a1']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer', ['void']]], +} ], + '_IRP' : [ 0x70, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_1390']], + 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x20, ['unsigned char']], + 'PendingReturned' : [ 0x21, ['unsigned char']], + 'StackCount' : [ 0x22, ['unsigned char']], + 'CurrentLocation' : [ 0x23, ['unsigned char']], + 'Cancel' : [ 0x24, ['unsigned char']], + 'CancelIrql' : [ 0x25, ['unsigned char']], + 'ApcEnvironment' : [ 0x26, ['unsigned char']], + 'AllocationFlags' : [ 0x27, ['unsigned char']], + 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], + 'Overlay' : [ 0x30, ['__unnamed_1398']], + 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], + 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], + 'Tail' : [ 0x40, ['__unnamed_13a3']], +} ], + '__unnamed_13aa' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'FileAttributes' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'EaLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13ae' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13b2' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13b4' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_13b8' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13ba' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_13bc' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], +} ], + '__unnamed_13be' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0xc, ['unsigned char']], + 'AdvanceOnly' : [ 0xd, ['unsigned char']], + 'ClusterCount' : [ 0xc, ['unsigned long']], + 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13c0' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x4, ['pointer', ['void']]], + 'EaListLength' : [ 0x8, ['unsigned long']], + 'EaIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13c2' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13c6' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13c8' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'FsControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13cb' : [ 0x10, { + 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_13cd' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'IoControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13cf' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_13d1' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_13d5' : [ 0x8, { + 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_13d9' : [ 0x4, { + 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_13dd' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x4, ['pointer', ['void']]], + 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13e1' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_13e5' : [ 0x10, { + 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned short']], + 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13e9' : [ 0x4, { + 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_13ed' : [ 0x4, { + 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_13ef' : [ 0x10, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['void']]], + 'Offset' : [ 0x8, ['unsigned long']], + 'Length' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13f1' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_13f5' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_13f9' : [ 0x8, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_13fd' : [ 0x8, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_1401' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_1405' : [ 0x4, { + 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_140d' : [ 0x10, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x8, ['_POWER_STATE']], + 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], +} ], + '__unnamed_1411' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1413' : [ 0x10, { + 'ProviderId' : [ 0x0, ['unsigned long']], + 'DataPath' : [ 0x4, ['pointer', ['void']]], + 'BufferSize' : [ 0x8, ['unsigned long']], + 'Buffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_1415' : [ 0x10, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_1417' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_13aa']], + 'CreatePipe' : [ 0x0, ['__unnamed_13ae']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13b2']], + 'Read' : [ 0x0, ['__unnamed_13b4']], + 'Write' : [ 0x0, ['__unnamed_13b4']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13b8']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13ba']], + 'QueryFile' : [ 0x0, ['__unnamed_13bc']], + 'SetFile' : [ 0x0, ['__unnamed_13be']], + 'QueryEa' : [ 0x0, ['__unnamed_13c0']], + 'SetEa' : [ 0x0, ['__unnamed_13c2']], + 'QueryVolume' : [ 0x0, ['__unnamed_13c6']], + 'SetVolume' : [ 0x0, ['__unnamed_13c6']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13c8']], + 'LockControl' : [ 0x0, ['__unnamed_13cb']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_13cd']], + 'QuerySecurity' : [ 0x0, ['__unnamed_13cf']], + 'SetSecurity' : [ 0x0, ['__unnamed_13d1']], + 'MountVolume' : [ 0x0, ['__unnamed_13d5']], + 'VerifyVolume' : [ 0x0, ['__unnamed_13d5']], + 'Scsi' : [ 0x0, ['__unnamed_13d9']], + 'QueryQuota' : [ 0x0, ['__unnamed_13dd']], + 'SetQuota' : [ 0x0, ['__unnamed_13c2']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_13e1']], + 'QueryInterface' : [ 0x0, ['__unnamed_13e5']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_13e9']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_13ed']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_13ef']], + 'SetLock' : [ 0x0, ['__unnamed_13f1']], + 'QueryId' : [ 0x0, ['__unnamed_13f5']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_13f9']], + 'UsageNotification' : [ 0x0, ['__unnamed_13fd']], + 'WaitWake' : [ 0x0, ['__unnamed_1401']], + 'PowerSequence' : [ 0x0, ['__unnamed_1405']], + 'Power' : [ 0x0, ['__unnamed_140d']], + 'StartDevice' : [ 0x0, ['__unnamed_1411']], + 'WMI' : [ 0x0, ['__unnamed_1413']], + 'Others' : [ 0x0, ['__unnamed_1415']], +} ], + '_IO_STACK_LOCATION' : [ 0x24, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x4, ['__unnamed_1417']], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], +} ], + '__unnamed_142d' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0xb8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x14, ['pointer', ['_IRP']]], + 'Timer' : [ 0x18, ['pointer', ['_IO_TIMER']]], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Characteristics' : [ 0x20, ['unsigned long']], + 'Vpb' : [ 0x24, ['pointer', ['_VPB']]], + 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], + 'DeviceType' : [ 0x2c, ['unsigned long']], + 'StackSize' : [ 0x30, ['unsigned char']], + 'Queue' : [ 0x34, ['__unnamed_142d']], + 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], + 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0x74, ['_KDPC']], + 'ActiveThreadCount' : [ 0x94, ['unsigned long']], + 'SecurityDescriptor' : [ 0x98, ['pointer', ['void']]], + 'DeviceLock' : [ 0x9c, ['_KEVENT']], + 'SectorSize' : [ 0xac, ['unsigned short']], + 'Spare1' : [ 0xae, ['unsigned short']], + 'DeviceObjectExtension' : [ 0xb0, ['pointer', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0xb4, ['pointer', ['void']]], +} ], + '_KDPC' : [ 0x20, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x4, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x8, ['unsigned long']], + 'DeferredRoutine' : [ 0xc, ['pointer', ['void']]], + 'DeferredContext' : [ 0x10, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x14, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x18, ['pointer', ['void']]], + 'DpcData' : [ 0x1c, ['pointer', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x14, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x4, ['pointer', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x8, ['pointer', ['void']]], + 'TxnParameters' : [ 0xc, ['pointer', ['_TXN_PARAMETER_BLOCK']]], + 'SiloContext' : [ 0x10, ['pointer', ['_EJOB']]], +} ], + '_EJOB' : [ 0x2f8, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x10, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x18, ['_LIST_ENTRY']], + 'JobLock' : [ 0x20, ['_ERESOURCE']], + 'TotalUserTime' : [ 0x58, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0x60, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0x68, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0x70, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0x78, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0x80, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0x88, ['unsigned long']], + 'TotalProcesses' : [ 0x8c, ['unsigned long']], + 'ActiveProcesses' : [ 0x90, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0x94, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0x98, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xa0, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xa8, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0xac, ['unsigned long']], + 'LimitFlags' : [ 0xb0, ['unsigned long']], + 'ActiveProcessLimit' : [ 0xb4, ['unsigned long']], + 'Affinity' : [ 0xb8, ['_KAFFINITY_EX']], + 'AccessState' : [ 0xc4, ['pointer', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0xc8, ['pointer', ['void']]], + 'UIRestrictionsClass' : [ 0xcc, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0xd0, ['unsigned long']], + 'CompletionPort' : [ 0xd4, ['pointer', ['void']]], + 'CompletionKey' : [ 0xd8, ['pointer', ['void']]], + 'CompletionCount' : [ 0xe0, ['unsigned long long']], + 'SessionId' : [ 0xe8, ['unsigned long']], + 'SchedulingClass' : [ 0xec, ['unsigned long']], + 'ReadOperationCount' : [ 0xf0, ['unsigned long long']], + 'WriteOperationCount' : [ 0xf8, ['unsigned long long']], + 'OtherOperationCount' : [ 0x100, ['unsigned long long']], + 'ReadTransferCount' : [ 0x108, ['unsigned long long']], + 'WriteTransferCount' : [ 0x110, ['unsigned long long']], + 'OtherTransferCount' : [ 0x118, ['unsigned long long']], + 'DiskIoInfo' : [ 0x120, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x148, ['unsigned long']], + 'JobMemoryLimit' : [ 0x14c, ['unsigned long']], + 'JobTotalMemoryLimit' : [ 0x150, ['unsigned long']], + 'PeakProcessMemoryUsed' : [ 0x154, ['unsigned long']], + 'PeakJobMemoryUsed' : [ 0x158, ['unsigned long']], + 'EffectiveAffinity' : [ 0x15c, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x168, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x170, ['unsigned long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x174, ['unsigned long']], + 'EffectiveProcessMemoryLimit' : [ 0x178, ['unsigned long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x17c, ['pointer', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x180, ['pointer', ['_EJOB']]], + 'EffectiveDiskIoRateLimitJob' : [ 0x184, ['pointer', ['_EJOB']]], + 'EffectiveNetIoRateLimitJob' : [ 0x188, ['pointer', ['_EJOB']]], + 'EffectiveHeapAttributionJob' : [ 0x18c, ['pointer', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x190, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x194, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x198, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x19c, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x1a0, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x1a4, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x1a8, ['unsigned char']], + 'PriorityClass' : [ 0x1a9, ['unsigned char']], + 'NestingDepth' : [ 0x1aa, ['unsigned char']], + 'Reserved1' : [ 0x1ab, ['array', 1, ['unsigned char']]], + 'CompletionFilter' : [ 0x1ac, ['unsigned long']], + 'WakeChannel' : [ 0x1b0, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x1b0, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x1e8, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x1f0, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x1f4, ['unsigned long']], + 'NotificationLink' : [ 0x1f8, ['pointer', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x200, ['unsigned long long']], + 'NotificationInfo' : [ 0x208, ['pointer', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x20c, ['pointer', ['void']]], + 'NotificationPacket' : [ 0x210, ['pointer', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x214, ['pointer', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x218, ['pointer', ['void']]], + 'ReadyTime' : [ 0x220, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x228, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x22c, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x234, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x23c, ['pointer', ['_EJOB']]], + 'RootJob' : [ 0x240, ['pointer', ['_EJOB']]], + 'IteratorListHead' : [ 0x244, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x24c, ['unsigned long']], + 'Ancestors' : [ 0x250, ['pointer', ['pointer', ['_EJOB']]]], + 'SessionObject' : [ 0x250, ['pointer', ['void']]], + 'Accounting' : [ 0x258, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x2a8, ['unsigned long']], + 'ActiveAuxiliaryProcessCount' : [ 0x2ac, ['unsigned long']], + 'SequenceNumber' : [ 0x2b0, ['unsigned long']], + 'TimerListLock' : [ 0x2b4, ['unsigned long']], + 'TimerListHead' : [ 0x2b8, ['_LIST_ENTRY']], + 'ContainerId' : [ 0x2c0, ['_GUID']], + 'Container' : [ 0x2d0, ['pointer', ['_SILO_CONTEXT']]], + 'PropertySet' : [ 0x2d4, ['_PS_PROPERTY_SET']], + 'NetRateControl' : [ 0x2e0, ['pointer', ['_JOB_NET_RATE_CONTROL']]], + 'IoRateControl' : [ 0x2e4, ['pointer', ['_JOB_IO_RATE_CONTROL']]], + 'JobFlags' : [ 0x2e8, ['unsigned long']], + 'CloseDone' : [ 0x2e8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x2e8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x2e8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x2e8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x2e8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x2e8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x2e8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x2e8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x2e8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x2e8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x2e8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x2e8, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x2e8, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x2e8, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x2e8, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x2e8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x2e8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x2e8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x2e8, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x2e8, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x2e8, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x2e8, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x2e8, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x2e8, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x2e8, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'NetRateControlActive' : [ 0x2e8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'OwnNetRateControl' : [ 0x2e8, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IoRateControlActive' : [ 0x2e8, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'OwnIoRateControl' : [ 0x2e8, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'DisallowNewProcesses' : [ 0x2e8, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'SpareJobFlags' : [ 0x2e8, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x2ec, ['unsigned long']], + 'EnergyValues' : [ 0x2f0, ['pointer', ['_PROCESS_ENERGY_VALUES']]], + 'SharedCommitCharge' : [ 0x2f4, ['unsigned long']], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_MDL' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MDL']]], + 'Size' : [ 0x4, ['short']], + 'MdlFlags' : [ 0x6, ['short']], + 'Process' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0xc, ['pointer', ['void']]], + 'StartVa' : [ 0x10, ['pointer', ['void']]], + 'ByteCount' : [ 0x14, ['unsigned long']], + 'ByteOffset' : [ 0x18, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x68, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x5c, ['pointer', ['void']]], + 'UserContext' : [ 0x60, ['pointer', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0x80, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x8, ['pointer', ['_VPB']]], + 'FsContext' : [ 0xc, ['pointer', ['void']]], + 'FsContext2' : [ 0x10, ['pointer', ['void']]], + 'SectionObjectPointer' : [ 0x14, ['pointer', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x18, ['pointer', ['void']]], + 'FinalStatus' : [ 0x1c, ['long']], + 'RelatedFileObject' : [ 0x20, ['pointer', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x24, ['unsigned char']], + 'DeletePending' : [ 0x25, ['unsigned char']], + 'ReadAccess' : [ 0x26, ['unsigned char']], + 'WriteAccess' : [ 0x27, ['unsigned char']], + 'DeleteAccess' : [ 0x28, ['unsigned char']], + 'SharedRead' : [ 0x29, ['unsigned char']], + 'SharedWrite' : [ 0x2a, ['unsigned char']], + 'SharedDelete' : [ 0x2b, ['unsigned char']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x40, ['unsigned long']], + 'Busy' : [ 0x44, ['unsigned long']], + 'LastLock' : [ 0x48, ['pointer', ['void']]], + 'Lock' : [ 0x4c, ['_KEVENT']], + 'Event' : [ 0x5c, ['_KEVENT']], + 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0x70, ['unsigned long']], + 'IrpList' : [ 0x74, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0x7c, ['pointer', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x4, { + 'Count' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x38, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0x8, ['unsigned long']], + 'CurrentFileIndex' : [ 0x8, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x24, ['pointer', ['unsigned long']]], + 'FirstFileEntry' : [ 0x28, ['pointer', ['unsigned long']]], + 'Process' : [ 0x2c, ['pointer', ['_EPROCESS']]], + 'SessionId' : [ 0x30, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer', ['unsigned long']]], + 'LastPageFrameEntry' : [ 0x24, ['pointer', ['unsigned long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0xc, ['pointer', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x10, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x28, ['pointer', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x2c, ['_LIST_ENTRY']], + 'PushLock' : [ 0x34, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x38, ['pointer', ['pointer', ['void']]]], + 'Oplock' : [ 0x3c, ['pointer', ['void']]], + 'ReservedForRemote' : [ 0x3c, ['pointer', ['void']]], + 'ReservedContext' : [ 0x40, ['pointer', ['void']]], +} ], + '_iobuf' : [ 0x20, { + '_ptr' : [ 0x0, ['pointer', ['unsigned char']]], + '_cnt' : [ 0x4, ['long']], + '_base' : [ 0x8, ['pointer', ['unsigned char']]], + '_flag' : [ 0xc, ['long']], + '_file' : [ 0x10, ['long']], + '_charbuf' : [ 0x14, ['long']], + '_bufsiz' : [ 0x18, ['long']], + '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], +} ], + '_TlgProvider_t' : [ 0x30, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x4, ['pointer', ['unsigned short']]], + 'KeywordAny' : [ 0x8, ['unsigned long long']], + 'KeywordAll' : [ 0x10, ['unsigned long long']], + 'RegHandle' : [ 0x18, ['unsigned long long']], + 'EnableCallback' : [ 0x20, ['pointer', ['void']]], + 'CallbackContext' : [ 0x24, ['pointer', ['void']]], + 'AnnotationFunc' : [ 0x28, ['pointer', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '__unnamed_1618' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'HighLow' : [ 0x0, ['_MMPTE_HIGHLOW']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_1618']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0xc, { + 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'State' : [ 0x4, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], + 'Stats' : [ 0x8, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x38, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x8, ['pointer', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0xc, ['short']], + 'Flag' : [ 0xe, ['unsigned short']], + 'ReservedLowFlags' : [ 0xe, ['unsigned char']], + 'WaiterPriority' : [ 0xf, ['unsigned char']], + 'SharedWaiters' : [ 0x10, ['_KWAIT_CHAIN']], + 'ExclusiveWaiters' : [ 0x14, ['pointer', ['_KEVENT']]], + 'OwnerEntry' : [ 0x18, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x28, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x2c, ['unsigned long']], + 'Address' : [ 0x30, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0x30, ['unsigned long']], + 'SpinLock' : [ 0x34, ['unsigned long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0xc, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x8, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x14, { + 'Total' : [ 0x0, ['unsigned long']], + 'ListName' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x8, ['unsigned long']], + 'Blink' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_1650' : [ 0x4, { + 'Flink' : [ 0x0, ['unsigned long']], + 'WsIndex' : [ 0x0, ['unsigned long']], + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1654' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], + 'VolatileShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_1656' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_1654']], +} ], + '__unnamed_165b' : [ 0x4, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'EntireField' : [ 0x0, ['unsigned long']], +} ], + '_MMPFN' : [ 0x1c, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'u1' : [ 0x0, ['__unnamed_1650']], + 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x4, ['pointer', ['void']]], + 'PteLong' : [ 0x4, ['unsigned long']], + 'OriginalPte' : [ 0x8, ['_MMPTE']], + 'u2' : [ 0x10, ['_MIPFNBLINK']], + 'u3' : [ 0x14, ['__unnamed_1656']], + 'u4' : [ 0x18, ['__unnamed_165b']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x34, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP']], + 'BasePte' : [ 0x8, ['pointer', ['_MMPTE']]], + 'Flags' : [ 0xc, ['unsigned long']], + 'VaType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaPagedProtoPool', 15: 'MiVaMaximumType', 16: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x14, ['pointer', ['unsigned long']]], + 'PteFailures' : [ 0x18, ['unsigned long']], + 'SpinLock' : [ 0x1c, ['unsigned long']], + 'GlobalPushLock' : [ 0x1c, ['pointer', ['_EX_PUSH_LOCK']]], + 'Vm' : [ 0x20, ['pointer', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x24, ['unsigned long']], + 'Hint' : [ 0x28, ['unsigned long']], + 'CachedPtes' : [ 0x2c, ['pointer', ['_MI_CACHED_PTES']]], + 'TotalFreeSystemPtes' : [ 0x30, ['unsigned long']], +} ], + '_MMCLONE_DESCRIPTOR' : [ 0x30, { + 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Next' : [ 0x0, ['pointer', ['_MMCLONE_DESCRIPTOR']]], + 'StartingCloneBlock' : [ 0xc, ['pointer', ['_MMCLONE_BLOCK']]], + 'EndingCloneBlock' : [ 0x10, ['pointer', ['_MMCLONE_BLOCK']]], + 'NumberOfPtes' : [ 0x14, ['unsigned long']], + 'NumberOfReferences' : [ 0x18, ['unsigned long']], + 'CloneHeader' : [ 0x1c, ['pointer', ['_MMCLONE_HEADER']]], + 'NonPagedPoolQuotaCharge' : [ 0x20, ['unsigned long']], + 'NestingLevel' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_168b' : [ 0x4, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'Long' : [ 0x0, ['unsigned long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x4, { + 'u1' : [ 0x0, ['__unnamed_168b']], +} ], + '_MMWSL' : [ 0xe48, { + 'FirstFree' : [ 0x0, ['unsigned long']], + 'FirstDynamic' : [ 0x4, ['unsigned long']], + 'LastEntry' : [ 0x8, ['unsigned long']], + 'NextSlot' : [ 0xc, ['unsigned long']], + 'LastInitializedWsle' : [ 0x10, ['unsigned long']], + 'NextAgingSlot' : [ 0x14, ['unsigned long']], + 'NextAccessClearingSlot' : [ 0x18, ['unsigned long']], + 'LastAccessClearingRemainder' : [ 0x1c, ['unsigned long']], + 'LastAgingRemainder' : [ 0x20, ['unsigned long']], + 'WsleSize' : [ 0x24, ['unsigned long']], + 'NonDirectCount' : [ 0x28, ['unsigned long']], + 'LowestPagableAddress' : [ 0x2c, ['pointer', ['void']]], + 'NonDirectHash' : [ 0x30, ['pointer', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x34, ['pointer', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x38, ['pointer', ['_MMWSLE_HASH']]], + 'ActiveWsleCounts' : [ 0x3c, ['array', 16, ['unsigned long']]], + 'ActiveWsles' : [ 0x7c, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], + 'Wsle' : [ 0xfc, ['pointer', ['_MMWSLE']]], + 'UserVaInfo' : [ 0x100, ['_MI_USER_VA_INFO']], +} ], + '_MMSUPPORT' : [ 0x80, { + 'WorkingSetLock' : [ 0x0, ['long']], + 'ExitOutswapGate' : [ 0x4, ['pointer', ['_KGATE']]], + 'AccessLog' : [ 0x8, ['pointer', ['void']]], + 'WorkingSetExpansionLinks' : [ 0xc, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x14, ['array', 7, ['unsigned long']]], + 'MinimumWorkingSetSize' : [ 0x30, ['unsigned long']], + 'WorkingSetLeafSize' : [ 0x34, ['unsigned long']], + 'WorkingSetLeafPrivateSize' : [ 0x38, ['unsigned long']], + 'WorkingSetSize' : [ 0x3c, ['unsigned long']], + 'WorkingSetPrivateSize' : [ 0x40, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0x44, ['unsigned long']], + 'ChargedWslePages' : [ 0x48, ['unsigned long']], + 'ActualWslePages' : [ 0x4c, ['unsigned long']], + 'WorkingSetSizeOverhead' : [ 0x50, ['unsigned long']], + 'PeakWorkingSetSize' : [ 0x54, ['unsigned long']], + 'HardFaultCount' : [ 0x58, ['unsigned long']], + 'VmWorkingSetList' : [ 0x5c, ['pointer', ['_MMWSL']]], + 'NextPageColor' : [ 0x60, ['unsigned short']], + 'LastTrimStamp' : [ 0x62, ['unsigned short']], + 'PageFaultCount' : [ 0x64, ['unsigned long']], + 'TrimmedPageCount' : [ 0x68, ['unsigned long']], + 'Reserved0' : [ 0x6c, ['unsigned long']], + 'Flags' : [ 0x70, ['_MMSUPPORT_FLAGS']], + 'ReleasedCommitDebt' : [ 0x74, ['unsigned long']], + 'WsSwapSupport' : [ 0x78, ['pointer', ['void']]], + 'CommitReAcquireFailSupport' : [ 0x7c, ['pointer', ['void']]], +} ], + '__unnamed_16a6' : [ 0x4, { + 'ImageCommitment' : [ 0x0, ['unsigned long']], + 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], +} ], + '__unnamed_16aa' : [ 0x4, { + 'ImageInformation' : [ 0x0, ['pointer', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x20, ['__unnamed_16a6']], + 'u2' : [ 0x24, ['__unnamed_16aa']], + 'PrototypePte' : [ 0x28, ['pointer', ['_MMPTE']]], +} ], + '__unnamed_16af' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_16b9' : [ 0xc, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], + 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_16bb' : [ 0xc, { + 'e2' : [ 0x0, ['__unnamed_16b9']], +} ], + '_CONTROL_AREA' : [ 0x50, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'ListHead' : [ 0x4, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0xc, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x10, ['unsigned long']], + 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], + 'NumberOfUserReferences' : [ 0x18, ['unsigned long']], + 'u' : [ 0x1c, ['__unnamed_16af']], + 'FilePointer' : [ 0x20, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x24, ['long']], + 'ModifiedWriteCount' : [ 0x28, ['unsigned long']], + 'WaitList' : [ 0x2c, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x30, ['__unnamed_16bb']], + 'LockedPages' : [ 0x40, ['unsigned long long']], + 'FileObjectLock' : [ 0x48, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_16d0' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_16d3' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x28, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['long']], + 'PushLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'u' : [ 0x1c, ['__unnamed_16d0']], + 'u1' : [ 0x20, ['__unnamed_16d3']], + 'EventList' : [ 0x24, ['pointer', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_MI_PARTITION' : [ 0x18c0, { + 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], + 'Modwriter' : [ 0xb8, ['_MI_PARTITION_MODWRITES']], + 'Store' : [ 0x288, ['_MI_PARTITION_STORES']], + 'Segments' : [ 0x300, ['_MI_PARTITION_SEGMENTS']], + 'PageLists' : [ 0x400, ['_MI_PARTITION_PAGE_LISTS']], + 'Commit' : [ 0xb80, ['_MI_PARTITION_COMMIT']], + 'Zeroing' : [ 0xc00, ['_MI_PARTITION_ZEROING']], + 'PageCombine' : [ 0xc40, ['_MI_PAGE_COMBINING_SUPPORT']], + 'WorkingSetControl' : [ 0xd18, ['pointer', ['void']]], + 'WorkingSetExpansionHead' : [ 0xd1c, ['_MMWORKING_SET_EXPANSION_HEAD']], + 'Vp' : [ 0xd40, ['_MI_VISIBLE_PARTITION']], +} ], + '_MM_STORE_KEY' : [ 0x4, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28, native_type='unsigned long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'EntireKey' : [ 0x0, ['unsigned long']], +} ], + '_MMPAGING_FILE' : [ 0xa8, { + 'Size' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'MinimumSize' : [ 0x8, ['unsigned long']], + 'FreeSpace' : [ 0xc, ['unsigned long']], + 'PeakUsage' : [ 0x10, ['unsigned long']], + 'HighestPage' : [ 0x14, ['unsigned long']], + 'FreeReservationSpace' : [ 0x18, ['unsigned long']], + 'File' : [ 0x1c, ['pointer', ['_FILE_OBJECT']]], + 'Entry' : [ 0x20, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x28, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x30, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x38, ['pointer', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x3c, ['unsigned long']], + 'LargestAllocationCluster' : [ 0x40, ['unsigned long']], + 'RefreshAllocationCluster' : [ 0x44, ['unsigned long']], + 'LastRefreshAllocationCluster' : [ 0x48, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x4c, ['unsigned long']], + 'MaximumRunLengthInBitmaps' : [ 0x50, ['unsigned long']], + 'BitmapsCacheLengthTree' : [ 0x54, ['_RTL_RB_TREE']], + 'BitmapsCacheLocationTree' : [ 0x5c, ['_RTL_RB_TREE']], + 'BitmapsCacheFreeList' : [ 0x64, ['_LIST_ENTRY']], + 'BitmapsCacheEntries' : [ 0x6c, ['pointer', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], + 'ToBeEvictedCount' : [ 0x70, ['unsigned long']], + 'HybridPriority' : [ 0x70, ['unsigned long']], + 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'NoReservations' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'VirtualStorePagefile' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SwapSupported' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'NodeInserted' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'StackNotified' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'IgnoreReservations' : [ 0x77, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare2' : [ 0x77, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0x78, ['unsigned long']], + 'PageHashPagesPeak' : [ 0x7c, ['unsigned long']], + 'PageHash' : [ 0x80, ['pointer', ['unsigned long']]], + 'FileHandle' : [ 0x84, ['pointer', ['void']]], + 'Lock' : [ 0x88, ['unsigned long']], + 'LockOwner' : [ 0x8c, ['pointer', ['_ETHREAD']]], + 'FlowThroughReadRoot' : [ 0x90, ['_RTL_AVL_TREE']], + 'Partition' : [ 0x94, ['pointer', ['_MI_PARTITION']]], + 'FileObjectNode' : [ 0x98, ['_RTL_BALANCED_NODE']], +} ], + 'tagSWITCH_CONTEXT' : [ 0x68, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '_CMP_SILO_CONTEXT' : [ 0x10, { + 'LockEntryHead' : [ 0x0, ['_LIST_ENTRY']], + 'LockListUnderCleanup' : [ 0x8, ['unsigned char']], + 'ContextLock' : [ 0xc, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_171e' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1721' : [ 0xc, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x4, ['pointer', ['void']]], + 'Status' : [ 0x8, ['long']], +} ], + '__unnamed_1723' : [ 0x4, { + 'CheckStack' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1727' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x4, ['pointer', ['_CELL_DATA']]], + 'RootPoint' : [ 0x8, ['pointer', ['void']]], + 'Index' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1729' : [ 0x10, { + 'List' : [ 0x0, ['pointer', ['_CELL_DATA']]], + 'Index' : [ 0x4, ['unsigned long']], + 'Cell' : [ 0x8, ['unsigned long']], + 'CellPoint' : [ 0xc, ['pointer', ['_CELL_DATA']]], +} ], + '__unnamed_172d' : [ 0xc, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer', ['_HBIN']]], +} ], + '__unnamed_1731' : [ 0x8, { + 'Bin' : [ 0x0, ['pointer', ['_HBIN']]], + 'CellPoint' : [ 0x4, ['pointer', ['_HCELL']]], +} ], + '__unnamed_1733' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x120, { + 'Hive' : [ 0x0, ['pointer', ['_HHIVE']]], + 'Index' : [ 0x4, ['unsigned long']], + 'RecoverableIndex' : [ 0x8, ['unsigned long']], + 'Locations' : [ 0xc, ['array', 8, ['__unnamed_171e']]], + 'RecoverableLocations' : [ 0x6c, ['array', 8, ['__unnamed_171e']]], + 'RegistryIO' : [ 0xcc, ['__unnamed_1721']], + 'CheckRegistry2' : [ 0xd8, ['__unnamed_1723']], + 'CheckKey' : [ 0xdc, ['__unnamed_1727']], + 'CheckValueList' : [ 0xec, ['__unnamed_1729']], + 'CheckHive' : [ 0xfc, ['__unnamed_172d']], + 'CheckHive1' : [ 0x108, ['__unnamed_172d']], + 'CheckBin' : [ 0x114, ['__unnamed_1731']], + 'RecoverData' : [ 0x11c, ['__unnamed_1733']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x8, ['unsigned long']], + 'Counters' : [ 0xc, ['pointer', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x10, ['pointer', ['void']]], + 'CallbackContext' : [ 0x14, ['pointer', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xc0, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'ParkingStatus' : [ 0x80, ['unsigned long']], + 'CurrentFrequency' : [ 0x84, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], + 'StateFlags' : [ 0x8c, ['unsigned long']], + 'NominalThroughput' : [ 0x90, ['unsigned long']], + 'ActiveThroughput' : [ 0x94, ['unsigned long']], + 'ScaledThroughput' : [ 0x98, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb8, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x8, { + 'Data' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_TEB32' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], + 'SystemReserved1' : [ 0x10c, ['array', 38, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_TEB64' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], + 'SystemReserved1' : [ 0x190, ['array', 38, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], + 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], + 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], + 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], + 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x1840, { + 'TimerExpiry' : [ 0x0, ['array', 16, ['pointer', ['_KTIMER']]]], + 'TimerEntries' : [ 0x40, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Entry' : [ 0x4, ['_LIST_ENTRY']], + 'Time' : [ 0x10, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x20, { + 'Reserved1' : [ 0x0, ['long long']], + 'Reserved2' : [ 0x8, ['unsigned long']], + 'Prev' : [ 0xc, ['pointer', ['_XSTATE_SAVE']]], + 'Reserved3' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Thread' : [ 0x14, ['pointer', ['_KTHREAD']]], + 'Reserved4' : [ 0x18, ['pointer', ['void']]], + 'Level' : [ 0x1c, ['unsigned char']], + 'XStateContext' : [ 0x0, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x134, { + 'Lock' : [ 0x0, ['unsigned long']], + 'ReadySummary' : [ 0x4, ['unsigned long']], + 'ReadyListHead' : [ 0x8, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x108, ['array', 32, ['unsigned char']]], + 'Span' : [ 0x128, ['unsigned char']], + 'LowProcIndex' : [ 0x129, ['unsigned char']], + 'QueueIndex' : [ 0x12a, ['unsigned char']], + 'ProcCount' : [ 0x12b, ['unsigned char']], + 'ScanOwner' : [ 0x12c, ['unsigned char']], + 'Spare' : [ 0x12d, ['array', 3, ['unsigned char']]], + 'Affinity' : [ 0x130, ['unsigned long']], +} ], + '_KAFFINITY_EX' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KAFFINITY_ENUMERATION_CONTEXT' : [ 0xc, { + 'Affinity' : [ 0x0, ['pointer', ['_KAFFINITY_EX']]], + 'CurrentMask' : [ 0x4, ['unsigned long']], + 'CurrentIndex' : [ 0x8, ['unsigned short']], +} ], + '__unnamed_1841' : [ 0x4, { + 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1843' : [ 0x4, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], +} ], + '__unnamed_1847' : [ 0x10, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x1cc, { + 'Sibling' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'Child' : [ 0x4, ['pointer', ['_DEVICE_NODE']]], + 'Parent' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'LastChild' : [ 0xc, ['pointer', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x14, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x1c, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'FxDevice' : [ 0x28, ['pointer', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x2c, ['long']], + 'FxRemoveEvent' : [ 0x30, ['_KEVENT']], + 'FxActivationCount' : [ 0x40, ['long']], + 'FxSleepCount' : [ 0x44, ['long']], + 'Plugin' : [ 0x48, ['pointer', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x4c, ['unsigned long']], + 'CurrentPowerState' : [ 0x50, ['_POWER_STATE']], + 'Notify' : [ 0x54, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0x90, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0xa0, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0xa8, ['unsigned long']], + 'State' : [ 0xac, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0xb0, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0xb4, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x104, ['unsigned long']], + 'CompletionStatus' : [ 0x108, ['long']], + 'Flags' : [ 0x10c, ['unsigned long']], + 'UserFlags' : [ 0x110, ['unsigned long']], + 'Problem' : [ 0x114, ['unsigned long']], + 'ProblemStatus' : [ 0x118, ['long']], + 'ResourceList' : [ 0x11c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x120, ['pointer', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x124, ['pointer', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x128, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x130, ['unsigned long']], + 'ChildInterfaceType' : [ 0x134, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x138, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x13c, ['unsigned short']], + 'RemovalPolicy' : [ 0x13e, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x13f, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x140, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x148, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x150, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x158, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x15a, ['unsigned short']], + 'NoArbiterMask' : [ 0x15c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x15e, ['unsigned short']], + 'OverUsed1' : [ 0x160, ['__unnamed_1841']], + 'OverUsed2' : [ 0x164, ['__unnamed_1843']], + 'BootResources' : [ 0x168, ['pointer', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x16c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x170, ['unsigned long']], + 'DockInfo' : [ 0x174, ['__unnamed_1847']], + 'DisableableDepends' : [ 0x184, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x188, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x190, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x198, ['unsigned long']], + 'PreviousParent' : [ 0x19c, ['pointer', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x1a0, ['long']], + 'NumaNodeIndex' : [ 0x1a4, ['unsigned long']], + 'ContainerID' : [ 0x1a8, ['_GUID']], + 'OverrideFlags' : [ 0x1b8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x1bc, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x1c0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x1c4, ['pointer', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x1c8, ['unsigned long']], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x38, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x2c, ['pointer', ['unsigned long']]], + 'EnableKeyWords' : [ 0x30, ['pointer', ['unsigned long long']]], + 'EnableLevel' : [ 0x34, ['pointer', ['unsigned char']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x8, ['unsigned long']], + 'CompletedList' : [ 0xc, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x14, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x28, ['unsigned long']], +} ], + '_KSEMAPHORE' : [ 0x14, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x10, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x38, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x8, ['unsigned long']], + 'Dope' : [ 0xc, ['pointer', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x10, ['unsigned long']], + 'DeviceNode' : [ 0x14, ['pointer', ['void']]], + 'AttachedTo' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x1c, ['long']], + 'StartIoKey' : [ 0x20, ['long']], + 'StartIoFlags' : [ 0x24, ['unsigned long']], + 'Vpb' : [ 0x28, ['pointer', ['_VPB']]], + 'DependencyNode' : [ 0x2c, ['pointer', ['void']]], + 'InterruptContext' : [ 0x30, ['pointer', ['void']]], + 'VerifierContext' : [ 0x34, ['pointer', ['void']]], +} ], + '_GROUP_AFFINITY' : [ 0xc, { + 'Mask' : [ 0x0, ['unsigned long']], + 'Group' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['array', 3, ['unsigned short']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0xc, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x28, { + 'PhysicalDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x4, ['unsigned long']], + 'AllocationType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0xc, ['unsigned long']], + 'Position' : [ 0x10, ['unsigned long']], + 'ResourceRequirements' : [ 0x14, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x18, ['pointer', ['void']]], + 'ResourceAssignment' : [ 0x1c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x20, ['pointer', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x24, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1941' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_1941']], +} ], + '__unnamed_1948' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_1948']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_X86_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PEP_ACPI_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], + 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], + 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], + 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], + 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], + 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], + 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], +} ], + '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Information' : [ 0x4, ['unsigned char']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Alignment' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'Count' : [ 0x10, ['unsigned char']], + 'Pins' : [ 0x14, ['pointer', ['unsigned long']]], +} ], + '_PEP_ACPI_GPIO_RESOURCE' : [ 0x30, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], + 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], + 'DriveStrength' : [ 0x18, ['unsigned short']], + 'DebounceTimeout' : [ 0x1a, ['unsigned short']], + 'PinTable' : [ 0x1c, ['pointer', ['unsigned short']]], + 'PinCount' : [ 0x20, ['unsigned short']], + 'ResourceSourceIndex' : [ 0x22, ['unsigned char']], + 'ResourceSourceName' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x28, ['pointer', ['unsigned char']]], + 'VendorDataLength' : [ 0x2c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x20, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x18, ['unsigned long']], + 'SlaveAddress' : [ 0x1c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x24, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'BaudRate' : [ 0x18, ['unsigned long']], + 'RxBufferSize' : [ 0x1c, ['unsigned short']], + 'TxBufferSize' : [ 0x1e, ['unsigned short']], + 'Parity' : [ 0x20, ['unsigned char']], + 'LinesInUse' : [ 0x21, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x24, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x18, ['unsigned long']], + 'DataBitLength' : [ 0x1c, ['unsigned char']], + 'Phase' : [ 0x1d, ['unsigned char']], + 'Polarity' : [ 0x1e, ['unsigned char']], + 'DeviceSelection' : [ 0x20, ['unsigned short']], +} ], + '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'ResourceFlags' : [ 0x8, ['unsigned char']], + 'GeneralFlags' : [ 0x9, ['unsigned char']], + 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], + 'RevisionId' : [ 0xb, ['unsigned char']], + 'Reserved' : [ 0xc, ['unsigned char']], + 'Granularity' : [ 0x10, ['unsigned long long']], + 'MinimumAddress' : [ 0x18, ['unsigned long long']], + 'MaximumAddress' : [ 0x20, ['unsigned long long']], + 'TranslationAddress' : [ 0x28, ['unsigned long long']], + 'AddressLength' : [ 0x30, ['unsigned long long']], + 'TypeAttribute' : [ 0x38, ['unsigned long long']], + 'DescriptorName' : [ 0x40, ['pointer', ['_UNICODE_STRING']]], +} ], + '_PPM_PLATFORM_STATES' : [ 0x100, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'InterfaceVersion' : [ 0x4, ['unsigned long']], + 'ProcessorCount' : [ 0x8, ['unsigned long']], + 'CoordinatedInterface' : [ 0xc, ['unsigned char']], + 'IdleTest' : [ 0x10, ['pointer', ['void']]], + 'IdlePreExecute' : [ 0x14, ['pointer', ['void']]], + 'IdleComplete' : [ 0x18, ['pointer', ['void']]], + 'QueryPlatformStateResidency' : [ 0x1c, ['pointer', ['void']]], + 'Accounting' : [ 0x20, ['pointer', ['_PLATFORM_IDLE_ACCOUNTING']]], + 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], +} ], + '_POP_CPU_INFO' : [ 0x10, { + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_PPM_PROFILE' : [ 0x1a8, { + 'Name' : [ 0x0, ['pointer', ['unsigned short']]], + 'Id' : [ 0x4, ['unsigned char']], + 'Guid' : [ 0x8, ['_GUID']], + 'Flags' : [ 0x18, ['unsigned long']], + 'Priority' : [ 0x1c, ['unsigned char']], + 'Settings' : [ 0x20, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], + 'StartTime' : [ 0x180, ['unsigned long long']], + 'Count' : [ 0x188, ['unsigned long long']], + 'MaxDuration' : [ 0x190, ['unsigned long long']], + 'MinDuration' : [ 0x198, ['unsigned long long']], + 'TotalDuration' : [ 0x1a0, ['unsigned long long']], +} ], + '_PPM_ENGINE_SETTINGS' : [ 0xb0, { + 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], + 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], + 'PerfTimeCheck' : [ 0x14, ['unsigned long']], + 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], + 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], + 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], + 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], + 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], + 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], + 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], + 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], + 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], + 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], + 'PerfBoostMode' : [ 0x30, ['unsigned long']], + 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], + 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], + 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], + 'AutonomousPreference' : [ 0x40, ['unsigned char']], + 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], + 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], + 'DutyCycling' : [ 0x45, ['unsigned char']], + 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], + 'DistributeUtility' : [ 0x48, ['unsigned char']], + 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], + 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], + 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], + 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], + 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], + 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], + 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], + 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], + 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], + 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], + 'AllowScaling' : [ 0x5c, ['unsigned char']], + 'IdleDisabled' : [ 0x5d, ['unsigned char']], + 'IdleTimeCheck' : [ 0x60, ['unsigned long']], + 'IdleDemotePercent' : [ 0x64, ['unsigned char']], + 'IdlePromotePercent' : [ 0x65, ['unsigned char']], + 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], + 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], + 'HeteroDecreaseThreshold' : [ 0x68, ['array', 32, ['unsigned char']]], + 'HeteroIncreaseThreshold' : [ 0x88, ['array', 32, ['unsigned char']]], + 'Class0FloorPerformance' : [ 0xa8, ['unsigned char']], + 'Class1InitialPerformance' : [ 0xa9, ['unsigned char']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_PERF_FLAGS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], + 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], + 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x8, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x4, ['pointer', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0x90, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0xc, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x14, ['unsigned long']], + 'LogHandleContext' : [ 0x18, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0x80, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0x84, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0x88, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x178, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x28, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x30, ['array', 4, ['pointer', ['_VACB']]]], + 'Vacbs' : [ 0x40, ['pointer', ['pointer', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x44, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x4c, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x50, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x58, ['_LIST_ENTRY']], + 'Flags' : [ 0x60, ['unsigned long']], + 'Status' : [ 0x64, ['long']], + 'Mbcb' : [ 0x68, ['pointer', ['_MBCB']]], + 'Section' : [ 0x6c, ['pointer', ['void']]], + 'CreateEvent' : [ 0x70, ['pointer', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0x74, ['pointer', ['_KEVENT']]], + 'PagesToWrite' : [ 0x78, ['unsigned long']], + 'BeyondLastFlush' : [ 0x80, ['long long']], + 'Callbacks' : [ 0x88, ['pointer', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0x8c, ['pointer', ['void']]], + 'PrivateList' : [ 0x90, ['_LIST_ENTRY']], + 'V1' : [ 0x98, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0x98, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0xa0, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0xa8, ['unsigned long']], + 'LazyWritePassCount' : [ 0xac, ['unsigned long']], + 'UninitializeEvent' : [ 0xb0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0xb4, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0xd8, ['_LARGE_INTEGER']], + 'Event' : [ 0xe0, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0xf0, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0xf8, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x160, ['pointer', ['void']]], + 'VolumeCacheMap' : [ 0x164, ['pointer', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x168, ['unsigned long']], + 'WritesInProgress' : [ 0x16c, ['unsigned long']], + 'AsyncReadRequestCount' : [ 0x170, ['unsigned long']], +} ], + '__unnamed_1a2d' : [ 0x8, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x18, { + 'BaseAddress' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x8, ['__unnamed_1a2d']], + 'ArrayHead' : [ 0x10, ['pointer', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1a52' : [ 0x4, { + 'FileObject' : [ 0x0, ['pointer', ['_FILE_OBJECT']]], +} ], + '__unnamed_1a54' : [ 0x4, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1a56' : [ 0x4, { + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], +} ], + '__unnamed_1a58' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1a5a' : [ 0x1c, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x4, ['pointer', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x8, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_1a5e' : [ 0x38, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], + 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], + 'FileObject' : [ 0x10, ['pointer', ['_FILE_OBJECT']]], + 'Length' : [ 0x14, ['unsigned long']], + 'PrefetchList' : [ 0x18, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'PrefetchPagePriority' : [ 0x1c, ['unsigned long']], + 'Mdl' : [ 0x20, ['pointer', ['_MDL']]], + 'IoStatusBlock' : [ 0x24, ['pointer', ['_IO_STATUS_BLOCK']]], + 'CallbackContext' : [ 0x28, ['pointer', ['_CC_ASYNC_READ_CONTEXT']]], + 'OriginatingProcess' : [ 0x2c, ['pointer', ['_EPROCESS']]], + 'RequestorMode' : [ 0x30, ['unsigned char']], + 'NestingLevel' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_1a60' : [ 0x38, { + 'Read' : [ 0x0, ['__unnamed_1a52']], + 'Write' : [ 0x0, ['__unnamed_1a54']], + 'Event' : [ 0x0, ['__unnamed_1a56']], + 'Notification' : [ 0x0, ['__unnamed_1a58']], + 'LowPriWrite' : [ 0x0, ['__unnamed_1a5a']], + 'AsyncRead' : [ 0x0, ['__unnamed_1a5e']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x48, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x8, ['__unnamed_1a60']], + 'Function' : [ 0x40, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x18, { + 'Callback' : [ 0x0, ['pointer', ['void']]], + 'DirtyPageStatistics' : [ 0x4, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x68, { + 'LogHandle' : [ 0x0, ['pointer', ['void']]], + 'FlushToLsnRoutine' : [ 0x4, ['pointer', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x8, ['pointer', ['void']]], + 'DirtyPageStatistics' : [ 0xc, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x18, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x40, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x44, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x48, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x50, ['pointer', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x54, ['unsigned long']], + 'LastLWTimeStamp' : [ 0x58, ['_LARGE_INTEGER']], + 'Flags' : [ 0x60, ['unsigned long']], +} ], + '_MBCB' : [ 0x88, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x18, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x20, ['long long']], + 'BitmapRange1' : [ 0x28, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x48, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x68, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x20, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x8, ['long long']], + 'FirstDirtyPage' : [ 0x10, ['unsigned long']], + 'LastDirtyPage' : [ 0x14, ['unsigned long']], + 'DirtyPages' : [ 0x18, ['unsigned long']], + 'Bitmap' : [ 0x1c, ['pointer', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x10, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x8, ['pointer', ['void']]], + 'VacbLevelsAllocated' : [ 0xc, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x4, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x24, { + 'ExtendedLookup' : [ 0x0, ['pointer', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x4, ['unsigned long']], + 'ExtraItem' : [ 0x8, ['unsigned long']], + 'ItemCount' : [ 0xc, ['unsigned long']], + 'OutOfRangeItems' : [ 0x10, ['unsigned long']], + 'BaseIndex' : [ 0x14, ['unsigned long']], + 'ListHead' : [ 0x18, ['pointer', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x1c, ['pointer', ['unsigned long']]], + 'ListHints' : [ 0x20, ['pointer', ['pointer', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x248, { + 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], + 'Flags' : [ 0x40, ['unsigned long']], + 'ForceFlags' : [ 0x44, ['unsigned long']], + 'CompatibilityFlags' : [ 0x48, ['unsigned long']], + 'EncodeFlagMask' : [ 0x4c, ['unsigned long']], + 'Encoding' : [ 0x50, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x58, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x5c, ['unsigned long']], + 'Signature' : [ 0x60, ['unsigned long']], + 'SegmentReserve' : [ 0x64, ['unsigned long']], + 'SegmentCommit' : [ 0x68, ['unsigned long']], + 'DeCommitFreeBlockThreshold' : [ 0x6c, ['unsigned long']], + 'DeCommitTotalFreeThreshold' : [ 0x70, ['unsigned long']], + 'TotalFreeSize' : [ 0x74, ['unsigned long']], + 'MaximumAllocationSize' : [ 0x78, ['unsigned long']], + 'ProcessHeapsListIndex' : [ 0x7c, ['unsigned short']], + 'HeaderValidateLength' : [ 0x7e, ['unsigned short']], + 'HeaderValidateCopy' : [ 0x80, ['pointer', ['void']]], + 'NextAvailableTagIndex' : [ 0x84, ['unsigned short']], + 'MaximumTagIndex' : [ 0x86, ['unsigned short']], + 'TagEntries' : [ 0x88, ['pointer', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0x8c, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x94, ['unsigned long']], + 'AlignMask' : [ 0x98, ['unsigned long']], + 'VirtualAllocdBlocks' : [ 0x9c, ['_LIST_ENTRY']], + 'SegmentList' : [ 0xa4, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0xac, ['unsigned short']], + 'NonDedicatedListLength' : [ 0xb0, ['unsigned long']], + 'BlocksIndex' : [ 0xb4, ['pointer', ['void']]], + 'UCRIndex' : [ 0xb8, ['pointer', ['void']]], + 'PseudoTagEntries' : [ 0xbc, ['pointer', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0xc0, ['_LIST_ENTRY']], + 'LockVariable' : [ 0xc8, ['pointer', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0xcc, ['pointer', ['void']]], + 'FrontEndHeap' : [ 0xd0, ['pointer', ['void']]], + 'FrontHeapLockCount' : [ 0xd4, ['unsigned short']], + 'FrontEndHeapType' : [ 0xd6, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0xd7, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0xd8, ['pointer', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0xdc, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0xde, ['array', 257, ['unsigned char']]], + 'Counters' : [ 0x1e0, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x23c, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1ace' : [ 0x38, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x38, { + 'Lock' : [ 0x0, ['__unnamed_1ace']], +} ], + '_HEAP_ENTRY' : [ 0x8, { + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'Code234' : [ 0x4, ['unsigned long']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x40, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x20, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x8, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x10, ['unsigned long']], + 'ReserveSize' : [ 0x14, ['unsigned long']], + 'BusyBlock' : [ 0x18, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x10, { + 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'Code234' : [ 0x4, ['unsigned long']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], + 'FreeList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '__unnamed_1b21' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1b23' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b21']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1b25' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1b27' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1b25']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1b23']], + 'u2' : [ 0x4, ['__unnamed_1b27']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x20, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x14, ['pointer', ['void']]], + 'DestroyProcedure' : [ 0x18, ['pointer', ['void']]], + 'UsualSize' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_1b44' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1b46' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1b44']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x18, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'u1' : [ 0x8, ['__unnamed_1b46']], + 'ResourceId' : [ 0x9, ['unsigned char']], + 'CachedReferences' : [ 0xa, ['short']], + 'ReferenceCount' : [ 0xc, ['long']], + 'Pad' : [ 0x10, ['unsigned long']], + 'Lock' : [ 0x14, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1b5a' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1b5c' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b5a']], +} ], + '_KALPC_SECTION' : [ 0x28, { + 'SectionObject' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'HandleTable' : [ 0x8, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0xc, ['pointer', ['void']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0x14, ['pointer', ['_ALPC_PORT']]], + 'u1' : [ 0x18, ['__unnamed_1b5c']], + 'NumberOfRegions' : [ 0x1c, ['unsigned long']], + 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '__unnamed_1b65' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1b67' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b65']], +} ], + '_KALPC_REGION' : [ 0x30, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x8, ['pointer', ['_KALPC_SECTION']]], + 'Offset' : [ 0xc, ['unsigned long']], + 'Size' : [ 0x10, ['unsigned long']], + 'ViewSize' : [ 0x14, ['unsigned long']], + 'u1' : [ 0x18, ['__unnamed_1b67']], + 'NumberOfViews' : [ 0x1c, ['unsigned long']], + 'ViewListHead' : [ 0x20, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x28, ['pointer', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x2c, ['pointer', ['_KALPC_VIEW']]], +} ], + '__unnamed_1b6d' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1b6f' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b6d']], +} ], + '_KALPC_VIEW' : [ 0x34, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x8, ['pointer', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'Address' : [ 0x14, ['pointer', ['void']]], + 'Size' : [ 0x18, ['unsigned long']], + 'SecureViewHandle' : [ 0x1c, ['pointer', ['void']]], + 'WriteAccessHandle' : [ 0x20, ['pointer', ['void']]], + 'u1' : [ 0x24, ['__unnamed_1b6f']], + 'NumberOfOwnerMessages' : [ 0x28, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x2c, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x28, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x4, ['pointer', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x8, ['pointer', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0xc, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x24, ['pointer', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1b8c' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1b8e' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b8c']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x11c, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'CompletionPort' : [ 0x10, ['pointer', ['void']]], + 'CompletionKey' : [ 0x14, ['pointer', ['void']]], + 'CompletionPacketLookaside' : [ 0x18, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x1c, ['pointer', ['void']]], + 'StaticSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x5c, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x60, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0x68, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0x70, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0x74, ['_LIST_ENTRY']], + 'DirectQueueLock' : [ 0x7c, ['_EX_PUSH_LOCK']], + 'DirectQueue' : [ 0x80, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0x8c, ['_LIST_ENTRY']], + 'Semaphore' : [ 0x94, ['pointer', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0x94, ['pointer', ['_KEVENT']]], + 'PortAttributes' : [ 0x98, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0xc4, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0xd0, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0xd4, ['pointer', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0xd8, ['pointer', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0xdc, ['pointer', ['void']]], + 'CanceledQueue' : [ 0xe0, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0xe8, ['long']], + 'ReferenceNo' : [ 0xec, ['long']], + 'ReferenceNoWait' : [ 0xf0, ['pointer', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0xf4, ['__unnamed_1b8e']], + 'TargetQueuePort' : [ 0xf8, ['pointer', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0xfc, ['pointer', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x100, ['pointer', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x104, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x108, ['unsigned long']], + 'PendingQueueLength' : [ 0x10c, ['unsigned long']], + 'DirectQueueLength' : [ 0x110, ['unsigned long']], + 'CanceledQueueLength' : [ 0x114, ['unsigned long']], + 'WaitQueueLength' : [ 0x118, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0x58, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'CompletionListLock' : [ 0xc, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x10, ['pointer', ['_MDL']]], + 'UserVa' : [ 0x14, ['pointer', ['void']]], + 'UserLimit' : [ 0x18, ['pointer', ['void']]], + 'DataUserVa' : [ 0x1c, ['pointer', ['void']]], + 'SystemVa' : [ 0x20, ['pointer', ['void']]], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'Header' : [ 0x28, ['pointer', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x2c, ['pointer', ['void']]], + 'ListSize' : [ 0x30, ['unsigned long']], + 'Bitmap' : [ 0x34, ['pointer', ['void']]], + 'BitmapSize' : [ 0x38, ['unsigned long']], + 'Data' : [ 0x3c, ['pointer', ['void']]], + 'DataSize' : [ 0x40, ['unsigned long']], + 'BitmapLimit' : [ 0x44, ['unsigned long']], + 'BitmapNextHint' : [ 0x48, ['unsigned long']], + 'ConcurrencyCount' : [ 0x4c, ['unsigned long']], + 'AttributeFlags' : [ 0x50, ['unsigned long']], + 'AttributeSize' : [ 0x54, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ObjectName' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'Attributes' : [ 0xc, ['unsigned long']], + 'SecurityDescriptor' : [ 0x10, ['pointer', ['void']]], + 'SecurityQualityOfService' : [ 0x14, ['pointer', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0x90, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x10, ['pointer', ['void']]], + 'Index' : [ 0x14, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x18, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x1c, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x20, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x24, ['unsigned long']], + 'TypeInfo' : [ 0x28, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0x80, ['_EX_PUSH_LOCK']], + 'Key' : [ 0x84, ['unsigned long']], + 'CallbackList' : [ 0x88, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x14, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x10, ['long']], +} ], + '__unnamed_1bb1' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1bb3' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bb1']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x90, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x8, ['pointer', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x10, ['pointer', ['_ETHREAD']]], + 'u1' : [ 0x14, ['__unnamed_1bb3']], + 'SequenceNo' : [ 0x18, ['long']], + 'QuotaProcess' : [ 0x1c, ['pointer', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x1c, ['pointer', ['void']]], + 'CancelSequencePort' : [ 0x20, ['pointer', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x24, ['pointer', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x28, ['long']], + 'CancelListEntry' : [ 0x2c, ['_LIST_ENTRY']], + 'Reserve' : [ 0x34, ['pointer', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x38, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0x58, ['pointer', ['void']]], + 'CommunicationInfo' : [ 0x5c, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0x60, ['pointer', ['_ALPC_PORT']]], + 'ServerThread' : [ 0x64, ['pointer', ['_ETHREAD']]], + 'WakeReference' : [ 0x68, ['pointer', ['void']]], + 'ExtensionBuffer' : [ 0x6c, ['pointer', ['void']]], + 'ExtensionBufferSize' : [ 0x70, ['unsigned long']], + 'PortMessage' : [ 0x78, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x24, { + 'PortObject' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'Message' : [ 0x4, ['pointer', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'TargetPort' : [ 0x10, ['pointer', ['_ALPC_PORT']]], + 'DirectEvent' : [ 0x14, ['_KALPC_DIRECT_EVENT']], + 'Flags' : [ 0x18, ['unsigned long']], + 'TotalLength' : [ 0x1c, ['unsigned short']], + 'Type' : [ 0x1e, ['unsigned short']], + 'DataInfoOffset' : [ 0x20, ['unsigned short']], + 'SignalCompletion' : [ 0x22, ['unsigned char']], + 'PostedToCompletionList' : [ 0x23, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x4, ['unsigned long']], + 'ViewBase' : [ 0x8, ['pointer', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x14, { + 'OwnerPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x4, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Message' : [ 0xc, ['pointer', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x10, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x20, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x20, { + 'ClientContext' : [ 0x0, ['pointer', ['void']]], + 'ServerContext' : [ 0x4, ['pointer', ['void']]], + 'PortContext' : [ 0x8, ['pointer', ['void']]], + 'CancelPortContext' : [ 0xc, ['pointer', ['void']]], + 'SecurityData' : [ 0x10, ['pointer', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x14, ['pointer', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], + 'DirectEvent' : [ 0x1c, ['_KALPC_DIRECT_EVENT']], +} ], + '__unnamed_1bf6' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1bf8' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bf6']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x50, { + 'HandleTable' : [ 0x0, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x4, ['pointer', ['void']]], + 'OwningProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x10, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x4c, ['__unnamed_1bf8']], +} ], + '_KALPC_DIRECT_EVENT' : [ 0x4, { + 'Event' : [ 0x0, ['unsigned long']], + 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x8, ['unsigned long']], + 'KeyContext' : [ 0xc, ['pointer', ['void']]], + 'ApcContext' : [ 0x10, ['pointer', ['void']]], + 'IoStatus' : [ 0x14, ['long']], + 'IoStatusInformation' : [ 0x18, ['unsigned long']], + 'MiniPacketCallback' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], + 'Allocated' : [ 0x24, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x28, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer', ['void']]], + 'ActivityId' : [ 0xc, ['_GUID']], + 'Timestamp' : [ 0x1c, ['_LARGE_INTEGER']], + 'ZeroingOffset' : [ 0x1c, ['unsigned long']], + 'FsTrackOffsetBlob' : [ 0x1c, ['pointer', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], + 'FsTrackedOffset' : [ 0x20, ['long long']], +} ], + '_DRIVER_OBJECT' : [ 0xa8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'DriverStart' : [ 0xc, ['pointer', ['void']]], + 'DriverSize' : [ 0x10, ['unsigned long']], + 'DriverSection' : [ 0x14, ['pointer', ['void']]], + 'DriverExtension' : [ 0x18, ['pointer', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x1c, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x28, ['pointer', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x2c, ['pointer', ['void']]], + 'DriverStartIo' : [ 0x30, ['pointer', ['void']]], + 'DriverUnload' : [ 0x34, ['pointer', ['void']]], + 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x14, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0xc, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x28, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x4, ['array', 8, ['pointer', ['void']]]], + 'FoIoPriorityHint' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0x78, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x8, ['long']], + 'Information' : [ 0xc, ['unsigned long']], + 'ParseCheck' : [ 0x10, ['unsigned long']], + 'RelatedFileObject' : [ 0x14, ['pointer', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x18, ['pointer', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x28, ['unsigned long']], + 'FileAttributes' : [ 0x2c, ['unsigned short']], + 'ShareAccess' : [ 0x2e, ['unsigned short']], + 'EaBuffer' : [ 0x30, ['pointer', ['void']]], + 'EaLength' : [ 0x34, ['unsigned long']], + 'Options' : [ 0x38, ['unsigned long']], + 'Disposition' : [ 0x3c, ['unsigned long']], + 'BasicInformation' : [ 0x40, ['pointer', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x44, ['pointer', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x4c, ['pointer', ['void']]], + 'Override' : [ 0x50, ['unsigned char']], + 'QueryOnly' : [ 0x51, ['unsigned char']], + 'DeleteOnly' : [ 0x52, ['unsigned char']], + 'FullAttributes' : [ 0x53, ['unsigned char']], + 'LocalFileObject' : [ 0x54, ['pointer', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x58, ['unsigned long']], + 'AccessMode' : [ 0x5c, ['unsigned char']], + 'DriverCreateContext' : [ 0x60, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1cc1' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x110, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1cc1']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer', ['unsigned short']]], + 'LogFileName' : [ 0x3c, ['pointer', ['unsigned short']]], + 'TimeZone' : [ 0x40, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf0, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0xf8, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x100, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x108, ['unsigned long']], + 'BuffersLost' : [ 0x10c, ['unsigned long']], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x288, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 1, ['unsigned long']]], + 'ErrorMarker' : [ 0x18, ['unsigned long']], + 'SizeMask' : [ 0x1c, ['unsigned long']], + 'GetCpuClock' : [ 0x20, ['pointer', ['void']]], + 'LoggerThread' : [ 0x24, ['pointer', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x28, ['long']], + 'FailureReason' : [ 0x2c, ['unsigned long']], + 'BufferQueue' : [ 0x30, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x3c, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x48, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x50, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x58, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x58, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x5c, ['_UNICODE_STRING']], + 'LogFileName' : [ 0x64, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0x6c, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0x74, ['_UNICODE_STRING']], + 'ClockType' : [ 0x7c, ['unsigned long']], + 'LastFlushedBuffer' : [ 0x80, ['unsigned long']], + 'FlushTimer' : [ 0x84, ['unsigned long']], + 'FlushThreshold' : [ 0x88, ['unsigned long']], + 'ByteOffset' : [ 0x90, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0x98, ['unsigned long']], + 'BuffersAvailable' : [ 0x9c, ['long']], + 'NumberOfBuffers' : [ 0xa0, ['long']], + 'MaximumBuffers' : [ 0xa4, ['unsigned long']], + 'EventsLost' : [ 0xa8, ['unsigned long']], + 'PeakBuffersCount' : [ 0xac, ['long']], + 'BuffersWritten' : [ 0xb0, ['unsigned long']], + 'LogBuffersLost' : [ 0xb4, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0xb8, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0xbc, ['unsigned long']], + 'SequencePtr' : [ 0xc0, ['pointer', ['long']]], + 'LocalSequence' : [ 0xc4, ['unsigned long']], + 'InstanceGuid' : [ 0xc8, ['_GUID']], + 'MaximumFileSize' : [ 0xd8, ['unsigned long']], + 'FileCounter' : [ 0xdc, ['long']], + 'PoolType' : [ 0xe0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0xe8, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0xf8, ['long']], + 'ProviderInfoSize' : [ 0xfc, ['unsigned long']], + 'Consumers' : [ 0x100, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x108, ['unsigned long']], + 'TransitionConsumer' : [ 0x10c, ['pointer', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x110, ['pointer', ['void']]], + 'RealtimeLogfileName' : [ 0x114, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x120, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x128, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x130, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x138, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x140, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x148, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x150, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x160, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x164, ['_KEVENT']], + 'FlushEvent' : [ 0x174, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x188, ['_KTIMER']], + 'LoggerDpc' : [ 0x1b0, ['_KDPC']], + 'LoggerMutex' : [ 0x1d0, ['_KMUTANT']], + 'LoggerLock' : [ 0x1f0, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x1f4, ['unsigned long']], + 'BufferListPushLock' : [ 0x1f4, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x1f8, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x234, ['pointer', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x238, ['_EX_FAST_REF']], + 'StartTime' : [ 0x240, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x248, ['pointer', ['void']]], + 'BufferSequenceNumber' : [ 0x250, ['long long']], + 'Flags' : [ 0x258, ['unsigned long']], + 'Persistent' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x258, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x258, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x258, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x258, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x258, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x258, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x258, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x258, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x258, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x258, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'StackLookasideListAllocated' : [ 0x258, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SecurityTrace' : [ 0x258, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x258, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x258, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x258, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x258, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x25c, ['unsigned long']], + 'DbgRequestNewFile' : [ 0x25c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x25c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x25c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x25c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x25c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x25c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x25c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x25c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDeferredFlush' : [ 0x25c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDeferredFlushTimer' : [ 0x25c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x25c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x25c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x25c, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x260, ['_RTL_BITMAP']], + 'StackCache' : [ 0x268, ['pointer', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x26c, ['pointer', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x270, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x278, ['pointer', ['pointer', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x27c, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x24, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_SILODRIVERSTATE' : [ 0xa80, { + 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], + 'EtwpLoggerRundown' : [ 0x168, ['array', 64, ['pointer', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], + 'WmipLoggerContext' : [ 0x268, ['array', 64, ['pointer', ['_WMI_LOGGER_CONTEXT']]]], + 'EtwpGuidHashTable' : [ 0x368, ['array', 64, ['_ETW_HASH_BUCKET']]], + 'EtwpSecurityLoggers' : [ 0xa68, ['array', 8, ['unsigned short']]], + 'EtwpSecurityProviderEnableMask' : [ 0xa78, ['unsigned char']], + 'EtwpShutdownInProgress' : [ 0xa79, ['unsigned char']], + 'EtwpSecurityProviderPID' : [ 0xa7c, ['unsigned long']], +} ], + '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x10, { + 'RunRefs' : [ 0x0, ['pointer', ['_EX_RUNDOWN_REF']]], + 'PoolToFree' : [ 0x4, ['pointer', ['void']]], + 'RunRefSize' : [ 0x8, ['unsigned long']], + 'Number' : [ 0xc, ['unsigned long']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x298, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x34, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x94, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0x98, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0x9c, ['pointer', ['void']]], + 'DynamicPart' : [ 0xa0, ['pointer', ['unsigned long']]], + 'DefaultDacl' : [ 0xa4, ['pointer', ['_ACL']]], + 'TokenType' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xac, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xb0, ['unsigned long']], + 'TokenInUse' : [ 0xb4, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xb8, ['unsigned long']], + 'MandatoryPolicy' : [ 0xbc, ['unsigned long']], + 'LogonSession' : [ 0xc0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xc4, ['_LUID']], + 'SidHash' : [ 0xcc, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x154, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x1dc, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x1e0, ['pointer', ['void']]], + 'Capabilities' : [ 0x1e4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x1e8, ['unsigned long']], + 'CapabilitiesHash' : [ 0x1ec, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x274, ['pointer', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x278, ['pointer', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x27c, ['pointer', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x280, ['pointer', ['void']]], + 'TrustLinkedToken' : [ 0x284, ['pointer', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x288, ['pointer', ['void']]], + 'TokenSidValues' : [ 0x28c, ['pointer', ['_SEP_SID_VALUES_BLOCK']]], + 'IndexEntry' : [ 0x290, ['pointer', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], + 'VariablePart' : [ 0x294, ['unsigned long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0x64, { + 'Next' : [ 0x0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x4, ['_LUID']], + 'BuddyLogonId' : [ 0xc, ['_LUID']], + 'ReferenceCount' : [ 0x14, ['long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'pDeviceMap' : [ 0x1c, ['pointer', ['_DEVICE_MAP']]], + 'Token' : [ 0x20, ['pointer', ['void']]], + 'AccountName' : [ 0x24, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x2c, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x34, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x3c, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x40, ['pointer', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x44, ['pointer', ['_SEP_SID_VALUES_BLOCK']]], + 'RevocationBlock' : [ 0x48, ['_OB_HANDLE_REVOCATION_BLOCK']], + 'ServerSilo' : [ 0x58, ['pointer', ['_EJOB']]], + 'SiblingAuthId' : [ 0x5c, ['_LUID']], +} ], + '_OBJECT_HEADER' : [ 0x20, { + 'PointerCount' : [ 0x0, ['long']], + 'HandleCount' : [ 0x4, ['long']], + 'NextToFree' : [ 0x4, ['pointer', ['void']]], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0xc, ['unsigned char']], + 'TraceFlags' : [ 0xd, ['unsigned char']], + 'DbgRefTrace' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0xd, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0xe, ['unsigned char']], + 'Flags' : [ 0xf, ['unsigned char']], + 'NewObject' : [ 0xf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0xf, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0xf, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0xf, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0xf, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0xf, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0xf, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0xf, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectCreateInfo' : [ 0x10, ['pointer', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x10, ['pointer', ['void']]], + 'SecurityDescriptor' : [ 0x14, ['pointer', ['void']]], + 'Body' : [ 0x18, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x10, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0xc, ['pointer', ['void']]], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x8, { + 'ExclusiveProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x8, { + 'HandleCountDataBase' : [ 0x0, ['pointer', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x10, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x4, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0xc, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x10, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x8, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x8, { + 'SecurityDescriptor' : [ 0x0, ['pointer', ['void']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_HEADER_HANDLE_REVOCATION_INFO' : [ 0x10, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'RevocationBlock' : [ 0x8, ['pointer', ['_OB_HANDLE_REVOCATION_BLOCK']]], + 'Padding1' : [ 0xc, ['array', 4, ['unsigned char']]], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x18, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'EntryLink' : [ 0x8, ['pointer', ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0xc, ['unsigned long']], + 'HashIndex' : [ 0x10, ['unsigned short']], + 'DirectoryLocked' : [ 0x12, ['unsigned char']], + 'LockedExclusive' : [ 0x13, ['unsigned char']], + 'LockStateSignature' : [ 0x14, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0xac, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x94, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x98, ['pointer', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x9c, ['pointer', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0xa0, ['unsigned long']], + 'NamespaceEntry' : [ 0xa4, ['pointer', ['void']]], + 'Flags' : [ 0xa8, ['unsigned long']], +} ], + '_OBP_SILODRIVERSTATE' : [ 0x1a4, { + 'SystemDeviceMap' : [ 0x0, ['pointer', ['_DEVICE_MAP']]], + 'SystemDosDeviceState' : [ 0x4, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], + 'DeviceMapLock' : [ 0x70, ['_EX_PUSH_LOCK']], + 'PrivateNamespaceLookupTable' : [ 0x74, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], +} ], + '_DEVICE_MAP' : [ 0x34, { + 'DosDevicesDirectory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x4, ['pointer', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x8, ['pointer', ['void']]], + 'ReferenceCount' : [ 0xc, ['long']], + 'DriveMap' : [ 0x10, ['unsigned long']], + 'DriveType' : [ 0x14, ['array', 32, ['unsigned char']]], +} ], + '_WHEAP_INFO_BLOCK' : [ 0xc, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x4, ['pointer', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x8, ['pointer', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x418, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x8, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0xc, ['unsigned long']], + 'ErrorCount' : [ 0x10, ['long']], + 'RecordCount' : [ 0x14, ['unsigned long']], + 'RecordLength' : [ 0x18, ['unsigned long']], + 'PoolTag' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x24, ['pointer', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x28, ['pointer', ['void']]], + 'SectionCount' : [ 0x2c, ['unsigned long']], + 'SectionLength' : [ 0x30, ['unsigned long']], + 'TickCountAtLastError' : [ 0x38, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x40, ['unsigned long']], + 'TotalErrors' : [ 0x44, ['unsigned long']], + 'Deferred' : [ 0x48, ['unsigned char']], + 'Descriptor' : [ 0x49, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xe4, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x8, ['unsigned long']], + 'ProcessorNumber' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x14, ['long']], + 'ErrorSource' : [ 0x18, ['pointer', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x1c, ['_WHEA_ERROR_RECORD']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x1c, { + 'SpinLock' : [ 0x0, ['unsigned long']], + 'ConnectLock' : [ 0x4, ['_KEVENT']], + 'LineMasked' : [ 0x14, ['unsigned char']], + 'InterruptList' : [ 0x18, ['pointer', ['_KINTERRUPT']]], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { + 'ImpersonationData' : [ 0x0, ['unsigned long']], + 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { + 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], +} ], + '_POP_FX_PLUGIN' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned long long']], + 'WorkQueue' : [ 0x18, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x40, ['pointer', ['void']]], + 'AcceptProcessorNotification' : [ 0x44, ['pointer', ['void']]], + 'AcceptAcpiNotification' : [ 0x48, ['pointer', ['void']]], + 'WorkOrderCount' : [ 0x4c, ['unsigned long']], + 'WorkOrders' : [ 0x50, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x30, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x4, ['unsigned long']], + 'SenderPort' : [ 0x8, ['pointer', ['void']]], + 'RepliedToThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'PortContext' : [ 0x10, ['pointer', ['void']]], + 'Request' : [ 0x18, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x2c, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long']], + 'MemoryBandwidth' : [ 0x14, ['unsigned long']], + 'MaxPoolUsage' : [ 0x18, ['unsigned long']], + 'MaxSectionSize' : [ 0x1c, ['unsigned long']], + 'MaxViewSize' : [ 0x20, ['unsigned long']], + 'MaxTotalSectionSize' : [ 0x24, ['unsigned long']], + 'DupObjectTypes' : [ 0x28, ['unsigned long']], +} ], + '_MI_PARTITION_SEGMENTS' : [ 0x100, { + 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], + 'UnusedSegmentCleanup' : [ 0x10, ['_KEVENT']], + 'SubsectionDeletePtes' : [ 0x20, ['unsigned long']], + 'DereferenceSegmentHeader' : [ 0x24, ['_MMDEREFERENCE_SEGMENT_HEADER']], + 'DeleteOnCloseList' : [ 0x40, ['_LIST_ENTRY']], + 'DeleteOnCloseTimer' : [ 0x48, ['_KTIMER']], + 'DeleteOnCloseTimerActive' : [ 0x70, ['unsigned char']], + 'DeleteOnCloseCount' : [ 0x74, ['unsigned long']], + 'UnusedSegmentList' : [ 0x78, ['_LIST_ENTRY']], + 'UnusedSubsectionList' : [ 0x80, ['_LIST_ENTRY']], + 'DeleteSubsectionList' : [ 0x88, ['_LIST_ENTRY']], + 'ControlAreaDeleteEvent' : [ 0x90, ['_KEVENT']], + 'ControlAreaDeleteList' : [ 0xa0, ['_SINGLE_LIST_ENTRY']], + 'SegmentListLock' : [ 0xc0, ['long']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { + 'Version' : [ 0x0, ['unsigned char']], + 'DataCount' : [ 0x1, ['unsigned char']], + 'SemanticType' : [ 0x2, ['unsigned char']], + 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], + 'AttributeType' : [ 0x0, ['unsigned long']], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x128, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x104, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x124, ['unsigned long']], +} ], + '_HEAP_UNPACKED_ENTRY' : [ 0x8, { + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_RESOURCE' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], + 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], + 'ResourceSourceName' : [ 0xc, ['pointer', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x10, ['pointer', ['unsigned char']]], + 'VendorDataLength' : [ 0x14, ['unsigned short']], +} ], + '_DISPATCHER_HEADER' : [ 0x10, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Instrumented' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_ETW_GUID_ENTRY' : [ 0x168, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x8, ['long']], + 'Guid' : [ 0xc, ['_GUID']], + 'RegListHead' : [ 0x1c, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x24, ['pointer', ['void']]], + 'LastEnable' : [ 0x28, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x28, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x38, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x58, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x158, ['pointer', ['_ETW_FILTER_HEADER']]], + 'HostSilo' : [ 0x15c, ['unsigned char']], + 'Lock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'LockOwner' : [ 0x164, ['pointer', ['_ETHREAD']]], +} ], + '_VI_POOL_ENTRY' : [ 0x10, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x4, ['unsigned long']], + 'WaitResponse' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0xc, ['_KGATE']], +} ], + '_HEAP_COUNTERS' : [ 0x5c, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long']], + 'TotalMemoryCommitted' : [ 0x4, ['unsigned long']], + 'TotalMemoryLargeUCR' : [ 0x8, ['unsigned long']], + 'TotalSizeInVirtualBlocks' : [ 0xc, ['unsigned long']], + 'TotalSegments' : [ 0x10, ['unsigned long']], + 'TotalUCRs' : [ 0x14, ['unsigned long']], + 'CommittOps' : [ 0x18, ['unsigned long']], + 'DeCommitOps' : [ 0x1c, ['unsigned long']], + 'LockAcquires' : [ 0x20, ['unsigned long']], + 'LockCollisions' : [ 0x24, ['unsigned long']], + 'CommitRate' : [ 0x28, ['unsigned long']], + 'DecommittRate' : [ 0x2c, ['unsigned long']], + 'CommitFailures' : [ 0x30, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x34, ['unsigned long']], + 'PollIntervalCounter' : [ 0x38, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x3c, ['unsigned long']], + 'HeapPollInterval' : [ 0x40, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x44, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x48, ['unsigned long']], + 'InBlockDeccommits' : [ 0x4c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x50, ['unsigned long']], + 'HighWatermarkSize' : [ 0x54, ['unsigned long']], + 'LastPolledSize' : [ 0x58, ['unsigned long']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_MI_VISIBLE_PARTITION' : [ 0xb80, { + 'LowestPhysicalPage' : [ 0x0, ['unsigned long']], + 'HighestPhysicalPage' : [ 0x4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x8, ['unsigned long']], + 'NumberOfPagingFiles' : [ 0xc, ['unsigned long']], + 'PagingFile' : [ 0x10, ['array', 16, ['pointer', ['_MMPAGING_FILE']]]], + 'AvailablePages' : [ 0x80, ['unsigned long']], + 'ResidentAvailablePages' : [ 0xc0, ['unsigned long']], + 'TotalCommittedPages' : [ 0xc4, ['unsigned long']], + 'ModifiedPageListHead' : [ 0x100, ['_MMPFNLIST']], + 'ModifiedNoWritePageListHead' : [ 0x140, ['_MMPFNLIST']], + 'TotalCommitLimit' : [ 0x154, ['unsigned long']], + 'TotalPagesForPagingFile' : [ 0x158, ['unsigned long']], + 'VadPhysicalPages' : [ 0x15c, ['unsigned long']], + 'ProcessLockedFilePages' : [ 0x160, ['unsigned long']], + 'ChargeCommitmentFailures' : [ 0x164, ['array', 4, ['unsigned long']]], + 'PageFileTraceIndex' : [ 0x174, ['long']], + 'PageFileTraces' : [ 0x178, ['array', 32, ['_MI_PAGEFILE_TRACES']]], +} ], + '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x10, { + 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'Rundown' : [ 0xc, ['_EX_RUNDOWN_REF']], +} ], + '_SYSPTES_HEADER' : [ 0x8c, { + 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], + 'Count' : [ 0x80, ['unsigned long']], + 'NumberOfEntries' : [ 0x84, ['unsigned long']], + 'NumberOfEntriesPeak' : [ 0x88, ['unsigned long']], +} ], + '_EXCEPTION_RECORD' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0xc, ['pointer', ['void']]], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x44, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x18, ['pointer', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x1c, ['pointer', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x20, ['pointer', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'Lock' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x2c, ['unsigned long']], + 'ProfileChangingEject' : [ 0x30, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x31, ['unsigned char']], + 'LightestSleepState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x38, ['pointer', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x3c, ['unsigned char']], + 'DeleteType' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_PPM_PLATFORM_STATE' : [ 0xc0, { + 'Latency' : [ 0x0, ['unsigned long']], + 'BreakEvenDuration' : [ 0x4, ['unsigned long']], + 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], + 'TransitionDebugger' : [ 0x20, ['unsigned char']], + 'Platform' : [ 0x21, ['unsigned char']], + 'DependencyListCount' : [ 0x24, ['unsigned long']], + 'Processors' : [ 0x28, ['_KAFFINITY_EX']], + 'Name' : [ 0x34, ['_UNICODE_STRING']], + 'DependencyLists' : [ 0x3c, ['pointer', ['_PPM_SELECTION_DEPENDENCY']]], + 'Synchronization' : [ 0x40, ['_PPM_COORDINATED_SYNCHRONIZATION']], + 'EnterTime' : [ 0x48, ['unsigned long long']], + 'RefCount' : [ 0x80, ['long']], + 'CacheAlign0' : [ 0x80, ['array', 64, ['unsigned char']]], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x30, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x38, { + 'SidHash' : [ 0x0, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x8, ['pointer', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0xc, ['_LUID']], + 'TokenType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x1c, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x20, ['unsigned long']], + 'AppContainerNumber' : [ 0x24, ['unsigned long']], + 'PackageSid' : [ 0x28, ['pointer', ['void']]], + 'CapabilitiesHash' : [ 0x2c, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x30, ['pointer', ['void']]], + 'SecurityAttributes' : [ 0x34, ['pointer', ['void']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x8, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x4, ['unsigned long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x8, { + 'Key' : [ 0x0, ['pointer', ['void']]], + 'Index' : [ 0x4, ['unsigned long']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x1c, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x10, ['long']], + 'Context' : [ 0x14, ['pointer', ['void']]], + 'WatchdogTimerInfo' : [ 0x18, ['pointer', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'FloppyMedia' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { + 'Va' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x4, ['unsigned long']], + 'Pattern' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolType' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], + 'SlushSize' : [ 0x8, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'NumberOfBytes' : [ 0xc, ['unsigned long']], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ulTargetPlatform' : [ 0x8, ['unsigned long']], + 'ullContextMinimum' : [ 0x10, ['unsigned long long']], + 'guPlatform' : [ 0x18, ['_GUID']], + 'guMinPlatform' : [ 0x28, ['_GUID']], + 'ulContextSource' : [ 0x38, ['unsigned long']], + 'ulElementCount' : [ 0x3c, ['unsigned long']], + 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x10, ['_KEVENT']], +} ], + '_ETW_HASH_BUCKET' : [ 0x1c, { + 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], + 'BucketLock' : [ 0x18, ['_EX_PUSH_LOCK']], +} ], + '_TEB_ACTIVE_FRAME' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x4, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x8, ['pointer', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x8, ['pointer', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0xc, ['pointer', ['void']]], + 'KeyBodyList' : [ 0x10, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x1c, ['pointer', ['void']]], + 'KtmUow' : [ 0x20, ['pointer', ['_GUID']]], + 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x18, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x8, ['unsigned char']], + 'BlockState' : [ 0x9, ['unsigned char']], + 'WaitKey' : [ 0xa, ['unsigned short']], + 'Thread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'NotificationQueue' : [ 0xc, ['pointer', ['_KQUEUE']]], + 'Object' : [ 0x10, ['pointer', ['void']]], + 'SparePtr' : [ 0x14, ['pointer', ['void']]], +} ], + '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { + 'Continue' : [ 0x0, ['unsigned long']], + 'TraceFlag' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], + 'MinimumThrottle' : [ 0x50, ['unsigned long']], + 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1ea3' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1ea5' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1ea3']], + 'Private' : [ 0x0, ['__unnamed_1ea5']], +} ], + '_KTIMER2' : [ 0x58, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'RbNodes' : [ 0x10, ['array', 2, ['_RTL_BALANCED_NODE']]], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'DueTime' : [ 0x28, ['array', 2, ['unsigned long long']]], + 'Period' : [ 0x38, ['long long']], + 'Callback' : [ 0x40, ['pointer', ['void']]], + 'CallbackContext' : [ 0x44, ['pointer', ['void']]], + 'DisableCallback' : [ 0x48, ['pointer', ['void']]], + 'DisableContext' : [ 0x4c, ['pointer', ['void']]], + 'AbsoluteSystemTime' : [ 0x50, ['unsigned char']], + 'TypeFlags' : [ 0x51, ['unsigned char']], + 'Unused' : [ 0x51, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IdleResilient' : [ 0x51, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HighResolution' : [ 0x51, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'NoWake' : [ 0x51, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Unused1' : [ 0x51, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CollectionIndex' : [ 0x52, ['array', 2, ['unsigned char']]], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x10, { + 'IssueType' : [ 0x0, ['unsigned long']], + 'Address' : [ 0x4, ['pointer', ['void']]], + 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x8, { + 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x4, ['pointer', ['_CONTEXT']]], +} ], + '_KMUTANT' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x18, ['pointer', ['_KTHREAD']]], + 'Abandoned' : [ 0x1c, ['unsigned char']], + 'ApcDisable' : [ 0x1d, ['unsigned char']], +} ], + '_OBJECT_REF_INFO' : [ 0x1c, { + 'ObjectHeader' : [ 0x0, ['pointer', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x4, ['pointer', ['void']]], + 'ImageFileName' : [ 0x8, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x18, ['unsigned short']], + 'MaxStacks' : [ 0x1a, ['unsigned short']], + 'StackInfo' : [ 0x1c, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0xc, { + 'DynamicRelocations' : [ 0x0, ['pointer', ['void']]], + 'SecurityContext' : [ 0x4, ['_IMAGE_SECURITY_CONTEXT']], + 'StrongImageReference' : [ 0x8, ['unsigned long']], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x130, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x8, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0xc, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x10, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x98, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x120, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x124, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x128, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x12c, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x40, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'TagIndex' : [ 0xc, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0xe, ['unsigned short']], + 'TagName' : [ 0x10, ['array', 24, ['wchar']]], +} ], + '_MMPTE_HIGHLOW' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x4, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_NT_TIB' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x4, ['pointer', ['void']]], + 'StackLimit' : [ 0x8, ['pointer', ['void']]], + 'SubSystemTib' : [ 0xc, ['pointer', ['void']]], + 'FiberData' : [ 0x10, ['pointer', ['void']]], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['pointer', ['void']]], + 'Self' : [ 0x18, ['pointer', ['_NT_TIB']]], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PPM_IDLE_STATES' : [ 0x140, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'UnaccountedTransition' : [ 0x5, ['unsigned char']], + 'IdleDurationLimited' : [ 0x6, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0x44, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x50, ['pointer', ['void']]], + 'IdlePreExecute' : [ 0x54, ['pointer', ['void']]], + 'IdleExecute' : [ 0x58, ['pointer', ['void']]], + 'IdlePreselect' : [ 0x5c, ['pointer', ['void']]], + 'IdleTest' : [ 0x60, ['pointer', ['void']]], + 'IdleAvailabilityCheck' : [ 0x64, ['pointer', ['void']]], + 'IdleComplete' : [ 0x68, ['pointer', ['void']]], + 'IdleCancel' : [ 0x6c, ['pointer', ['void']]], + 'IdleIsHalted' : [ 0x70, ['pointer', ['void']]], + 'IdleInitiateWake' : [ 0x74, ['pointer', ['void']]], + 'PrepareInfo' : [ 0x78, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'DeepIdleSnapshot' : [ 0xc8, ['_KAFFINITY_EX']], + 'Tracing' : [ 0xd4, ['pointer', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'CoordinatedTracing' : [ 0xd8, ['pointer', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'ProcessorMenu' : [ 0xdc, ['_PPM_SELECTION_MENU']], + 'CoordinatedMenu' : [ 0xe4, ['_PPM_SELECTION_MENU']], + 'CoordinatedSelection' : [ 0xec, ['_PPM_COORDINATED_SELECTION']], + 'State' : [ 0xfc, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x18, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x4, ['_LIST_ENTRY']], + 'CsAccountingBlocks' : [ 0xc, ['unsigned char']], + 'BlocksDrips' : [ 0xd, ['unsigned char']], + 'PreallocatedVetoCount' : [ 0x10, ['unsigned long']], + 'PreallocatedVetoList' : [ 0x14, ['pointer', ['_PPM_VETO_ENTRY']]], +} ], + '_PEB' : [ 0x460, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['pointer', ['void']]], + 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], + 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x10, ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x14, ['pointer', ['void']]], + 'ProcessHeap' : [ 0x18, ['pointer', ['void']]], + 'FastPebLock' : [ 0x1c, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], + 'IFEOKey' : [ 0x24, ['pointer', ['void']]], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], + 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['pointer', ['void']]], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['pointer', ['void']]], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['pointer', ['void']]], + 'SparePvoid0' : [ 0x50, ['pointer', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x54, ['pointer', ['pointer', ['void']]]], + 'AnsiCodePageData' : [ 0x58, ['pointer', ['void']]], + 'OemCodePageData' : [ 0x5c, ['pointer', ['void']]], + 'UnicodeCaseTableData' : [ 0x60, ['pointer', ['void']]], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['pointer', ['pointer', ['void']]]], + 'GdiSharedHandleTable' : [ 0x94, ['pointer', ['void']]], + 'ProcessStarterHelper' : [ 0x98, ['pointer', ['void']]], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['pointer', ['void']]], + 'TlsExpansionBitmap' : [ 0x150, ['pointer', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['pointer', ['void']]], + 'AppCompatInfo' : [ 0x1ec, ['pointer', ['void']]], + 'CSDVersion' : [ 0x1f0, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x1f8, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x200, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x204, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['pointer', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x210, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x218, ['pointer', ['void']]], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['pointer', ['void']]], + 'WerShipAssertPtr' : [ 0x234, ['pointer', ['void']]], + 'pUnused' : [ 0x238, ['pointer', ['void']]], + 'pImageHeaderHash' : [ 0x23c, ['pointer', ['void']]], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], + 'TppWorkerpList' : [ 0x254, ['_LIST_ENTRY']], + 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['pointer', ['void']]]], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x8, ['_LIST_ENTRY']], + 'Address' : [ 0x10, ['pointer', ['void']]], + 'Size' : [ 0x14, ['unsigned long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x54, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x8, ['pointer', ['void']]], + 'ProcessObject' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x10, ['pointer', ['void']]], + 'RealtimeConnectContext' : [ 0x14, ['pointer', ['void']]], + 'DisconnectEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x1c, ['pointer', ['_KEVENT']]], + 'UserBufferCount' : [ 0x20, ['pointer', ['unsigned long']]], + 'UserBufferListHead' : [ 0x24, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x28, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x2c, ['unsigned long']], + 'LoggerId' : [ 0x30, ['unsigned short']], + 'Flags' : [ 0x32, ['unsigned char']], + 'ShutDownRequested' : [ 0x32, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x32, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x32, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x32, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x34, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x3c, ['pointer', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x40, ['unsigned long']], + 'UserPagesAllocated' : [ 0x44, ['unsigned long']], + 'UserPagesReused' : [ 0x48, ['unsigned long']], + 'EventsLostCount' : [ 0x4c, ['pointer', ['unsigned long']]], + 'BuffersLostCount' : [ 0x50, ['pointer', ['unsigned long']]], +} ], + '__unnamed_1f0b' : [ 0x4, { + 'BaseMid' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHi' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_1f10' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1f12' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_1f0b']], + 'Bits' : [ 0x0, ['__unnamed_1f10']], +} ], + '_KGDTENTRY' : [ 0x8, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'HighWord' : [ 0x4, ['__unnamed_1f12']], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x4, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x4, ['unsigned long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'PendingFreeDepth' : [ 0x104, ['long']], + 'ListHeads' : [ 0x140, ['array', 512, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_KGATE' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x4, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0xc, ['unsigned long']], +} ], + '_DRIVER_EXTENSION' : [ 0x28, { + 'DriverObject' : [ 0x0, ['pointer', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x4, ['pointer', ['void']]], + 'Count' : [ 0x8, ['unsigned long']], + 'ServiceKeyName' : [ 0xc, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x14, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x1c, ['pointer', ['void']]], + 'DvCallbacks' : [ 0x20, ['pointer', ['void']]], + 'VerifierContext' : [ 0x24, ['pointer', ['void']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x44, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x8, ['unsigned long']], + 'ItemCount' : [ 0xc, ['long']], + 'Dpc' : [ 0x10, ['_KDPC']], + 'WorkItem' : [ 0x30, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x40, ['pointer', ['void']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x2c, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x8, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_KINTERRUPT' : [ 0xb0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0xc, ['pointer', ['void']]], + 'MessageServiceRoutine' : [ 0x10, ['pointer', ['void']]], + 'MessageIndex' : [ 0x14, ['unsigned long']], + 'ServiceContext' : [ 0x18, ['pointer', ['void']]], + 'SpinLock' : [ 0x1c, ['unsigned long']], + 'TickCount' : [ 0x20, ['unsigned long']], + 'ActualLock' : [ 0x24, ['pointer', ['unsigned long']]], + 'DispatchAddress' : [ 0x28, ['pointer', ['void']]], + 'Vector' : [ 0x2c, ['unsigned long']], + 'Irql' : [ 0x30, ['unsigned char']], + 'SynchronizeIrql' : [ 0x31, ['unsigned char']], + 'FloatingSave' : [ 0x32, ['unsigned char']], + 'Connected' : [ 0x33, ['unsigned char']], + 'Number' : [ 0x34, ['unsigned long']], + 'ShareVector' : [ 0x38, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x39, ['unsigned char']], + 'ActiveCount' : [ 0x3a, ['unsigned short']], + 'InternalState' : [ 0x3c, ['long']], + 'Mode' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x48, ['unsigned long']], + 'DispatchCount' : [ 0x4c, ['unsigned long']], + 'PassiveEvent' : [ 0x50, ['pointer', ['_KEVENT']]], + 'DisconnectData' : [ 0x54, ['pointer', ['void']]], + 'ServiceThread' : [ 0x58, ['pointer', ['_KTHREAD']]], + 'ConnectionData' : [ 0x5c, ['pointer', ['_INTERRUPT_CONNECTION_DATA']]], + 'IntTrackEntry' : [ 0x60, ['pointer', ['void']]], + 'IsrDpcStats' : [ 0x68, ['_ISRDPCSTATS']], + 'RedirectObject' : [ 0xa8, ['pointer', ['void']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x18, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x4, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0xc, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x60, { + 'FileName' : [ 0x0, ['pointer', ['unsigned short']]], + 'BaseName' : [ 0x4, ['pointer', ['unsigned short']]], + 'RegRootName' : [ 0x8, ['pointer', ['unsigned short']]], + 'CmHive' : [ 0xc, ['pointer', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x10, ['unsigned long']], + 'CmHiveFlags' : [ 0x14, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x18, ['unsigned long']], + 'CmHive2' : [ 0x1c, ['pointer', ['_CMHIVE']]], + 'HiveMounted' : [ 0x20, ['unsigned char']], + 'ThreadFinished' : [ 0x21, ['unsigned char']], + 'ThreadStarted' : [ 0x22, ['unsigned char']], + 'Allocate' : [ 0x23, ['unsigned char']], + 'WinPERequired' : [ 0x24, ['unsigned char']], + 'StartEvent' : [ 0x28, ['_KEVENT']], + 'FinishedEvent' : [ 0x38, ['_KEVENT']], + 'MountLock' : [ 0x48, ['_KEVENT']], + 'FilePath' : [ 0x58, ['_UNICODE_STRING']], +} ], + '_HMAP_DIRECTORY' : [ 0x1000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer', ['_HMAP_TABLE']]]], +} ], + '_CONTEXT' : [ 0x2cc, { + 'ContextFlags' : [ 0x0, ['unsigned long']], + 'Dr0' : [ 0x4, ['unsigned long']], + 'Dr1' : [ 0x8, ['unsigned long']], + 'Dr2' : [ 0xc, ['unsigned long']], + 'Dr3' : [ 0x10, ['unsigned long']], + 'Dr6' : [ 0x14, ['unsigned long']], + 'Dr7' : [ 0x18, ['unsigned long']], + 'FloatSave' : [ 0x1c, ['_FLOATING_SAVE_AREA']], + 'SegGs' : [ 0x8c, ['unsigned long']], + 'SegFs' : [ 0x90, ['unsigned long']], + 'SegEs' : [ 0x94, ['unsigned long']], + 'SegDs' : [ 0x98, ['unsigned long']], + 'Edi' : [ 0x9c, ['unsigned long']], + 'Esi' : [ 0xa0, ['unsigned long']], + 'Ebx' : [ 0xa4, ['unsigned long']], + 'Edx' : [ 0xa8, ['unsigned long']], + 'Ecx' : [ 0xac, ['unsigned long']], + 'Eax' : [ 0xb0, ['unsigned long']], + 'Ebp' : [ 0xb4, ['unsigned long']], + 'Eip' : [ 0xb8, ['unsigned long']], + 'SegCs' : [ 0xbc, ['unsigned long']], + 'EFlags' : [ 0xc0, ['unsigned long']], + 'Esp' : [ 0xc4, ['unsigned long']], + 'SegSs' : [ 0xc8, ['unsigned long']], + 'ExtendedRegisters' : [ 0xcc, ['array', 512, ['unsigned char']]], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x10, { + 'Handles' : [ 0x0, ['pointer', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1f74' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1f74']], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x8, { + 'Port' : [ 0x0, ['pointer', ['void']]], + 'Key' : [ 0x4, ['pointer', ['void']]], +} ], + '_EX_WORK_QUEUE' : [ 0x1b8, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x19c, ['pointer', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x1a0, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x1a4, ['unsigned long']], + 'ThreadCount' : [ 0x1a8, ['long']], + 'MinThreads' : [ 0x1ac, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x1ac, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x1b0, ['long']], + 'QueueIndex' : [ 0x1b4, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x100, { + 'Irp' : [ 0x0, ['pointer', ['_IRP']]], + 'Thread' : [ 0x4, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 62, ['pointer', ['void']]]], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x10, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'CallingAddress' : [ 0x4, ['pointer', ['void']]], + 'NumberOfBytes' : [ 0x8, ['unsigned long']], + 'Tag' : [ 0xc, ['unsigned long']], +} ], + '_INTERFACE' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_PS_PROPERTY_SET' : [ 0xc, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x8, ['unsigned long']], +} ], + '_LAZY_WRITER' : [ 0x50, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x20, ['_KTIMER']], + 'ScanActive' : [ 0x48, ['unsigned char']], + 'OtherWork' : [ 0x49, ['unsigned char']], + 'PendingTeardownScan' : [ 0x4a, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x4b, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x4c, ['unsigned char']], + 'PendingPowerScan' : [ 0x4d, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x4e, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x44, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer', ['unsigned char']]], + 'DataPortMapped' : [ 0xc, ['unsigned char']], + 'AddressPort' : [ 0x10, ['pointer', ['unsigned char']]], + 'AddrPortMapped' : [ 0x14, ['unsigned char']], + 'CommandPort' : [ 0x18, ['pointer', ['unsigned char']]], + 'CmdPortMapped' : [ 0x1c, ['unsigned char']], + 'NextSlotNumber' : [ 0x20, ['unsigned long']], + 'DeviceList' : [ 0x24, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x28, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x2c, ['pointer', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x30, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x34, ['pointer', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x38, ['unsigned long']], + 'SystemPowerState' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { + 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'AccessRights' : [ 0x0, ['unsigned char']], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x8, { + 'Sid' : [ 0x0, ['pointer', ['void']]], + 'Attributes' : [ 0x4, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_IO_WORKITEM' : [ 0x34, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x10, ['pointer', ['void']]], + 'IoObject' : [ 0x14, ['pointer', ['void']]], + 'Context' : [ 0x18, ['pointer', ['void']]], + 'WorkingOnBehalfClient' : [ 0x1c, ['pointer', ['void']]], + 'Type' : [ 0x20, ['unsigned long']], + 'ActivityId' : [ 0x24, ['_GUID']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMWSLE_HASH' : [ 0x4, { + 'Index' : [ 0x0, ['unsigned long']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x50, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x28, ['_KDPC']], + 'WorkOrder' : [ 0x48, ['pointer', ['_POP_FX_WORK_ORDER']]], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x24, { + 'Next' : [ 0x0, ['pointer', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x4, ['unsigned long']], + 'Gate' : [ 0x8, ['_KGATE']], + 'SecureInfo' : [ 0x8, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x8, ['_RTL_BITMAP']], + 'InPageSupport' : [ 0x8, ['pointer', ['_MMINPAGE_SUPPORT']]], + 'LargePage' : [ 0x8, ['pointer', ['_MI_LARGEPAGE_MEMORY_INFO']]], + 'CreatingThread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'PebTeb' : [ 0x8, ['_MI_SUB64K_FREE_RANGES']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x18, { + 'AllocAddress' : [ 0x0, ['unsigned long']], + 'AllocTag' : [ 0x4, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x8, ['unsigned long']], + 'ReAllocTag' : [ 0xc, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x10, ['unsigned long']], + 'FreeTag' : [ 0x14, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0xc, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x8, ['pointer', ['void']]], + 'CallersCaller' : [ 0xc, ['pointer', ['void']]], + 'CallCount' : [ 0x10, ['unsigned long']], +} ], + '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'Luid' : [ 0x10, ['unsigned long long']], + 'IndexIntoGlobalSingletonTable' : [ 0x18, ['unsigned long long']], + 'MarkedForDeletion' : [ 0x20, ['unsigned char']], +} ], + '_KTIMER2_COLLECTION' : [ 0x10, { + 'Tree' : [ 0x0, ['_RTL_RB_TREE']], + 'NextDueTime' : [ 0x8, ['unsigned long long']], +} ], + '_MIPFNBLINK' : [ 0x4, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'EntireField' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x0, ['long']], + 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_VF_TRACKER_STAMP' : [ 0x8, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'OldIrql' : [ 0x4, ['unsigned char']], + 'NewIrql' : [ 0x5, ['unsigned char']], + 'Processor' : [ 0x6, ['unsigned short']], + 'TickCount' : [ 0x8, ['unsigned long']], + 'StackTrace' : [ 0xc, ['array', 5, ['pointer', ['void']]]], +} ], + '_MMCLONE_HEADER' : [ 0xc, { + 'NumberOfPtes' : [ 0x0, ['unsigned long']], + 'NumberOfProcessReferences' : [ 0x4, ['unsigned long']], + 'ClonePtes' : [ 0x8, ['pointer', ['_MMCLONE_BLOCK']]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'LowboxMap' : [ 0xc, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_PEB_LDR_DATA' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer', ['void']]], + 'InLoadOrderModuleList' : [ 0xc, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x14, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x1c, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x24, ['pointer', ['void']]], + 'ShutdownInProgress' : [ 0x28, ['unsigned char']], + 'ShutdownThreadId' : [ 0x2c, ['pointer', ['void']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0x88, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x8, ['unsigned long']], + 'ArgumentStatus' : [ 0xc, ['long']], + 'CallerEvent' : [ 0x10, ['pointer', ['_KEVENT']]], + 'Callback' : [ 0x14, ['pointer', ['void']]], + 'Context' : [ 0x18, ['pointer', ['void']]], + 'VetoType' : [ 0x1c, ['pointer', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x20, ['pointer', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x24, ['unsigned long']], + 'Lock' : [ 0x28, ['unsigned long']], + 'Cancel' : [ 0x2c, ['unsigned char']], + 'Parent' : [ 0x30, ['pointer', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'ActivityId' : [ 0x34, ['_GUID']], + 'Data' : [ 0x44, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_RH_OP_CONTEXT' : [ 0x24, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x8, ['pointer', ['_IRP']]], + 'OplockRequestFileObject' : [ 0xc, ['pointer', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x14, ['pointer', ['_ETHREAD']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'AtomicLinks' : [ 0x1c, ['_LIST_ENTRY']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x8, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_KWAIT_CHAIN' : [ 0x4, { + 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_MI_PARTITION_PAGE_LISTS' : [ 0x780, { + 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer', ['_MMPFNLIST']]]], + 'FreePageSlist' : [ 0x8, ['array', 2, ['pointer', ['_SLIST_HEADER']]]], + 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], + 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], + 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], + 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], + 'ModifiedPageListNoReservation' : [ 0x1c0, ['_MMPFNLIST']], + 'ModifiedPageListByReservation' : [ 0x200, ['array', 16, ['_MMPFNLIST']]], + 'MappedPageListHead' : [ 0x340, ['array', 16, ['_MMPFNLIST']]], + 'BadPageListHead' : [ 0x480, ['_MMPFNLIST']], + 'EnclavePageListHead' : [ 0x4c0, ['_MMPFNLIST']], + 'PageLocationList' : [ 0x4d4, ['array', 8, ['pointer', ['_MMPFNLIST']]]], + 'StandbyRepurposedByPriority' : [ 0x4f4, ['array', 8, ['unsigned long']]], + 'MappedPageListHeadEvent' : [ 0x514, ['array', 16, ['_KEVENT']]], + 'DecayClusterTimerHeads' : [ 0x614, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], + 'DecayHand' : [ 0x624, ['unsigned long']], + 'LastDecayHandUpdateTime' : [ 0x628, ['unsigned long long']], + 'LastChanceLdwContext' : [ 0x630, ['_MI_LDW_WORK_CONTEXT']], + 'AvailableEventsLock' : [ 0x680, ['unsigned long']], + 'AvailablePageWaitStates' : [ 0x684, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], + 'LowMemoryThreshold' : [ 0x6c0, ['unsigned long']], + 'HighMemoryThreshold' : [ 0x6c4, ['unsigned long']], + 'TransitionPrivatePages' : [ 0x700, ['unsigned long']], + 'StandbyListDiscard' : [ 0x704, ['unsigned long']], + 'FreeListDiscard' : [ 0x708, ['unsigned char']], + 'RebuildLargePagesInitialized' : [ 0x709, ['unsigned char']], + 'RebuildLargePagesItem' : [ 0x70c, ['_MI_REBUILD_LARGE_PAGES']], + 'AddMemoryNotifyList' : [ 0x740, ['_LIST_ENTRY']], + 'MirrorListLocks' : [ 0x748, ['pointer', ['void']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x330, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], + 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], + 'AlignedFeatures' : [ 0x220, ['unsigned long long']], + 'AllFeatureSize' : [ 0x228, ['unsigned long']], + 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0xa0, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0xc, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0xc, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x14, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], + 'KcbPushlock' : [ 0x1c, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x20, ['pointer', ['_KTHREAD']]], + 'SharedCount' : [ 0x20, ['long']], + 'SlotHint' : [ 0x24, ['unsigned long']], + 'ParentKcb' : [ 0x28, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x2c, ['pointer', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x30, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x34, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x3c, ['pointer', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x3c, ['unsigned long']], + 'SubKeyCount' : [ 0x3c, ['unsigned long']], + 'KeyBodyListHead' : [ 0x40, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x48, ['array', 4, ['pointer', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0x58, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0x60, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0x62, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0x64, ['unsigned long']], + 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KCBUoWListHead' : [ 0x6c, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0x74, ['_LIST_ENTRY']], + 'Stolen' : [ 0x74, ['pointer', ['unsigned char']]], + 'TransKCBOwner' : [ 0x7c, ['pointer', ['_CM_TRANS']]], + 'KCBLock' : [ 0x80, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x88, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x90, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x98, ['pointer', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x9c, ['pointer', ['_UNICODE_STRING']]], +} ], + '_KLOCK_ENTRY' : [ 0x30, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'EntryFlags' : [ 0xc, ['unsigned long']], + 'EntryOffset' : [ 0xc, ['unsigned char']], + 'ThreadLocalFlags' : [ 0xd, ['unsigned char']], + 'WaitingBit' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare0' : [ 0xd, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'AcquiredByte' : [ 0xe, ['unsigned char']], + 'AcquiredBit' : [ 0xe, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadFlags' : [ 0xf, ['unsigned char']], + 'HeadNodeBit' : [ 0xf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IoPriorityBit' : [ 0xf, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare1' : [ 0xf, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'StaticState' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'AllFlags' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'LockState' : [ 0x10, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x10, ['pointer', ['void']]], + 'CrossThreadReleasableAndBusyByte' : [ 0x10, ['unsigned char']], + 'Reserved' : [ 0x11, ['array', 2, ['unsigned char']]], + 'InTreeByte' : [ 0x13, ['unsigned char']], + 'SessionState' : [ 0x14, ['pointer', ['void']]], + 'SessionId' : [ 0x14, ['unsigned long']], + 'OwnerTree' : [ 0x18, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x20, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x18, ['unsigned char']], + 'EntryLock' : [ 0x28, ['unsigned long']], + 'AllBoosts' : [ 0x2c, ['unsigned short']], + 'IoBoost' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'CpuBoostsBitmap' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x2e, ['unsigned short']], +} ], + '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { + 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], + 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2041' : [ 0x8, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0xa0, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x8, ['__unnamed_2041']], + 'Irp' : [ 0x10, ['pointer', ['_IRP']]], + 'u1' : [ 0x14, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x18, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x1c, ['_KAPC']], + 'ByteCount' : [ 0x4c, ['unsigned long']], + 'ChargedPages' : [ 0x50, ['unsigned long']], + 'PagingFile' : [ 0x54, ['pointer', ['_MMPAGING_FILE']]], + 'File' : [ 0x58, ['pointer', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x5c, ['pointer', ['_CONTROL_AREA']]], + 'FileResource' : [ 0x60, ['pointer', ['_ERESOURCE']]], + 'WriteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0x70, ['_LARGE_INTEGER']], + 'Partition' : [ 0x78, ['pointer', ['_MI_PARTITION']]], + 'PointerMdl' : [ 0x7c, ['pointer', ['_MDL']]], + 'Mdl' : [ 0x80, ['_MDL']], + 'Page' : [ 0x9c, ['array', 1, ['unsigned long']]], +} ], + '_MI_PARTITION_COMMIT' : [ 0x80, { + 'PeakCommitment' : [ 0x0, ['unsigned long']], + 'TotalCommitLimitMaximum' : [ 0x4, ['unsigned long']], + 'Popups' : [ 0x8, ['array', 2, ['long']]], + 'LowCommitThreshold' : [ 0x10, ['unsigned long']], + 'HighCommitThreshold' : [ 0x14, ['unsigned long']], + 'EventLock' : [ 0x18, ['unsigned long']], + 'SystemCommitReserve' : [ 0x1c, ['unsigned long']], + 'OverCommit' : [ 0x40, ['unsigned long']], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_CM_RESOURCE_LIST' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x1c, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0xc, ['unsigned long']], + 'PagedAllocs' : [ 0x10, ['unsigned long']], + 'PagedFrees' : [ 0x14, ['unsigned long']], + 'PagedBytes' : [ 0x18, ['unsigned long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer', ['void']]], + 'Pointer1' : [ 0x3c, ['pointer', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x50, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'CycleTime' : [ 0x10, ['unsigned long long']], + 'ContextSwitches' : [ 0x18, ['unsigned long long']], + 'ReadOperationCount' : [ 0x20, ['long long']], + 'WriteOperationCount' : [ 0x28, ['long long']], + 'OtherOperationCount' : [ 0x30, ['long long']], + 'ReadTransferCount' : [ 0x38, ['long long']], + 'WriteTransferCount' : [ 0x40, ['long long']], + 'OtherTransferCount' : [ 0x48, ['long long']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x180, { + 'IdleStates' : [ 0x0, ['pointer', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x4, ['pointer', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x8, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x10, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x18, ['unsigned long long']], + 'IdleTimeExpiration' : [ 0x20, ['unsigned long long']], + 'NonInterruptibleTransition' : [ 0x28, ['unsigned char']], + 'PepWokenTransition' : [ 0x29, ['unsigned char']], + 'Class' : [ 0x2a, ['unsigned char']], + 'TargetIdleState' : [ 0x2c, ['unsigned long']], + 'IdlePolicy' : [ 0x30, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x38, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x40, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xc8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], + 'LastSysTime' : [ 0xcc, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xd0, ['unsigned long']], + 'WmiInterfaceEnabled' : [ 0xd4, ['long']], + 'FFHThrottleStateInfo' : [ 0xd8, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0xf8, ['_KDPC']], + 'PerfActionMask' : [ 0x118, ['long']], + 'HvIdleCheck' : [ 0x120, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x130, ['pointer', ['_PROC_PERF_CHECK']]], + 'Domain' : [ 0x134, ['pointer', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x138, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x13c, ['pointer', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x140, ['pointer', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x144, ['pointer', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x148, ['unsigned char']], + 'HvTargetState' : [ 0x149, ['unsigned char']], + 'Parked' : [ 0x14a, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x14c, ['unsigned long']], + 'AveragePerformancePercent' : [ 0x150, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x154, ['unsigned long']], + 'RelativePerformance' : [ 0x158, ['unsigned long']], + 'Utility' : [ 0x15c, ['unsigned long']], + 'AffinitizedUtility' : [ 0x160, ['unsigned long']], + 'SnapTimeLast' : [ 0x168, ['unsigned long long']], + 'EnergyConsumed' : [ 0x168, ['unsigned long long']], + 'ActiveTime' : [ 0x170, ['unsigned long long']], + 'TotalTime' : [ 0x178, ['unsigned long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SystemChargedPage' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_THREAD_ENERGY_VALUES' : [ 0x40, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x20, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_CC_ASYNC_READ_CONTEXT' : [ 0x14, { + 'CompletionRoutine' : [ 0x0, ['pointer', ['void']]], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'Mdl' : [ 0x8, ['pointer', ['_MDL']]], + 'RequestorMode' : [ 0xc, ['unsigned char']], + 'NestingLevel' : [ 0x10, ['unsigned long']], +} ], + '_KTSS' : [ 0x20ac, { + 'Backlink' : [ 0x0, ['unsigned short']], + 'Reserved0' : [ 0x2, ['unsigned short']], + 'Esp0' : [ 0x4, ['unsigned long']], + 'Ss0' : [ 0x8, ['unsigned short']], + 'Reserved1' : [ 0xa, ['unsigned short']], + 'NotUsed1' : [ 0xc, ['array', 4, ['unsigned long']]], + 'CR3' : [ 0x1c, ['unsigned long']], + 'Eip' : [ 0x20, ['unsigned long']], + 'EFlags' : [ 0x24, ['unsigned long']], + 'Eax' : [ 0x28, ['unsigned long']], + 'Ecx' : [ 0x2c, ['unsigned long']], + 'Edx' : [ 0x30, ['unsigned long']], + 'Ebx' : [ 0x34, ['unsigned long']], + 'Esp' : [ 0x38, ['unsigned long']], + 'Ebp' : [ 0x3c, ['unsigned long']], + 'Esi' : [ 0x40, ['unsigned long']], + 'Edi' : [ 0x44, ['unsigned long']], + 'Es' : [ 0x48, ['unsigned short']], + 'Reserved2' : [ 0x4a, ['unsigned short']], + 'Cs' : [ 0x4c, ['unsigned short']], + 'Reserved3' : [ 0x4e, ['unsigned short']], + 'Ss' : [ 0x50, ['unsigned short']], + 'Reserved4' : [ 0x52, ['unsigned short']], + 'Ds' : [ 0x54, ['unsigned short']], + 'Reserved5' : [ 0x56, ['unsigned short']], + 'Fs' : [ 0x58, ['unsigned short']], + 'Reserved6' : [ 0x5a, ['unsigned short']], + 'Gs' : [ 0x5c, ['unsigned short']], + 'Reserved7' : [ 0x5e, ['unsigned short']], + 'LDT' : [ 0x60, ['unsigned short']], + 'Reserved8' : [ 0x62, ['unsigned short']], + 'Flags' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], + 'IoMaps' : [ 0x68, ['array', 1, ['_KiIoAccessMap']]], + 'IntDirectionMap' : [ 0x208c, ['array', 32, ['unsigned char']]], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_CMHIVE' : [ 0xf20, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0x6f0, ['array', 6, ['pointer', ['void']]]], + 'NotifyList' : [ 0x708, ['_LIST_ENTRY']], + 'HiveList' : [ 0x710, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0x718, ['_LIST_ENTRY']], + 'FailedUnloadList' : [ 0x720, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0x728, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0x72c, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0x734, ['pointer', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0x738, ['unsigned long']], + 'DeletedKcbTable' : [ 0x73c, ['pointer', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0x740, ['unsigned long']], + 'Identity' : [ 0x744, ['unsigned long']], + 'HiveLock' : [ 0x748, ['pointer', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0x74c, ['pointer', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0x750, ['pointer', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0x754, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0x75c, ['unsigned long']], + 'FlushLogEntry' : [ 0x760, ['pointer', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0x764, ['unsigned long']], + 'FlushHiveTruncated' : [ 0x768, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0x76c, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0x770, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0x778, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0x77c, ['pointer', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0x780, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0x784, ['pointer', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0x788, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0x78c, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0x790, ['unsigned long']], + 'ActualFileSize' : [ 0x798, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0x7a0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0x7b0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0x7b8, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0x7c0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0x7c8, ['unsigned long']], + 'SecurityCacheSize' : [ 0x7cc, ['unsigned long']], + 'SecurityHitHint' : [ 0x7d0, ['long']], + 'SecurityCache' : [ 0x7d4, ['pointer', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0x7d8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0x9d8, ['unsigned long']], + 'UnloadEventArray' : [ 0x9dc, ['pointer', ['pointer', ['_KEVENT']]]], + 'RootKcb' : [ 0x9e0, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x9e4, ['unsigned char']], + 'UnloadWorkItem' : [ 0x9e8, ['pointer', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x9ec, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0xa00, ['unsigned char']], + 'GrowOffset' : [ 0xa04, ['unsigned long']], + 'KcbConvertListHead' : [ 0xa08, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0xa10, ['pointer', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0xa14, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0xc9c, ['unsigned long']], + 'TrustClassEntry' : [ 0xca0, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0xca8, ['unsigned long long']], + 'UnreconciledTime' : [ 0xcb0, ['unsigned long long']], + 'CmRm' : [ 0xcb8, ['pointer', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0xcbc, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0xcc0, ['long']], + 'CreatorOwner' : [ 0xcc4, ['pointer', ['_KTHREAD']]], + 'RundownThread' : [ 0xcc8, ['pointer', ['_KTHREAD']]], + 'LastWriteTime' : [ 0xcd0, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0xcd8, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0xce4, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0xcf0, ['unsigned long']], + 'FlushActive' : [ 0xcf0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0xcf0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0xcf0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0xcf0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0xcf4, ['unsigned long']], + 'ReferenceCount' : [ 0xcf8, ['long']], + 'UnloadHistoryIndex' : [ 0xcfc, ['long']], + 'UnloadHistory' : [ 0xd00, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0xf00, ['unsigned long']], + 'UnaccessedStart' : [ 0xf04, ['unsigned long']], + 'UnaccessedEnd' : [ 0xf08, ['unsigned long']], + 'LoadedKeyCount' : [ 0xf0c, ['unsigned long']], + 'HandleClosePending' : [ 0xf10, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0xf14, ['_EX_PUSH_LOCK']], + 'FinalFlushSucceeded' : [ 0xf18, ['unsigned char']], + 'FailedUnload' : [ 0xf19, ['unsigned char']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_KIDTENTRY' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'Access' : [ 0x4, ['unsigned short']], + 'ExtendedOffset' : [ 0x6, ['unsigned short']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x28, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long']], + 'DirtyPageThresholdTop' : [ 0x4, ['unsigned long']], + 'DirtyPageThresholdBottom' : [ 0x8, ['unsigned long']], + 'DirtyPageTarget' : [ 0xc, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x10, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x18, ['unsigned long long']], + 'AvailableHistory' : [ 0x20, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ProfileDepartureSetMode' : [ 0x10, ['pointer', ['void']]], + 'ProfileDepartureUpdate' : [ 0x14, ['pointer', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0xc, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x4, ['pointer', ['void']]], + 'DataLength' : [ 0x8, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], +} ], + '_PPM_VETO_ENTRY' : [ 0x38, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'VetoReason' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'HitCount' : [ 0x10, ['unsigned long long']], + 'LastActivationTime' : [ 0x18, ['unsigned long long']], + 'TotalActiveTime' : [ 0x20, ['unsigned long long']], + 'CsActivationTime' : [ 0x28, ['unsigned long long']], + 'CsActiveTime' : [ 0x30, ['unsigned long long']], +} ], + '_IMAGE_OPTIONAL_HEADER' : [ 0xe0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'ImageBase' : [ 0x1c, ['unsigned long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long']], + 'SizeOfStackCommit' : [ 0x4c, ['unsigned long']], + 'SizeOfHeapReserve' : [ 0x50, ['unsigned long']], + 'SizeOfHeapCommit' : [ 0x54, ['unsigned long']], + 'LoaderFlags' : [ 0x58, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x5c, ['unsigned long']], + 'DataDirectory' : [ 0x60, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'ActiveCount' : [ 0x8, ['unsigned long']], + 'PendingNullCount' : [ 0xc, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x10, ['unsigned long']], + 'PendingDelete' : [ 0x14, ['unsigned long']], + 'FreeListHead' : [ 0x18, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x1c, ['pointer', ['void']]], + 'CompletionKey' : [ 0x20, ['pointer', ['void']]], + 'Entry' : [ 0x24, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_TERMINATION_PORT' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], + 'Port' : [ 0x4, ['pointer', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderMaximum'})]], + 'BasePage' : [ 0xc, ['unsigned long']], + 'PageCount' : [ 0x10, ['unsigned long']], +} ], + '_CM_INTENT_LOCK' : [ 0x8, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x4, ['pointer', ['pointer', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x408, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x4c, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0xc, ['unsigned long']], + 'SamplingPeriod' : [ 0x10, ['unsigned long']], + 'CurrentTemperature' : [ 0x14, ['unsigned long']], + 'PassiveTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x14, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x4, ['_RTL_BITMAP']], + 'HashTable' : [ 0xc, ['pointer', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x10, ['unsigned char']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x20, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0x8c, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long']], + 'NonPagedBytes' : [ 0x54, ['unsigned long']], + 'PeakPagedBytes' : [ 0x58, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x5c, ['unsigned long']], + 'BurstAllocationsFailedDeliberately' : [ 0x60, ['unsigned long']], + 'SessionTrims' : [ 0x64, ['unsigned long']], + 'OptionChanges' : [ 0x68, ['unsigned long']], + 'VerifyMode' : [ 0x6c, ['unsigned long']], + 'PreviousBucketName' : [ 0x70, ['_UNICODE_STRING']], + 'ExecutePoolTypes' : [ 0x78, ['unsigned long']], + 'ExecutePageProtections' : [ 0x7c, ['unsigned long']], + 'ExecutePageMappings' : [ 0x80, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x84, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0x88, ['unsigned long']], +} ], + '_VF_DRIVER_IO_CALLBACKS' : [ 0x80, { + 'DriverInit' : [ 0x0, ['pointer', ['void']]], + 'DriverStartIo' : [ 0x4, ['pointer', ['void']]], + 'DriverUnload' : [ 0x8, ['pointer', ['void']]], + 'AddDevice' : [ 0xc, ['pointer', ['void']]], + 'MajorFunction' : [ 0x10, ['array', 28, ['pointer', ['void']]]], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0xc, { + 'ActiveThread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'WaitList' : [ 0x4, ['pointer', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x8, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x24, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 8, ['pointer', ['void']]]], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x8, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0xc, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x4, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_OWNER_ENTRY' : [ 0x8, { + 'OwnerThread' : [ 0x0, ['unsigned long']], + 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x4, ['unsigned long']], +} ], + '_ETIMER' : [ 0xb8, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x28, ['unsigned long']], + 'TimerApc' : [ 0x2c, ['_KAPC']], + 'TimerDpc' : [ 0x5c, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0x7c, ['_LIST_ENTRY']], + 'Period' : [ 0x84, ['unsigned long']], + 'TimerFlags' : [ 0x88, ['unsigned char']], + 'ApcAssociated' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0x88, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0x88, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0x88, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0x89, ['unsigned char']], + 'Spare2' : [ 0x8a, ['unsigned short']], + 'WakeReason' : [ 0x8c, ['pointer', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x90, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x98, ['pointer', ['void']]], + 'VirtualizedTimerLinks' : [ 0x9c, ['_LIST_ENTRY']], + 'DueTime' : [ 0xa8, ['unsigned long long']], + 'CoalescingWindow' : [ 0xb0, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0xc, { + 'ChainLink' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'HashValue' : [ 0x8, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x4c, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0xc, ['pointer', ['_MDL']]], + 'StartVa' : [ 0x10, ['pointer', ['void']]], + 'Count' : [ 0x14, ['unsigned long']], + 'Offset' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], + 'Page' : [ 0x20, ['unsigned long']], + 'StackTrace' : [ 0x24, ['array', 8, ['pointer', ['void']]]], + 'Who' : [ 0x44, ['unsigned long']], + 'Process' : [ 0x48, ['pointer', ['_EPROCESS']]], +} ], + '_MI_CACHED_PTES' : [ 0x48, { + 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], + 'CachedPteCount' : [ 0x40, ['long']], +} ], + '_EXHANDLE' : [ 0x4, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2119' : [ 0x4, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2119']], + 'EndVa' : [ 0x4, ['pointer', ['void']]], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { + 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x288, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_ARBITER_INSTANCE' : [ 0xa8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x4, ['pointer', ['_KEVENT']]], + 'Name' : [ 0x8, ['pointer', ['unsigned short']]], + 'OrderingName' : [ 0xc, ['pointer', ['unsigned short']]], + 'ResourceType' : [ 0x10, ['long']], + 'Allocation' : [ 0x14, ['pointer', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x18, ['pointer', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x1c, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x24, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x2c, ['long']], + 'Interface' : [ 0x30, ['pointer', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x34, ['unsigned long']], + 'AllocationStack' : [ 0x38, ['pointer', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x3c, ['pointer', ['void']]], + 'PackResource' : [ 0x40, ['pointer', ['void']]], + 'UnpackResource' : [ 0x44, ['pointer', ['void']]], + 'ScoreRequirement' : [ 0x48, ['pointer', ['void']]], + 'TestAllocation' : [ 0x4c, ['pointer', ['void']]], + 'RetestAllocation' : [ 0x50, ['pointer', ['void']]], + 'CommitAllocation' : [ 0x54, ['pointer', ['void']]], + 'RollbackAllocation' : [ 0x58, ['pointer', ['void']]], + 'BootAllocation' : [ 0x5c, ['pointer', ['void']]], + 'QueryArbitrate' : [ 0x60, ['pointer', ['void']]], + 'QueryConflict' : [ 0x64, ['pointer', ['void']]], + 'AddReserved' : [ 0x68, ['pointer', ['void']]], + 'StartArbiter' : [ 0x6c, ['pointer', ['void']]], + 'PreprocessEntry' : [ 0x70, ['pointer', ['void']]], + 'AllocateEntry' : [ 0x74, ['pointer', ['void']]], + 'GetNextAllocationRange' : [ 0x78, ['pointer', ['void']]], + 'FindSuitableRange' : [ 0x7c, ['pointer', ['void']]], + 'AddAllocation' : [ 0x80, ['pointer', ['void']]], + 'BacktrackAllocation' : [ 0x84, ['pointer', ['void']]], + 'OverrideConflict' : [ 0x88, ['pointer', ['void']]], + 'InitializeRangeList' : [ 0x8c, ['pointer', ['void']]], + 'TransactionInProgress' : [ 0x90, ['unsigned char']], + 'TransactionEvent' : [ 0x94, ['pointer', ['_KEVENT']]], + 'Extension' : [ 0x98, ['pointer', ['void']]], + 'BusDeviceObject' : [ 0x9c, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0xa0, ['pointer', ['void']]], + 'ConflictCallback' : [ 0xa4, ['pointer', ['void']]], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SYSTEM_INFORMATION' : [ 0x3cc0, { + 'Pools' : [ 0x0, ['_MI_POOL_STATE']], + 'Sections' : [ 0x500, ['_MI_SECTION_STATE']], + 'SystemImages' : [ 0x640, ['_MI_SYSTEM_IMAGE_STATE']], + 'Sessions' : [ 0x6ac, ['_MI_SESSION_STATE']], + 'Processes' : [ 0x16e8, ['_MI_PROCESS_STATE']], + 'Hardware' : [ 0x1758, ['_MI_HARDWARE_STATE']], + 'SystemVa' : [ 0x1800, ['_MI_SYSTEM_VA_STATE']], + 'PageCombines' : [ 0x2cc0, ['_MI_COMBINE_STATE']], + 'Partitions' : [ 0x2cd8, ['_MI_PARTITION_STATE']], + 'Shutdowns' : [ 0x2d10, ['_MI_SHUTDOWN_STATE']], + 'Errors' : [ 0x2d58, ['_MI_ERROR_STATE']], + 'AccessLog' : [ 0x2e00, ['_MI_ACCESS_LOG_STATE']], + 'Debugger' : [ 0x2e80, ['_MI_DEBUGGER_STATE']], + 'Standby' : [ 0x2f40, ['_MI_STANDBY_STATE']], + 'SystemPtes' : [ 0x2fc0, ['_MI_SYSTEM_PTE_STATE']], + 'IoPages' : [ 0x3140, ['_MI_IO_PAGE_STATE']], + 'PagingIo' : [ 0x3178, ['_MI_PAGING_IO_STATE']], + 'CommonPages' : [ 0x31b0, ['_MI_COMMON_PAGE_STATE']], + 'Trims' : [ 0x3200, ['_MI_SYSTEM_TRIM_STATE']], + 'ResTrack' : [ 0x3240, ['_MI_RESAVAIL_TRACKER']], + 'Cookie' : [ 0x3440, ['unsigned long']], + 'ZeroingDisabled' : [ 0x3444, ['long']], + 'BootRegistryRuns' : [ 0x3448, ['pointer', ['pointer', ['void']]]], + 'FullyInitialized' : [ 0x344c, ['unsigned char']], + 'SafeBooted' : [ 0x344d, ['unsigned char']], + 'LargePfnBitMap' : [ 0x3450, ['_RTL_BITMAP']], + 'PfnBitMap' : [ 0x3458, ['_RTL_BITMAP']], + 'TraceLogging' : [ 0x3460, ['pointer', ['_TlgProvider_t']]], + 'Vs' : [ 0x3480, ['_MI_VISIBLE_STATE']], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x10, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x8, ['unsigned long']], + 'Inserted' : [ 0xc, ['unsigned char']], +} ], + '_PPM_SELECTION_DEPENDENCY' : [ 0xc, { + 'Processor' : [ 0x0, ['unsigned long']], + 'Menu' : [ 0x4, ['_PPM_SELECTION_MENU']], +} ], + '__unnamed_2193' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2195' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2193']], +} ], + '__unnamed_2197' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_2195']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_2197']], +} ], + '_MI_VISIBLE_STATE' : [ 0x840, { + 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], + 'SessionWsList' : [ 0x48, ['_LIST_ENTRY']], + 'SessionIdBitmap' : [ 0x50, ['pointer', ['_RTL_BITMAP']]], + 'PagedPoolInfo' : [ 0x54, ['_MM_PAGED_POOL_INFO']], + 'MaximumNonPagedPoolInPages' : [ 0x70, ['unsigned long']], + 'SizeOfPagedPoolInPages' : [ 0x74, ['unsigned long']], + 'SystemPteInfo' : [ 0x78, ['_MI_SYSTEM_PTE_TYPE']], + 'NonPagedPoolCommit' : [ 0xac, ['unsigned long']], + 'BootCommit' : [ 0xb0, ['unsigned long']], + 'MdlPagesAllocated' : [ 0xb4, ['unsigned long']], + 'SystemPageTableCommit' : [ 0xb8, ['unsigned long']], + 'SpecialPagesInUse' : [ 0xbc, ['unsigned long']], + 'WsOverheadPages' : [ 0xc0, ['unsigned long']], + 'VadBitmapPages' : [ 0xc4, ['unsigned long']], + 'ProcessCommit' : [ 0xc8, ['unsigned long']], + 'SharedCommit' : [ 0xcc, ['unsigned long']], + 'DriverCommit' : [ 0xd0, ['long']], + 'SystemWs' : [ 0x100, ['array', 3, ['_MMSUPPORT']]], + 'MapCacheFailures' : [ 0x280, ['unsigned long']], + 'PagefileHashPages' : [ 0x284, ['unsigned long']], + 'PteHeader' : [ 0x288, ['_SYSPTES_HEADER']], + 'SessionSpecialPool' : [ 0x314, ['pointer', ['_MI_SPECIAL_POOL']]], + 'SystemVaTypeCount' : [ 0x318, ['array', 15, ['unsigned long']]], + 'SystemVaType' : [ 0x354, ['array', 1024, ['unsigned char']]], + 'SystemVaTypeCountFailures' : [ 0x754, ['array', 15, ['unsigned long']]], + 'SystemVaTypeCountLimit' : [ 0x790, ['array', 15, ['unsigned long']]], + 'SystemVaTypeCountPeak' : [ 0x7cc, ['array', 15, ['unsigned long']]], + 'SystemAvailableVa' : [ 0x808, ['unsigned long']], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_HMAP_TABLE' : [ 0x2800, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x1c, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'PackageSid' : [ 0x10, ['pointer', ['void']]], + 'HandleCount' : [ 0x14, ['unsigned long']], + 'Handles' : [ 0x18, ['pointer', ['pointer', ['void']]]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x50, { + 'Prcb' : [ 0x0, ['pointer', ['_KPRCB']]], + 'PerfContext' : [ 0x4, ['unsigned long']], + 'ProcCap' : [ 0x8, ['unsigned long']], + 'ProcFloor' : [ 0xc, ['unsigned long']], + 'PlatformCap' : [ 0x10, ['unsigned long']], + 'ThermalCap' : [ 0x14, ['unsigned long']], + 'LimitReasons' : [ 0x18, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x20, ['unsigned long long']], + 'TargetPercent' : [ 0x28, ['unsigned long']], + 'SelectedPercent' : [ 0x2c, ['unsigned long']], + 'SelectedFrequency' : [ 0x30, ['unsigned long']], + 'PreviousFrequency' : [ 0x34, ['unsigned long']], + 'PreviousPercent' : [ 0x38, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x3c, ['unsigned long']], + 'SelectedState' : [ 0x40, ['unsigned long long']], + 'Force' : [ 0x48, ['unsigned char']], +} ], + '__unnamed_21b4' : [ 0x10, { + 'CallerCompletion' : [ 0x0, ['pointer', ['void']]], + 'CallerContext' : [ 0x4, ['pointer', ['void']]], + 'CallerDevice' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0xc, ['unsigned char']], +} ], + '__unnamed_21b7' : [ 0x8, { + 'NotifyDevice' : [ 0x0, ['pointer', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x4, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0x90, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'Pdo' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x18, ['unsigned long long']], + 'WatchdogTimer' : [ 0x20, ['_KTIMER']], + 'WatchdogDpc' : [ 0x48, ['_KDPC']], + 'MinorFunction' : [ 0x68, ['unsigned char']], + 'PowerStateType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0x70, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0x74, ['unsigned char']], + 'FxDevice' : [ 0x78, ['pointer', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0x7c, ['unsigned char']], + 'NotifyPEP' : [ 0x7d, ['unsigned char']], + 'Device' : [ 0x80, ['__unnamed_21b4']], + 'System' : [ 0x80, ['__unnamed_21b7']], +} ], + '_MI_ERROR_STATE' : [ 0xa8, { + 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], + 'ProbeRaises' : [ 0x28, ['_MI_PROBE_RAISE_TRACKER']], + 'ForcedCommits' : [ 0x68, ['_MI_FORCED_COMMITS']], + 'WsleFailures' : [ 0x70, ['array', 2, ['unsigned long']]], + 'WsLinear' : [ 0x78, ['unsigned long']], + 'PageHashErrors' : [ 0x7c, ['unsigned long']], + 'CheckZeroCount' : [ 0x80, ['unsigned long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x84, ['long']], + 'BadPagesDetected' : [ 0x88, ['long']], + 'ScrubPasses' : [ 0x8c, ['long']], + 'ScrubBadPagesFound' : [ 0x90, ['long']], + 'UserViewFailures' : [ 0x94, ['unsigned long']], + 'UserViewCollisionFailures' : [ 0x98, ['unsigned long']], + 'ResavailFailures' : [ 0x9c, ['_MI_RESAVAIL_FAILURES']], + 'PendingBadPages' : [ 0xa4, ['unsigned char']], + 'InitFailure' : [ 0xa5, ['unsigned char']], + 'StopBadMaps' : [ 0xa6, ['unsigned char']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_MI_USER_VA_INFO' : [ 0xd48, { + 'NumberOfCommittedPageTables' : [ 0x0, ['unsigned long']], + 'HighestTopDownAllocationAddress' : [ 0x4, ['pointer', ['void']]], + 'VadCell' : [ 0x8, ['array', 2, ['_MI_VAD_ALLOCATION_CELL']]], + 'VadBitMapCommitment' : [ 0x40, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x44, ['unsigned long']], + 'VadsBeingDeleted' : [ 0x48, ['long']], + 'NumberOfDebugEnclaves' : [ 0x4c, ['long']], + 'PhysicalMappingCount' : [ 0x50, ['unsigned long']], + 'LastVadDeletionEvent' : [ 0x54, ['pointer', ['_KEVENT']]], + 'SubVadRanges' : [ 0x58, ['array', 1, ['_LIST_ENTRY']]], + 'NumaAware' : [ 0x60, ['unsigned char']], + 'CloneNestingLevel' : [ 0x68, ['unsigned long long']], + 'PrivateFixupVadCount' : [ 0x70, ['unsigned long']], + 'CfgBitMap' : [ 0x74, ['array', 1, ['_MI_CFG_BITMAP_INFO']]], + 'CommittedPageTableBufferForTopLevel' : [ 0x80, ['array', 48, ['unsigned long']]], + 'CommittedPageTableBitmaps' : [ 0x140, ['array', 1, ['_RTL_BITMAP']]], + 'UsedPageTableEntries' : [ 0x148, ['array', 1536, ['unsigned short']]], +} ], + '_PROC_FEEDBACK' : [ 0x88, { + 'Lock' : [ 0x0, ['unsigned long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x20, ['unsigned long long']], + 'UnscaledTime' : [ 0x28, ['unsigned long long']], + 'UnaccountedTime' : [ 0x30, ['long long']], + 'ScaledTime' : [ 0x38, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x48, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x50, ['unsigned long long']], + 'UserTimeLast' : [ 0x58, ['unsigned long']], + 'KernelTimeLast' : [ 0x5c, ['unsigned long']], + 'IdleGenerationNumberLast' : [ 0x60, ['unsigned long long']], + 'HvActiveTimeLast' : [ 0x68, ['unsigned long long']], + 'StallCyclesLast' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'KernelTimesIndex' : [ 0x80, ['unsigned char']], +} ], + '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x20, { + 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'LocationTreeNode' : [ 0xc, ['_RTL_BALANCED_NODE']], + 'StartingIndex' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_21d7' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_21db' : [ 0x14, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_21dd' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_21df' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_21e1' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_21e3' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_21e5' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_21e7' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_21e9' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_21eb' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_21ed' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_21ef' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_21d7']], + 'Memory' : [ 0x0, ['__unnamed_21d7']], + 'Interrupt' : [ 0x0, ['__unnamed_21db']], + 'Dma' : [ 0x0, ['__unnamed_21dd']], + 'DmaV3' : [ 0x0, ['__unnamed_21df']], + 'Generic' : [ 0x0, ['__unnamed_21d7']], + 'DevicePrivate' : [ 0x0, ['__unnamed_21e1']], + 'BusNumber' : [ 0x0, ['__unnamed_21e3']], + 'ConfigData' : [ 0x0, ['__unnamed_21e5']], + 'Memory40' : [ 0x0, ['__unnamed_21e7']], + 'Memory48' : [ 0x0, ['__unnamed_21e9']], + 'Memory64' : [ 0x0, ['__unnamed_21eb']], + 'Connection' : [ 0x0, ['__unnamed_21ed']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_21ef']], +} ], + '_POP_THERMAL_ZONE' : [ 0x2c0, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0xc, ['pointer', ['void']]], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'Device' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x1c, ['pointer', ['_IRP']]], + 'State' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], + 'Removing' : [ 0x22, ['unsigned char']], + 'Mode' : [ 0x23, ['unsigned char']], + 'PendingMode' : [ 0x24, ['unsigned char']], + 'ActivePoint' : [ 0x25, ['unsigned char']], + 'PendingActivePoint' : [ 0x26, ['unsigned char']], + 'Critical' : [ 0x27, ['unsigned char']], + 'ThermalStandby' : [ 0x28, ['unsigned char']], + 'OverThrottled' : [ 0x29, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x2c, ['long']], + 'Throttle' : [ 0x30, ['long']], + 'PendingThrottle' : [ 0x34, ['long']], + 'ThrottleReasons' : [ 0x38, ['unsigned long']], + 'LastTime' : [ 0x40, ['unsigned long long']], + 'SampleRate' : [ 0x48, ['unsigned long']], + 'LastTemp' : [ 0x4c, ['unsigned long']], + 'PassiveTimer' : [ 0x50, ['_KTIMER']], + 'PassiveDpc' : [ 0x78, ['_KDPC']], + 'Info' : [ 0x98, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0xf0, ['_LARGE_INTEGER']], + 'Policy' : [ 0xf8, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x110, ['unsigned char']], + 'LastActiveStartTime' : [ 0x118, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x120, ['unsigned long long']], + 'WorkItem' : [ 0x128, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x138, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x140, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x150, ['_KEVENT']], + 'InstanceId' : [ 0x160, ['unsigned long']], + 'TelemetryTracker' : [ 0x168, ['_POP_THERMAL_TELEMETRY_TRACKER']], + 'Description' : [ 0x2b8, ['_UNICODE_STRING']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0xc, { + 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'VerifierEntry' : [ 0x4, ['pointer', ['void']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_MI_REBUILD_LARGE_PAGES' : [ 0x34, { + 'Active' : [ 0x0, ['long']], + 'Timer' : [ 0x4, ['array', 16, ['array', 1, ['_MI_REBUILD_LARGE_PAGE_COUNTDOWN']]]], + 'WorkItem' : [ 0x24, ['_WORK_QUEUE_ITEM']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0x80, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0xc, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x2c, ['unsigned long']], + 'TraceDb' : [ 0x30, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_HHIVE' : [ 0x6f0, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x4, ['pointer', ['void']]], + 'ReleaseCellRoutine' : [ 0x8, ['pointer', ['void']]], + 'Allocate' : [ 0xc, ['pointer', ['void']]], + 'Free' : [ 0x10, ['pointer', ['void']]], + 'FileWrite' : [ 0x14, ['pointer', ['void']]], + 'FileRead' : [ 0x18, ['pointer', ['void']]], + 'HiveLoadFailure' : [ 0x1c, ['pointer', ['void']]], + 'BaseBlock' : [ 0x20, ['pointer', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x24, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x2c, ['unsigned long']], + 'DirtyAlloc' : [ 0x30, ['unsigned long']], + 'UnreconciledVector' : [ 0x34, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x3c, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x40, ['unsigned long']], + 'Cluster' : [ 0x44, ['unsigned long']], + 'Flat' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SystemCacheBacked' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x49, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x4c, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x50, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x54, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x58, ['unsigned long']], + 'HiveFlags' : [ 0x5c, ['unsigned long']], + 'CurrentLog' : [ 0x60, ['unsigned long']], + 'CurrentLogSequence' : [ 0x64, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x68, ['unsigned long']], + 'CurrentLogOffset' : [ 0x6c, ['unsigned long']], + 'MinimumLogSequence' : [ 0x70, ['unsigned long']], + 'LogFileSizeCap' : [ 0x74, ['unsigned long']], + 'LogDataPresent' : [ 0x78, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0x7a, ['unsigned char']], + 'BaseBlockDirty' : [ 0x7b, ['unsigned char']], + 'LastLogSwapTime' : [ 0x80, ['_LARGE_INTEGER']], + 'FirstLogFile' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0x88, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0x88, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0x88, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0x88, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0x88, ['unsigned short']], + 'LogEntriesRecovered' : [ 0x8a, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0x8c, ['unsigned long']], + 'StorageTypeCount' : [ 0x90, ['unsigned long']], + 'Version' : [ 0x94, ['unsigned long']], + 'ViewMap' : [ 0x98, ['_HVIEW_MAP']], + 'Storage' : [ 0x3b8, ['array', 2, ['_DUAL']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_ETW_FILTER_HEADER' : [ 0x24, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x4, ['pointer', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x8, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0xc, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x10, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x14, ['pointer', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x18, ['pointer', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x1c, ['pointer', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x20, ['pointer', ['_EVENT_FILTER_HEADER']]], +} ], + '_CM_WORKITEM' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x8, ['unsigned long']], + 'WorkerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Parameter' : [ 0x10, ['pointer', ['void']]], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_CM_TRANS' : [ 0x68, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x8, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x18, ['pointer', ['void']]], + 'CmRm' : [ 0x1c, ['pointer', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x20, ['pointer', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x24, ['pointer', ['void']]], + 'KtmUow' : [ 0x28, ['_GUID']], + 'StartLsn' : [ 0x38, ['unsigned long long']], + 'TransState' : [ 0x40, ['unsigned long']], + 'HiveCount' : [ 0x44, ['unsigned long']], + 'HiveArray' : [ 0x48, ['array', 7, ['pointer', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x14, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Count' : [ 0xc, ['unsigned long']], + 'Stamp' : [ 0x10, ['unsigned long']], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x150, { + 'AccountingDisabled' : [ 0x0, ['unsigned char']], + 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], + 'TotalPassiveTime' : [ 0x10, ['array', 20, ['unsigned long long']]], + 'PassiveTimeSnap' : [ 0xb0, ['array', 20, ['unsigned long long']]], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x2c, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ProbeMode' : [ 0x8, ['unsigned char']], + 'PagedPoolCharge' : [ 0xc, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x10, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x14, ['unsigned long']], + 'SecurityDescriptor' : [ 0x18, ['pointer', ['void']]], + 'SecurityQos' : [ 0x1c, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x20, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_HVIEW_MAP' : [ 0x320, { + 'MappedLength' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'Directory' : [ 0xc, ['pointer', ['_HVIEW_MAP_DIRECTORY']]], + 'PagesCharged' : [ 0x10, ['unsigned long']], + 'PinLog' : [ 0x18, ['_HVIEW_MAP_PIN_LOG']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_DISALLOWED_GUIDS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x4, ['pointer', ['_GUID']]], +} ], + '_HVIEW_MAP_DIRECTORY' : [ 0x200, { + 'Tables' : [ 0x0, ['array', 128, ['pointer', ['_HVIEW_MAP_TABLE']]]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x8, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x4, ['array', 1, ['pointer', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0xc, { + 'DataSectionObject' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['void']]], + 'ImageSectionObject' : [ 0x8, ['pointer', ['void']]], +} ], + '_VF_BTS_DATA_MANAGEMENT_AREA' : [ 0x34, { + 'BTSBufferBase' : [ 0x0, ['pointer', ['void']]], + 'BTSIndex' : [ 0x4, ['pointer', ['void']]], + 'BTSMax' : [ 0x8, ['pointer', ['void']]], + 'BTSInterruptThreshold' : [ 0xc, ['pointer', ['void']]], + 'PEBSBufferBase' : [ 0x10, ['pointer', ['void']]], + 'PEBSIndex' : [ 0x14, ['pointer', ['void']]], + 'PEBSMax' : [ 0x18, ['pointer', ['void']]], + 'PEBSInterruptThreshold' : [ 0x1c, ['pointer', ['void']]], + 'PEBSCounterReset' : [ 0x20, ['array', 2, ['pointer', ['void']]]], + 'Reserved' : [ 0x28, ['array', 12, ['unsigned char']]], +} ], + '_FLOATING_SAVE_AREA' : [ 0x70, { + 'ControlWord' : [ 0x0, ['unsigned long']], + 'StatusWord' : [ 0x4, ['unsigned long']], + 'TagWord' : [ 0x8, ['unsigned long']], + 'ErrorOffset' : [ 0xc, ['unsigned long']], + 'ErrorSelector' : [ 0x10, ['unsigned long']], + 'DataOffset' : [ 0x14, ['unsigned long']], + 'DataSelector' : [ 0x18, ['unsigned long']], + 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], + 'Spare0' : [ 0x6c, ['unsigned long']], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1f, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1e, ['unsigned char']], +} ], + '__unnamed_226c' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_226e' : [ 0x10, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_226c']], +} ], + '_VF_TARGET_DRIVER' : [ 0x1c, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x8, ['__unnamed_226e']], + 'VerifiedData' : [ 0x18, ['pointer', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '_RTL_BITMAP' : [ 0x8, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '__unnamed_2279' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_227b' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_227d' : [ 0x8, { + 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], + 'DeviceId' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_227f' : [ 0x4, { + 'Notification' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_2281' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2283' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_2285' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2287' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2289' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_228b' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_2279']], + 'TargetDevice' : [ 0x0, ['__unnamed_227b']], + 'InstallDevice' : [ 0x0, ['__unnamed_227b']], + 'CustomNotification' : [ 0x0, ['__unnamed_227d']], + 'ProfileNotification' : [ 0x0, ['__unnamed_227f']], + 'PowerNotification' : [ 0x0, ['__unnamed_2281']], + 'VetoNotification' : [ 0x0, ['__unnamed_2283']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_2285']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_2287']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_2289']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_227b']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_227b']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x44, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x14, ['pointer', ['unsigned long']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'TotalSize' : [ 0x1c, ['unsigned long']], + 'DeviceObject' : [ 0x20, ['pointer', ['void']]], + 'u' : [ 0x24, ['__unnamed_228b']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x8, ['unsigned long']], + 'Unloads' : [ 0xc, ['unsigned long']], + 'BaseName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x8, ['array', 32, ['unsigned long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Reserved2' : [ 0x14, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer', ['void']]], + 'Reserved3' : [ 0x1c, ['unsigned long']], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x50, { + 'Context' : [ 0x0, ['pointer', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x38, ['unsigned long']], + 'DependencyUsed' : [ 0x3c, ['unsigned long']], + 'DependencyArray' : [ 0x40, ['pointer', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x44, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x48, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x4c, ['unsigned long']], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 8, ['_M128A']]], + 'Reserved4' : [ 0x120, ['array', 224, ['unsigned char']]], +} ], + '__unnamed_22a7' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_22a7']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['void']]], + 'BusExtension' : [ 0x4, ['pointer', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x4, ['unsigned long']], + 'RealKcb' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x14, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x4, ['_LIST_ENTRY']], + 'Lock' : [ 0xc, ['unsigned long']], + 'Busy' : [ 0x10, ['unsigned char']], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_MI_HARDWARE_STATE' : [ 0x78, { + 'NodeMask' : [ 0x0, ['unsigned long']], + 'NodeGraph' : [ 0x4, ['pointer', ['unsigned short']]], + 'SystemNodeInformation' : [ 0x8, ['pointer', ['_MI_SYSTEM_NODE_INFORMATION']]], + 'NumaLastRangeIndex' : [ 0xc, ['unsigned long']], + 'NumaMemoryRanges' : [ 0x10, ['pointer', ['_HAL_NODE_RANGE']]], + 'NumaTableCaptured' : [ 0x14, ['unsigned char']], + 'NodeShift' : [ 0x15, ['unsigned char']], + 'ChannelMemoryRanges' : [ 0x18, ['pointer', ['_HAL_CHANNEL_MEMORY_RANGES']]], + 'ChannelShift' : [ 0x1c, ['unsigned char']], + 'SecondLevelCacheSize' : [ 0x20, ['unsigned long']], + 'FirstLevelCacheSize' : [ 0x24, ['unsigned long']], + 'PhysicalAddressBits' : [ 0x28, ['unsigned long']], + 'AllMainMemoryMustBeCached' : [ 0x2c, ['unsigned char']], + 'TotalPagesAllowed' : [ 0x30, ['unsigned long']], + 'SecondaryColorMask' : [ 0x34, ['unsigned long']], + 'SecondaryColors' : [ 0x38, ['unsigned long']], + 'FlushTbForAttributeChange' : [ 0x3c, ['unsigned long']], + 'FlushCacheForAttributeChange' : [ 0x40, ['unsigned long']], + 'FlushCacheForPageAttributeChange' : [ 0x44, ['unsigned long']], + 'CacheFlushPromoteThreshold' : [ 0x48, ['unsigned long']], + 'FlushTbThreshold' : [ 0x4c, ['unsigned long']], + 'ZeroCostCounts' : [ 0x50, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], + 'HighestPossiblePhysicalPage' : [ 0x70, ['unsigned long']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer', ['void']]], + 'OpenProcedure' : [ 0x34, ['pointer', ['void']]], + 'CloseProcedure' : [ 0x38, ['pointer', ['void']]], + 'DeleteProcedure' : [ 0x3c, ['pointer', ['void']]], + 'ParseProcedure' : [ 0x40, ['pointer', ['void']]], + 'SecurityProcedure' : [ 0x44, ['pointer', ['void']]], + 'QueryNameProcedure' : [ 0x48, ['pointer', ['void']]], + 'OkayToCloseProcedure' : [ 0x4c, ['pointer', ['void']]], + 'WaitObjectFlagMask' : [ 0x50, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x54, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x56, ['unsigned short']], +} ], + '__unnamed_22e8' : [ 0x4, { + 'Long' : [ 0x0, ['unsigned long']], + 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], +} ], + '_MI_DECAY_TIMER_LINK' : [ 0x4, { + 'u1' : [ 0x0, ['__unnamed_22e8']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0xc, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x8, ['pointer', ['_TRIAGE_DEVICE_NODE']]], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x8, { + 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x4, ['pointer', ['void']]], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_HEAP_EXTENDED_ENTRY' : [ 0x8, { + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], +} ], + '_MI_SYSTEM_VA_STATE' : [ 0x14c0, { + 'SystemTablesLock' : [ 0x0, ['unsigned long']], + 'SystemVaBias' : [ 0x4, ['unsigned long']], + 'SystemAvailableVaLow' : [ 0x8, ['unsigned long']], + 'VirtualBias' : [ 0xc, ['unsigned long']], + 'HyperSpaceEnd' : [ 0x10, ['pointer', ['void']]], + 'HyperSpaceEndPte' : [ 0x14, ['pointer', ['_MMPTE']]], + 'SystemRangeStart' : [ 0x18, ['pointer', ['void']]], + 'SystemCachePdeCount' : [ 0x1c, ['array', 1024, ['unsigned char']]], + 'SystemCacheReverseMaps' : [ 0x41c, ['array', 1024, ['pointer', ['void']]]], + 'WorkingSetListHashStart' : [ 0x141c, ['pointer', ['_MMWSLE_HASH']]], + 'WorkingSetListHashEnd' : [ 0x1420, ['pointer', ['_MMWSLE_HASH']]], + 'WorkingSetListIndirectHashStart' : [ 0x1424, ['pointer', ['_MMWSLE_NONDIRECT_HASH']]], + 'FreeSystemCacheVa' : [ 0x1428, ['_KEVENT']], + 'SystemVaLock' : [ 0x1438, ['unsigned long']], + 'DeleteKvaLock' : [ 0x143c, ['long']], + 'FreeSystemCache' : [ 0x1440, ['_MI_PTE_CHAIN_HEAD']], + 'SystemCacheViewLock' : [ 0x1458, ['unsigned long']], + 'UnusableWsles' : [ 0x145c, ['array', 5, ['unsigned long']]], + 'PossibleWsles' : [ 0x1470, ['array', 5, ['unsigned long']]], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0xc, { + 'DirtyPages' : [ 0x0, ['unsigned long']], + 'DirtyPagesLastScan' : [ 0x4, ['unsigned long']], + 'DirtyPagesScheduledLastScan' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], + 'BreakPointHandle' : [ 0x10, ['unsigned long']], + 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], + 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x10, { + 'StackBase' : [ 0x0, ['unsigned long']], + 'StackLimit' : [ 0x4, ['unsigned long']], + 'KernelStack' : [ 0x8, ['unsigned long']], + 'InitialStack' : [ 0xc, ['unsigned long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_MI_DEBUGGER_STATE' : [ 0x90, { + 'TransientWrite' : [ 0x0, ['unsigned char']], + 'CodePageEdited' : [ 0x1, ['unsigned char']], + 'DebugPte' : [ 0x4, ['pointer', ['_MMPTE']]], + 'PoisonedTb' : [ 0x8, ['unsigned long']], + 'InDebugger' : [ 0xc, ['long']], + 'Pfns' : [ 0x10, ['array', 32, ['pointer', ['void']]]], +} ], + '_MI_PROCESS_STATE' : [ 0x70, { + 'ColorSeed' : [ 0x0, ['unsigned long']], + 'CloneDereferenceEvent' : [ 0x4, ['_KEVENT']], + 'CloneProtosSListHead' : [ 0x18, ['_SLIST_HEADER']], + 'SystemDllBase' : [ 0x20, ['pointer', ['void']]], + 'RotatingUniprocessorNumber' : [ 0x24, ['long']], + 'CriticalSectionTimeout' : [ 0x28, ['_LARGE_INTEGER']], + 'ProcessList' : [ 0x30, ['_LIST_ENTRY']], + 'SharedUserDataPte' : [ 0x38, ['pointer', ['_MMPTE']]], + 'FreePaeEntries' : [ 0x3c, ['unsigned long']], + 'FirstFreePae' : [ 0x40, ['_PAE_ENTRY']], + 'AllocatedPaePages' : [ 0x60, ['long']], + 'PaeLock' : [ 0x64, ['unsigned long']], + 'PaeEntrySList' : [ 0x68, ['_SLIST_HEADER']], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x24, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x28, ['unsigned long']], + 'Alternatives' : [ 0x2c, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x30, ['unsigned short']], + 'RangeAttributes' : [ 0x32, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x33, ['unsigned char']], + 'WorkSpace' : [ 0x34, ['unsigned long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'HiberFileType' : [ 0x16, ['unsigned char']], + 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], + 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_MI_REBUILD_LARGE_PAGE_COUNTDOWN' : [ 0x2, { + 'SecondsLeft' : [ 0x0, ['unsigned char']], + 'SecondsAssigned' : [ 0x1, ['unsigned char']], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_REQUEST_MAILBOX' : [ 0x20, { + 'Next' : [ 0x0, ['pointer', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x4, ['unsigned long']], + 'RequestPacket' : [ 0x8, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x18, ['pointer', ['long']]], + 'NodeTargetCount' : [ 0x1c, ['long']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x8, { + 'Validation' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'TrackedOffsetCallback' : [ 0x4, ['pointer', ['void']]], +} ], + '_VPB' : [ 0x58, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'VolumeLabel' : [ 0x18, ['array', 32, ['wchar']]], +} ], + '_MI_SESSION_STATE' : [ 0x1038, { + 'SystemSession' : [ 0x0, ['_MMSESSION']], + 'CodePageEdited' : [ 0x14, ['unsigned char']], + 'VaReferenceCount' : [ 0x18, ['array', 1024, ['long']]], + 'DynamicPtesBitBuffer' : [ 0x1018, ['pointer', ['unsigned long']]], + 'IdLock' : [ 0x101c, ['_EX_PUSH_LOCK']], + 'DetachTimeStamp' : [ 0x1020, ['unsigned long']], + 'LeaderProcess' : [ 0x1024, ['pointer', ['_EPROCESS']]], + 'InitializeLock' : [ 0x1028, ['_EX_PUSH_LOCK']], + 'WorkingSetList' : [ 0x102c, ['pointer', ['_MMWSL']]], + 'WsHashStart' : [ 0x1030, ['pointer', ['_MMWSLE_HASH']]], + 'WsHashEnd' : [ 0x1034, ['pointer', ['_MMWSLE_HASH']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_MMSESSION' : [ 0x14, { + 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'SystemSpaceViewLockPointer' : [ 0x4, ['pointer', ['_EX_PUSH_LOCK']]], + 'ViewRoot' : [ 0x8, ['_RTL_AVL_TREE']], + 'ViewCount' : [ 0xc, ['unsigned long']], + 'BitmapFailures' : [ 0x10, ['unsigned long']], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x130, { + 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'NumberOfPrivateSpaces' : [ 0x12c, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x10, { + 'ClientToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x8, ['pointer', ['void']]], + 'ProcessAuditId' : [ 0xc, ['pointer', ['void']]], +} ], + '_MI_DECAY_TIMER_LINKAGE' : [ 0x4, { + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 32, native_type='unsigned long')]], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_KiIoAccessMap' : [ 0x2024, { + 'DirectionMap' : [ 0x0, ['array', 32, ['unsigned char']]], + 'IoMap' : [ 0x20, ['array', 8196, ['unsigned char']]], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x40, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0xc, ['_KEVENT']], + 'AccessBufferMax' : [ 0x1c, ['unsigned long']], + 'AccessBufferList' : [ 0x20, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x28, ['long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x30, ['long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0xc, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'Entry' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '__unnamed_236d' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], +} ], + '_MI_PARTITION_CORE' : [ 0xb8, { + 'PartitionId' : [ 0x0, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_236d']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], + 'ParentPartition' : [ 0xc, ['pointer', ['_MI_PARTITION']]], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'NodeInformation' : [ 0x18, ['pointer', ['_MI_NODE_INFORMATION']]], + 'MdlPhysicalMemoryBlock' : [ 0x1c, ['pointer', ['_MDL']]], + 'MemoryNodeRuns' : [ 0x20, ['pointer', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'MemoryBlockReferences' : [ 0x24, ['unsigned long']], + 'PfnUnmapWorkItem' : [ 0x28, ['_WORK_QUEUE_ITEM']], + 'PfnUnmapActive' : [ 0x38, ['unsigned char']], + 'PfnUnmapCount' : [ 0x3c, ['unsigned long']], + 'PfnUnmapWaitList' : [ 0x40, ['pointer', ['void']]], + 'MemoryRuns' : [ 0x44, ['pointer', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'ExitEvent' : [ 0x48, ['_KEVENT']], + 'SystemThreadHandles' : [ 0x58, ['array', 5, ['pointer', ['void']]]], + 'PartitionObject' : [ 0x6c, ['pointer', ['void']]], + 'PartitionObjectHandle' : [ 0x70, ['pointer', ['void']]], + 'DynamicMemoryPushLock' : [ 0x74, ['_EX_PUSH_LOCK']], + 'DynamicMemoryLock' : [ 0x78, ['long']], + 'TemporaryMemoryEvent' : [ 0x7c, ['_KEVENT']], + 'MemoryEvents' : [ 0x8c, ['array', 11, ['pointer', ['_KEVENT']]]], +} ], + '_MI_PARTITION_MODWRITES' : [ 0x1d0, { + 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], + 'PageFileContract' : [ 0x38, ['_MMPAGE_FILE_EXPANSION']], + 'NumberOfMappedMdls' : [ 0x70, ['unsigned long']], + 'NumberOfMappedMdlsInUse' : [ 0x74, ['long']], + 'NumberOfMappedMdlsInUsePeak' : [ 0x78, ['unsigned long']], + 'MappedFileHeader' : [ 0x7c, ['_MMMOD_WRITER_LISTHEAD']], + 'NeedMappedMdl' : [ 0x94, ['unsigned char']], + 'NeedPageFileMdl' : [ 0x95, ['unsigned char']], + 'TransitionInserted' : [ 0x96, ['unsigned char']], + 'LastModifiedWriteError' : [ 0x98, ['long']], + 'LastMappedWriteError' : [ 0x9c, ['long']], + 'MappedFileWriteSucceeded' : [ 0xa0, ['unsigned long']], + 'MappedWriteBurstCount' : [ 0xa4, ['unsigned long']], + 'LowPriorityModWritesOutstanding' : [ 0xa8, ['unsigned long']], + 'BoostModWriteIoPriorityEvent' : [ 0xac, ['_KEVENT']], + 'ModifiedWriterThreadPriority' : [ 0xbc, ['long']], + 'ModifiedPagesLowPriorityGoal' : [ 0xc0, ['unsigned long']], + 'ModifiedPageWriterEvent' : [ 0xc4, ['_KEVENT']], + 'ModifiedWriterExitedEvent' : [ 0xd4, ['_KEVENT']], + 'WriteAllPagefilePages' : [ 0xe4, ['long']], + 'WriteAllMappedPages' : [ 0xe8, ['long']], + 'MappedPageWriterEvent' : [ 0xec, ['_KEVENT']], + 'ModWriteData' : [ 0x100, ['_MI_MODWRITE_DATA']], + 'RescanPageFilesEvent' : [ 0x130, ['_KEVENT']], + 'PagingFileHeader' : [ 0x140, ['_MMMOD_WRITER_LISTHEAD']], + 'ModifiedPageWriterThread' : [ 0x158, ['pointer', ['_ETHREAD']]], + 'ModifiedPageWriterRundown' : [ 0x15c, ['_EX_RUNDOWN_REF']], + 'PagefileScanWorkItem' : [ 0x160, ['_WORK_QUEUE_ITEM']], + 'PagefileScanCount' : [ 0x170, ['unsigned long']], + 'ClusterWritesDisabled' : [ 0x174, ['array', 2, ['long']]], + 'NotifyStoreMemoryConditions' : [ 0x17c, ['_KEVENT']], + 'DelayMappedWrite' : [ 0x18c, ['unsigned char']], + 'PagefileReservationsEnabled' : [ 0x190, ['unsigned long']], + 'PageFileCreationLock' : [ 0x194, ['_EX_PUSH_LOCK']], + 'TrimPagefileWorkItem' : [ 0x198, ['_WORK_QUEUE_ITEM']], + 'LastTrimPagefileTime' : [ 0x1a8, ['unsigned long long']], + 'WsSwapPagefileContractWorkItem' : [ 0x1b0, ['_WORK_QUEUE_ITEM']], + 'WsSwapPageFileContractionInProgress' : [ 0x1c0, ['long']], + 'WorkingSetSwapLock' : [ 0x1c4, ['_EX_PUSH_LOCK']], + 'WorkingSetInswapLock' : [ 0x1c8, ['long']], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '_KPRIQUEUE' : [ 0x19c, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x110, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x190, ['unsigned long']], + 'ThreadListHead' : [ 0x194, ['_LIST_ENTRY']], +} ], + '__unnamed_2385' : [ 0x4, { + 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_NODE_INFORMATION' : [ 0x68, { + 'LargePageFreeCount' : [ 0x0, ['array', 2, ['unsigned long']]], + 'LargePages' : [ 0x8, ['array', 2, ['array', 2, ['array', 1, ['_LIST_ENTRY']]]]], + 'LargePagesCount' : [ 0x28, ['array', 2, ['array', 2, ['array', 1, ['unsigned long']]]]], + 'FreeCount' : [ 0x38, ['array', 2, ['unsigned long']]], + 'TotalPages' : [ 0x40, ['array', 1, ['unsigned long']]], + 'TotalPagesEntireNode' : [ 0x44, ['unsigned long']], + 'MmShiftedColor' : [ 0x48, ['unsigned long']], + 'Color' : [ 0x4c, ['unsigned long']], + 'ChannelFreeCount' : [ 0x50, ['array', 1, ['array', 2, ['unsigned long']]]], + 'Flags' : [ 0x58, ['__unnamed_2385']], + 'NodeLock' : [ 0x5c, ['_EX_PUSH_LOCK']], + 'ChannelStatus' : [ 0x60, ['unsigned char']], + 'ChannelOrdering' : [ 0x61, ['array', 1, ['unsigned char']]], + 'LockedChannelOrdering' : [ 0x62, ['array', 1, ['unsigned char']]], + 'PowerAttribute' : [ 0x63, ['array', 1, ['unsigned char']]], + 'LargePageLock' : [ 0x64, ['unsigned long']], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x4, ['pointer', ['void']]], +} ], + '_WAITING_IRP' : [ 0x20, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'CompletionRoutine' : [ 0xc, ['pointer', ['void']]], + 'Context' : [ 0x10, ['pointer', ['void']]], + 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], + 'Information' : [ 0x18, ['unsigned long']], + 'BreakAllRH' : [ 0x1c, ['unsigned char']], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_PPM_SELECTION_MENU' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'Entries' : [ 0x4, ['pointer', ['_PPM_SELECTION_MENU_ENTRY']]], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x10, { + 'SharedExportThunks' : [ 0x0, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x4, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x8, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0xc, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_KSCHEDULING_GROUP' : [ 0x140, { + 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], + 'RelativeWeight' : [ 0x8, ['unsigned long']], + 'ChildMinRate' : [ 0xc, ['unsigned long']], + 'ChildMinWeight' : [ 0x10, ['unsigned long']], + 'ChildTotalWeight' : [ 0x14, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], + 'NotificationCycles' : [ 0x20, ['long long']], + 'SchedulingGroupList' : [ 0x28, ['_LIST_ENTRY']], + 'Sibling' : [ 0x28, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x30, ['pointer', ['_KDPC']]], + 'ChildList' : [ 0x34, ['_LIST_ENTRY']], + 'Parent' : [ 0x3c, ['pointer', ['_KSCHEDULING_GROUP']]], + 'PerProcessor' : [ 0x40, ['array', 1, ['_KSCB']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x18, { + 'SourceProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'SourceHandle' : [ 0x4, ['pointer', ['void']]], + 'Object' : [ 0x8, ['pointer', ['void']]], + 'TargetAccess' : [ 0xc, ['unsigned long']], + 'ObjectInfo' : [ 0x10, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x14, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x8, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x18, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'Irp' : [ 0xc, ['pointer', ['_IRP']]], + 'Device' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x14, ['unsigned char']], +} ], + '_POP_POLICY_DEVICE' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0xc, ['pointer', ['void']]], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'Device' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x1c, ['pointer', ['_IRP']]], +} ], + '__unnamed_23b6' : [ 0x4, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'FileObject' : [ 0x0, ['pointer', ['_FILE_OBJECT']]], + 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '_SECTION' : [ 0x28, { + 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'u1' : [ 0x14, ['__unnamed_23b6']], + 'SizeOfSection' : [ 0x18, ['unsigned long long']], + 'u' : [ 0x20, ['__unnamed_16af']], + 'InitialPageProtection' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'SessionId' : [ 0x24, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x24, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SECTION_STATE' : [ 0x140, { + 'SectionObjectPointersLock' : [ 0x0, ['long']], + 'SectionExtendLock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'SectionExtendSetLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'SectionBasedRoot' : [ 0xc, ['_RTL_AVL_TREE']], + 'SectionBasedLock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'UnusedSubsectionPagedPool' : [ 0x14, ['unsigned long']], + 'UnusedSegmentForceFree' : [ 0x18, ['unsigned long']], + 'DataSectionProtectionMask' : [ 0x1c, ['unsigned long']], + 'HighSectionBase' : [ 0x20, ['pointer', ['void']]], + 'PhysicalSubsection' : [ 0x24, ['_MSUBSECTION']], + 'PhysicalControlArea' : [ 0x68, ['_CONTROL_AREA']], + 'DanglingExtentsPages' : [ 0xb8, ['pointer', ['_MMPFN']]], + 'DanglingExtentsLock' : [ 0xbc, ['long']], + 'DanglingExtentsWorkItem' : [ 0xc0, ['_WORK_QUEUE_ITEM']], + 'DanglingExtentsWorkerActive' : [ 0xd0, ['unsigned char']], + 'PageFileSectionHead' : [ 0xd4, ['_RTL_AVL_TREE']], + 'PageFileSectionListSpinLock' : [ 0xd8, ['long']], + 'ImageBias' : [ 0xdc, ['unsigned long']], + 'RelocateBitmapsLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'ImageBitMap' : [ 0xe4, ['_RTL_BITMAP']], + 'ApiSetSection' : [ 0xec, ['pointer', ['void']]], + 'ApiSetSchema' : [ 0xf0, ['pointer', ['void']]], + 'ApiSetSchemaSize' : [ 0xf4, ['unsigned long']], + 'LostDataFiles' : [ 0xf8, ['unsigned long']], + 'LostDataPages' : [ 0xfc, ['unsigned long']], + 'ImageFailureReason' : [ 0x100, ['unsigned long']], + 'CfgBitMapSection32' : [ 0x104, ['pointer', ['_SECTION']]], + 'CfgBitMapControlArea32' : [ 0x108, ['pointer', ['_CONTROL_AREA']]], + 'ImageCfgFailure' : [ 0x10c, ['unsigned long']], + 'ImageValidationFailed' : [ 0x110, ['long']], +} ], + '_MI_PARTITION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], +} ], + '__unnamed_23c2' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23c4' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23c6' : [ 0xc, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23c8' : [ 0xc, { + 'Raw' : [ 0x0, ['__unnamed_23c6']], + 'Translated' : [ 0x0, ['__unnamed_23c4']], +} ], + '__unnamed_23ca' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23cc' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_23ce' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23d0' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23d2' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23d4' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23d6' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_23d8' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_23c2']], + 'Port' : [ 0x0, ['__unnamed_23c2']], + 'Interrupt' : [ 0x0, ['__unnamed_23c4']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_23c8']], + 'Memory' : [ 0x0, ['__unnamed_23c2']], + 'Dma' : [ 0x0, ['__unnamed_23ca']], + 'DmaV3' : [ 0x0, ['__unnamed_23cc']], + 'DevicePrivate' : [ 0x0, ['__unnamed_21e1']], + 'BusNumber' : [ 0x0, ['__unnamed_23ce']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_23d0']], + 'Memory40' : [ 0x0, ['__unnamed_23d2']], + 'Memory48' : [ 0x0, ['__unnamed_23d4']], + 'Memory64' : [ 0x0, ['__unnamed_23d6']], + 'Connection' : [ 0x0, ['__unnamed_21ed']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_23d8']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_23e0' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_23e0']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x4, { + 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x1c, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'PagedPoolAllocationMap' : [ 0x4, ['_RTL_BITMAP']], + 'FirstPteForPagedPool' : [ 0xc, ['pointer', ['_MMPTE']]], + 'MaximumSize' : [ 0x10, ['unsigned long']], + 'PagedPoolHint' : [ 0x14, ['unsigned long']], + 'AllocatedPagedPool' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_23ec' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x54, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x4, ['__unnamed_23ec']], +} ], + '_PPM_COORDINATED_SELECTION' : [ 0x10, { + 'MaximumStates' : [ 0x0, ['unsigned long']], + 'SelectedStates' : [ 0x4, ['unsigned long']], + 'DefaultSelection' : [ 0x8, ['unsigned long']], + 'Selection' : [ 0xc, ['pointer', ['unsigned long']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_PAE_ENTRY' : [ 0x20, { + 'PteEntry' : [ 0x0, ['array', 4, ['_MMPTE']]], + 'PaeEntry' : [ 0x0, ['_PAE_PAGEINFO']], + 'NextPae' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_MI_PAGE_COMBINING_SUPPORT' : [ 0xd8, { + 'Partition' : [ 0x0, ['pointer', ['_MI_PARTITION']]], + 'ArbitraryPfnMapList' : [ 0x4, ['_LIST_ENTRY']], + 'FreeCombinePoolItem' : [ 0xc, ['_MI_COMBINE_WORKITEM']], + 'CombiningThreadCount' : [ 0x20, ['unsigned long']], + 'CombinePageFreeList' : [ 0x24, ['_LIST_ENTRY']], + 'CombineFreeListLock' : [ 0x2c, ['unsigned long']], + 'CombinePageListHeads' : [ 0x30, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], + 'PageCombineStats' : [ 0xb0, ['_MI_PAGE_COMBINE_STATISTICS']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x8, { + 'p' : [ 0x0, ['pointer', ['void']]], + 'RangeSize' : [ 0x4, ['unsigned long']], +} ], + '_POP_FX_DEVICE' : [ 0x188, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'IrpData' : [ 0xc, ['pointer', ['_POP_IRP_DATA']]], + 'Status' : [ 0x10, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x14, ['long']], + 'PowerNotReqCall' : [ 0x18, ['long']], + 'DevNode' : [ 0x1c, ['pointer', ['_DEVICE_NODE']]], + 'DpmContext' : [ 0x20, ['pointer', ['PEPHANDLE__']]], + 'Plugin' : [ 0x24, ['pointer', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x28, ['pointer', ['PEPHANDLE__']]], + 'AcpiPlugin' : [ 0x2c, ['pointer', ['_POP_FX_PLUGIN']]], + 'AcpiPluginHandle' : [ 0x30, ['pointer', ['PEPHANDLE__']]], + 'DeviceObject' : [ 0x34, ['pointer', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x38, ['pointer', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x3c, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0x58, ['pointer', ['void']]], + 'AcpiLink' : [ 0x5c, ['_LIST_ENTRY']], + 'DeviceId' : [ 0x64, ['_UNICODE_STRING']], + 'RemoveLock' : [ 0x6c, ['_IO_REMOVE_LOCK']], + 'AcpiRemoveLock' : [ 0x84, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0x9c, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0xb8, ['unsigned long']], + 'IdleTimer' : [ 0xc0, ['_KTIMER']], + 'IdleDpc' : [ 0xe8, ['_KDPC']], + 'IdleTimeout' : [ 0x108, ['unsigned long long']], + 'IdleStamp' : [ 0x110, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x118, ['array', 2, ['pointer', ['_DEVICE_OBJECT']]]], + 'NextIrpPowerState' : [ 0x120, ['array', 2, ['_POWER_STATE']]], + 'NextIrpCallerCompletion' : [ 0x128, ['array', 2, ['pointer', ['void']]]], + 'NextIrpCallerContext' : [ 0x130, ['array', 2, ['pointer', ['void']]]], + 'IrpCompleteEvent' : [ 0x138, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x148, ['pointer', ['void']]], + 'Accounting' : [ 0x150, ['_POP_FX_ACCOUNTING']], + 'Flags' : [ 0x178, ['unsigned long']], + 'ComponentCount' : [ 0x17c, ['unsigned long']], + 'Components' : [ 0x180, ['pointer', ['pointer', ['_POP_FX_COMPONENT']]]], +} ], + '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { + 'AsULong' : [ 0x0, ['unsigned long']], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2418' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_241a' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_2418']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x44, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x1c, ['_LIST_ENTRY']], + 'IdleType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CoolingExtension' : [ 0x30, ['pointer', ['_POP_COOLING_EXTENSION']]], + 'Volume' : [ 0x34, ['_LIST_ENTRY']], + 'Specific' : [ 0x3c, ['__unnamed_241a']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MI_COMBINE_STATE' : [ 0x18, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'CombiningThreadCount' : [ 0x4, ['unsigned long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], + 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], +} ], + '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x1c, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'ListHead' : [ 0x14, ['_LIST_ENTRY']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { + 'BadPageCount' : [ 0x0, ['unsigned long']], + 'BadPagesDetected' : [ 0x4, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x8, ['long']], + 'ScrubPasses' : [ 0xc, ['long']], + 'ScrubBadPagesFound' : [ 0x10, ['long']], + 'PageHashErrors' : [ 0x14, ['unsigned long']], + 'FeatureBits' : [ 0x18, ['unsigned long long']], + 'TimeZoneId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['_MI_FLAGS']], + 'VsmConnection' : [ 0x28, ['pointer', ['void']]], + 'ExceptionChainTerminator' : [ 0x2c, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'ExceptionChainTerminatorRecord' : [ 0x30, ['_EXCEPTION_REGISTRATION_RECORD']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x38, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0xc, ['pointer', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x10, ['pointer', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x14, ['pointer', ['void']]], + 'PreAcquireForCcFlush' : [ 0x18, ['pointer', ['void']]], + 'PostAcquireForCcFlush' : [ 0x1c, ['pointer', ['void']]], + 'PreReleaseForCcFlush' : [ 0x20, ['pointer', ['void']]], + 'PostReleaseForCcFlush' : [ 0x24, ['pointer', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x28, ['pointer', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x2c, ['pointer', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x30, ['pointer', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x34, ['pointer', ['void']]], +} ], + '_KENLISTMENT' : [ 0x168, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x4, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x18, ['_GUID']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NextSameTx' : [ 0x48, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x50, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x58, ['pointer', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0x5c, ['pointer', ['_KTRANSACTION']]], + 'State' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0x64, ['unsigned long']], + 'NotificationMask' : [ 0x68, ['unsigned long']], + 'Key' : [ 0x6c, ['pointer', ['void']]], + 'KeyRefCount' : [ 0x70, ['unsigned long']], + 'RecoveryInformation' : [ 0x74, ['pointer', ['void']]], + 'RecoveryInformationLength' : [ 0x78, ['unsigned long']], + 'DynamicNameInformation' : [ 0x7c, ['pointer', ['void']]], + 'DynamicNameInformationLength' : [ 0x80, ['unsigned long']], + 'FinalNotification' : [ 0x84, ['pointer', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0x88, ['pointer', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0x8c, ['pointer', ['void']]], + 'SubordinateTxHandle' : [ 0x90, ['pointer', ['void']]], + 'CrmEnlistmentEnId' : [ 0x94, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0xa4, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0xb4, ['_GUID']], + 'NextHistory' : [ 0xc4, ['unsigned long']], + 'History' : [ 0xc8, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ArbiterHandler' : [ 0x10, ['pointer', ['void']]], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_DELAY_ACK_FO' : [ 0xc, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x4, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x28, { + 'BugCheckCode' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['long']], + 'Data' : [ 0x8, ['unsigned long']], + 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { + 'ExpansionLock' : [ 0x0, ['unsigned long']], + 'TrimInProgressCount' : [ 0x4, ['long']], + 'PeriodicWorkingSetEvent' : [ 0x8, ['_KEVENT']], + 'TrimAllPageFaultCount' : [ 0x18, ['array', 3, ['unsigned long']]], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_MI_ZERO_COST_COUNTS' : [ 0x10, { + 'NativeSum' : [ 0x0, ['unsigned long long']], + 'CachedSum' : [ 0x8, ['unsigned long long']], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MI_RESAVAIL_TRACKER' : [ 0x200, { + 'AllocateKernelStack' : [ 0x0, ['unsigned long']], + 'AllocateGrowKernelStack' : [ 0x4, ['unsigned long']], + 'FreeKernelStack' : [ 0x8, ['unsigned long']], + 'FreeKernelStackError' : [ 0xc, ['unsigned long']], + 'FreeGrowKernelStackError' : [ 0x10, ['unsigned long']], + 'AllocateCreateProcess' : [ 0x14, ['unsigned long']], + 'FreeCreateProcessError' : [ 0x18, ['unsigned long']], + 'FreeDeleteProcess' : [ 0x1c, ['unsigned long']], + 'FreeCleanProcess' : [ 0x20, ['unsigned long']], + 'FreeCleanProcessError' : [ 0x24, ['unsigned long']], + 'AllocateAddProcessWsMetaPage' : [ 0x28, ['unsigned long']], + 'AllocateWsIncrease' : [ 0x2c, ['unsigned long']], + 'FreeWsIncreaseError' : [ 0x30, ['unsigned long']], + 'FreeWsIncreaseErrorMax' : [ 0x34, ['unsigned long']], + 'FreeWsDecrease' : [ 0x38, ['unsigned long']], + 'AllocateWorkingSetPage' : [ 0x3c, ['unsigned long']], + 'FreeWorkingSetPageError' : [ 0x40, ['unsigned long']], + 'FreeDeletePteRange' : [ 0x44, ['unsigned long']], + 'AllocatePageTablesForProcessMetadata' : [ 0x48, ['unsigned long']], + 'FreePageTablesForProcessMetadataError2' : [ 0x4c, ['unsigned long']], + 'AllocatePageTablesForSystem' : [ 0x50, ['unsigned long']], + 'FreePageTablesExcess' : [ 0x54, ['unsigned long']], + 'FreeSystemVaPageTables' : [ 0x58, ['unsigned long']], + 'FreeSessionVaPageTables' : [ 0x5c, ['unsigned long']], + 'AllocateCreateSession' : [ 0x60, ['unsigned long']], + 'FreeSessionWsDereference' : [ 0x64, ['unsigned long']], + 'FreeSessionDereference' : [ 0x68, ['unsigned long']], + 'AllocateLockedSessionImage' : [ 0x6c, ['unsigned long']], + 'FreeLockedSessionImage' : [ 0x70, ['unsigned long']], + 'FreeSessionImageConversion' : [ 0x74, ['unsigned long']], + 'AllocateWsAdjustPageTable' : [ 0x78, ['unsigned long']], + 'FreeWsAdjustPageTable' : [ 0x7c, ['unsigned long']], + 'FreeWsAdjustPageTableError' : [ 0x80, ['unsigned long']], + 'AllocateNoLowMemory' : [ 0x84, ['unsigned long']], + 'AllocatePagedPoolLockedDown' : [ 0x88, ['unsigned long']], + 'FreePagedPoolLockedDown' : [ 0x8c, ['unsigned long']], + 'AllocateSystemBitmaps' : [ 0x90, ['unsigned long']], + 'FreeSystemBitmapsError' : [ 0x94, ['unsigned long']], + 'AllocateForMdl' : [ 0x98, ['unsigned long']], + 'FreeFromMdl' : [ 0x9c, ['unsigned long']], + 'AllocateForMdlPartition' : [ 0xa0, ['unsigned long']], + 'FreeFromMdlPartition' : [ 0xa4, ['unsigned long']], + 'FreeMdlExcess' : [ 0xa8, ['unsigned long']], + 'AllocateExpansionNonPagedPool' : [ 0xac, ['unsigned long']], + 'FreeExpansionNonPagedPool' : [ 0xb0, ['unsigned long']], + 'AllocateVad' : [ 0xb4, ['unsigned long']], + 'RemoveVad' : [ 0xb8, ['unsigned long']], + 'FreeVad' : [ 0xbc, ['unsigned long']], + 'AllocateContiguous' : [ 0xc0, ['unsigned long']], + 'FreeContiguousPages' : [ 0xc4, ['unsigned long']], + 'FreeContiguousError' : [ 0xc8, ['unsigned long']], + 'FreeLargePageMemory' : [ 0xcc, ['unsigned long']], + 'AllocateSystemWsles' : [ 0xd0, ['unsigned long']], + 'FreeSystemWsles' : [ 0xd4, ['unsigned long']], + 'AllocateSystemInitWs' : [ 0xd8, ['unsigned long']], + 'AllocateSessionInitWs' : [ 0xdc, ['unsigned long']], + 'FreeSessionInitWsError' : [ 0xe0, ['unsigned long']], + 'AllocateSystemImage' : [ 0xe4, ['unsigned long']], + 'AllocateSystemImageLoad' : [ 0xe8, ['unsigned long']], + 'AllocateSessionSharedImage' : [ 0xec, ['unsigned long']], + 'FreeSystemImageInitCode' : [ 0xf0, ['unsigned long']], + 'FreeSystemImageLargePageConversion' : [ 0xf4, ['unsigned long']], + 'FreeSystemImageError' : [ 0xf8, ['unsigned long']], + 'FreeSystemImageLoadExcess' : [ 0xfc, ['unsigned long']], + 'FreeUnloadSystemImage' : [ 0x100, ['unsigned long']], + 'FreeReloadBootImageLarge' : [ 0x104, ['unsigned long']], + 'FreeIndependent' : [ 0x108, ['unsigned long']], + 'AllocateHotRemove' : [ 0x10c, ['unsigned long']], + 'FreeHotAdd' : [ 0x110, ['unsigned long']], + 'AllocateBoot' : [ 0x114, ['unsigned long']], + 'FreeLoaderBlock' : [ 0x118, ['unsigned long']], + 'AllocateNonPagedSpecialPool' : [ 0x11c, ['unsigned long']], + 'FreeNonPagedSpecialPoolError' : [ 0x120, ['unsigned long']], + 'FreeNonPagedSpecialPool' : [ 0x124, ['unsigned long']], + 'AllocateSharedSegmentPage' : [ 0x128, ['unsigned long']], + 'FreeSharedSegmentPage' : [ 0x12c, ['unsigned long']], + 'AllocateZeroPage' : [ 0x130, ['unsigned long']], + 'FreeZeroPage' : [ 0x134, ['unsigned long']], + 'AllocateForPo' : [ 0x138, ['unsigned long']], + 'AllocateForPoForce' : [ 0x13c, ['unsigned long']], + 'FreeForPo' : [ 0x140, ['unsigned long']], + 'AllocateThreadHardFaultBehavior' : [ 0x144, ['unsigned long']], + 'FreeThreadHardFaultBehavior' : [ 0x148, ['unsigned long']], + 'ObtainFaultCharges' : [ 0x14c, ['unsigned long']], + 'FreeFaultCharges' : [ 0x150, ['unsigned long']], + 'AllocateStoreCharges' : [ 0x154, ['unsigned long']], + 'FreeStoreCharges' : [ 0x158, ['unsigned long']], + 'ObtainLockedPageCharge' : [ 0x180, ['unsigned long']], + 'FreeLockedPageCharge' : [ 0x1c0, ['unsigned long']], + 'AllocateStore' : [ 0x1c4, ['unsigned long']], + 'FreeStore' : [ 0x1c8, ['unsigned long']], + 'AllocateSystemImageProtos' : [ 0x1cc, ['unsigned long']], + 'FreeSystemImageProtos' : [ 0x1d0, ['unsigned long']], + 'AllocateModWriterCharge' : [ 0x1d4, ['unsigned long']], + 'FreeModWriterCharge' : [ 0x1d8, ['unsigned long']], + 'AllocateMappedWriterCharge' : [ 0x1dc, ['unsigned long']], + 'FreeMappedWriterCharge' : [ 0x1e0, ['unsigned long']], + 'AllocateRegistryCharges' : [ 0x1e4, ['unsigned long']], + 'FreeRegistryCharges' : [ 0x1e8, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'CompactionMask' : [ 0x8, ['unsigned long long']], + 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x18, { + 'DebugInfo' : [ 0x0, ['pointer', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x4, ['long']], + 'RecursionCount' : [ 0x8, ['long']], + 'OwningThread' : [ 0xc, ['pointer', ['void']]], + 'LockSemaphore' : [ 0x10, ['pointer', ['void']]], + 'SpinCount' : [ 0x14, ['unsigned long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x24, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'Context' : [ 0xc, ['pointer', ['void']]], + 'CompletionState' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x14, ['unsigned long']], + 'Status' : [ 0x18, ['long']], + 'Information' : [ 0x1c, ['pointer', ['void']]], + 'ReferenceCount' : [ 0x20, ['long']], +} ], + '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x8, { + 'Table' : [ 0x0, ['_RTL_AVL_TREE']], + 'Lock' : [ 0x4, ['long']], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x10, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x4, ['unsigned long']], + 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '__unnamed_248d' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_248f' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2491' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2493' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_248d']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_248f']], + 'Raw' : [ 0x0, ['__unnamed_2491']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x28, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'Operation' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0x8, ['__unnamed_2493']], + 'Stack' : [ 0x10, ['array', 6, ['pointer', ['void']]]], +} ], + '_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_MI_SYSTEM_NODE_INFORMATION' : [ 0xb0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x8, ['array', 3, ['_SLIST_HEADER']]], + 'NonPagedPoolSListHeadNx' : [ 0x20, ['array', 3, ['_SLIST_HEADER']]], + 'CachedKernelStacks' : [ 0x38, ['array', 2, ['_CACHED_KSTACK_LIST']]], + 'NonPagedPoolLowestPage' : [ 0x68, ['unsigned long']], + 'NonPagedPoolHighestPage' : [ 0x6c, ['unsigned long']], + 'AllocatedNonPagedPool' : [ 0x70, ['unsigned long']], + 'PartialLargePoolRegions' : [ 0x74, ['unsigned long']], + 'PagesInPartialLargePoolRegions' : [ 0x78, ['unsigned long']], + 'CachedNonPagedPoolCount' : [ 0x7c, ['unsigned long']], + 'NonPagedPoolSpinLock' : [ 0x80, ['unsigned long']], + 'CachedNonPagedPool' : [ 0x84, ['pointer', ['_MMPFN']]], + 'NonPagedPoolFirstVa' : [ 0x88, ['pointer', ['void']]], + 'NonPagedPoolLastVa' : [ 0x8c, ['pointer', ['void']]], + 'NonPagedBitMap' : [ 0x90, ['array', 3, ['_RTL_BITMAP']]], + 'NonPagedHint' : [ 0xa8, ['array', 2, ['unsigned long']]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x8, { + 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 31, native_type='unsigned long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'LockState' : [ 0x0, ['pointer', ['void']]], + 'SessionState' : [ 0x4, ['pointer', ['void']]], + 'SessionId' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24a5' : [ 0x4, { + 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], + 'Long' : [ 0x0, ['long']], +} ], + '_MI_PARTITION_STORES' : [ 0x50, { + 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_24a5']], + 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], + 'Registered' : [ 0x8, ['unsigned long']], + 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], + 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], + 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], + 'WriteIssueFailures' : [ 0x18, ['unsigned long']], + 'EvictionThread' : [ 0x1c, ['pointer', ['_ETHREAD']]], + 'EvictEvent' : [ 0x20, ['_KEVENT']], + 'EvictFlushCompleteEvent' : [ 0x30, ['_KEVENT']], + 'WriteSupportSListHead' : [ 0x40, ['_SLIST_HEADER']], + 'EvictFlushLock' : [ 0x48, ['long']], + 'ModifiedWriteFailedBitmap' : [ 0x4c, ['pointer', ['_RTL_BITMAP']]], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x28, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x8, ['unsigned long']], + 'SyncCallback' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x10, ['pointer', ['void']]], + 'DeviceContext' : [ 0x14, ['pointer', ['void']]], + 'NumberOfMapRegisters' : [ 0x18, ['unsigned long']], + 'DeviceObject' : [ 0x1c, ['pointer', ['void']]], + 'CurrentIrp' : [ 0x20, ['pointer', ['void']]], + 'BufferChainingDpc' : [ 0x24, ['pointer', ['_KDPC']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x10, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x4, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0xc, ['unsigned short']], + 'Name' : [ 0xe, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x48, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0xc, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_MI_FLAGS' : [ 0x4, { + 'EntireFlags' : [ 0x0, ['long']], + 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ZeroNonCachedByConverting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ZeroWriteCombinedByConverting' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], +} ], + '_MI_SUB64K_FREE_RANGES' : [ 0x1c, { + 'BitMap' : [ 0x0, ['_RTL_BITMAP']], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'Vad' : [ 0x10, ['pointer', ['_MMVAD_SHORT']]], + 'SubListIndex' : [ 0x14, ['unsigned short']], + 'Hint' : [ 0x16, ['unsigned short']], + 'SetBits' : [ 0x18, ['unsigned long']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x30, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'LastTotalAllocates' : [ 0x1c, ['unsigned long']], + 'LastAllocateMisses' : [ 0x20, ['unsigned long']], + 'Counters' : [ 0x24, ['array', 2, ['unsigned long']]], +} ], + '_KTIMER' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x10, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Dpc' : [ 0x20, ['pointer', ['_KDPC']]], + 'Period' : [ 0x24, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0xc, ['pointer', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'NumberOfBuckets' : [ 0x14, ['unsigned long']], + 'Buckets' : [ 0x18, ['array', 1, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '__unnamed_24e2' : [ 0x18, { + 'RequestedTime' : [ 0x0, ['unsigned long long']], + 'ProgrammedTime' : [ 0x8, ['unsigned long long']], + 'TimerInfo' : [ 0x10, ['pointer', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0x108, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x34, ['pointer', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x38, ['pointer', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x40, ['unsigned long long']], + 'SleepTime' : [ 0x48, ['unsigned long long']], + 'WakeFirstUnattendedTime' : [ 0x50, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x60, ['array', 3, ['__unnamed_24e2']]], + 'WakeAlarmPaused' : [ 0xa8, ['unsigned char']], + 'WakeAlarmLastTime' : [ 0xb0, ['unsigned long long']], + 'FilteredCapabilities' : [ 0xb8, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_CM_KEY_HASH' : [ 0x10, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0xc, ['unsigned long']], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_KAPC_STATE' : [ 0x18, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x10, ['pointer', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x14, ['unsigned char']], + 'KernelApcInProgress' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x15, ['unsigned char']], + 'UserApcPending' : [ 0x16, ['unsigned char']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x3c, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x8, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x10, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x1c, ['unsigned char']], + 'DeviceObject' : [ 0x20, ['pointer', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x24, ['pointer', ['unsigned short']]], + 'DriverName' : [ 0x28, ['pointer', ['unsigned short']]], + 'ChildCount' : [ 0x2c, ['unsigned long']], + 'ActiveChild' : [ 0x30, ['unsigned long']], + 'ParentCount' : [ 0x34, ['unsigned long']], + 'ActiveParent' : [ 0x38, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x24, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0xc, ['pointer', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x10, ['_FS_FILTER_PARAMETERS']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { + 'PageHashes' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0x70, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x4, ['pointer', ['void']]], + 'FastIoRead' : [ 0x8, ['pointer', ['void']]], + 'FastIoWrite' : [ 0xc, ['pointer', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x10, ['pointer', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x14, ['pointer', ['void']]], + 'FastIoLock' : [ 0x18, ['pointer', ['void']]], + 'FastIoUnlockSingle' : [ 0x1c, ['pointer', ['void']]], + 'FastIoUnlockAll' : [ 0x20, ['pointer', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x24, ['pointer', ['void']]], + 'FastIoDeviceControl' : [ 0x28, ['pointer', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x2c, ['pointer', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x30, ['pointer', ['void']]], + 'FastIoDetachDevice' : [ 0x34, ['pointer', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x38, ['pointer', ['void']]], + 'AcquireForModWrite' : [ 0x3c, ['pointer', ['void']]], + 'MdlRead' : [ 0x40, ['pointer', ['void']]], + 'MdlReadComplete' : [ 0x44, ['pointer', ['void']]], + 'PrepareMdlWrite' : [ 0x48, ['pointer', ['void']]], + 'MdlWriteComplete' : [ 0x4c, ['pointer', ['void']]], + 'FastIoReadCompressed' : [ 0x50, ['pointer', ['void']]], + 'FastIoWriteCompressed' : [ 0x54, ['pointer', ['void']]], + 'MdlReadCompleteCompressed' : [ 0x58, ['pointer', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0x5c, ['pointer', ['void']]], + 'FastIoQueryOpen' : [ 0x60, ['pointer', ['void']]], + 'ReleaseForModWrite' : [ 0x64, ['pointer', ['void']]], + 'AcquireForCcFlush' : [ 0x68, ['pointer', ['void']]], + 'ReleaseForCcFlush' : [ 0x6c, ['pointer', ['void']]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x38, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x8, ['unsigned char']], + 'ArbiterInterface' : [ 0xc, ['pointer', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x10, ['pointer', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x1c, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x24, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x2c, ['_LIST_ENTRY']], + 'State' : [ 0x34, ['unsigned char']], + 'ResourcesChanged' : [ 0x35, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['pointer', ['void']]], + 'Group' : [ 0x8, ['pointer', ['void']]], + 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], + 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer', ['_MMPTE']]], +} ], + '_PPM_SELECTION_MENU_ENTRY' : [ 0x10, { + 'StrictDependency' : [ 0x0, ['unsigned char']], + 'InitiatingState' : [ 0x1, ['unsigned char']], + 'DependentState' : [ 0x2, ['unsigned char']], + 'StateIndex' : [ 0x4, ['unsigned long']], + 'Dependencies' : [ 0x8, ['unsigned long']], + 'DependencyList' : [ 0xc, ['pointer', ['_PPM_SELECTION_DEPENDENCY']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x14, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x4, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0xc, ['_RTL_BITMAP']], + 'EvictedBitmap' : [ 0xc, ['_RTL_BITMAP']], +} ], + '_KQUEUE' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x10, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x18, ['unsigned long']], + 'MaximumCount' : [ 0x1c, ['unsigned long']], + 'ThreadListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_MI_COMBINE_WORKITEM' : [ 0x14, { + 'NextEntry' : [ 0x0, ['pointer', ['void']]], + 'WorkItem' : [ 0x4, ['_WORK_QUEUE_ITEM']], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x2a4, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer', ['void']]], + 'ConsoleFlags' : [ 0x14, ['unsigned long']], + 'StandardInput' : [ 0x18, ['pointer', ['void']]], + 'StandardOutput' : [ 0x1c, ['pointer', ['void']]], + 'StandardError' : [ 0x20, ['pointer', ['void']]], + 'CurrentDirectory' : [ 0x24, ['_CURDIR']], + 'DllPath' : [ 0x30, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x38, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x40, ['_UNICODE_STRING']], + 'Environment' : [ 0x48, ['pointer', ['void']]], + 'StartingX' : [ 0x4c, ['unsigned long']], + 'StartingY' : [ 0x50, ['unsigned long']], + 'CountX' : [ 0x54, ['unsigned long']], + 'CountY' : [ 0x58, ['unsigned long']], + 'CountCharsX' : [ 0x5c, ['unsigned long']], + 'CountCharsY' : [ 0x60, ['unsigned long']], + 'FillAttribute' : [ 0x64, ['unsigned long']], + 'WindowFlags' : [ 0x68, ['unsigned long']], + 'ShowWindowFlags' : [ 0x6c, ['unsigned long']], + 'WindowTitle' : [ 0x70, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0x78, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0x80, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0x88, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0x90, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x290, ['unsigned long']], + 'EnvironmentVersion' : [ 0x294, ['unsigned long']], + 'PackageDependencyData' : [ 0x298, ['pointer', ['void']]], + 'ProcessGroupId' : [ 0x29c, ['unsigned long']], + 'LoaderThreads' : [ 0x2a0, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x8, { + 'BasePage' : [ 0x0, ['unsigned long']], + 'PageCount' : [ 0x4, ['unsigned long']], +} ], + '_RTL_SRWLOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x14, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x10, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x10, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x4, ['pointer', ['void']]], + 'AcquireForReadAhead' : [ 0x8, ['pointer', ['void']]], + 'ReleaseFromReadAhead' : [ 0xc, ['pointer', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x20, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer', ['void']]], + 'Owner' : [ 0x14, ['pointer', ['void']]], + 'Attributes' : [ 0x18, ['unsigned char']], + 'Flags' : [ 0x19, ['unsigned char']], +} ], + '_LOCK_HEADER' : [ 0x10, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x4, ['unsigned long']], + 'Lock' : [ 0x8, ['unsigned long']], + 'Valid' : [ 0xc, ['unsigned long']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_MSUBSECTION' : [ 0x44, { + 'Core' : [ 0x0, ['_SUBSECTION']], + 'SubsectionNode' : [ 0x28, ['_RTL_BALANCED_NODE']], + 'DereferenceList' : [ 0x34, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x3c, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x40, ['unsigned long']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x4, { + 'ImageFileName' : [ 0x0, ['pointer', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x8, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x4, ['unsigned long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x40, { + 'Address' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0xc, ['array', 13, ['pointer', ['void']]]], +} ], + '__unnamed_259c' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x2000, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_259c']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x18, ['unsigned long']], + 'NonPagablePages' : [ 0x1c, ['unsigned long']], + 'CommittedPages' : [ 0x20, ['unsigned long']], + 'PagedPoolStart' : [ 0x24, ['pointer', ['void']]], + 'PagedPoolEnd' : [ 0x28, ['pointer', ['void']]], + 'SessionObject' : [ 0x2c, ['pointer', ['void']]], + 'SessionObjectHandle' : [ 0x30, ['pointer', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x34, ['array', 4, ['unsigned long']]], + 'ImageTree' : [ 0x44, ['_RTL_AVL_TREE']], + 'LocaleId' : [ 0x48, ['unsigned long']], + 'AttachCount' : [ 0x4c, ['unsigned long']], + 'AttachGate' : [ 0x50, ['_KGATE']], + 'WsListEntry' : [ 0x60, ['_LIST_ENTRY']], + 'Lookaside' : [ 0x80, ['array', 24, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xc80, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xc94, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xcb0, ['_MMSUPPORT']], + 'Wsle' : [ 0xd30, ['pointer', ['_MMWSLE']]], + 'DriverUnload' : [ 0xd34, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xd40, ['_POOL_DESCRIPTOR']], + 'PageTables' : [ 0x1e80, ['pointer', ['_MMPTE']]], + 'PagedPoolBitBuffer' : [ 0x1e84, ['array', 32, ['unsigned long']]], + 'SpecialPool' : [ 0x1f08, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1f50, ['_EX_PUSH_LOCK']], + 'PoolBigEntriesInUse' : [ 0x1f54, ['long']], + 'PagedPoolPdeCount' : [ 0x1f58, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1f5c, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1f60, ['unsigned long']], + 'SystemPteInfo' : [ 0x1f64, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1f98, ['pointer', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1f9c, ['unsigned long']], + 'PoolTrackBigPages' : [ 0x1fa0, ['pointer', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1fa4, ['unsigned long']], + 'IoState' : [ 0x1fa8, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1fac, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1fb0, ['_KEVENT']], + 'ServerSilo' : [ 0x1fc0, ['pointer', ['_EJOB']]], + 'CreateTime' : [ 0x1fc8, ['unsigned long long']], +} ], + '_MMPAGE_FILE_EXPANSION' : [ 0x38, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'DereferenceList' : [ 0x4, ['_LIST_ENTRY']], + 'Partition' : [ 0xc, ['pointer', ['_MI_PARTITION']]], + 'RequestedExpansionSize' : [ 0x10, ['unsigned long']], + 'ActualExpansion' : [ 0x14, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'InProgress' : [ 0x28, ['long']], + 'u' : [ 0x2c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], + 'ActiveEntry' : [ 0x30, ['pointer', ['pointer', ['void']]]], + 'AttemptForCantExtend' : [ 0x34, ['unsigned char']], + 'PageFileContract' : [ 0x35, ['unsigned char']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '__unnamed_25ad' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_25b1' : [ 0x4, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x4c, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x28, ['__unnamed_25ad']], + 'Subsection' : [ 0x2c, ['pointer', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x30, ['pointer', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x34, ['pointer', ['_MMPTE']]], + 'ViewLinks' : [ 0x38, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x40, ['pointer', ['_EPROCESS']]], + 'u4' : [ 0x44, ['__unnamed_25b1']], + 'FileObject' : [ 0x48, ['pointer', ['_FILE_OBJECT']]], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x10, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'SidCount' : [ 0x8, ['unsigned long']], + 'SidValuesStart' : [ 0xc, ['unsigned long']], +} ], + '_MI_PARTITION_STATE' : [ 0x38, { + 'PartitionLock' : [ 0x0, ['unsigned long']], + 'PartitionIdLock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'InitialPartitionIdBits' : [ 0x8, ['unsigned long long']], + 'PartitionList' : [ 0x10, ['_LIST_ENTRY']], + 'PartitionIdBitmap' : [ 0x18, ['pointer', ['_RTL_BITMAP']]], + 'InitialPartitionIdBitmap' : [ 0x1c, ['_RTL_BITMAP']], + 'TempPartitionPointers' : [ 0x24, ['array', 1, ['pointer', ['_MI_PARTITION']]]], + 'Partition' : [ 0x28, ['pointer', ['pointer', ['_MI_PARTITION']]]], + 'TotalPagesInChildPartitions' : [ 0x2c, ['unsigned long']], + 'CrossPartitionDenials' : [ 0x30, ['unsigned long']], +} ], + '_MMMOD_WRITER_LISTHEAD' : [ 0x18, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Gate' : [ 0x8, ['_KGATE']], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_CM_RM' : [ 0x58, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x8, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x10, ['pointer', ['void']]], + 'Tm' : [ 0x14, ['pointer', ['void']]], + 'RmHandle' : [ 0x18, ['pointer', ['void']]], + 'KtmRm' : [ 0x1c, ['pointer', ['void']]], + 'RefCount' : [ 0x20, ['unsigned long']], + 'ContainerNum' : [ 0x24, ['unsigned long']], + 'ContainerSize' : [ 0x28, ['unsigned long long']], + 'CmHive' : [ 0x30, ['pointer', ['_CMHIVE']]], + 'LogFileObject' : [ 0x34, ['pointer', ['void']]], + 'MarshallingContext' : [ 0x38, ['pointer', ['void']]], + 'RmFlags' : [ 0x3c, ['unsigned long']], + 'LogStartStatus1' : [ 0x40, ['long']], + 'LogStartStatus2' : [ 0x44, ['long']], + 'BaseLsn' : [ 0x48, ['unsigned long long']], + 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0x50, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer', ['_IRP']]], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x10, ['unsigned char']], + 'IrpOplocksR' : [ 0x14, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x1c, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x24, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x2c, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x34, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x3c, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x44, ['pointer', ['_GUID']]], + 'OplockState' : [ 0x48, ['unsigned long']], + 'FastMutex' : [ 0x4c, ['pointer', ['_FAST_MUTEX']]], +} ], + '_MI_LARGEPAGE_MEMORY_INFO' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ColoredPageInfoBase' : [ 0x8, ['pointer', ['_COLORED_PAGE_INFO']]], + 'PagesNeedZeroing' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { + 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PROCESS_ENERGY_VALUES' : [ 0x90, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'DiskEnergy' : [ 0x40, ['unsigned long long']], + 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], + 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], + 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], + 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], + 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'WindowInformation' : [ 0x68, ['unsigned long']], + 'PixelArea' : [ 0x6c, ['unsigned long']], + 'PixelReportTimestamp' : [ 0x70, ['long long']], + 'PixelTime' : [ 0x78, ['unsigned long long']], + 'ForegroundReportTimestamp' : [ 0x80, ['long long']], + 'ForegroundTime' : [ 0x88, ['unsigned long long']], +} ], + '_CLIENT_ID' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], + 'UniqueThread' : [ 0x4, ['pointer', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_MI_COMMON_PAGE_STATE' : [ 0x2c, { + 'PageOfOnesPfn' : [ 0x0, ['pointer', ['_MMPFN']]], + 'PageOfOnes' : [ 0x4, ['unsigned long']], + 'DummyPagePfn' : [ 0x8, ['pointer', ['_MMPFN']]], + 'DummyPage' : [ 0xc, ['unsigned long']], + 'PageOfZeroes' : [ 0x10, ['unsigned long']], + 'ZeroMapping' : [ 0x14, ['pointer', ['void']]], + 'OnesMapping' : [ 0x18, ['pointer', ['void']]], + 'BitmapGapFrames' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'PfnGapFrames' : [ 0x24, ['array', 2, ['unsigned long']]], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0x80, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], + 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x20, ['array', 8, ['pointer', ['void']]]], + 'LastAcquireTrace' : [ 0x40, ['array', 8, ['pointer', ['void']]]], + 'LastReleaseTrace' : [ 0x60, ['array', 8, ['pointer', ['void']]]], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0xc, ['pointer', ['void']]], + 'DirectlyAccessClientToken' : [ 0x10, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x11, ['unsigned char']], + 'ServerIsRemote' : [ 0x12, ['unsigned char']], + 'ClientTokenControl' : [ 0x14, ['_TOKEN_CONTROL']], +} ], + '_MI_VAD_ALLOCATION_CELL' : [ 0x1c, { + 'AllocationBitMap' : [ 0x0, ['_RTL_BITMAP']], + 'BitMapHint' : [ 0x8, ['unsigned long']], + 'LastAllocationSize' : [ 0xc, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0x10, ['unsigned long']], + 'LowestBottomUpVadBit' : [ 0x14, ['unsigned long']], + 'LowestBottomUpAllocationAddress' : [ 0x18, ['pointer', ['void']]], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x18, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x8, ['pointer', ['void']]], + 'SessionViewVa' : [ 0x8, ['pointer', ['void']]], + 'VadsProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'Type' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Subsection' : [ 0xc, ['pointer', ['_SUBSECTION']]], + 'SubsectionType' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SectionOffset' : [ 0x10, ['unsigned long long']], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x10, { + 'SecurityQos' : [ 0x0, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x4, ['pointer', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x8, ['unsigned long']], + 'FullCreateOptions' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_25f2' : [ 0x20, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x1c, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x50, { + 'Status' : [ 0x0, ['long']], + 'PartitionId' : [ 0x4, ['unsigned short']], + 'Priority' : [ 0x6, ['unsigned char']], + 'IrpPriority' : [ 0x7, ['unsigned char']], + 'ReservationWrite' : [ 0x8, ['unsigned char']], + 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x18, ['unsigned long']], + 'ModifiedPagesTotal' : [ 0x1c, ['unsigned long']], + 'ModifiedPagefilePages' : [ 0x20, ['unsigned long']], + 'ModifiedNoWritePages' : [ 0x24, ['unsigned long']], + 'ModifiedPagefileNoReservationPages' : [ 0x28, ['unsigned long']], + 'MdlHack' : [ 0x2c, ['__unnamed_25f2']], +} ], + '_PROC_PERF_DOMAIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x8, ['pointer', ['_KPRCB']]], + 'Members' : [ 0xc, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0x18, ['unsigned long']], + 'Class' : [ 0x1c, ['unsigned char']], + 'Spare' : [ 0x1d, ['array', 3, ['unsigned char']]], + 'Processors' : [ 0x20, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0x24, ['pointer', ['void']]], + 'TimeWindowHandler' : [ 0x28, ['pointer', ['void']]], + 'BoostPolicyHandler' : [ 0x2c, ['pointer', ['void']]], + 'BoostModeHandler' : [ 0x30, ['pointer', ['void']]], + 'EnergyPerfPreferenceHandler' : [ 0x34, ['pointer', ['void']]], + 'AutonomousActivityWindowHandler' : [ 0x38, ['pointer', ['void']]], + 'AutonomousModeHandler' : [ 0x3c, ['pointer', ['void']]], + 'ReinitializeHandler' : [ 0x40, ['pointer', ['void']]], + 'PerfSelectionHandler' : [ 0x44, ['pointer', ['void']]], + 'PerfControlHandler' : [ 0x48, ['pointer', ['void']]], + 'MaxFrequency' : [ 0x4c, ['unsigned long']], + 'NominalFrequency' : [ 0x50, ['unsigned long']], + 'MaxPercent' : [ 0x54, ['unsigned long']], + 'MinPerfPercent' : [ 0x58, ['unsigned long']], + 'MinThrottlePercent' : [ 0x5c, ['unsigned long']], + 'MinimumRelativePerformance' : [ 0x60, ['unsigned long long']], + 'NominalRelativePerformance' : [ 0x68, ['unsigned long long']], + 'Coordination' : [ 0x70, ['unsigned char']], + 'HardPlatformCap' : [ 0x71, ['unsigned char']], + 'AffinitizeControl' : [ 0x72, ['unsigned char']], + 'EfficientThrottle' : [ 0x73, ['unsigned char']], + 'AutonomousMode' : [ 0x74, ['unsigned char']], + 'SelectedPercent' : [ 0x78, ['unsigned long']], + 'SelectedFrequency' : [ 0x7c, ['unsigned long']], + 'DesiredPercent' : [ 0x80, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x84, ['unsigned long']], + 'MinPolicyPercent' : [ 0x88, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x8c, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x90, ['unsigned long']], + 'GuaranteedPercent' : [ 0x94, ['unsigned long']], + 'TolerancePercent' : [ 0x98, ['unsigned long']], + 'SelectedState' : [ 0xa0, ['unsigned long long']], + 'PerfChangeTime' : [ 0xa8, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0xb0, ['unsigned long']], + 'Force' : [ 0xb4, ['unsigned char']], + 'ProvideGuidance' : [ 0xb5, ['unsigned char']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_TABLE' : [ 0x600, { + 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0x50, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Type' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 16, ['pointer', ['void']]]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0xa0, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x20, ['array', 128, ['unsigned char']]], +} ], + '_TRIAGE_9F_PNP' : [ 0xc, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'CompletionQueue' : [ 0x4, ['pointer', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], + 'DelayedWorkQueue' : [ 0x8, ['pointer', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_RELATION_LIST' : [ 0x8, { + 'DeviceObjectList' : [ 0x0, ['pointer', ['_DEVICE_OBJECT_LIST']]], + 'Sorted' : [ 0x4, ['unsigned char']], +} ], + '_IO_TIMER' : [ 0x18, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x4, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Context' : [ 0x10, ['pointer', ['void']]], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_MI_STANDBY_STATE' : [ 0x80, { + 'TransitionSharedPages' : [ 0x0, ['unsigned long']], + 'TransitionSharedPagesPeak' : [ 0x4, ['array', 3, ['unsigned long']]], + 'FirstDecayPage' : [ 0x10, ['unsigned long']], + 'PfnDecayFreeSList' : [ 0x18, ['_SLIST_HEADER']], + 'PfnRepurposeLog' : [ 0x20, ['pointer', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'AllocatePfnRepurposeDpc' : [ 0x24, ['_KDPC']], +} ], + '_MI_ACCESS_LOG_STATE' : [ 0x80, { + 'CcAccessLog' : [ 0x0, ['pointer', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'Enabled' : [ 0x4, ['unsigned long']], + 'DisableAccessLogging' : [ 0x8, ['_WORK_QUEUE_ITEM']], + 'MinLoggingPriority' : [ 0x18, ['unsigned long']], + 'AccessLoggingLock' : [ 0x40, ['unsigned long']], +} ], + '_ETW_BUFFER_QUEUE' : [ 0xc, { + 'QueueHead' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'QueueTail' : [ 0x4, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x48, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long']], + 'SpecialPoolPdes' : [ 0x3c, ['_RTL_BITMAP']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x4, { + 'LogHandleContext' : [ 0x0, ['pointer', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x10, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], + 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x10, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'DeviceState' : [ 0xc, ['pointer', ['_POP_DEVICE_SYS_STATE']]], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x4, ['_KMUTANT']], + 'Lock' : [ 0x24, ['_FAST_MUTEX']], + 'List' : [ 0x44, ['_LIST_ENTRY']], +} ], + '_IOV_IRP_TRACE' : [ 0x40, { + 'Irp' : [ 0x0, ['pointer', ['_IRP']]], + 'Thread' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x8, ['short']], + 'SpecialApcDisable' : [ 0xa, ['short']], + 'CombinedApcDisable' : [ 0x8, ['unsigned long']], + 'Irql' : [ 0xc, ['unsigned char']], + 'StackTrace' : [ 0x10, ['array', 12, ['pointer', ['void']]]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x10, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x8, ['_PO_IRP_QUEUE']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x8, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x4, ['pointer', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_PROC_IDLE_POLICY' : [ 0x6, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], + 'ForceLightIdle' : [ 0x5, ['unsigned char']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2657' : [ 0x4, { + 'PercentLevel' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2659' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x10, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0xc, ['__unnamed_2657']], + 'Button' : [ 0xc, ['__unnamed_2659']], +} ], + '_KDPC_DATA' : [ 0x18, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x8, ['unsigned long']], + 'DpcQueueDepth' : [ 0xc, ['long']], + 'DpcCount' : [ 0x10, ['unsigned long']], + 'ActiveDpc' : [ 0x14, ['pointer', ['_KDPC']]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_KSCB' : [ 0xf8, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], + 'RankCycleTarget' : [ 0x18, ['unsigned long long']], + 'LongTermCycles' : [ 0x20, ['unsigned long long']], + 'LastReportedCycles' : [ 0x28, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], + 'ReadyTime' : [ 0x38, ['unsigned long long']], + 'InsertTime' : [ 0x40, ['unsigned long long']], + 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x50, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'MaxOverQuota' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'MinOverQuota' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SoftCap' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Spare1' : [ 0x5c, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Depth' : [ 0x5d, ['unsigned char']], + 'ReadySummary' : [ 0x5e, ['unsigned short']], + 'Rank' : [ 0x60, ['unsigned long']], + 'ReadyListHead' : [ 0x64, ['array', 16, ['_LIST_ENTRY']]], + 'ChildScbQueue' : [ 0xe4, ['_RTL_RB_TREE']], + 'Parent' : [ 0xec, ['pointer', ['_KSCB']]], + 'Root' : [ 0xf0, ['pointer', ['_KSCB']]], +} ], + '__unnamed_2668' : [ 0x8, { + 'UserData' : [ 0x0, ['pointer', ['void']]], + 'Owner' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_2669' : [ 0x8, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_2668']], + 'Merged' : [ 0x10, ['__unnamed_2669']], + 'Attributes' : [ 0x18, ['unsigned char']], + 'PublicFlags' : [ 0x19, ['unsigned char']], + 'PrivateFlags' : [ 0x1a, ['unsigned short']], + 'ListEntry' : [ 0x1c, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0xc, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x4, ['pointer', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x8, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'UtilityTotal' : [ 0x8, ['unsigned long']], + 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], + 'FrequencyTotal' : [ 0x10, ['unsigned long']], + 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], + 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_MI_PARTITION_ZEROING' : [ 0x40, { + 'PageEvent' : [ 0x0, ['_KEVENT']], + 'ThreadActive' : [ 0x10, ['unsigned char']], + 'ZeroFreePageSlistMinimum' : [ 0x14, ['long']], + 'FirstReservedZeroingPte' : [ 0x18, ['pointer', ['_MMPTE']]], + 'RebalanceZeroFreeWorkItem' : [ 0x1c, ['_WORK_QUEUE_ITEM']], + 'ThreadCount' : [ 0x2c, ['long']], + 'Gate' : [ 0x30, ['_KGATE']], +} ], + '__unnamed_2676' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_2676']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x18, { + 'ActiveFrame' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x4, ['_LIST_ENTRY']], + 'Flags' : [ 0xc, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x10, ['unsigned long']], + 'StackId' : [ 0x14, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Processors' : [ 0x4, ['unsigned long']], + 'ActiveProcessors' : [ 0x8, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x10, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_268e' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2690' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_268e']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0xa8, { + 'SuspectDriverEntry' : [ 0x0, ['pointer', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x4, ['pointer', ['void']]], + 'EtwHandlesListHead' : [ 0x8, ['_LIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_2690']], + 'Signature' : [ 0x14, ['unsigned long']], + 'PoolPageHeaders' : [ 0x18, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x20, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x28, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x2c, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x30, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x34, ['unsigned long']], + 'PagedBytes' : [ 0x38, ['unsigned long']], + 'NonPagedBytes' : [ 0x3c, ['unsigned long']], + 'PeakPagedBytes' : [ 0x40, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x44, ['unsigned long']], + 'RaiseIrqls' : [ 0x48, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x4c, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x50, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x54, ['unsigned long']], + 'AllocationsFailed' : [ 0x58, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x5c, ['unsigned long']], + 'LockedBytes' : [ 0x60, ['unsigned long']], + 'PeakLockedBytes' : [ 0x64, ['unsigned long']], + 'MappedLockedBytes' : [ 0x68, ['unsigned long']], + 'PeakMappedLockedBytes' : [ 0x6c, ['unsigned long']], + 'MappedIoSpaceBytes' : [ 0x70, ['unsigned long']], + 'PeakMappedIoSpaceBytes' : [ 0x74, ['unsigned long']], + 'PagesForMdlBytes' : [ 0x78, ['unsigned long']], + 'PeakPagesForMdlBytes' : [ 0x7c, ['unsigned long']], + 'ContiguousMemoryBytes' : [ 0x80, ['unsigned long']], + 'PeakContiguousMemoryBytes' : [ 0x84, ['unsigned long']], + 'ContiguousMemoryListHead' : [ 0x88, ['_LIST_ENTRY']], + 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], + 'ExecutePageProtections' : [ 0x94, ['unsigned long']], + 'ExecutePageMappings' : [ 0x98, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], +} ], + '_TRIAGE_DEVICE_NODE' : [ 0x2c, { + 'Sibling' : [ 0x0, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'Child' : [ 0x4, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'Parent' : [ 0x8, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'LastChild' : [ 0xc, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x14, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x1c, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'FxDevice' : [ 0x28, ['pointer', ['_TRIAGE_POP_FX_DEVICE']]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long']], + 'PipelinedReadAheadRequestSize' : [ 0x54, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x58, ['unsigned long']], + 'PrivateLinks' : [ 0x5c, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x64, ['pointer', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MI_SYSTEM_IMAGE_STATE' : [ 0x6c, { + 'FixupLock' : [ 0x0, ['long']], + 'FixupList' : [ 0x4, ['_LIST_ENTRY']], + 'LoadLock' : [ 0xc, ['_KMUTANT']], + 'FirstLoadEver' : [ 0x2c, ['unsigned char']], + 'LargePageAll' : [ 0x2d, ['unsigned char']], + 'LastPage' : [ 0x30, ['unsigned long']], + 'LargePageList' : [ 0x34, ['_LIST_ENTRY']], + 'BeingDeleted' : [ 0x3c, ['pointer', ['_KLDR_DATA_TABLE_ENTRY']]], + 'MappingRangesPushLock' : [ 0x40, ['_EX_PUSH_LOCK']], + 'MappingRanges' : [ 0x44, ['array', 2, ['pointer', ['_MI_DRIVER_VA']]]], + 'PageCount' : [ 0x4c, ['unsigned long']], + 'PageCounts' : [ 0x50, ['_MM_SYSTEM_PAGE_COUNTS']], + 'CollidedLock' : [ 0x60, ['_EX_PUSH_LOCK']], + 'ErrataPte' : [ 0x64, ['pointer', ['_MMPTE']]], + 'ErrataPteMapped' : [ 0x68, ['unsigned long']], +} ], + '_PTE_TRACKER' : [ 0x44, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x8, ['pointer', ['_MDL']]], + 'Count' : [ 0xc, ['unsigned long']], + 'SystemVa' : [ 0x10, ['pointer', ['void']]], + 'StartVa' : [ 0x14, ['pointer', ['void']]], + 'Offset' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], + 'Page' : [ 0x20, ['unsigned long']], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'GuardPte' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x28, ['array', 7, ['pointer', ['void']]]], +} ], + '_HV_GET_CELL_CONTEXT' : [ 0x4, { + 'Cell' : [ 0x0, ['unsigned long']], + 'IsInTempBin' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0xc, ['unsigned long']], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0xc, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_26c2' : [ 0x2, { + 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'EntireField' : [ 0x0, ['unsigned short']], +} ], + '_KLDR_DATA_TABLE_ENTRY' : [ 0x5c, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'ExceptionTable' : [ 0x8, ['pointer', ['void']]], + 'ExceptionTableSize' : [ 0xc, ['unsigned long']], + 'GpValue' : [ 0x10, ['pointer', ['void']]], + 'NonPagedDebugInfo' : [ 0x14, ['pointer', ['_NON_PAGED_DEBUG_INFO']]], + 'DllBase' : [ 0x18, ['pointer', ['void']]], + 'EntryPoint' : [ 0x1c, ['pointer', ['void']]], + 'SizeOfImage' : [ 0x20, ['unsigned long']], + 'FullDllName' : [ 0x24, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x2c, ['_UNICODE_STRING']], + 'Flags' : [ 0x34, ['unsigned long']], + 'LoadCount' : [ 0x38, ['unsigned short']], + 'u1' : [ 0x3a, ['__unnamed_26c2']], + 'SectionPointer' : [ 0x3c, ['pointer', ['void']]], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'CoverageSectionSize' : [ 0x44, ['unsigned long']], + 'CoverageSection' : [ 0x48, ['pointer', ['void']]], + 'LoadedImports' : [ 0x4c, ['pointer', ['void']]], + 'Spare' : [ 0x50, ['pointer', ['void']]], + 'SizeOfImageNotRounded' : [ 0x54, ['unsigned long']], + 'TimeDateStamp' : [ 0x58, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x28, { + 'InstantaneousRead' : [ 0x0, ['pointer', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'Scaling' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x24, ['unsigned long']], +} ], + '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], + 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PAGING_IO_STATE' : [ 0x38, { + 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], + 'PageFileHeadSpinLock' : [ 0x4, ['long']], + 'PrefetchSeekThreshold' : [ 0x8, ['long']], + 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], + 'InPageSupportSListMinimum' : [ 0x20, ['array', 2, ['unsigned char']]], + 'InPageSinglePages' : [ 0x24, ['unsigned long']], + 'DelayPageFaults' : [ 0x28, ['long']], + 'FileCompressionBoundary' : [ 0x2c, ['unsigned long']], + 'MdlsAdjusted' : [ 0x30, ['unsigned char']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_MI_FORCED_COMMITS' : [ 0x8, { + 'Regular' : [ 0x0, ['unsigned long']], + 'Wrap' : [ 0x4, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x14, { + 'BlockOffset' : [ 0x0, ['unsigned long']], + 'PermanentBinAddress' : [ 0x4, ['unsigned long']], + 'TemporaryBinAddress' : [ 0x8, ['unsigned long']], + 'TemporaryBinRundown' : [ 0xc, ['_EX_RUNDOWN_REF']], + 'MemAlloc' : [ 0x10, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x1c, { + 'HashLink' : [ 0x0, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x4, ['unsigned short']], + 'Atom' : [ 0x6, ['unsigned short']], + 'Reference' : [ 0x8, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x18, ['unsigned char']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { + 'ResetCount' : [ 0x0, ['unsigned long']], + 'StateCount' : [ 0x4, ['unsigned long']], + 'DeepSleepCount' : [ 0x8, ['unsigned long']], + 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x4, ['pointer', ['void']]], +} ], + '_DUAL' : [ 0x19c, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x4, ['pointer', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x8, ['pointer', ['_HMAP_TABLE']]], + 'Guard' : [ 0xc, ['unsigned long']], + 'FreeDisplay' : [ 0x10, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x190, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x198, ['unsigned long']], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x4, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 11, native_type='unsigned long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_26f1' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_26f4' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0xf8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Event' : [ 0x10, ['_KEVENT']], + 'CollidedEvent' : [ 0x20, ['_KEVENT']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ApcState' : [ 0x40, ['_KAPC_STATE']], + 'Thread' : [ 0x58, ['pointer', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0x5c, ['pointer', ['_MMPFN']]], + 'PteContents' : [ 0x60, ['_MMPTE']], + 'WaitCount' : [ 0x68, ['long']], + 'ByteCount' : [ 0x6c, ['unsigned long']], + 'u3' : [ 0x70, ['__unnamed_26f1']], + 'u1' : [ 0x74, ['__unnamed_26f4']], + 'FilePointer' : [ 0x78, ['pointer', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x7c, ['pointer', ['_CONTROL_AREA']]], + 'Subsection' : [ 0x7c, ['pointer', ['_SUBSECTION']]], + 'Autoboost' : [ 0x80, ['pointer', ['void']]], + 'FaultingAddress' : [ 0x84, ['pointer', ['void']]], + 'PointerPte' : [ 0x88, ['pointer', ['_MMPTE']]], + 'BasePte' : [ 0x8c, ['pointer', ['_MMPTE']]], + 'Pfn' : [ 0x90, ['pointer', ['_MMPFN']]], + 'PrefetchMdl' : [ 0x94, ['pointer', ['_MDL']]], + 'Mdl' : [ 0x98, ['_MDL']], + 'Page' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'FlowThrough' : [ 0xb4, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], +} ], + '_HAL_NODE_RANGE' : [ 0x8, { + 'PageFrameIndex' : [ 0x0, ['unsigned long']], + 'Node' : [ 0x4, ['unsigned long']], +} ], + '_MMCLONE_BLOCK' : [ 0x10, { + 'ProtoPte' : [ 0x0, ['_MMPTE']], + 'CloneCommitCount' : [ 0x8, ['unsigned long']], + 'u1' : [ 0x8, ['_MI_CLONE_BLOCK_FLAGS']], + 'CloneRefCount' : [ 0xc, ['unsigned long']], +} ], + '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { + 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], + 'ReorderingBarrier' : [ 0x10, ['unsigned char']], + 'RequestArgument' : [ 0x14, ['unsigned long']], + 'CompletionEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'CompletionStatus' : [ 0x1c, ['pointer', ['long']]], + 'ActivityId' : [ 0x20, ['_GUID']], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x1c, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'PackageSid' : [ 0x10, ['pointer', ['void']]], + 'LowboxNumber' : [ 0x14, ['unsigned long']], + 'AtomTable' : [ 0x18, ['pointer', ['void']]], +} ], + '_MI_LDW_WORK_CONTEXT' : [ 0x20, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'FileObject' : [ 0x10, ['pointer', ['_FILE_OBJECT']]], + 'ErrorStatus' : [ 0x14, ['long']], + 'Active' : [ 0x18, ['long']], + 'FreeWhenDone' : [ 0x1c, ['unsigned char']], +} ], + '_MI_CFG_BITMAP_INFO' : [ 0xc, { + 'BaseAddress' : [ 0x0, ['pointer', ['void']]], + 'RegionSize' : [ 0x4, ['unsigned long']], + 'BitmapVad' : [ 0x8, ['pointer', ['_MMVAD']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MI_SHUTDOWN_STATE' : [ 0x48, { + 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], + 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], + 'SystemShutdown' : [ 0x4, ['unsigned long']], + 'ShutdownFlushInProgress' : [ 0x8, ['long']], + 'ResumeItem' : [ 0xc, ['_MI_RESUME_WORKITEM']], + 'MirrorHoldsPfn' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'MirroringActive' : [ 0x30, ['unsigned long']], + 'MirrorBitMaps' : [ 0x34, ['array', 2, ['_RTL_BITMAP']]], + 'CrashDumpPte' : [ 0x44, ['pointer', ['_MMPTE']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x30, { + 'TransferAddress' : [ 0x0, ['pointer', ['void']]], + 'ZeroBits' : [ 0x4, ['unsigned long']], + 'MaximumStackSize' : [ 0x8, ['unsigned long']], + 'CommittedStackSize' : [ 0xc, ['unsigned long']], + 'SubSystemType' : [ 0x10, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x14, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x16, ['unsigned short']], + 'SubSystemVersion' : [ 0x14, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x18, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x1a, ['unsigned short']], + 'OperatingSystemVersion' : [ 0x18, ['unsigned long']], + 'ImageCharacteristics' : [ 0x1c, ['unsigned short']], + 'DllCharacteristics' : [ 0x1e, ['unsigned short']], + 'Machine' : [ 0x20, ['unsigned short']], + 'ImageContainsCode' : [ 0x22, ['unsigned char']], + 'ImageFlags' : [ 0x23, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ComPlusPrefer32bit' : [ 0x23, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x24, ['unsigned long']], + 'ImageFileSize' : [ 0x28, ['unsigned long']], + 'CheckSum' : [ 0x2c, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x3c, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x8, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x10, ['pointer', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x14, ['pointer', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x18, ['pointer', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x18, ['array', 4, ['pointer', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x18, ['pointer', ['void']]], + 'SessionId' : [ 0x1c, ['unsigned long']], + 'Process' : [ 0x28, ['pointer', ['_EPROCESS']]], + 'CallbackContext' : [ 0x28, ['pointer', ['void']]], + 'Callback' : [ 0x2c, ['pointer', ['void']]], + 'Index' : [ 0x30, ['unsigned short']], + 'Flags' : [ 0x32, ['unsigned char']], + 'DbgKernelRegistration' : [ 0x32, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgUserRegistration' : [ 0x32, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DbgReplyRegistration' : [ 0x32, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'DbgClassicRegistration' : [ 0x32, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'DbgSessionSpaceRegistration' : [ 0x32, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DbgModernRegistration' : [ 0x32, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DbgClosed' : [ 0x32, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DbgInserted' : [ 0x32, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'EnableMask' : [ 0x33, ['unsigned char']], + 'GroupEnableMask' : [ 0x34, ['unsigned char']], + 'UseDescriptorType' : [ 0x35, ['unsigned char']], + 'Traits' : [ 0x38, ['pointer', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0xa4, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x4, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x8, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x18, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x20, ['pointer', ['void']]], + 'ServerSectionBase' : [ 0x24, ['pointer', ['void']]], + 'PortContext' : [ 0x28, ['pointer', ['void']]], + 'ClientThread' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'SecurityQos' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x3c, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0x78, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0x80, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MappingProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0x8c, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0x8e, ['unsigned short']], + 'Flags' : [ 0x90, ['unsigned long']], + 'WaitEvent' : [ 0x94, ['_KEVENT']], +} ], + '_HVIEW_MAP_PIN_LOG' : [ 0x308, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x8, ['unsigned long']], + 'Alternatives' : [ 0xc, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'WorkSpace' : [ 0x1c, ['long']], + 'InterfaceType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x24, ['unsigned long']], + 'BusNumber' : [ 0x28, ['unsigned long']], + 'Assignment' : [ 0x2c, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x30, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { + 'UserRangeInKernel' : [ 0x0, ['unsigned long']], + 'FaultFailed' : [ 0x4, ['unsigned long']], + 'WriteFaultFailed' : [ 0x8, ['unsigned long']], + 'LargePageFailed' : [ 0xc, ['unsigned long']], + 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], + 'BadPageLocation' : [ 0x14, ['unsigned long']], + 'InsufficientCharge' : [ 0x18, ['unsigned long']], + 'PageTableCharge' : [ 0x1c, ['unsigned long']], + 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], + 'NoIoReference' : [ 0x24, ['unsigned long']], + 'ProbeFailed' : [ 0x28, ['unsigned long']], + 'PteIsZero' : [ 0x2c, ['unsigned long']], + 'StrongCodeWrite' : [ 0x30, ['unsigned long']], + 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], + 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], + 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x14, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'Traits' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0x58, { + 'Count' : [ 0x0, ['unsigned long']], + 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_MI_CLONE_BLOCK_FLAGS' : [ 0x4, { + 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 27, native_type='unsigned long')]], + 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0xa0, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x8, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DllBase' : [ 0x18, ['pointer', ['void']]], + 'EntryPoint' : [ 0x1c, ['pointer', ['void']]], + 'SizeOfImage' : [ 0x20, ['unsigned long']], + 'FullDllName' : [ 0x24, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x2c, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x34, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x34, ['unsigned long']], + 'PackagedBinary' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x34, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x34, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x34, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x34, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x34, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x34, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x34, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x34, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LoadConfigProcessed' : [ 0x34, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x34, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x34, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x34, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x34, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x34, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x34, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x34, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x34, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x34, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x34, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x38, ['unsigned short']], + 'TlsIndex' : [ 0x3a, ['unsigned short']], + 'HashLinks' : [ 0x3c, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x44, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x48, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x4c, ['pointer', ['void']]], + 'DdagNode' : [ 0x50, ['pointer', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0x54, ['_LIST_ENTRY']], + 'LoadContext' : [ 0x5c, ['pointer', ['_LDRP_LOAD_CONTEXT']]], + 'ParentDllBase' : [ 0x60, ['pointer', ['void']]], + 'SwitchBackContext' : [ 0x64, ['pointer', ['void']]], + 'BaseAddressIndexNode' : [ 0x68, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0x74, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0x80, ['unsigned long']], + 'LoadTime' : [ 0x88, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x90, ['unsigned long']], + 'LoadReason' : [ 0x94, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x98, ['unsigned long']], + 'ReferenceCount' : [ 0x9c, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x18, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x8, ['long']], + 'Misses' : [ 0xc, ['unsigned long']], + 'MissesLast' : [ 0x10, ['unsigned long']], + 'AllStacksInUse' : [ 0x14, ['unsigned long']], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_DRIVER_VA' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_MI_DRIVER_VA']]], + 'PointerPte' : [ 0x4, ['pointer', ['_MMPTE']]], + 'BitMap' : [ 0x8, ['_RTL_BITMAP']], + 'Hint' : [ 0x10, ['unsigned long']], +} ], + '_LDR_DDAG_NODE' : [ 0x2c, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x8, ['pointer', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0xc, ['unsigned long']], + 'LoadWhileUnloadingCount' : [ 0x10, ['unsigned long']], + 'LowestLink' : [ 0x14, ['unsigned long']], + 'Dependencies' : [ 0x18, ['_LDRP_CSLIST']], + 'IncomingDependencies' : [ 0x1c, ['_LDRP_CSLIST']], + 'State' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x24, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x28, ['unsigned long']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x104, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long']], + 'Thread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'AbortEvent' : [ 0x10, ['pointer', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x14, ['pointer', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x18, ['pointer', ['_KSEMAPHORE']]], + 'Order' : [ 0x1c, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0xec, ['_LIST_ENTRY']], + 'Status' : [ 0xf4, ['long']], + 'FailedDevice' : [ 0xf8, ['pointer', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0xfc, ['unsigned char']], + 'Cancelled' : [ 0xfd, ['unsigned char']], + 'IgnoreErrors' : [ 0xfe, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0xff, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x100, ['unsigned char']], +} ], + '_KHETERO_PROCESSOR_SET' : [ 0x8, { + 'PreferredMask' : [ 0x0, ['unsigned long']], + 'AvailableMask' : [ 0x4, ['unsigned long']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 7, ['pointer', ['void']]]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x8, { + 'LogHandle' : [ 0x0, ['pointer', ['void']]], + 'FlushToLsnRoutine' : [ 0x4, ['pointer', ['void']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned long']], + 'CallerType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x8, ['unsigned long']], + 'DevicePathOffset' : [ 0xc, ['unsigned long']], + 'ReasonOffset' : [ 0x14, ['unsigned long']], +} ], + '_KWAIT_CHAIN_ENTRY' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Event' : [ 0x4, ['_KEVENT']], +} ], + '__unnamed_276f' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '__unnamed_2771' : [ 0x4, { + 'NumberOfChildViews' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2773' : [ 0x4, { + 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SUBSECTION' : [ 0x28, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x4, ['pointer', ['_MMPTE']]], + 'NextSubsection' : [ 0x8, ['pointer', ['_SUBSECTION']]], + 'GlobalPerSessionHead' : [ 0xc, ['_RTL_AVL_TREE']], + 'CreationWaitList' : [ 0xc, ['pointer', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'SessionDriverProtos' : [ 0xc, ['pointer', ['_MI_PER_SESSION_PROTOS']]], + 'u' : [ 0x10, ['__unnamed_276f']], + 'StartingSector' : [ 0x14, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x18, ['unsigned long']], + 'PtesInSubsection' : [ 0x1c, ['unsigned long']], + 'u1' : [ 0x20, ['__unnamed_2771']], + 'UnusedPtes' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x24, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u2' : [ 0x24, ['__unnamed_2773']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x4, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x8, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x14, ['unsigned long']], + 'PagingCount' : [ 0x18, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x1c, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0x44, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Name' : [ 0xc, ['_UNICODE_STRING']], + 'Latency' : [ 0x14, ['unsigned long']], + 'BreakEvenDuration' : [ 0x18, ['unsigned long']], + 'Power' : [ 0x1c, ['unsigned long']], + 'StateFlags' : [ 0x20, ['unsigned long']], + 'VetoAccounting' : [ 0x24, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0x3c, ['unsigned char']], + 'InterruptsEnabled' : [ 0x3d, ['unsigned char']], + 'Interruptible' : [ 0x3e, ['unsigned char']], + 'ContextRetained' : [ 0x3f, ['unsigned char']], + 'CacheCoherent' : [ 0x40, ['unsigned char']], + 'WakesSpuriously' : [ 0x41, ['unsigned char']], + 'PlatformOnly' : [ 0x42, ['unsigned char']], + 'NoCState' : [ 0x43, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x154, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'State' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x1c, ['_KMUTANT']], + 'NamespaceLink' : [ 0x3c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x50, ['_GUID']], + 'NotificationQueue' : [ 0x60, ['_KQUEUE']], + 'NotificationMutex' : [ 0x88, ['_KMUTANT']], + 'EnlistmentHead' : [ 0xa8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xb0, ['unsigned long']], + 'NotificationRoutine' : [ 0xb4, ['pointer', ['void']]], + 'Key' : [ 0xb8, ['pointer', ['void']]], + 'ProtocolListHead' : [ 0xbc, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0xc4, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0xcc, ['_LIST_ENTRY']], + 'Tm' : [ 0xd4, ['pointer', ['_KTM']]], + 'Description' : [ 0xd8, ['_UNICODE_STRING']], + 'Enlistments' : [ 0xe0, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x140, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_MI_SYSTEM_PTE_STATE' : [ 0x180, { + 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'PteTrackerLock' : [ 0x8, ['unsigned long']], + 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], + 'PteTrackingBitmap' : [ 0x100, ['_RTL_BITMAP']], + 'CachedPteHeads' : [ 0x108, ['pointer', ['_MI_CACHED_PTES']]], + 'SystemViewPteInfo' : [ 0x10c, ['_MI_SYSTEM_PTE_TYPE']], + 'KernelStackPages' : [ 0x140, ['unsigned char']], + 'QueuedStacks' : [ 0x148, ['_SLIST_HEADER']], + 'StackGrowthFailures' : [ 0x150, ['unsigned long']], + 'TrackPtesAborted' : [ 0x154, ['unsigned char']], + 'AdjustCounter' : [ 0x155, ['unsigned char']], + 'QueuedStacksWorkItem' : [ 0x158, ['_MI_QUEUED_DEADSTACK_WORKITEM']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x34, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x4, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x8, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0xc, ['long']], + 'HighWaterMark' : [ 0x10, ['unsigned long']], + 'Reserved' : [ 0x14, ['array', 8, ['unsigned long']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long long']], + 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_27a3' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x14, { + 'NodeRangeSize' : [ 0x0, ['unsigned long']], + 'NodeCount' : [ 0x4, ['unsigned long']], + 'Tables' : [ 0x8, ['pointer', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0xc, ['unsigned long']], + 'u1' : [ 0x10, ['__unnamed_27a3']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['unsigned char']], + 'DripsRequiredState' : [ 0x8, ['unsigned long']], + 'Level' : [ 0xc, ['long']], + 'ActiveStamp' : [ 0x10, ['long long']], + 'CsActiveTime' : [ 0x18, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x20, ['long long']], +} ], + '_MI_RESUME_WORKITEM' : [ 0x20, { + 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x10, ['long']], + 'Link' : [ 0x14, ['_LIST_ENTRY']], + 'Trigger' : [ 0x1c, ['pointer', ['_POP_ACTION_TRIGGER']]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_TRIAGE_EX_WORK_QUEUE' : [ 0x19c, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], +} ], + '_POP_FX_COMPONENT' : [ 0xc0, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x14, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x30, ['pointer', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x34, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x3c, ['long']], + 'ActiveEvent' : [ 0x40, ['_KEVENT']], + 'IdleLock' : [ 0x50, ['unsigned long']], + 'IdleConditionComplete' : [ 0x54, ['long']], + 'IdleStateComplete' : [ 0x58, ['long']], + 'IdleStamp' : [ 0x60, ['unsigned long long']], + 'CurrentIdleState' : [ 0x68, ['unsigned long']], + 'IdleStateCount' : [ 0x6c, ['unsigned long']], + 'IdleStates' : [ 0x70, ['pointer', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0x74, ['unsigned long']], + 'ProviderCount' : [ 0x78, ['unsigned long']], + 'Providers' : [ 0x7c, ['pointer', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0x80, ['unsigned long']], + 'DependentCount' : [ 0x84, ['unsigned long']], + 'Dependents' : [ 0x88, ['pointer', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0x90, ['_POP_FX_ACCOUNTING']], + 'Performance' : [ 0xb8, ['pointer', ['_POP_FX_PERF_INFO']]], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x8, { + 'DeviceHandle' : [ 0x0, ['pointer', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x4, ['pointer', ['void']]], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x1c, { + 'ComponentActive' : [ 0x0, ['pointer', ['void']]], + 'ComponentIdle' : [ 0x4, ['pointer', ['void']]], + 'ComponentIdleState' : [ 0x8, ['pointer', ['void']]], + 'DevicePowerRequired' : [ 0xc, ['pointer', ['void']]], + 'DevicePowerNotRequired' : [ 0x10, ['pointer', ['void']]], + 'PowerControl' : [ 0x14, ['pointer', ['void']]], + 'ComponentCriticalTransition' : [ 0x18, ['pointer', ['void']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x2c, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x8, ['unsigned char']], + 'Spare' : [ 0x9, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0xc, ['unsigned long']], + 'DebugId' : [ 0x10, ['_CVDD']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x40f0, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x14, ['unsigned long']], + 'ResourceAddressRange' : [ 0x18, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x2010, ['pointer', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x2014, ['unsigned long']], + 'ThreadAddressRange' : [ 0x2018, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x4010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x4014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x4018, ['unsigned long']], + 'NodesSearched' : [ 0x401c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x4020, ['unsigned long']], + 'SequenceNumber' : [ 0x4024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x4028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x402c, ['unsigned long']], + 'DepthLimitHits' : [ 0x4030, ['unsigned long']], + 'SearchLimitHits' : [ 0x4034, ['unsigned long']], + 'StackLimitHits' : [ 0x4038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x403c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x4040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x4044, ['unsigned long']], + 'TotalReleases' : [ 0x4048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x404c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x4050, ['unsigned long']], + 'Instigator' : [ 0x4054, ['pointer', ['void']]], + 'NumberOfParticipants' : [ 0x4058, ['unsigned long']], + 'Participant' : [ 0x405c, ['array', 32, ['pointer', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x40dc, ['long']], + 'StackType' : [ 0x40e0, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x40e4, ['unsigned long']], + 'StackHighLimit' : [ 0x40e8, ['unsigned long']], +} ], + '_KTM' : [ 0x238, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x4, ['_KMUTANT']], + 'State' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x28, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x3c, ['_GUID']], + 'Flags' : [ 0x4c, ['unsigned long']], + 'VolatileFlags' : [ 0x50, ['unsigned long']], + 'LogFileName' : [ 0x54, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x5c, ['pointer', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0x60, ['pointer', ['void']]], + 'LogManagementContext' : [ 0x64, ['pointer', ['void']]], + 'Transactions' : [ 0x68, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0xc8, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x128, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x148, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x150, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x158, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x178, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x180, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x188, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x190, ['pointer', ['void']]], + 'TmRm' : [ 0x194, ['pointer', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x198, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x1a8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x1b8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x1c0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x1d0, ['_ERESOURCE']], + 'LogFlags' : [ 0x208, ['unsigned long']], + 'LogFullStatus' : [ 0x20c, ['long']], + 'RecoveryStatus' : [ 0x210, ['long']], + 'LastCheckBaseLsn' : [ 0x218, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x220, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x228, ['_WORK_QUEUE_ITEM']], +} ], + '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { + 'SystemCodePage' : [ 0x0, ['unsigned long']], + 'SystemDriverPage' : [ 0x4, ['unsigned long']], + 'TotalSystemCodePages' : [ 0x8, ['long']], + 'TotalSystemDriverPages' : [ 0xc, ['long']], +} ], + '_MI_MODWRITE_DATA' : [ 0x30, { + 'PagesLoad' : [ 0x0, ['long']], + 'PagesAverage' : [ 0x4, ['unsigned long']], + 'AverageAvailablePages' : [ 0x8, ['unsigned long']], + 'PagesWritten' : [ 0xc, ['unsigned long']], + 'WritesIssued' : [ 0x10, ['unsigned long']], + 'IgnoredReservationsCount' : [ 0x14, ['unsigned long']], + 'FreedReservationsCount' : [ 0x18, ['unsigned long']], + 'WriteBurstCount' : [ 0x1c, ['unsigned long']], + 'IgnoreReservationsStartTime' : [ 0x20, ['unsigned long long']], + 'ReservationClusterInfo' : [ 0x28, ['_MI_RESERVATION_CLUSTER_INFO']], + 'IgnoreReservations' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'Spare1' : [ 0x2e, ['unsigned short']], +} ], + '_VF_BTS_RECORD' : [ 0xc, { + 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], + 'JumpedTo' : [ 0x4, ['pointer', ['void']]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], +} ], + '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { + 'CancelCount' : [ 0x0, ['unsigned long']], + 'FailureCount' : [ 0x4, ['unsigned long']], + 'SuccessCount' : [ 0x8, ['unsigned long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'TotalTime' : [ 0x20, ['unsigned long long']], + 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], + 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_KTRANSACTION' : [ 0x1e0, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'Mutex' : [ 0x14, ['_KMUTANT']], + 'TreeTx' : [ 0x34, ['pointer', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x38, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x4c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0x60, ['_GUID']], + 'State' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0x74, ['unsigned long']], + 'EnlistmentHead' : [ 0x78, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x80, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0x84, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0x88, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0x8c, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0x90, ['unsigned long']], + 'PendingResponses' : [ 0x94, ['unsigned long']], + 'SuperiorEnlistment' : [ 0x98, ['pointer', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xa0, ['_CLS_LSN']], + 'PromotedEntry' : [ 0xa8, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0xb0, ['pointer', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0xb4, ['pointer', ['void']]], + 'IsolationLevel' : [ 0xb8, ['unsigned long']], + 'IsolationFlags' : [ 0xbc, ['unsigned long']], + 'Timeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'Description' : [ 0xc8, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0xd0, ['pointer', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0xd4, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0xe4, ['_KDPC']], + 'RollbackTimer' : [ 0x108, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x130, ['_LIST_ENTRY']], + 'Outcome' : [ 0x138, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x13c, ['pointer', ['_KTM']]], + 'CommitReservation' : [ 0x140, ['long long']], + 'TransactionHistory' : [ 0x148, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x198, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x19c, ['pointer', ['void']]], + 'DTCPrivateInformationLength' : [ 0x1a0, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x1a4, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x1c4, ['pointer', ['void']]], + 'PendingPromotionCount' : [ 0x1c8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x38, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x8, ['pointer', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0xc, ['pointer', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x18, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x1c, ['pointer', ['_CM_TRANS']]], + 'UoWState' : [ 0x20, ['unsigned long']], + 'ActionType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x30, ['unsigned long']], + 'OldValueCell' : [ 0x30, ['unsigned long']], + 'NewValueCell' : [ 0x34, ['unsigned long']], + 'UserFlags' : [ 0x30, ['unsigned long']], + 'LastWriteTime' : [ 0x30, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x30, ['unsigned long']], + 'OldChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x34, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x34, ['unsigned long']], +} ], + '_KPROCESSOR_STATE' : [ 0x320, { + 'ContextFrame' : [ 0x0, ['_CONTEXT']], + 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], +} ], + '_KREQUEST_PACKET' : [ 0x10, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer', ['void']]]], + 'WorkerRoutine' : [ 0xc, ['pointer', ['void']]], +} ], + '_VF_WATCHDOG_IRP' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'DueTickCount' : [ 0xc, ['unsigned long']], + 'Inserted' : [ 0x10, ['unsigned char']], + 'TrackedStackLocation' : [ 0x11, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x12, ['unsigned short']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_281d' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_281f' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_281d']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_281f']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'RealRefCount' : [ 0x14, ['unsigned long']], + 'Descriptor' : [ 0x18, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_CM_NAME_HASH' : [ 0xc, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x8, ['unsigned short']], + 'Name' : [ 0xa, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_PO_IRP_QUEUE' : [ 0x8, { + 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_2834' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0x6c, { + 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x4, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0xc, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], + 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x24, ['__unnamed_2834']], + 'ChildrenCount' : [ 0x28, ['long']], + 'StackTrace' : [ 0x2c, ['array', 8, ['pointer', ['void']]]], + 'ParentStackTrace' : [ 0x4c, ['array', 8, ['pointer', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0x60, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x38, ['_KMUTANT']], + 'LinksOffset' : [ 0x58, ['unsigned short']], + 'GuidOffset' : [ 0x5a, ['unsigned short']], + 'Expired' : [ 0x5c, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x10, { + 'NonPagedPortQueue' : [ 0x0, ['pointer', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x4, ['pointer', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x8, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x4, ['pointer', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_HVIEW_MAP_ENTRY' : [ 0x18, { + 'ViewStart' : [ 0x0, ['pointer', ['void']]], + 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Bcb' : [ 0x4, ['pointer', ['void']]], + 'PinnedPages' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x8, { + 'Stream' : [ 0x0, ['pointer', ['void']]], + 'Detail' : [ 0x4, ['unsigned long']], +} ], + '_POP_COOLING_EXTENSION' : [ 0x48, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'RequestListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['_POP_RW_LOCK']], + 'DeviceObject' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'NotificationEntry' : [ 0x1c, ['pointer', ['void']]], + 'Enabled' : [ 0x20, ['unsigned char']], + 'ActiveEngaged' : [ 0x21, ['unsigned char']], + 'ThrottleLimit' : [ 0x22, ['unsigned char']], + 'UpdatingToCurrent' : [ 0x23, ['unsigned char']], + 'RemovalFlushEvent' : [ 0x24, ['pointer', ['_KEVENT']]], + 'PnpFlushEvent' : [ 0x28, ['pointer', ['_KEVENT']]], + 'Interface' : [ 0x2c, ['_THERMAL_COOLING_INTERFACE']], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_CM_INDEX' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], + 'HashKey' : [ 0x4, ['unsigned long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x8, { + 'Start' : [ 0x0, ['pointer', ['unsigned char']]], + 'End' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x18, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x18, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x14, ['pointer', ['_LPCP_PORT_OBJECT']]], +} ], + '_THERMAL_POLICY' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ThermalStandby' : [ 0x7, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], + 'OverThrottled' : [ 0x14, ['unsigned char']], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x14, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x8, ['pointer', ['void']]], + 'Key' : [ 0xc, ['unsigned long']], + 'BindingProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x204, { + 'SpinLock' : [ 0x0, ['unsigned long']], + 'HashTable' : [ 0x4, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x38, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], +} ], + '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x14, { + 'Event' : [ 0x0, ['_KEVENT']], + 'EventSets' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_COLORED_PAGE_INFO' : [ 0x10, { + 'BeingZeroed' : [ 0x0, ['long']], + 'Processor' : [ 0x4, ['unsigned long']], + 'PagesQueued' : [ 0x8, ['unsigned long']], + 'PfnAllocation' : [ 0xc, ['pointer', ['_MMPFN']]], +} ], + '_TRIAGE_9F_POWER' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'IrpList' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], + 'ThreadList' : [ 0x8, ['pointer', ['_LIST_ENTRY']]], + 'DelayedWorkQueue' : [ 0xc, ['pointer', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_MI_POOL_STATE' : [ 0x4e8, { + 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long']], + 'NonPagedPoolSListMaximum' : [ 0x4, ['array', 3, ['unsigned long']]], + 'AllocatedNonPagedPool' : [ 0x10, ['unsigned long']], + 'BadPoolHead' : [ 0x14, ['_SINGLE_LIST_ENTRY']], + 'HighEventSets' : [ 0x18, ['unsigned long']], + 'HighEventSetsValid' : [ 0x1c, ['unsigned char']], + 'PoolFailures' : [ 0x20, ['array', 3, ['array', 3, ['unsigned long']]]], + 'PoolFailureReasons' : [ 0x44, ['_MI_POOL_FAILURE_REASONS']], + 'LowPagedPoolThreshold' : [ 0x70, ['unsigned long']], + 'HighPagedPoolThreshold' : [ 0x74, ['unsigned long']], + 'SpecialPoolPdesMax' : [ 0x78, ['long']], + 'NonPagedPoolNodes' : [ 0x7c, ['array', 1024, ['unsigned char']]], + 'PagedProtoPoolInfo' : [ 0x47c, ['_MM_PAGED_POOL_INFO']], + 'PagedPoolSListMaximum' : [ 0x498, ['unsigned long']], + 'PreemptiveTrims' : [ 0x49c, ['array', 4, ['unsigned long']]], + 'SpecialPagesInUsePeak' : [ 0x4ac, ['unsigned long']], + 'SpecialPoolRejected' : [ 0x4b0, ['array', 9, ['unsigned long']]], + 'SpecialPagesNonPaged' : [ 0x4d4, ['unsigned long']], + 'SpecialPoolPdes' : [ 0x4d8, ['long']], + 'SessionSpecialPoolPdesMax' : [ 0x4dc, ['unsigned long']], + 'TotalPagedPoolQuota' : [ 0x4e0, ['unsigned long']], + 'TotalNonPagedPoolQuota' : [ 0x4e4, ['unsigned long']], +} ], + '_STACK_TABLE' : [ 0x8040, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x4, ['array', 16, ['pointer', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x44, ['array', 16381, ['unsigned short']]], +} ], + '_POP_POWER_SETTING_VALUES' : [ 0x13c, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], + 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], + 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], + 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], + 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], + 'AwayModeIgnoreAction' : [ 0xf8, ['long']], + 'DisableFastS4' : [ 0xfc, ['unsigned char']], + 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], + 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], + 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], + 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], + 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], + 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], + 'VideoDimBrightness' : [ 0x114, ['unsigned long']], + 'AlsOffset' : [ 0x118, ['unsigned long']], + 'AlsEnabled' : [ 0x11c, ['unsigned long']], + 'EsBrightness' : [ 0x120, ['unsigned long']], + 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], + 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], + 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], + 'OffloadedAudio' : [ 0x12d, ['unsigned char']], + 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], + 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], + 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], + 'EsUserAwaySetting' : [ 0x134, ['unsigned char']], + 'WiFiInStandby' : [ 0x138, ['unsigned long']], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_DEFERRED_WRITE' : [ 0x24, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x8, ['unsigned long']], + 'DeferredWriteLinks' : [ 0xc, ['_LIST_ENTRY']], + 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], + 'PostRoutine' : [ 0x18, ['pointer', ['void']]], + 'Context1' : [ 0x1c, ['pointer', ['void']]], + 'Context2' : [ 0x20, ['pointer', ['void']]], +} ], + '__unnamed_28a5' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_28a7' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_28a5']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_28a7']], +} ], + '_MI_RESAVAIL_FAILURES' : [ 0x8, { + 'Wrap' : [ 0x0, ['unsigned long']], + 'NoCharge' : [ 0x4, ['unsigned long']], +} ], + '_MI_IO_PAGE_STATE' : [ 0x34, { + 'IoPfnLock' : [ 0x0, ['unsigned long']], + 'IoPfnRoot' : [ 0x4, ['array', 3, ['_RTL_AVL_TREE']]], + 'UnusedCachedMaps' : [ 0x10, ['_LIST_ENTRY']], + 'OldestCacheFlushTimeStamp' : [ 0x18, ['unsigned long']], + 'IoCacheStats' : [ 0x1c, ['_MI_IO_CACHE_STATS']], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x4, ['pointer', ['_ARBITER_ORDERING']]], +} ], + '_VF_AVL_TABLE' : [ 0x80, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x38, ['pointer', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x3c, ['pointer', ['void']]], + 'Lock' : [ 0x40, ['long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1e, { + 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], +} ], + '_TRIAGE_POP_FX_DEVICE' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'IrpData' : [ 0xc, ['pointer', ['_TRIAGE_POP_IRP_DATA']]], + 'Status' : [ 0x10, ['long']], + 'PowerReqCall' : [ 0x14, ['long']], + 'PowerNotReqCall' : [ 0x18, ['long']], + 'DeviceNode' : [ 0x1c, ['pointer', ['_TRIAGE_DEVICE_NODE']]], +} ], + '__unnamed_28c3' : [ 0x8, { + 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], +} ], + '__unnamed_28c5' : [ 0x4, { + 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], +} ], + '__unnamed_28cb' : [ 0xc, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], + 'OutputInformation' : [ 0x8, ['pointer', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], +} ], + '__unnamed_28cf' : [ 0x8, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x4, ['unsigned char']], +} ], + '__unnamed_28d1' : [ 0x14, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], + 'Argument5' : [ 0x10, ['pointer', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x14, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_28c3']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_28c5']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_28cb']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_28cf']], + 'Others' : [ 0x0, ['__unnamed_28d1']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x4, { + 'Function' : [ 0x0, ['pointer', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x78, { + 'SelectedCount' : [ 0x0, ['unsigned long long']], + 'VetoCount' : [ 0x8, ['unsigned long long']], + 'PreVetoCount' : [ 0x10, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'IdleDurationCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], + 'InterruptibleCount' : [ 0x48, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], + 'CstateCheckCount' : [ 0x58, ['unsigned long long']], + 'NoCStateCount' : [ 0x60, ['unsigned long long']], + 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], + 'PreVetoAccounting' : [ 0x70, ['pointer', ['_PPM_VETO_ACCOUNTING']]], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x4, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { + 'PagesScannedActive' : [ 0x0, ['unsigned long long']], + 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], + 'PagesCombined' : [ 0x10, ['unsigned long long']], + 'CombineScanCount' : [ 0x18, ['unsigned long']], + 'CombinedBlocksInUse' : [ 0x1c, ['long']], + 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], +} ], + '_THERMAL_COOLING_INTERFACE' : [ 0x1c, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ActiveCooling' : [ 0x14, ['pointer', ['void']]], + 'PassiveCooling' : [ 0x18, ['pointer', ['void']]], +} ], + '_HIVE_WAIT_PACKET' : [ 0x18, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x10, ['long']], + 'Next' : [ 0x14, ['pointer', ['_HIVE_WAIT_PACKET']]], +} ], + '_PROC_PERF_CHECK' : [ 0xc0, { + 'LastActive' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'LastStall' : [ 0x10, ['unsigned long long']], + 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], + 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], + 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], + 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], + 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], +} ], + '__unnamed_28ea' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_28ec' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_28ee' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_28ea']], + 'Interrupt' : [ 0x0, ['__unnamed_28ec']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_28ec']], + 'Sci' : [ 0x0, ['__unnamed_28ec']], + 'Nmi' : [ 0x0, ['__unnamed_28ec']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_28ee']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x140, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'VerifyKernelPhaseOnResume' : [ 0x3, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x4, ['unsigned char']], + 'InitializationFinished' : [ 0x5, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'HvCaptureReadyBarrier' : [ 0x14, ['long']], + 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], + 'MapFrozen' : [ 0x1c, ['unsigned char']], + 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x28, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x30, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x38, ['unsigned long']], + 'ClonedPageCount' : [ 0x40, ['unsigned long long']], + 'CurrentMap' : [ 0x48, ['pointer', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x4c, ['pointer', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x50, ['unsigned long']], + 'LoaderMdl' : [ 0x54, ['pointer', ['_MDL']]], + 'AllocatedMdl' : [ 0x58, ['pointer', ['_MDL']]], + 'PagesOut' : [ 0x60, ['unsigned long long']], + 'IoPages' : [ 0x68, ['pointer', ['void']]], + 'IoPagesCount' : [ 0x6c, ['unsigned long']], + 'CurrentMcb' : [ 0x70, ['pointer', ['void']]], + 'DumpStack' : [ 0x74, ['pointer', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0x78, ['pointer', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0x7c, ['unsigned long']], + 'Status' : [ 0x80, ['long']], + 'GraphicsProc' : [ 0x84, ['unsigned long']], + 'MemoryImage' : [ 0x88, ['pointer', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0x8c, ['pointer', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0x90, ['pointer', ['_MDL']]], + 'SiLogOffset' : [ 0x94, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0x98, ['pointer', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0x9c, ['pointer', ['void']]], + 'ResumeContext' : [ 0xa0, ['pointer', ['void']]], + 'ResumeContextPages' : [ 0xa4, ['unsigned long']], + 'ProcessorCount' : [ 0xa8, ['unsigned long']], + 'ProcessorContext' : [ 0xac, ['pointer', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0xb0, ['pointer', ['unsigned char']]], + 'ProdConsSize' : [ 0xb4, ['unsigned long']], + 'MaxDataPages' : [ 0xb8, ['unsigned long']], + 'ExtraBuffer' : [ 0xbc, ['pointer', ['void']]], + 'ExtraBufferSize' : [ 0xc0, ['unsigned long']], + 'ExtraMapVa' : [ 0xc4, ['pointer', ['void']]], + 'BitlockerKeyPFN' : [ 0xc8, ['unsigned long']], + 'IoInfo' : [ 0xd0, ['_POP_IO_INFO']], + 'IoChecksums' : [ 0x130, ['pointer', ['unsigned short']]], + 'IoChecksumsSize' : [ 0x134, ['unsigned long']], + 'HardwareConfigurationSignature' : [ 0x138, ['unsigned long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x40, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer', ['void']]]], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x8, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_POP_FX_PERF_INFO' : [ 0x60, { + 'Component' : [ 0x0, ['pointer', ['_POP_FX_COMPONENT']]], + 'CompletedEvent' : [ 0x4, ['_KEVENT']], + 'ComponentPerfState' : [ 0x14, ['pointer', ['void']]], + 'Flags' : [ 0x18, ['_POP_FX_PERF_FLAGS']], + 'LastChange' : [ 0x1c, ['pointer', ['_PO_FX_PERF_STATE_CHANGE']]], + 'LastChangeCount' : [ 0x20, ['unsigned long']], + 'LastChangeStamp' : [ 0x28, ['unsigned long long']], + 'LastChangeNominal' : [ 0x30, ['unsigned char']], + 'PepRegistered' : [ 0x31, ['unsigned char']], + 'QueryOnIdleStates' : [ 0x32, ['unsigned char']], + 'RequestDriverContext' : [ 0x34, ['pointer', ['void']]], + 'WorkOrder' : [ 0x38, ['_POP_FX_WORK_ORDER']], + 'SetsCount' : [ 0x54, ['unsigned long']], + 'Sets' : [ 0x58, ['pointer', ['_POP_FX_PERF_SET']]], +} ], + '_HAL_CHANNEL_MEMORY_RANGES' : [ 0xc, { + 'PageFrameIndex' : [ 0x0, ['unsigned long']], + 'MpnId' : [ 0x4, ['unsigned short']], + 'Node' : [ 0x6, ['unsigned short']], + 'Channel' : [ 0x8, ['unsigned short']], + 'IsPowerManageable' : [ 0xa, ['unsigned char']], + 'DeepPowerState' : [ 0xb, ['unsigned char']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x100, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0xc0, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0xc8, ['pointer', ['void']]], + 'PointersLength' : [ 0xcc, ['unsigned long']], + 'ModulePrefix' : [ 0xd0, ['pointer', ['unsigned short']]], + 'DriverList' : [ 0xd4, ['_LIST_ENTRY']], + 'InitMsg' : [ 0xdc, ['_STRING']], + 'ProgMsg' : [ 0xe4, ['_STRING']], + 'DoneMsg' : [ 0xec, ['_STRING']], + 'FileObject' : [ 0xf4, ['pointer', ['void']]], + 'UsageType' : [ 0xf8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_PAE_PAGEINFO' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'PageFrameNumber' : [ 0x8, ['unsigned long']], + 'EntriesInUse' : [ 0xc, ['unsigned long']], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x4, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x24, { + 'InitiatingThread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'ThreadId' : [ 0x8, ['pointer', ['void']]], + 'ProcessId' : [ 0xc, ['pointer', ['void']]], + 'Code' : [ 0x10, ['unsigned long']], + 'Parameter1' : [ 0x14, ['unsigned long']], + 'Parameter2' : [ 0x18, ['unsigned long']], + 'Parameter3' : [ 0x1c, ['unsigned long']], + 'Parameter4' : [ 0x20, ['unsigned long']], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_PCW_MASK_INFORMATION' : [ 0x20, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0xc, ['unsigned long']], + 'CollectMultiple' : [ 0x10, ['unsigned char']], + 'Buffer' : [ 0x14, ['pointer', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x18, ['pointer', ['_KEVENT']]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'SizeReturned' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x30, { + 'ViewOffset' : [ 0x0, ['unsigned long']], + 'Pinned' : [ 0x4, ['unsigned char']], + 'PinMask' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer', ['_KTHREAD']]], + 'Stack' : [ 0x14, ['array', 6, ['pointer', ['void']]]], +} ], + '__unnamed_292e' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x10, { + 'Parameters' : [ 0x0, ['__unnamed_292e']], +} ], + '__unnamed_2932' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_2932']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SUBSECTION_WAIT_BLOCK' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'Gate' : [ 0x4, ['_KGATE']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long']], + 'Weight' : [ 0x0, ['unsigned short']], + 'MinRate' : [ 0x0, ['unsigned short']], + 'MaxRate' : [ 0x2, ['unsigned short']], + 'AllFlags' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x310, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long']], + 'PageSize' : [ 0x14, ['unsigned long']], + 'SystemTime' : [ 0x18, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x20, ['unsigned long long']], + 'FeatureFlags' : [ 0x28, ['unsigned long long']], + 'HiberFlags' : [ 0x30, ['unsigned char']], + 'spare' : [ 0x31, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x34, ['unsigned long']], + 'HiberVa' : [ 0x38, ['unsigned long']], + 'NoFreePages' : [ 0x3c, ['unsigned long']], + 'FreeMapCheck' : [ 0x40, ['unsigned long']], + 'WakeCheck' : [ 0x44, ['unsigned long']], + 'NumPagesForLoader' : [ 0x48, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x50, ['unsigned long']], + 'FirstKernelRestorePage' : [ 0x54, ['unsigned long']], + 'FirstChecksumRestorePage' : [ 0x58, ['unsigned long']], + 'NoChecksumEntries' : [ 0x60, ['unsigned long long']], + 'PerfInfo' : [ 0x68, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x248, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x24c, ['array', 1, ['unsigned long']]], + 'SiLogOffset' : [ 0x250, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x254, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x258, ['array', 24, ['unsigned long']]], + 'NotUsed' : [ 0x2b8, ['unsigned long']], + 'ResumeContextCheck' : [ 0x2bc, ['unsigned long']], + 'ResumeContextPages' : [ 0x2c0, ['unsigned long']], + 'Hiberboot' : [ 0x2c4, ['unsigned char']], + 'HvCr3' : [ 0x2c8, ['unsigned long long']], + 'HvEntryPoint' : [ 0x2d0, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x2d8, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x2e0, ['unsigned long long']], + 'BootFlags' : [ 0x2e8, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x2f0, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x2f8, ['unsigned long']], + 'BitlockerKeyPfns' : [ 0x2fc, ['array', 4, ['unsigned long']]], + 'HardwareSignature' : [ 0x30c, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x10, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['unsigned short']], +} ], + '_CURDIR' : [ 0xc, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x8, ['pointer', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x1e0, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], + 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x48, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x4c, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x50, ['unsigned long']], + 'ResumeAppTicks' : [ 0x58, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x60, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x68, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x70, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x78, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x80, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x88, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x90, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0x98, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeMapTicks' : [ 0xa8, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xb0, ['unsigned long long']], + 'ResumeChecksumTicks' : [ 0xb8, ['unsigned long long']], + 'ResumeChecksumIoTicks' : [ 0xc0, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xc8, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xd0, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xd8, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xe0, ['unsigned long long']], + 'HalTscOffset' : [ 0xe8, ['unsigned long long']], + 'HvlTscOffset' : [ 0xf0, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0xf8, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0x100, ['unsigned long long']], + 'IoBoundedness' : [ 0x108, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0x110, ['unsigned long long']], + 'KernelIoTicks' : [ 0x118, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x120, ['unsigned long long']], + 'ReadCheckCount' : [ 0x128, ['unsigned long long']], + 'KernelInitTicks' : [ 0x130, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x138, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x140, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x148, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x150, ['unsigned long long']], + 'KernelChecksumTicks' : [ 0x158, ['unsigned long long']], + 'KernelChecksumIoTicks' : [ 0x160, ['unsigned long long']], + 'AnimationStart' : [ 0x168, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x170, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x178, ['unsigned long']], + 'SecurePagesProcessed' : [ 0x180, ['unsigned long long']], + 'BootPagesProcessed' : [ 0x188, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x190, ['unsigned long long']], + 'BootBytesWritten' : [ 0x198, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x1a0, ['unsigned long long']], + 'BootPagesWritten' : [ 0x1a8, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x1b0, ['unsigned long long']], + 'BytesWritten' : [ 0x1b8, ['unsigned long long']], + 'PagesWritten' : [ 0x1c0, ['unsigned long']], + 'FileRuns' : [ 0x1c4, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x1c8, ['unsigned long']], + 'MaxHuffRatio' : [ 0x1cc, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x1d0, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1d8, ['unsigned long long']], +} ], + '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x14, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Active' : [ 0x10, ['long']], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_RTL_BALANCED_LINKS' : [ 0x10, { + 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x4, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x8, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0xc, ['unsigned char']], + 'Reserved' : [ 0xd, ['array', 3, ['unsigned char']]], +} ], + '_FREE_DISPLAY' : [ 0x10, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x1c, { + 'Page' : [ 0x0, ['array', 1, ['unsigned long']]], + 'InitialInPageSupport' : [ 0x4, ['pointer', ['_MMINPAGE_SUPPORT']]], + 'PagingFile' : [ 0x8, ['pointer', ['_MMPAGING_FILE']]], + 'PageFileOffset' : [ 0xc, ['unsigned long']], + 'Node' : [ 0x10, ['_RTL_BALANCED_NODE']], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x70, { + 'UncompressedData' : [ 0x0, ['pointer', ['unsigned char']]], + 'MappingVa' : [ 0x4, ['pointer', ['void']]], + 'XpressEncodeWorkspace' : [ 0x8, ['pointer', ['void']]], + 'CompressedDataBuffer' : [ 0xc, ['pointer', ['unsigned char']]], + 'CopyTicks' : [ 0x10, ['unsigned long long']], + 'CompressTicks' : [ 0x18, ['unsigned long long']], + 'BytesCopied' : [ 0x20, ['unsigned long long']], + 'PagesProcessed' : [ 0x28, ['unsigned long long']], + 'DecompressTicks' : [ 0x30, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x38, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x40, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x48, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x68, ['unsigned long']], + 'HuffCompressCount' : [ 0x6c, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK' : [ 0x18, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_POP_IO_INFO' : [ 0x60, { + 'DumpMdl' : [ 0x0, ['pointer', ['_MDL']]], + 'IoStatus' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x8, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x10, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x18, ['unsigned long long']], + 'RequestSize' : [ 0x20, ['unsigned long long']], + 'IoLocation' : [ 0x28, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x30, ['unsigned long long']], + 'Buffer' : [ 0x38, ['pointer', ['void']]], + 'AsyncCapable' : [ 0x3c, ['unsigned char']], + 'BytesToRead' : [ 0x40, ['unsigned long long']], + 'Pages' : [ 0x48, ['unsigned long']], + 'HighestChecksumIndex' : [ 0x50, ['unsigned long long']], + 'PreviousChecksum' : [ 0x58, ['unsigned short']], +} ], + '_LDRP_CSLIST' : [ 0x4, { + 'Tail' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_NON_PAGED_DEBUG_INFO' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Machine' : [ 0x8, ['unsigned short']], + 'Characteristics' : [ 0xa, ['unsigned short']], + 'TimeDateStamp' : [ 0xc, ['unsigned long']], + 'CheckSum' : [ 0x10, ['unsigned long']], + 'SizeOfImage' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], +} ], + '_POP_FX_PERF_SET' : [ 0x20, { + 'PerfSet' : [ 0x0, ['pointer', ['_PO_FX_COMPONENT_PERF_SET']]], + 'CurrentPerf' : [ 0x8, ['unsigned long long']], + 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], + 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x4, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x8, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x10, ['unsigned long']], + 'ContentionCount' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x1c, ['unsigned short']], + 'SpareUSHORT' : [ 0x1e, ['unsigned short']], +} ], + '__unnamed_296f' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2971' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2974' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_2978' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x50, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x14, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x20, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x30, ['__unnamed_296f']], + 'HvDeviceId' : [ 0x38, ['unsigned long long']], + 'XapicMessage' : [ 0x40, ['__unnamed_2971']], + 'Hypertransport' : [ 0x40, ['__unnamed_2974']], + 'GenericMessage' : [ 0x40, ['__unnamed_2971']], + 'MessageRequest' : [ 0x40, ['__unnamed_2978']], +} ], + '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { + 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2986' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x4, ['pointer', ['_PO_FX_PERF_STATE']]], +} ], + '__unnamed_2988' : [ 0x10, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], +} ], + '_PO_FX_COMPONENT_PERF_SET' : [ 0x28, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], + 'Flags' : [ 0x8, ['unsigned long long']], + 'Unit' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], + 'Type' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], + 'Discrete' : [ 0x18, ['__unnamed_2986']], + 'Range' : [ 0x18, ['__unnamed_2988']], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2999' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_299b' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_299d' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2999']], + 'Gpt' : [ 0x0, ['__unnamed_299b']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0xc0, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer', ['void']]], + 'CommonBuffer' : [ 0xc, ['array', 2, ['pointer', ['void']]]], + 'PhysicalAddress' : [ 0x18, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x28, ['pointer', ['void']]], + 'OpenRoutine' : [ 0x2c, ['pointer', ['void']]], + 'WriteRoutine' : [ 0x30, ['pointer', ['void']]], + 'FinishRoutine' : [ 0x34, ['pointer', ['void']]], + 'AdapterObject' : [ 0x38, ['pointer', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x3c, ['pointer', ['void']]], + 'PortConfiguration' : [ 0x40, ['pointer', ['void']]], + 'CrashDump' : [ 0x44, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x45, ['unsigned char']], + 'HiberResume' : [ 0x46, ['unsigned char']], + 'Reserved1' : [ 0x47, ['unsigned char']], + 'MaximumTransferSize' : [ 0x48, ['unsigned long']], + 'CommonBufferSize' : [ 0x4c, ['unsigned long']], + 'TargetAddress' : [ 0x50, ['pointer', ['void']]], + 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], + 'PartitionStyle' : [ 0x58, ['unsigned long']], + 'DiskInfo' : [ 0x5c, ['__unnamed_299d']], + 'ReadRoutine' : [ 0x6c, ['pointer', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0x70, ['pointer', ['void']]], + 'LogSectionTruncateSize' : [ 0x74, ['unsigned long']], + 'Parameters' : [ 0x78, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xb8, ['pointer', ['void']]], + 'DumpNotifyRoutine' : [ 0xbc, ['pointer', ['void']]], +} ], + '_MI_IO_CACHE_STATS' : [ 0x18, { + 'UnusedBlocks' : [ 0x0, ['unsigned long']], + 'ActiveCacheMatch' : [ 0x4, ['unsigned long']], + 'ActiveCacheOverride' : [ 0x8, ['unsigned long']], + 'UnmappedCacheFlush' : [ 0xc, ['unsigned long']], + 'UnmappedCacheMatch' : [ 0x10, ['unsigned long']], + 'UnmappedCacheConflict' : [ 0x14, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x8, ['pointer', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0xc, ['pointer', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x10, ['pointer', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x14, ['pointer', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned short']], + 'ReplyIndex' : [ 0x1a, ['unsigned short']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { + 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'EntireInfo' : [ 0x0, ['long']], +} ], + '_TRIAGE_POP_IRP_DATA' : [ 0x10, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'Pdo' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_KDPC_LIST' : [ 0x8, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x4, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0xd0, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x4, ['pointer', ['pointer', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x8, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { + 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], + 'PriorityTooLow' : [ 0x4, ['unsigned long']], + 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], + 'PagedNoPtes' : [ 0xc, ['unsigned long']], + 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], + 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], + 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], + 'PagedNoCommit' : [ 0x1c, ['unsigned long']], + 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], + 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], + 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x18, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x28, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x10, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x18, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '__unnamed_29d2' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_29d4' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_29d2']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_29d7' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_29d9' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_29d7']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_29d4']], + 'HighPart' : [ 0x4, ['__unnamed_29d9']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x2c, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x28, ['long']], +} ], + '_PROC_PERF_CHECK_SNAP' : [ 0x50, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned long long']], + 'Stall' : [ 0x10, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], + 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x4, { + 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '__unnamed_29e7' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned long']], + 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], +} ], + '_MI_PER_SESSION_PROTOS' : [ 0x18, { + 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'DriverAddress' : [ 0x0, ['pointer', ['void']]], + 'SessionId' : [ 0xc, ['unsigned long']], + 'Subsection' : [ 0xc, ['pointer', ['_SUBSECTION']]], + 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], + 'u2' : [ 0x14, ['__unnamed_29e7']], +} ], + '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { + 'Set' : [ 0x0, ['unsigned long']], + 'StateIndex' : [ 0x8, ['unsigned long']], + 'StateValue' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_29ed' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_29ef' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_29ed']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_29ef']], +} ], + '_KSPECIAL_REGISTERS' : [ 0x54, { + 'Cr0' : [ 0x0, ['unsigned long']], + 'Cr2' : [ 0x4, ['unsigned long']], + 'Cr3' : [ 0x8, ['unsigned long']], + 'Cr4' : [ 0xc, ['unsigned long']], + 'KernelDr0' : [ 0x10, ['unsigned long']], + 'KernelDr1' : [ 0x14, ['unsigned long']], + 'KernelDr2' : [ 0x18, ['unsigned long']], + 'KernelDr3' : [ 0x1c, ['unsigned long']], + 'KernelDr6' : [ 0x20, ['unsigned long']], + 'KernelDr7' : [ 0x24, ['unsigned long']], + 'Gdtr' : [ 0x28, ['_DESCRIPTOR']], + 'Idtr' : [ 0x30, ['_DESCRIPTOR']], + 'Tr' : [ 0x38, ['unsigned short']], + 'Ldtr' : [ 0x3a, ['unsigned short']], + 'Xcr0' : [ 0x3c, ['unsigned long long']], + 'ExceptionList' : [ 0x44, ['unsigned long']], + 'Reserved' : [ 0x48, ['array', 3, ['unsigned long']]], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0xc, { + 'Previous' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x4, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x4, ['pointer', ['unsigned short']]], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_AVL_TABLE' : [ 0x38, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x10, ['pointer', ['void']]], + 'WhichOrderedElement' : [ 0x14, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x18, ['unsigned long']], + 'DepthOfTree' : [ 0x1c, ['unsigned long']], + 'RestartKey' : [ 0x20, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x24, ['unsigned long']], + 'CompareRoutine' : [ 0x28, ['pointer', ['void']]], + 'AllocateRoutine' : [ 0x2c, ['pointer', ['void']]], + 'FreeRoutine' : [ 0x30, ['pointer', ['void']]], + 'TableContext' : [ 0x34, ['pointer', ['void']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_PO_FX_PERF_STATE' : [ 0x10, { + 'Value' : [ 0x0, ['unsigned long long']], + 'Context' : [ 0x8, ['pointer', ['void']]], +} ], + '_DESCRIPTOR' : [ 0x8, { + 'Pad' : [ 0x0, ['unsigned short']], + 'Limit' : [ 0x2, ['unsigned short']], + 'Base' : [ 0x4, ['unsigned long']], +} ], +} From 883e317a364d30957d1f4e7a3adb2ef63fbfac67 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Wed, 10 Aug 2016 13:04:07 -0400 Subject: [PATCH 009/304] win10.py: fix _OBJECT_HEADER and _POOL_HEADER for recent versions --- volatility/plugins/overlays/windows/win10.py | 106 ++++++++++++++++++- 1 file changed, 105 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index c8dae58a2..aa033d3e6 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -317,6 +317,63 @@ def is_valid(self): 54: 'DxgkSharedSwapChainObject', } +class _OBJECT_HEADER_10_1AC738FB(_OBJECT_HEADER_10): + + type_map = { + 2: 'Type', + 3: 'Directory', + 4: 'SymbolicLink', + 5: 'Token', + 6: 'Job', + 7: 'Process', + 8: 'Thread', + 9: 'UserApcReserve', + 10: 'IoCompletionReserve', + 11: 'DebugObject', + 12: 'Event', + 13: 'Mutant', + 14: 'Callback', + 15: 'Semaphore', + 16: 'Timer', + 17: 'IRTimer', + 18: 'Profile', + 19: 'KeyedEvent', + 20: 'WindowStation', + 21: 'Desktop', + 22: 'Composition', + 23: 'RawInputManager', + 24: 'TpWorkerFactory', + 25: 'Adapter', + 26: 'Controller', + 27: 'Device', + 28: 'Driver', + 29: 'IoCompletion', + 30: 'WaitCompletionPacket', + 31: 'File', + 32: 'TmTm', + 33: 'TmTx', + 34: 'TmRm', + 35: 'TmEn', + 36: 'Section', + 37: 'Session', + 38: 'Partition', + 39: 'Key', + 40: 'ALPC Port', + 41: 'PowerRequest', + 42: 'WmiGuid', + 43: 'EtwRegistration', + 44: 'EtwConsumer', + 45: 'DmaAdapter', + 46: 'DmaDomain', + 47: 'PcwObject', + 48: 'FilterConnectionPort', + 49: 'FilterCommunicationPort', + 50: 'NetworkNamespace', + 51: 'DxgkSharedResource', + 52: 'DxgkSharedSyncObject', + 53: 'DxgkSharedSwapChainObject', + } + class Win10ObjectHeader(obj.ProfileModification): before = ["Win8ObjectClasses"] conditions = {'os': lambda x: x == 'windows', @@ -324,7 +381,54 @@ class Win10ObjectHeader(obj.ProfileModification): 'minor': lambda x: x == 4} def modification(self, profile): - profile.object_classes.update({"_OBJECT_HEADER": _OBJECT_HEADER_10}) + + metadata = profile.metadata + build = metadata.get("build", 0) + + if build == 10240: + header = _OBJECT_HEADER_10_1AC738FB + else: + header = _OBJECT_HEADER_10 + + profile.object_classes.update({"_OBJECT_HEADER": header}) + +class Win10PoolHeader(obj.ProfileModification): + before = ['WindowsOverlay'] + conditions = {'os': lambda x: x == 'windows', + 'major': lambda x: x == 6, + 'minor': lambda x: x == 4, + 'build': lambda x: x == 10240} + + def modification(self, profile): + + meta = profile.metadata + memory_model = meta.get("memory_model", "32bit") + + if memory_model == "32bit": + pool_types = {'_POOL_HEADER' : [ 0x8, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], + 'PoolTagHash' : [ 0x6, ['unsigned short']], + }]} + else: + pool_types = {'_POOL_HEADER' : [ 0x10, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'AllocatorBackTraceIndex' : [ 0x8, ['unsigned short']], + 'PoolTagHash' : [ 0xa, ['unsigned short']], + }]} + + profile.vtypes.update(pool_types) class Win10x64(obj.Profile): """ A Profile for Windows 10 x64 """ From aa1834632a6910ea6a44851732a764a972299735 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Wed, 10 Aug 2016 13:05:45 -0400 Subject: [PATCH 010/304] win32/tasks.py: only yield KDBGs that are valid --- volatility/win32/tasks.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility/win32/tasks.py b/volatility/win32/tasks.py index 84947d6a5..7ff371b56 100644 --- a/volatility/win32/tasks.py +++ b/volatility/win32/tasks.py @@ -53,10 +53,12 @@ def get_kdbg(addr_space): if kdbg.is_valid(): return kdbg - kdbg = obj.VolMagic(addr_space).KDBG.v() + kdbg_magic = obj.VolMagic(addr_space).KDBG - if kdbg.is_valid(): - return kdbg + for kdbg in kdbg_magic.get_suggestions(): + + if kdbg.is_valid(): + return kdbg # skip the KPCR backup method for x64 memmode = addr_space.profile.metadata.get('memory_model', '32bit') From d00496bd23f059ec878dae4a18d84b2bce1e45ee Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Wed, 10 Aug 2016 13:06:51 -0400 Subject: [PATCH 011/304] win8_kdbg.py: limit search to addresses above 0xf80000000000 --- volatility/plugins/overlays/windows/win8_kdbg.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility/plugins/overlays/windows/win8_kdbg.py b/volatility/plugins/overlays/windows/win8_kdbg.py index 26eee04b6..302d8d481 100644 --- a/volatility/plugins/overlays/windows/win8_kdbg.py +++ b/volatility/plugins/overlays/windows/win8_kdbg.py @@ -221,6 +221,9 @@ def generate_suggestions(self): current_offset = max(range_start, current_offset) range_end = range_start + range_size + if current_offset < 0xf80000000000: + continue + while (current_offset < range_end): # Figure out how much data to read l = min(constants.SCAN_BLOCKSIZE + overlap, range_end - current_offset) From d69519361400767334c1684293295804ae5db961 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Wed, 10 Aug 2016 15:59:45 -0400 Subject: [PATCH 012/304] amd64.py: refactor OS-specific code Migrate away from dynamic checks on each call to entry_present() to an inheritance-based scheme. --- volatility/plugins/addrspaces/amd64.py | 66 +++++++++++++++++++------- 1 file changed, 49 insertions(+), 17 deletions(-) diff --git a/volatility/plugins/addrspaces/amd64.py b/volatility/plugins/addrspaces/amd64.py index b9ddf21c8..33def0aa6 100644 --- a/volatility/plugins/addrspaces/amd64.py +++ b/volatility/plugins/addrspaces/amd64.py @@ -67,23 +67,7 @@ class AMD64PagedMemory(paged.AbstractWritablePagedMemory): _longlong_struct = struct.Struct(" Date: Thu, 11 Aug 2016 00:03:55 -0400 Subject: [PATCH 013/304] amd64.py: optionally skip consecutive PD/PT entries that are the same Created new class Win10AMD64PagedMemory for Windows 10 and later that engages the skipping logic. --- volatility/plugins/addrspaces/amd64.py | 32 ++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/volatility/plugins/addrspaces/amd64.py b/volatility/plugins/addrspaces/amd64.py index 33def0aa6..6c6b6bc5f 100644 --- a/volatility/plugins/addrspaces/amd64.py +++ b/volatility/plugins/addrspaces/amd64.py @@ -65,6 +65,7 @@ class AMD64PagedMemory(paged.AbstractWritablePagedMemory): minimum_size = 0x1000 alignment_gcd = 0x1000 _longlong_struct = struct.Struct("= 6 and minor >= 4 + + class LinuxAMD64PagedMemory(AMD64PagedMemory): """Linux-specific AMD 64-bit address space. From 2f08afca0e4d58fe17e6ee9392233107cca885a7 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 19 Aug 2016 08:39:51 -0500 Subject: [PATCH 014/304] update readme --- README.txt | 103 ++++++++++++++++++++++++++++++----------------------- 1 file changed, 59 insertions(+), 44 deletions(-) diff --git a/README.txt b/README.txt index 35dcc0ccb..12a01105a 100644 --- a/README.txt +++ b/README.txt @@ -135,63 +135,69 @@ Quick Start $ python vol.py --info Volatility Foundation Volatility Framework 2.5 -Profiles --------- -VistaSP0x64 - A Profile for Windows Vista SP0 x64 -VistaSP0x86 - A Profile for Windows Vista SP0 x86 -VistaSP1x64 - A Profile for Windows Vista SP1 x64 -VistaSP1x86 - A Profile for Windows Vista SP1 x86 -VistaSP2x64 - A Profile for Windows Vista SP2 x64 -VistaSP2x86 - A Profile for Windows Vista SP2 x86 -Win10x64 - A Profile for Windows 10 x64 -Win10x86 - A Profile for Windows 10 x86 -Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 -Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 -Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 -Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 -Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 -Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 -Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 -Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 -Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 -Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 -Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 -Win2012R2x64 - A Profile for Windows Server 2012 R2 x64 -Win2012x64 - A Profile for Windows Server 2012 x64 -Win7SP0x64 - A Profile for Windows 7 SP0 x64 -Win7SP0x86 - A Profile for Windows 7 SP0 x86 -Win7SP1x64 - A Profile for Windows 7 SP1 x64 -Win7SP1x86 - A Profile for Windows 7 SP1 x86 -Win81U1x64 - A Profile for Windows 8.1 Update 1 x64 -Win81U1x86 - A Profile for Windows 8.1 Update 1 x86 -Win8SP0x64 - A Profile for Windows 8 x64 -Win8SP0x86 - A Profile for Windows 8 x86 -Win8SP1x64 - A Profile for Windows 8.1 x64 -Win8SP1x86 - A Profile for Windows 8.1 x86 -WinXPSP1x64 - A Profile for Windows XP SP1 x64 -WinXPSP2x64 - A Profile for Windows XP SP2 x64 -WinXPSP2x86 - A Profile for Windows XP SP2 x86 -WinXPSP3x86 - A Profile for Windows XP SP3 x86 - Address Spaces -------------- AMD64PagedMemory - Standard AMD 64-bit address space. -ArmAddressSpace - Address space for ARM processors +ArmAddressSpace - Address space for ARM processors FileAddressSpace - This is a direct file AS. HPAKAddressSpace - This AS supports the HPAK format IA32PagedMemory - Standard IA-32 paging address space. IA32PagedMemoryPae - This class implements the IA-32 PAE paging address space. It is responsible LimeAddressSpace - Address space for Lime -MachOAddressSpace - Address space for Mach-O files to support atc-ny memory reader +LinuxAMD64PagedMemory - Linux-specific AMD 64-bit address space. +MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader OSXPmemELF - This AS supports VirtualBox ELF64 coredump format QemuCoreDumpElf - This AS supports Qemu ELF32 and ELF64 coredump format VMWareAddressSpace - This AS supports VMware snapshot (VMSS) and saved state (VMSS) files VMWareMetaAddressSpace - This AS supports the VMEM format with VMSN/VMSS metadata VirtualBoxCoreDumpElf64 - This AS supports VirtualBox ELF64 coredump format -WindowsCrashDumpSpace32 - This AS supports Windows Crash Dump format -WindowsCrashDumpSpace64 - This AS supports Windows Crash Dump format +Win10AMD64PagedMemory - Windows 10-specific AMD 64-bit address space. +WindowsAMD64PagedMemory - Windows-specific AMD 64-bit address space. +WindowsCrashDumpSpace32 - This AS supports windows Crash Dump format +WindowsCrashDumpSpace64 - This AS supports windows Crash Dump format WindowsCrashDumpSpace64BitMap - This AS supports Windows BitMap Crash Dump format -WindowsHiberFileSpace32 - This is a hibernate address space for Windows hibernation files. +WindowsHiberFileSpace32 - This is a hibernate address space for windows hibernation files. + +Profiles +-------- +LinuxRedHat62x64 - A Profile for Linux RedHat62 x64 +VistaSP0x64 - A Profile for Windows Vista SP0 x64 +VistaSP0x86 - A Profile for Windows Vista SP0 x86 +VistaSP1x64 - A Profile for Windows Vista SP1 x64 +VistaSP1x86 - A Profile for Windows Vista SP1 x86 +VistaSP2x64 - A Profile for Windows Vista SP2 x64 +VistaSP2x86 - A Profile for Windows Vista SP2 x86 +Win10x64 - A Profile for Windows 10 x64 +Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB +Win10x86 - A Profile for Windows 10 x86 +Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA +Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 +Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 +Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 +Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 +Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 +Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 +Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 +Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 +Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 +Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 +Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 +Win2012R2x64 - A Profile for Windows Server 2012 R2 x64 +Win2012x64 - A Profile for Windows Server 2012 x64 +Win7SP0x64 - A Profile for Windows 7 SP0 x64 +Win7SP0x86 - A Profile for Windows 7 SP0 x86 +Win7SP1x64 - A Profile for Windows 7 SP1 x64 +Win7SP1x86 - A Profile for Windows 7 SP1 x86 +Win81U1x64 - A Profile for Windows 8.1 Update 1 x64 +Win81U1x86 - A Profile for Windows 8.1 Update 1 x86 +Win8SP0x64 - A Profile for Windows 8 x64 +Win8SP0x86 - A Profile for Windows 8 x86 +Win8SP1x64 - A Profile for Windows 8.1 x64 +Win8SP1x86 - A Profile for Windows 8.1 x86 +WinXPSP1x64 - A Profile for Windows XP SP1 x64 +WinXPSP2x64 - A Profile for Windows XP SP2 x64 +WinXPSP2x86 - A Profile for Windows XP SP2 x86 +WinXPSP3x86 - A Profile for Windows XP SP3 x86 Plugins ------- @@ -221,6 +227,7 @@ driverscan - Pool scanner for driver objects dumpcerts - Dump RSA private and public SSL keys dumpfiles - Extract memory mapped and cached files dumpregistry - Dumps registry files out to disk +editbox - Displays information about Edit controls. (Listbox experimental.) envars - Display process environment variables eventhooks - Print details on windows event hooks evtlogs - Extract Windows Event Logs (XP/2003 only) @@ -304,6 +311,7 @@ linux_psaux - Gathers processes along with full command line and linux_psenv - Gathers processes along with their static environment variables linux_pslist - Gather active tasks by walking the task_struct->task list linux_pslist_cache - Gather tasks from the kmem_cache +linux_psscan - Scan physical memory for processes linux_pstree - Shows the parent/child relationship between processes linux_psxview - Find hidden processes with various process listings linux_recover_filesystem - Recovers the entire cached file system from memory @@ -326,6 +334,7 @@ mac_bash - Recover bash history from bash process memory mac_bash_env - Recover bash's environment variables mac_bash_hash - Recover bash hash table from bash process memory mac_calendar - Gets calendar events from Calendar.app +mac_check_fop - Validate File Operation Pointers mac_check_mig_table - Lists entires in the kernel's MIG table mac_check_syscall_shadow - Looks for shadow system call tables mac_check_syscalls - Checks to see if system call table entries are hooked @@ -336,14 +345,18 @@ mac_contacts - Gets contact names from Contacts.app mac_dead_procs - Prints terminated/de-allocated processes mac_dead_sockets - Prints terminated/de-allocated network sockets mac_dead_vnodes - Lists freed vnode structures +mac_devfs - Lists files in the file cache mac_dmesg - Prints the kernel debug buffer mac_dump_file - Dumps a specified file mac_dump_maps - Dumps memory ranges of process(es), optionally including pages in compressed swap mac_dyld_maps - Gets memory maps of processes from dyld data structures mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images -mac_get_profile - Automatically detect Mac profiles +mac_get_profile - Automatically detect Mac profiles mac_ifconfig - Lists network interface information for all devices +mac_interest_handlers - Lists IOKit Interest Handlers mac_ip_filters - Reports any hooked IP filters +mac_kernel_classes - Lists loaded c++ classes in the kernel +mac_kevents - Show parent/child relationship of processes mac_keychaindump - Recovers possbile keychain keys. Use chainbreaker to open related keychain files mac_ldrmodules - Compares the output of proc maps with the list of libraries from libdl mac_librarydump - Dumps the executable of a process @@ -384,8 +397,10 @@ mac_strings - Match physical offsets to virtual addresses (may ta mac_tasks - List Active Tasks mac_threads - List Process Threads mac_threads_simple - Lists threads along with their start time and priority +mac_timers - Reports timers set by kernel drivers mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version +mac_vfsevents - Lists processes filtering file system events mac_volshell - Shell in the memory image mac_yarascan - Scan memory for yara signatures machoinfo - Dump Mach-O file format information From b1c5abf5d25f78874accc62a7a075c7e007ee598 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 19 Aug 2016 09:23:06 -0500 Subject: [PATCH 015/304] update auditpol for win10 --- volatility/plugins/registry/auditpol.py | 61 ++++++++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/registry/auditpol.py b/volatility/plugins/registry/auditpol.py index 01e996af9..b9fbe6097 100644 --- a/volatility/plugins/registry/auditpol.py +++ b/volatility/plugins/registry/auditpol.py @@ -183,6 +183,24 @@ } ], } +auditpol_type_win8 = { + 'AuditPolData8' : [ None, { + 'Logon': [22, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'Logoff': [24, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'Sensitive': [70, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'ProcessCreation': [76, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + }], +} + +auditpol_type_win10 = { + 'AuditPolData10' : [ None, { + 'Logon': [0x16, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'Logoff': [0x18, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'Sensitive': [0x48, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + 'ProcessCreation': [0x4e, ['Enumeration', dict(target = 'unsigned short', choices = {0x00: "Not Logged", 0x01: "S", 0x02: "F", 0x03: "S/F"})]], + }], +} + # this are not used, but left here since they are more descriptive class AuditPolDataXP(obj.CType): def __str__(self): @@ -239,6 +257,19 @@ def __str__(self): return msg +class AuditPolData8(obj.CType): + def __str__(self): + msg = "\nLogon: {0}\n\tLogoff: {1}\n\tSensitive Privilegs: {2}\n\tProcess Creation: {3}\n\t".format( + self.Logon, self.Logoff, self.Sensitive, self.ProcessCreation) + + return msg + +class AuditPolData10(obj.CType): + def __str__(self): + msg = "\nLogon: {0}\n\tLogoff: {1}\n\tSensitive Privilegs: {2}\n\tProcess Creation: {3}\n\t".format( + self.Logon, self.Logoff, self.Sensitive, self.ProcessCreation) + + return msg class AuditPolData7(obj.CType): def __str__(self): @@ -317,6 +348,28 @@ def modification(self, profile): }) profile.vtypes.update(auditpol_type_win7) +class AudipolWin8(obj.ProfileModification): + before = ['WindowsObjectClasses'] + conditions = {'os': lambda x: x == 'windows', + 'major': lambda x: x == 6, + 'minor': lambda x: x == 2 or x == 3 } + def modification(self, profile): + profile.object_classes.update({ + 'AuditPolData8': AuditPolData8, + }) + profile.vtypes.update(auditpol_type_win8) + +class AudipolWin10(obj.ProfileModification): + before = ['WindowsObjectClasses'] + conditions = {'os': lambda x: x == 'windows', + 'major': lambda x: x == 6, + 'minor': lambda x: x >= 4} + def modification(self, profile): + profile.object_classes.update({ + 'AuditPolData10': AuditPolData10, + }) + profile.vtypes.update(auditpol_type_win10) + class Auditpol(common.AbstractWindowsCommand): """Prints out the Audit Policies from HKLM\\SECURITY\\Policy\\PolAdtEv""" @@ -343,14 +396,20 @@ def calculate(self): version = (addr_space.profile.metadata.get('major', 0), addr_space.profile.metadata.get('minor', 0)) + for value, data_raw in regapi.reg_yield_values('security', 'Policy\\PolAdtEv', thetype = 'REG_NONE'): bufferas = addrspace.BufferAddressSpace(self._config, data = data_raw) if version <= (5, 1): ap = obj.Object("AuditPolDataXP", offset = 0, vm = bufferas) elif version <= (6, 0): ap = obj.Object("AuditPolDataVista", offset = 0, vm = bufferas) - else: + elif version == (6, 1): ap = obj.Object("AuditPolData7", offset = 0, vm = bufferas) + elif version == (6, 2) or version == (6, 3): + ap = obj.Object("AuditPolData8", offset = 0, vm = bufferas) + else: + ap = obj.Object("AuditPolData10", offset = 0, vm = bufferas) + if ap == None: debug.error("No AuditPol data found") From 2800d33105873c89714ad44430111c93cd484ba8 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 19 Aug 2016 09:24:28 -0500 Subject: [PATCH 016/304] remove private profile from readme --- README.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/README.txt b/README.txt index 12a01105a..51ea50816 100644 --- a/README.txt +++ b/README.txt @@ -160,7 +160,6 @@ WindowsHiberFileSpace32 - This is a hibernate address space for windows hi Profiles -------- -LinuxRedHat62x64 - A Profile for Linux RedHat62 x64 VistaSP0x64 - A Profile for Windows Vista SP0 x64 VistaSP0x86 - A Profile for Windows Vista SP0 x86 VistaSP1x64 - A Profile for Windows Vista SP1 x64 From 14de62ea986ae79779c9c28af08300383d22f779 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Sat, 20 Aug 2016 16:53:41 -0500 Subject: [PATCH 017/304] add an assertion to the hiber AS to make sure the first table page is <= 10. this prevents volatility from going off the deep end when an incorrect profile is supplied (i.e. WinXP instead of Win7 or vice versa) --- volatility/plugins/addrspaces/hibernate.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/addrspaces/hibernate.py b/volatility/plugins/addrspaces/hibernate.py index b9044ab79..e67a0ba3b 100644 --- a/volatility/plugins/addrspaces/hibernate.py +++ b/volatility/plugins/addrspaces/hibernate.py @@ -93,7 +93,9 @@ def __init__(self, base, config, **kwargs): PROC_PAGE = volmag.HibrProcPage.v() # Check it's definitely a hibernation file - self.as_assert(self._get_first_table_page() is not None, "No xpress signature found") + pageno = self._get_first_table_page() + self.as_assert(pageno is not None, "No xpress signature found") + self.as_assert(pageno <= 10, "Bad profile for PO_MEMORY_RANGE") # Extract processor state self.ProcState = obj.Object("_KPROCESSOR_STATE", PROC_PAGE * 4096, base) From 676b14e0caebd1232488f27600aa2d6079b0ff54 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 29 Aug 2016 05:54:37 -0500 Subject: [PATCH 018/304] Windows - add support for IE DEST records --- volatility/plugins/iehistory.py | 113 +++++++++++++++++++++++++------- 1 file changed, 88 insertions(+), 25 deletions(-) diff --git a/volatility/plugins/iehistory.py b/volatility/plugins/iehistory.py index 5a9ee1b90..a4042a588 100644 --- a/volatility/plugins/iehistory.py +++ b/volatility/plugins/iehistory.py @@ -32,8 +32,15 @@ class _URL_RECORD(obj.CType): """A class for URL and LEAK records""" def is_valid(self): - return obj.CType.is_valid(self) and self.Length > 0 and self.Length < 32768 + ret = False + + if obj.CType.is_valid(self) and self.Length > 0 and self.Length < 32768: + if not str(self.LastModified).startswith("1970-01-01") and str(self.LastModified) != "-": + if not str(self.LastAccessed).startswith("1970-01-01") and str(self.LastAccessed) != "-": + ret = True + return ret + @property def Length(self): return self.m('Length') * 0x80 @@ -45,6 +52,42 @@ def has_data(self): and not self.Url.split(":")[0] in ["PrivacIE", "ietld", "iecompat", "Visited"]) +class _DEST_RECORD(obj.CType): + + def is_valid(self): + ret = False + + if obj.CType.is_valid(self) and self.LastModified.is_valid() and self.LastAccessed.is_valid(): + if not str(self.LastModified).startswith("1970-01-01") and str(self.LastModified) != "-": + if not str(self.LastAccessed).startswith("1970-01-01") and str(self.LastAccessed) != "-": + if 1999 < self.LastModified.as_datetime().year < 2075 and 1999 < self.LastAccessed.as_datetime().year < 2075 and self.URLStart.is_valid(): + ret = True + return ret + + def url_and_title(self): + url_buf = self.obj_vm.zread(self.URLStart.obj_offset, 4096) + + url = "" + title = "" + + # look for where url ends + idx = url_buf.find("\x00\x00") + if idx > 0: + idx = idx + 2 + tmpurl = url_buf[:idx] + for u in tmpurl: + if 31 < ord(u) < 127: + url = url + u + + idx2 = url_buf[idx:].find("\x00\x00") + if idx2 > 0: + tmptitle = url_buf[idx:idx+idx2+2] + for t in tmptitle: + if 31 < ord(t) < 127: + title = title + t + + return url, title + class IEHistoryVTypes(obj.ProfileModification): """Apply structures for IE history parsing""" @@ -70,11 +113,19 @@ def modification(self, profile): 'Length' : [ 0x4, ['unsigned int']], 'Url' : [ 0x10, ['String', dict(length = 4096)]], }], + '_DEST_RECORD' : [None, { + 'Signature' : [ 0, ['String', dict(length = 4)]], + 'LastModified' : [ 28, ['WinTimeStamp', dict(is_utc = True)]], + 'LastAccessed' : [ 36, ['WinTimeStamp', dict(is_utc = True)]], + 'URLStart' : [ 94, ['unsigned char']], + }], + }) profile.object_classes.update({ '_URL_RECORD' : _URL_RECORD, '_REDR_RECORD': _URL_RECORD, + '_DEST_RECORD' : _DEST_RECORD, }) class IEHistory(taskmods.DllList): @@ -91,28 +142,27 @@ def __init__(self, config, *args, **kwargs): @staticmethod def is_valid_profile(profile): - version = (profile.metadata.get('major', 0), - profile.metadata.get('minor', 0)) - - return (profile.metadata.get('os', 'unknown') == 'windows' - and version < (6, 2)) + return profile.metadata.get('os', 'unknown') == 'windows' def calculate(self): ## Select the tags to scan for. Always find visited URLs, ## but make freed and redirected records optional. - tags = ["URL "] + tags = ["URL ", "DEST"] if self._config.LEAK: tags.append("LEAK") if self._config.REDR: tags.append("REDR") + tags = ["DEST"] + ## Define the record type based on the tag tag_records = { "URL " : "_URL_RECORD", "LEAK" : "_URL_RECORD", - "REDR" : "_REDR_RECORD"} + "REDR" : "_REDR_RECORD", + "DEST" : "_DEST_RECORD"} - vad_filter = lambda x : hasattr(x, 'ControlArea') and str(x.FileObject.FileName or '').endswith("index.dat") + vad_filter = lambda x : (hasattr(x, 'ControlArea') and str(x.FileObject.FileName or '').endswith("index.dat")) or (x.VadFlags.Protection.v() == 4) ## Enumerate processes based on the --pid and --offset for proc in taskmods.DllList(self._config).calculate(): @@ -123,7 +173,7 @@ def calculate(self): for hit in proc.search_process_memory(tags, vad_filter = vad_filter): ## Get a preview of the data to see what tag was detected tag = ps_as.read(hit, 4) - + ## Create the appropriate object type based on the tag record = obj.Object(tag_records[tag], offset = hit, vm = ps_as) if record.is_valid(): @@ -186,21 +236,34 @@ def generator(self, data): def render_text(self, outfd, data): for process, record in data: - outfd.write("*" * 50 + "\n") - outfd.write("Process: {0} {1}\n".format(process.UniqueProcessId, process.ImageFileName)) - outfd.write("Cache type \"{0}\" at {1:#x}\n".format(record.Signature, record.obj_offset)) - outfd.write("Record length: {0:#x}\n".format(record.Length)) - outfd.write("Location: {0}\n".format(record.Url)) - ## Extended fields are available for these records - if record.obj_name == "_URL_RECORD": - outfd.write("Last modified: {0}\n".format(record.LastModified)) - outfd.write("Last accessed: {0}\n".format(record.LastAccessed)) - outfd.write("File Offset: {0:#x}, Data Offset: {1:#x}, Data Length: {2:#x}\n".format(record.Length, record.FileOffset, record.DataOffset, record.DataSize)) - if record.FileOffset > 0: - outfd.write("File: {0}\n".format(record.File)) - if record.has_data(): - outfd.write("Data: {0}\n".format(record.Data)) - + if record.obj_name == "_DEST_RECORD": + url, title = record.url_and_title() + + if len(url) > 4: + outfd.write("*" * 50 + "\n") + outfd.write("Process: {0} {1}\n".format(process.UniqueProcessId, process.ImageFileName)) + outfd.write("Cache type \"{0}\" at {1:#x}\n".format(record.Signature, record.obj_offset)) + outfd.write("Last modified: {0}\n".format(record.LastModified)) + outfd.write("Last accessed: {0}\n".format(record.LastAccessed)) + outfd.write("URL: {0}\n".format(url)) + if len(title) > 4: + outfd.write("Title: {0}\n".format(title)) + else: + outfd.write("*" * 50 + "\n") + outfd.write("Process: {0} {1}\n".format(process.UniqueProcessId, process.ImageFileName)) + outfd.write("Cache type \"{0}\" at {1:#x}\n".format(record.Signature, record.obj_offset)) + outfd.write("Record length: {0:#x}\n".format(record.Length)) + outfd.write("Location: {0}\n".format(record.Url)) + ## Extended fields are available for these records + if record.obj_name == "_URL_RECORD": + outfd.write("Last modified: {0}\n".format(record.LastModified)) + outfd.write("Last accessed: {0}\n".format(record.LastAccessed)) + outfd.write("File Offset: {0:#x}, Data Offset: {1:#x}, Data Length: {2:#x}\n".format(record.Length, record.FileOffset, record.DataOffset, record.DataSize)) + if record.FileOffset > 0: + outfd.write("File: {0}\n".format(record.File)) + if record.has_data(): + outfd.write("Data: {0}\n".format(record.Data)) + def render_csv(self, outfd, data): for process, record in data: if record.obj_name == "_URL_RECORD": From b87d2a4ec3edc86b9d4d165b1d0fa9f4131c6ebb Mon Sep 17 00:00:00 2001 From: gleeda Date: Tue, 30 Aug 2016 10:32:20 -0400 Subject: [PATCH 019/304] getsids: fixing missing backslashes --- volatility/plugins/getsids.py | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/volatility/plugins/getsids.py b/volatility/plugins/getsids.py index 852913c3c..ed755863c 100644 --- a/volatility/plugins/getsids.py +++ b/volatility/plugins/getsids.py @@ -108,19 +108,19 @@ def find_sid_re(sid_string, sid_re_list): 'S-1-5-32-550': 'Print Operators', 'S-1-5-32-551': 'Backup Operators', 'S-1-5-32-552': 'Replicators', - 'S-1-5-32-554': 'BUILTIN\Pre-Windows 2000 Compatible Access', - 'S-1-5-32-555': 'BUILTIN\Remote Desktop Users', - 'S-1-5-32-556': 'BUILTIN\Network Configuration Operators', - 'S-1-5-32-557': 'BUILTIN\Incoming Forest Trust Builders', - 'S-1-5-32-558': 'BUILTIN\Performance Monitor Users', - 'S-1-5-32-559': 'BUILTIN\Performance Log Users', - 'S-1-5-32-560': 'BUILTIN\Windows Authorization Access Group', - 'S-1-5-32-561': 'BUILTIN\Terminal Server License Servers', - 'S-1-5-32-562': 'BUILTIN\Distributed COM Users', - 'S-1-5-32-568': 'BUILTIN\IIS IUSRS', + 'S-1-5-32-554': 'BUILTIN\\Pre-Windows 2000 Compatible Access', + 'S-1-5-32-555': 'BUILTIN\\Remote Desktop Users', + 'S-1-5-32-556': 'BUILTIN\\Network Configuration Operators', + 'S-1-5-32-557': 'BUILTIN\\Incoming Forest Trust Builders', + 'S-1-5-32-558': 'BUILTIN\\Performance Monitor Users', + 'S-1-5-32-559': 'BUILTIN\\Performance Log Users', + 'S-1-5-32-560': 'BUILTIN\\Windows Authorization Access Group', + 'S-1-5-32-561': 'BUILTIN\\Terminal Server License Servers', + 'S-1-5-32-562': 'BUILTIN\\Distributed COM Users', + 'S-1-5-32-568': 'BUILTIN\\IIS IUSRS', 'S-1-5-32-569': 'Cryptographic Operators', - 'S-1-5-32-573': 'BUILTIN\Event Log Readers', - 'S-1-5-32-574': 'BUILTIN\Certificate Service DCOM Access', + 'S-1-5-32-573': 'BUILTIN\\Event Log Readers', + 'S-1-5-32-574': 'BUILTIN\\Certificate Service DCOM Access', 'S-1-5-33': 'Write Restricted', 'S-1-5-64-10': 'NTLM Authentication', 'S-1-5-64-14': 'SChannel Authentication', From af075f8fff8cbb284f5b3661b45d11c517f6cdc0 Mon Sep 17 00:00:00 2001 From: atcuno Date: Thu, 1 Sep 2016 03:23:39 -0500 Subject: [PATCH 020/304] Windows - update svcscan to print the executable that runs on service launch failure --- volatility/plugins/malware/svcscan.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/malware/svcscan.py b/volatility/plugins/malware/svcscan.py index 0bf4c0570..6c91e07b2 100644 --- a/volatility/plugins/malware/svcscan.py +++ b/volatility/plugins/malware/svcscan.py @@ -436,11 +436,16 @@ def get_service_info(regapi): path_value = "" dll_value = "" + failure_value = "" image_path = regapi.reg_get_value(hive_name = "system", key = "", value = "ImagePath", given_root = subkey) if image_path: path_value = utils.remove_unprintable(image_path) + failure_path = regapi.reg_get_value(hive_name = "system", key = "", value = "FailureCommand", given_root = subkey) + if failure_path: + failure_value = utils.remove_unprintable(failure_path) + for rootkey in regapi.reg_get_all_subkeys(hive_name = "system", key = "", given_root = subkey): if rootkey.Name == "Parameters": service_dll = regapi.reg_get_value(hive_name = "system", key = "", value = "ServiceDll", given_root = rootkey) @@ -448,7 +453,7 @@ def get_service_info(regapi): dll_value = utils.remove_unprintable(service_dll) break - info[utils.remove_unprintable(str(subkey.Name))] = (dll_value, path_value) + info[utils.remove_unprintable(str(subkey.Name))] = (dll_value, path_value, failure_value) return info @@ -464,7 +469,8 @@ def unified_output(self, data): ("State", str), ("BinaryPath", str), ("ServiceDll", str), - ("ImagePath", str)], + ("ImagePath", str), + ("FailureCommand", str)], self.generator(data)) return TreeGrid([("Offset", Address), @@ -496,7 +502,8 @@ def generator(self, data): str(rec.State), str(rec.Binary or ""), str(vals[0] if vals else ""), - str(vals[1] if vals else "")]) + str(vals[1] if vals else ""), + str(vals[2] if vals else "")]) else: yield (0, [Address(rec.obj_offset), int(rec.Order), @@ -531,5 +538,6 @@ def render_text(self, outfd, data): if vals: outfd.write("ServiceDll: {0}\n".format(vals[0])) outfd.write("ImagePath: {0}\n".format(vals[1])) + outfd.write("FailureCommand: {0}\n".format(vals[2])) outfd.write("\n") From 3399683aee4a4b7dcb3f20556271c0c570cfd918 Mon Sep 17 00:00:00 2001 From: gleeda Date: Tue, 6 Sep 2016 14:36:12 -0400 Subject: [PATCH 021/304] fixing typo in issue #325 Thanks, Wyatt! --- tools/mac/mac_create_all_profiles.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/mac/mac_create_all_profiles.py b/tools/mac/mac_create_all_profiles.py index 9e0b30520..241521179 100644 --- a/tools/mac/mac_create_all_profiles.py +++ b/tools/mac/mac_create_all_profiles.py @@ -135,7 +135,7 @@ def main(): elif version.startswith("10.10"): osx_name = "Yosemite" profile_runs.append((full_path, "x86_64", osx_name, version, build)) - elif version.startwith("10.11"): + elif version.startswith("10.11"): osx_name = "ElCapitan" profile_runs.append((full_path, "x86_64", osx_name, version, build)) From 6e51c593ead725400c633e08d65271d9e1073fd1 Mon Sep 17 00:00:00 2001 From: gleeda Date: Tue, 6 Sep 2016 14:39:46 -0400 Subject: [PATCH 022/304] adding new windows 10 profile --- volatility/plugins/overlays/windows/win10.py | 13 +- .../windows/win10_x64_DDA2B209_vtypes.py | 13258 ++++++++++++++++ 2 files changed, 13269 insertions(+), 2 deletions(-) create mode 100644 volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index aa033d3e6..2626127fb 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -385,7 +385,7 @@ def modification(self, profile): metadata = profile.metadata build = metadata.get("build", 0) - if build == 10240: + if build >= 10240: header = _OBJECT_HEADER_10_1AC738FB else: header = _OBJECT_HEADER_10 @@ -397,7 +397,7 @@ class Win10PoolHeader(obj.ProfileModification): conditions = {'os': lambda x: x == 'windows', 'major': lambda x: x == 6, 'minor': lambda x: x == 4, - 'build': lambda x: x == 10240} + 'build': lambda x: x >= 10240} def modification(self, profile): @@ -448,6 +448,15 @@ class Win10x64_1AC738FB(obj.Profile): _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes' +class Win10x64_DDA2B209(obj.Profile): + """ A Profile for Windows 10 x64 from PDB DDA2B209""" + _md_memory_model = '64bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 4 + _md_build = 10241 + _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_DDA2B209_vtypes' + class Win10x86(obj.Profile): """ A Profile for Windows 10 x86 """ _md_memory_model = '32bit' diff --git a/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py b/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py new file mode 100644 index 000000000..19868e643 --- /dev/null +++ b/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py @@ -0,0 +1,13258 @@ +ntkrnlmp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x708, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'NtBuildNumber' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'BootId' : [ 0x2c4, ['unsigned long']], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'Reserved12' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCall' : [ 0x308, ['unsigned long']], + 'SystemCallPad0' : [ 0x30c, ['unsigned long']], + 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], + 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], + 'Reserved8' : [ 0x37c, ['unsigned long']], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_1080' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_1080']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1098' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109a' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_1098']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], + 'RaceDll' : [ 0x20, ['pointer64', ['void']]], + 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], + 'u' : [ 0x38, ['__unnamed_109a']], + 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x40, ['unsigned long']], +} ], + '_TEB' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], + 'ClientId' : [ 0x40, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], + 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['pointer64', ['void']]]], + 'SystemReserved1' : [ 0x190, ['array', 38, ['pointer64', ['void']]]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], + 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], + 'glSection' : [ 0x1230, ['pointer64', ['void']]], + 'glTable' : [ 0x1238, ['pointer64', ['void']]], + 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], + 'glContext' : [ 0x1248, ['pointer64', ['void']]], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], + 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], + 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], + 'Vdm' : [ 0x1690, ['pointer64', ['void']]], + 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], + 'PerflibData' : [ 0x1728, ['pointer64', ['void']]], + 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], + 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], + 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], + 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], + 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], + 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], + 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], + 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], + 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], + 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], + 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], + 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], + 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], + 'ReservedForWdf' : [ 0x1818, ['pointer64', ['void']]], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_LIST_ENTRY' : [ 0x10, { + 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x8, { + 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0x18, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { + 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'CurEntry' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer64', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '__unnamed_1108' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1108']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '_RTL_BITMAP' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS64' : [ 0x108, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_RB_TREE' : [ 0x10, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0x18, { + 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_AVL_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x6a80, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], + 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], + 'UserRsp' : [ 0x10, ['unsigned long long']], + 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], + 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], + 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Used_Self' : [ 0x30, ['pointer64', ['void']]], + 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], + 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'Irql' : [ 0x50, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], + 'ObsoleteNumber' : [ 0x52, ['unsigned char']], + 'Fill0' : [ 0x53, ['unsigned char']], + 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], + 'MajorVersion' : [ 0x60, ['unsigned short']], + 'MinorVersion' : [ 0x62, ['unsigned short']], + 'StallScaleFactor' : [ 0x64, ['unsigned long']], + 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], + 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], + 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], + 'Unused2' : [ 0x100, ['unsigned long']], + 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], + 'Unused3' : [ 0x110, ['pointer64', ['void']]], + 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], + 'Prcb' : [ 0x180, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x6900, { + 'MxCsr' : [ 0x0, ['unsigned long']], + 'LegacyNumber' : [ 0x4, ['unsigned char']], + 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], + 'InterruptRequest' : [ 0x6, ['unsigned char']], + 'IdleHalt' : [ 0x7, ['unsigned char']], + 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NestingLevel' : [ 0x20, ['unsigned char']], + 'ClockOwner' : [ 0x21, ['unsigned char']], + 'PendingTickFlags' : [ 0x22, ['unsigned char']], + 'PendingTick' : [ 0x22, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x22, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IdleState' : [ 0x23, ['unsigned char']], + 'Number' : [ 0x24, ['unsigned long']], + 'RspBase' : [ 0x28, ['unsigned long long']], + 'PrcbLock' : [ 0x30, ['unsigned long long']], + 'PriorityState' : [ 0x38, ['pointer64', ['unsigned char']]], + 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], + 'CpuType' : [ 0x5f0, ['unsigned char']], + 'CpuID' : [ 0x5f1, ['unsigned char']], + 'CpuStep' : [ 0x5f2, ['unsigned short']], + 'CpuStepping' : [ 0x5f2, ['unsigned char']], + 'CpuModel' : [ 0x5f3, ['unsigned char']], + 'MHz' : [ 0x5f4, ['unsigned long']], + 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], + 'MinorVersion' : [ 0x638, ['unsigned short']], + 'MajorVersion' : [ 0x63a, ['unsigned short']], + 'BuildType' : [ 0x63c, ['unsigned char']], + 'CpuVendor' : [ 0x63d, ['unsigned char']], + 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], + 'ParentNode' : [ 0x640, ['pointer64', ['_KNODE']]], + 'GroupSetMember' : [ 0x648, ['unsigned long long']], + 'Group' : [ 0x650, ['unsigned char']], + 'GroupIndex' : [ 0x651, ['unsigned char']], + 'PrcbPad05' : [ 0x652, ['array', 2, ['unsigned char']]], + 'InitialApicId' : [ 0x654, ['unsigned long']], + 'ScbOffset' : [ 0x658, ['unsigned long']], + 'ApicMask' : [ 0x65c, ['unsigned long']], + 'AcpiReserved' : [ 0x660, ['pointer64', ['void']]], + 'CFlushSize' : [ 0x668, ['unsigned long']], + 'PrcbPad10' : [ 0x66c, ['unsigned long']], + 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x2080, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PrcbPad20' : [ 0x2c80, ['unsigned long long']], + 'DeferredReadyListHead' : [ 0x2c88, ['_SINGLE_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x2c90, ['long']], + 'MmCopyOnWriteCount' : [ 0x2c94, ['long']], + 'MmTransitionCount' : [ 0x2c98, ['long']], + 'MmDemandZeroCount' : [ 0x2c9c, ['long']], + 'MmPageReadCount' : [ 0x2ca0, ['long']], + 'MmPageReadIoCount' : [ 0x2ca4, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x2ca8, ['long']], + 'MmDirtyWriteIoCount' : [ 0x2cac, ['long']], + 'MmMappedPagesWriteCount' : [ 0x2cb0, ['long']], + 'MmMappedWriteIoCount' : [ 0x2cb4, ['long']], + 'KeSystemCalls' : [ 0x2cb8, ['unsigned long']], + 'KeContextSwitches' : [ 0x2cbc, ['unsigned long']], + 'LdtSelector' : [ 0x2cc0, ['unsigned short']], + 'PrcbPad40' : [ 0x2cc2, ['unsigned short']], + 'CcFastReadNoWait' : [ 0x2cc4, ['unsigned long']], + 'CcFastReadWait' : [ 0x2cc8, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x2ccc, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x2cd0, ['unsigned long']], + 'CcCopyReadWait' : [ 0x2cd4, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x2cd8, ['unsigned long']], + 'IoReadOperationCount' : [ 0x2cdc, ['long']], + 'IoWriteOperationCount' : [ 0x2ce0, ['long']], + 'IoOtherOperationCount' : [ 0x2ce4, ['long']], + 'IoReadTransferCount' : [ 0x2ce8, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x2cf0, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x2cf8, ['_LARGE_INTEGER']], + 'PacketBarrier' : [ 0x2d00, ['long']], + 'TargetCount' : [ 0x2d04, ['long']], + 'IpiFrozen' : [ 0x2d08, ['unsigned long']], + 'IsrDpcStats' : [ 0x2d10, ['pointer64', ['void']]], + 'DeviceInterrupts' : [ 0x2d18, ['unsigned long']], + 'LookasideIrpFloat' : [ 0x2d1c, ['long']], + 'InterruptLastCount' : [ 0x2d20, ['unsigned long']], + 'InterruptRate' : [ 0x2d24, ['unsigned long']], + 'PrcbPad41' : [ 0x2d28, ['array', 22, ['unsigned long']]], + 'DpcData' : [ 0x2d80, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2dd0, ['pointer64', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2dd8, ['long']], + 'DpcRequestRate' : [ 0x2ddc, ['unsigned long']], + 'MinimumDpcRate' : [ 0x2de0, ['unsigned long']], + 'DpcLastCount' : [ 0x2de4, ['unsigned long']], + 'ThreadDpcEnable' : [ 0x2de8, ['unsigned char']], + 'QuantumEnd' : [ 0x2de9, ['unsigned char']], + 'DpcRoutineActive' : [ 0x2dea, ['unsigned char']], + 'IdleSchedule' : [ 0x2deb, ['unsigned char']], + 'DpcRequestSummary' : [ 0x2dec, ['long']], + 'DpcRequestSlot' : [ 0x2dec, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x2dec, ['short']], + 'ThreadDpcState' : [ 0x2dee, ['short']], + 'DpcNormalProcessingActive' : [ 0x2dec, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x2dec, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x2dec, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x2dec, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x2dec, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x2dec, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x2dec, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x2dec, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x2dec, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x2dec, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2df0, ['unsigned long']], + 'LastTick' : [ 0x2df4, ['unsigned long']], + 'ClockInterrupts' : [ 0x2df8, ['unsigned long']], + 'ReadyScanTick' : [ 0x2dfc, ['unsigned long']], + 'InterruptObject' : [ 0x2e00, ['array', 256, ['pointer64', ['void']]]], + 'TimerTable' : [ 0x3600, ['_KTIMER_TABLE']], + 'DpcGate' : [ 0x5800, ['_KGATE']], + 'PrcbPad52' : [ 0x5818, ['pointer64', ['void']]], + 'CallDpc' : [ 0x5820, ['_KDPC']], + 'ClockKeepAlive' : [ 0x5860, ['long']], + 'PrcbPad60' : [ 0x5864, ['array', 2, ['unsigned char']]], + 'NmiActive' : [ 0x5866, ['unsigned short']], + 'DpcWatchdogPeriod' : [ 0x5868, ['long']], + 'DpcWatchdogCount' : [ 0x586c, ['long']], + 'KeSpinLockOrdering' : [ 0x5870, ['long']], + 'PrcbPad70' : [ 0x5874, ['array', 1, ['unsigned long']]], + 'CachedPtes' : [ 0x5878, ['pointer64', ['void']]], + 'WaitListHead' : [ 0x5880, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x5890, ['unsigned long long']], + 'ReadySummary' : [ 0x5898, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x589c, ['long']], + 'QueueIndex' : [ 0x58a0, ['unsigned long']], + 'PrcbPad75' : [ 0x58a4, ['array', 3, ['unsigned long']]], + 'TimerExpirationDpc' : [ 0x58b0, ['_KDPC']], + 'ScbQueue' : [ 0x58f0, ['_RTL_RB_TREE']], + 'DispatcherReadyListHead' : [ 0x5900, ['array', 32, ['_LIST_ENTRY']]], + 'InterruptCount' : [ 0x5b00, ['unsigned long']], + 'KernelTime' : [ 0x5b04, ['unsigned long']], + 'UserTime' : [ 0x5b08, ['unsigned long']], + 'DpcTime' : [ 0x5b0c, ['unsigned long']], + 'InterruptTime' : [ 0x5b10, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x5b14, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x5b18, ['unsigned char']], + 'GroupSchedulingOverQuota' : [ 0x5b19, ['unsigned char']], + 'DeepSleep' : [ 0x5b1a, ['unsigned char']], + 'PrcbPad80' : [ 0x5b1b, ['array', 5, ['unsigned char']]], + 'DpcTimeCount' : [ 0x5b20, ['unsigned long']], + 'DpcTimeLimit' : [ 0x5b24, ['unsigned long']], + 'PeriodicCount' : [ 0x5b28, ['unsigned long']], + 'PeriodicBias' : [ 0x5b2c, ['unsigned long']], + 'AvailableTime' : [ 0x5b30, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x5b34, ['unsigned long']], + 'StartCycles' : [ 0x5b38, ['unsigned long long']], + 'TaggedCyclesStart' : [ 0x5b40, ['unsigned long long']], + 'TaggedCycles' : [ 0x5b48, ['array', 2, ['unsigned long long']]], + 'GenerationTarget' : [ 0x5b58, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x5b60, ['unsigned long long']], + 'PrcbPad81' : [ 0x5b68, ['array', 29, ['unsigned long']]], + 'MmSpinLockOrdering' : [ 0x5bdc, ['long']], + 'PageColor' : [ 0x5be0, ['unsigned long']], + 'NodeColor' : [ 0x5be4, ['unsigned long']], + 'NodeShiftedColor' : [ 0x5be8, ['unsigned long']], + 'SecondaryColorMask' : [ 0x5bec, ['unsigned long']], + 'PrcbPad83' : [ 0x5bf0, ['unsigned long']], + 'CycleTime' : [ 0x5bf8, ['unsigned long long']], + 'Cycles' : [ 0x5c00, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'PrcbPad84' : [ 0x5c40, ['array', 16, ['unsigned long']]], + 'CcFastMdlReadNoWait' : [ 0x5c80, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x5c84, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x5c88, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x5c8c, ['unsigned long']], + 'CcMapDataWait' : [ 0x5c90, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x5c94, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x5c98, ['unsigned long']], + 'CcPinReadWait' : [ 0x5c9c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x5ca0, ['unsigned long']], + 'CcMdlReadWait' : [ 0x5ca4, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x5ca8, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x5cac, ['unsigned long']], + 'CcLazyWritePages' : [ 0x5cb0, ['unsigned long']], + 'CcDataFlushes' : [ 0x5cb4, ['unsigned long']], + 'CcDataPages' : [ 0x5cb8, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x5cbc, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x5cc0, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x5cc4, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x5cc8, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x5ccc, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x5cd0, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x5cd4, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x5cd8, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x5cdc, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x5ce0, ['unsigned long']], + 'CcReadAheadIos' : [ 0x5ce4, ['unsigned long']], + 'MmCacheTransitionCount' : [ 0x5ce8, ['long']], + 'MmCacheReadCount' : [ 0x5cec, ['long']], + 'MmCacheIoCount' : [ 0x5cf0, ['long']], + 'PrcbPad91' : [ 0x5cf4, ['array', 3, ['unsigned long']]], + 'PowerState' : [ 0x5d00, ['_PROCESSOR_POWER_STATE']], + 'ScbList' : [ 0x5ed0, ['_LIST_ENTRY']], + 'PrcbPad92' : [ 0x5ee0, ['array', 7, ['unsigned long']]], + 'KeAlignmentFixupCount' : [ 0x5efc, ['unsigned long']], + 'DpcWatchdogDpc' : [ 0x5f00, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x5f40, ['_KTIMER']], + 'Cache' : [ 0x5f80, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x5fbc, ['unsigned long']], + 'CachedCommit' : [ 0x5fc0, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x5fc4, ['unsigned long']], + 'HyperPte' : [ 0x5fc8, ['pointer64', ['void']]], + 'WheaInfo' : [ 0x5fd0, ['pointer64', ['void']]], + 'EtwSupport' : [ 0x5fd8, ['pointer64', ['void']]], + 'InterruptObjectPool' : [ 0x5fe0, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x5ff0, ['_SLIST_HEADER']], + 'HypercallCachedPages' : [ 0x6000, ['pointer64', ['void']]], + 'VirtualApicAssist' : [ 0x6008, ['pointer64', ['void']]], + 'StatisticsPage' : [ 0x6010, ['pointer64', ['unsigned long long']]], + 'PackageProcessorSet' : [ 0x6018, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x60c0, ['unsigned long long']], + 'SharedReadyQueue' : [ 0x60c8, ['pointer64', ['_KSHARED_READY_QUEUE']]], + 'SharedQueueScanOwner' : [ 0x60d0, ['unsigned long']], + 'ScanSiblingIndex' : [ 0x60d4, ['unsigned long']], + 'CoreProcessorSet' : [ 0x60d8, ['unsigned long long']], + 'ScanSiblingMask' : [ 0x60e0, ['unsigned long long']], + 'LLCMask' : [ 0x60e8, ['unsigned long long']], + 'CacheProcessorMask' : [ 0x60f0, ['array', 5, ['unsigned long long']]], + 'ProcessorProfileControlArea' : [ 0x6118, ['pointer64', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x6120, ['pointer64', ['void']]], + 'PrcbPad94' : [ 0x6128, ['array', 11, ['unsigned long long']]], + 'SynchCounters' : [ 0x6180, ['_SYNCH_COUNTERS']], + 'PteBitCache' : [ 0x6238, ['unsigned long long']], + 'PteBitOffset' : [ 0x6240, ['unsigned long']], + 'FsCounters' : [ 0x6248, ['_FILESYSTEM_DISK_COUNTERS']], + 'VendorString' : [ 0x6258, ['array', 13, ['unsigned char']]], + 'PrcbPad100' : [ 0x6265, ['array', 3, ['unsigned char']]], + 'FeatureBits' : [ 0x6268, ['unsigned long long']], + 'PrcbPad110' : [ 0x6270, ['unsigned long']], + 'UpdateSignature' : [ 0x6278, ['_LARGE_INTEGER']], + 'Context' : [ 0x6280, ['pointer64', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x6288, ['unsigned long']], + 'ExtendedState' : [ 0x6290, ['pointer64', ['_XSAVE_AREA']]], + 'IsrStack' : [ 0x6298, ['pointer64', ['void']]], + 'EntropyTimingState' : [ 0x62a0, ['_KENTROPY_TIMING_STATE']], + 'AbSelfIoBoostsList' : [ 0x63f0, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x63f8, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x6400, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x6440, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x6494, ['_IOP_IRP_STACK_PROFILER']], + 'LocalSharedReadyQueue' : [ 0x6500, ['_KSHARED_READY_QUEUE']], + 'TimerExpirationTrace' : [ 0x6760, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x6860, ['unsigned long']], + 'ExSaPageArray' : [ 0x6868, ['pointer64', ['void']]], + 'Mailbox' : [ 0x6880, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestMailbox' : [ 0x68c0, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KFLOATING_SAVE' : [ 0x4, { + 'Dummy' : [ 0x0, ['unsigned long']], +} ], + '_SINGLE_LIST_ENTRY32' : [ 0x4, { + 'Next' : [ 0x0, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { + 'TrustletIdentity' : [ 0x0, ['unsigned long long']], + 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { + 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], + 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { + 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], + 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { + 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { + 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_KPROCESS' : [ 0x2d8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x40, ['unsigned long']], + 'Spare0' : [ 0x44, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x48, ['unsigned long long']], + 'Affinity' : [ 0x50, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0xf8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x110, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x1b8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x1b8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x1b8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'DeepFreeze' : [ 0x1b8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x1b8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x1b8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SpareFlags0' : [ 0x1b8, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x1b8, ['BitField', dict(start_bit = 8, end_bit = 28, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x1b8, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x1b8, ['long']], + 'BasePriority' : [ 0x1bc, ['unsigned char']], + 'QuantumReset' : [ 0x1bd, ['unsigned char']], + 'Visited' : [ 0x1be, ['unsigned char']], + 'Flags' : [ 0x1bf, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x1c0, ['array', 20, ['unsigned long']]], + 'IdealNode' : [ 0x210, ['array', 20, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x238, ['unsigned short']], + 'Spare1' : [ 0x23a, ['unsigned short']], + 'StackCount' : [ 0x23c, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x240, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x250, ['unsigned long long']], + 'ContextSwitches' : [ 0x258, ['unsigned long long']], + 'SchedulingGroup' : [ 0x260, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'FreezeCount' : [ 0x268, ['unsigned long']], + 'KernelTime' : [ 0x26c, ['unsigned long']], + 'UserTime' : [ 0x270, ['unsigned long']], + 'LdtFreeSelectorHint' : [ 0x274, ['unsigned short']], + 'LdtTableLength' : [ 0x276, ['unsigned short']], + 'LdtSystemDescriptor' : [ 0x278, ['_KGDTENTRY64']], + 'LdtBaseAddress' : [ 0x288, ['pointer64', ['void']]], + 'LdtProcessLock' : [ 0x290, ['_FAST_MUTEX']], + 'InstrumentationCallback' : [ 0x2c8, ['pointer64', ['void']]], + 'SecurePid' : [ 0x2d0, ['unsigned long long']], +} ], + '_KTHREAD' : [ 0x5d8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x18, ['pointer64', ['void']]], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer64', ['void']]], + 'StackLimit' : [ 0x30, ['pointer64', ['void']]], + 'StackBase' : [ 0x38, ['pointer64', ['void']]], + 'ThreadLock' : [ 0x40, ['unsigned long long']], + 'CycleTime' : [ 0x48, ['unsigned long long']], + 'CurrentRunTime' : [ 0x50, ['unsigned long']], + 'ExpectedRunTime' : [ 0x54, ['unsigned long']], + 'KernelStack' : [ 0x58, ['pointer64', ['void']]], + 'StateSaveArea' : [ 0x60, ['pointer64', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x68, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x70, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x71, ['unsigned char']], + 'Alerted' : [ 0x72, ['array', 2, ['unsigned char']]], + 'AutoBoostActive' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitNext' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x74, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Alertable' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'TimerActive' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SystemThread' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x74, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CalloutActive' : [ 0x74, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x74, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x74, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x74, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x74, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x74, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SuspendSchedulerApcWait' : [ 0x74, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x74, ['long']], + 'AutoAlignment' : [ 0x78, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x78, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ThreadFlagsSpare0' : [ 0x78, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x78, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x78, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x78, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x78, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x78, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x78, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x78, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x78, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x78, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x78, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x78, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x78, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CommitFailTerminateRequest' : [ 0x78, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ProcessStackCountDecremented' : [ 0x78, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ThreadFlagsSpare' : [ 0x78, ['BitField', dict(start_bit = 19, end_bit = 24, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x78, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x78, ['long']], + 'Tag' : [ 0x7c, ['unsigned char']], + 'SystemHeteroCpuPolicy' : [ 0x7d, ['unsigned char']], + 'UserHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], + 'ExplicitSystemHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare0' : [ 0x7f, ['unsigned char']], + 'SystemCallNumber' : [ 0x80, ['unsigned long']], + 'Spare10' : [ 0x84, ['unsigned long']], + 'FirstArgument' : [ 0x88, ['pointer64', ['void']]], + 'TrapFrame' : [ 0x90, ['pointer64', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x98, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x98, ['array', 43, ['unsigned char']]], + 'Priority' : [ 0xc3, ['unsigned char']], + 'UserIdealProcessor' : [ 0xc4, ['unsigned long']], + 'WaitStatus' : [ 0xc8, ['long long']], + 'WaitBlockList' : [ 0xd0, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0xd8, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xe8, ['pointer64', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xf0, ['pointer64', ['void']]], + 'RelativeTimerBias' : [ 0xf8, ['unsigned long long']], + 'Timer' : [ 0x100, ['_KTIMER']], + 'WaitBlock' : [ 0x140, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill4' : [ 0x140, ['array', 20, ['unsigned char']]], + 'ContextSwitches' : [ 0x154, ['unsigned long']], + 'WaitBlockFill5' : [ 0x140, ['array', 68, ['unsigned char']]], + 'State' : [ 0x184, ['unsigned char']], + 'Spare13' : [ 0x185, ['unsigned char']], + 'WaitIrql' : [ 0x186, ['unsigned char']], + 'WaitMode' : [ 0x187, ['unsigned char']], + 'WaitBlockFill6' : [ 0x140, ['array', 116, ['unsigned char']]], + 'WaitTime' : [ 0x1b4, ['unsigned long']], + 'WaitBlockFill7' : [ 0x140, ['array', 164, ['unsigned char']]], + 'KernelApcDisable' : [ 0x1e4, ['short']], + 'SpecialApcDisable' : [ 0x1e6, ['short']], + 'CombinedApcDisable' : [ 0x1e4, ['unsigned long']], + 'WaitBlockFill8' : [ 0x140, ['array', 40, ['unsigned char']]], + 'ThreadCounters' : [ 0x168, ['pointer64', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0x140, ['array', 88, ['unsigned char']]], + 'XStateSave' : [ 0x198, ['pointer64', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0x140, ['array', 136, ['unsigned char']]], + 'Win32Thread' : [ 0x1c8, ['pointer64', ['void']]], + 'WaitBlockFill11' : [ 0x140, ['array', 176, ['unsigned char']]], + 'Ucb' : [ 0x1f0, ['pointer64', ['_UMS_CONTROL_BLOCK']]], + 'Uch' : [ 0x1f8, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], + 'TebMappedLowVa' : [ 0x200, ['pointer64', ['void']]], + 'QueueListEntry' : [ 0x208, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x218, ['unsigned long']], + 'NextProcessorNumber' : [ 0x218, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x218, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x21c, ['long']], + 'Process' : [ 0x220, ['pointer64', ['_KPROCESS']]], + 'UserAffinity' : [ 0x228, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x228, ['array', 10, ['unsigned char']]], + 'PreviousMode' : [ 0x232, ['unsigned char']], + 'BasePriority' : [ 0x233, ['unsigned char']], + 'PriorityDecrement' : [ 0x234, ['unsigned char']], + 'ForegroundBoost' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x235, ['unsigned char']], + 'AdjustReason' : [ 0x236, ['unsigned char']], + 'AdjustIncrement' : [ 0x237, ['unsigned char']], + 'AffinityVersion' : [ 0x238, ['unsigned long long']], + 'Affinity' : [ 0x240, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x240, ['array', 10, ['unsigned char']]], + 'ApcStateIndex' : [ 0x24a, ['unsigned char']], + 'WaitBlockCount' : [ 0x24b, ['unsigned char']], + 'IdealProcessor' : [ 0x24c, ['unsigned long']], + 'NpxState' : [ 0x250, ['unsigned long long']], + 'SavedApcState' : [ 0x258, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x258, ['array', 43, ['unsigned char']]], + 'WaitReason' : [ 0x283, ['unsigned char']], + 'SuspendCount' : [ 0x284, ['unsigned char']], + 'Saturation' : [ 0x285, ['unsigned char']], + 'SListFaultCount' : [ 0x286, ['unsigned short']], + 'SchedulerApc' : [ 0x288, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x288, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x289, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x288, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x28b, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x288, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x28c, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x288, ['array', 64, ['unsigned char']]], + 'WaitPrcb' : [ 0x2c8, ['pointer64', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x288, ['array', 72, ['unsigned char']]], + 'LegoData' : [ 0x2d0, ['pointer64', ['void']]], + 'SchedulerApcFill5' : [ 0x288, ['array', 83, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x2db, ['unsigned char']], + 'UserTime' : [ 0x2dc, ['unsigned long']], + 'SuspendEvent' : [ 0x2e0, ['_KEVENT']], + 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], + 'AbEntrySummary' : [ 0x318, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x319, ['unsigned char']], + 'Spare20' : [ 0x31a, ['unsigned short']], + 'SecureThreadCookie' : [ 0x31c, ['unsigned long']], + 'LockEntries' : [ 0x320, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x560, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x568, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x570, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x580, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x584, ['long']], + 'KeReferenceCount' : [ 0x588, ['short']], + 'AbOrphanedEntrySummary' : [ 0x58a, ['unsigned char']], + 'AbOwnedEntryCount' : [ 0x58b, ['unsigned char']], + 'ForegroundLossTime' : [ 0x58c, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x590, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x590, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x598, ['unsigned long long']], + 'ReadOperationCount' : [ 0x5a0, ['long long']], + 'WriteOperationCount' : [ 0x5a8, ['long long']], + 'OtherOperationCount' : [ 0x5b0, ['long long']], + 'ReadTransferCount' : [ 0x5b8, ['long long']], + 'WriteTransferCount' : [ 0x5c0, ['long long']], + 'OtherTransferCount' : [ 0x5c8, ['long long']], + 'QueuedScb' : [ 0x5d0, ['pointer64', ['_KSCB']]], +} ], + '_KSTACK_CONTROL' : [ 0x30, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'ActualLimit' : [ 0x8, ['unsigned long long']], + 'StackExpansion' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_FAST_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'OldIrql' : [ 0x30, ['unsigned long']], +} ], + '_KEVENT' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '__unnamed_1269' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SLIST_HEADER' : [ 0x10, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Region' : [ 0x8, ['unsigned long long']], + 'HeaderX64' : [ 0x0, ['__unnamed_1269']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x60, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_SLIST_ENTRY' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_IO_STATUS_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer64', ['void']]], + 'Information' : [ 0x8, ['unsigned long long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x20, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Parameter' : [ 0x18, ['pointer64', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer64', ['void']]], + 'DeleteContext' : [ 0x10, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x10, { + 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0x100, { + 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long long']], + 'IdleSmtSet' : [ 0x8, ['unsigned long long']], + 'IdleCpuSet' : [ 0x10, ['unsigned long long']], + 'DeepIdleSet' : [ 0x40, ['unsigned long long']], + 'IdleConstrainedSet' : [ 0x48, ['unsigned long long']], + 'NonParkedSet' : [ 0x50, ['unsigned long long']], + 'ParkLock' : [ 0x58, ['long']], + 'Seed' : [ 0x5c, ['unsigned long']], + 'SiblingMask' : [ 0x80, ['unsigned long']], + 'Affinity' : [ 0x88, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x88, ['array', 10, ['unsigned char']]], + 'NodeNumber' : [ 0x92, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x94, ['unsigned short']], + 'Stride' : [ 0x96, ['unsigned char']], + 'Spare0' : [ 0x97, ['unsigned char']], + 'SharedReadyQueueLeaders' : [ 0x98, ['unsigned long long']], + 'ProximityId' : [ 0xa0, ['unsigned long']], + 'Lowest' : [ 0xa4, ['unsigned long']], + 'Highest' : [ 0xa8, ['unsigned long']], + 'MaximumProcessors' : [ 0xac, ['unsigned char']], + 'Flags' : [ 0xad, ['_flags']], + 'Spare10' : [ 0xae, ['unsigned char']], + 'HeteroSets' : [ 0xb0, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], +} ], + '_ENODE' : [ 0x540, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0x100, ['array', 8, ['pointer64', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x140, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x410, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x428, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x468, ['_KEVENT']], + 'WaitBlocks' : [ 0x480, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x510, ['pointer64', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x518, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x51c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x51c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x51c, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x80, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long long']], + 'QuotaProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'HandleTableList' : [ 0x18, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'StrictFIFO' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x2c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x2c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x2c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x38, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x40, ['array', 32, ['unsigned char']]], + 'DebugInfo' : [ 0x60, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x10, { + 'VolatileLowValue' : [ 0x0, ['long long']], + 'LowValue' : [ 0x0, ['long long']], + 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'HighValue' : [ 0x8, ['long long']], + 'NextFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x8, ['_EXHANDLE']], + 'RefCountField' : [ 0x0, ['long long']], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 17, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 20, native_type='unsigned long long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 64, native_type='unsigned long long')]], + 'GrantedAccessBits' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Spare1' : [ 0x8, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], + 'Spare2' : [ 0xc, ['unsigned long']], +} ], + '_EX_FAST_REF' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_135c' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0xa0, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'AuxData' : [ 0x48, ['pointer64', ['void']]], + 'Privileges' : [ 0x50, ['__unnamed_135c']], + 'AuditPrivileges' : [ 0x7c, ['unsigned char']], + 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xe0, { + 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x18, ['unsigned long']], + 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], + 'TransactionId' : [ 0x20, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], + 'SDLock' : [ 0x50, ['pointer64', ['void']]], + 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xd8, ['unsigned char']], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x788, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x2d8, ['_EX_PUSH_LOCK']], + 'RundownProtect' : [ 0x2e0, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0x2e8, ['pointer64', ['void']]], + 'ActiveProcessLinks' : [ 0x2f0, ['_LIST_ENTRY']], + 'Flags2' : [ 0x300, ['unsigned long']], + 'JobNotReallyActive' : [ 0x300, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x300, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x300, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x300, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x300, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x300, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0x300, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x300, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x300, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x300, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0x300, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0x300, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x300, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x300, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x300, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x300, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x300, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x300, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x300, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x300, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0x300, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x300, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0x300, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0x300, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x300, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0x300, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0x300, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0x300, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0x304, ['unsigned long']], + 'CreateReported' : [ 0x304, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x304, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x304, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x304, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0x304, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x304, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x304, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x304, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FailFastOnCommitFail' : [ 0x304, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x304, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x304, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x304, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x304, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x304, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x304, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x304, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x304, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0x304, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x304, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x304, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x304, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x304, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0x304, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x304, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x304, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x304, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x304, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CreateTime' : [ 0x308, ['_LARGE_INTEGER']], + 'ProcessQuotaUsage' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'ProcessQuotaPeak' : [ 0x320, ['array', 2, ['unsigned long long']]], + 'PeakVirtualSize' : [ 0x330, ['unsigned long long']], + 'VirtualSize' : [ 0x338, ['unsigned long long']], + 'SessionProcessLinks' : [ 0x340, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0x350, ['pointer64', ['void']]], + 'ExceptionPortValue' : [ 0x350, ['unsigned long long']], + 'ExceptionPortState' : [ 0x350, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Token' : [ 0x358, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0x360, ['unsigned long long']], + 'AddressCreationLock' : [ 0x368, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x370, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x378, ['pointer64', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x380, ['pointer64', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x388, ['pointer64', ['_EJOB']]], + 'CloneRoot' : [ 0x390, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x398, ['unsigned long long']], + 'NumberOfLockedPages' : [ 0x3a0, ['unsigned long long']], + 'Win32Process' : [ 0x3a8, ['pointer64', ['void']]], + 'Job' : [ 0x3b0, ['pointer64', ['_EJOB']]], + 'SectionObject' : [ 0x3b8, ['pointer64', ['void']]], + 'SectionBaseAddress' : [ 0x3c0, ['pointer64', ['void']]], + 'Cookie' : [ 0x3c8, ['unsigned long']], + 'WorkingSetWatch' : [ 0x3d0, ['pointer64', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x3d8, ['pointer64', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x3e0, ['pointer64', ['void']]], + 'LdtInformation' : [ 0x3e8, ['pointer64', ['void']]], + 'OwnerProcessId' : [ 0x3f0, ['unsigned long long']], + 'Peb' : [ 0x3f8, ['pointer64', ['_PEB']]], + 'Session' : [ 0x400, ['pointer64', ['void']]], + 'AweInfo' : [ 0x408, ['pointer64', ['void']]], + 'QuotaBlock' : [ 0x410, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x418, ['pointer64', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x420, ['pointer64', ['void']]], + 'WoW64Process' : [ 0x428, ['pointer64', ['_EWOW64PROCESS']]], + 'DeviceMap' : [ 0x430, ['pointer64', ['void']]], + 'EtwDataSource' : [ 0x438, ['pointer64', ['void']]], + 'PageDirectoryPte' : [ 0x440, ['unsigned long long']], + 'ImageFilePointer' : [ 0x448, ['pointer64', ['_FILE_OBJECT']]], + 'ImageFileName' : [ 0x450, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x45f, ['unsigned char']], + 'SecurityPort' : [ 0x460, ['pointer64', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x468, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x470, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x480, ['pointer64', ['void']]], + 'ThreadListHead' : [ 0x488, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x498, ['unsigned long']], + 'ImagePathHash' : [ 0x49c, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x4a0, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x4a4, ['long']], + 'PrefetchTrace' : [ 0x4a8, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x4b0, ['pointer64', ['void']]], + 'ReadOperationCount' : [ 0x4b8, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x4c0, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x4c8, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x4d0, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x4d8, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x4e0, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x4e8, ['unsigned long long']], + 'CommitCharge' : [ 0x4f0, ['unsigned long long']], + 'CommitChargePeak' : [ 0x4f8, ['unsigned long long']], + 'Vm' : [ 0x500, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x5f8, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x608, ['unsigned long']], + 'ExitStatus' : [ 0x60c, ['long']], + 'VadRoot' : [ 0x610, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x618, ['pointer64', ['void']]], + 'VadCount' : [ 0x620, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x628, ['unsigned long long']], + 'VadPhysicalPagesLimit' : [ 0x630, ['unsigned long long']], + 'AlpcContext' : [ 0x638, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x658, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x668, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x670, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x674, ['unsigned long']], + 'ExitTime' : [ 0x678, ['_LARGE_INTEGER']], + 'InvertedFunctionTable' : [ 0x680, ['pointer64', ['_INVERTED_FUNCTION_TABLE']]], + 'InvertedFunctionTableLock' : [ 0x688, ['_EX_PUSH_LOCK']], + 'ActiveThreadsHighWatermark' : [ 0x690, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x694, ['unsigned long']], + 'ThreadListLock' : [ 0x698, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x6a0, ['pointer64', ['void']]], + 'Spare0' : [ 0x6a8, ['unsigned long long']], + 'SignatureLevel' : [ 0x6b0, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x6b1, ['unsigned char']], + 'Protection' : [ 0x6b2, ['_PS_PROTECTION']], + 'HangCount' : [ 0x6b3, ['unsigned char']], + 'Flags3' : [ 0x6b4, ['unsigned long']], + 'Minimal' : [ 0x6b4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReplacingPageRoot' : [ 0x6b4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DisableNonSystemFonts' : [ 0x6b4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AuditNonSystemFontLoading' : [ 0x6b4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Crashed' : [ 0x6b4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'JobVadsAreTracked' : [ 0x6b4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'VadTrackingDisabled' : [ 0x6b4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AuxiliaryProcess' : [ 0x6b4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SubsystemProcess' : [ 0x6b4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6b4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'InPrivate' : [ 0x6b4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProhibitRemoteImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProhibitLowILImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SignatureMitigationOptIn' : [ 0x6b4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeviceAsid' : [ 0x6b8, ['long']], + 'SvmData' : [ 0x6c0, ['pointer64', ['void']]], + 'SvmProcessLock' : [ 0x6c8, ['_EX_PUSH_LOCK']], + 'SvmLock' : [ 0x6d0, ['unsigned long long']], + 'SvmProcessDeviceListHead' : [ 0x6d8, ['_LIST_ENTRY']], + 'LastFreezeInterruptTime' : [ 0x6e8, ['unsigned long long']], + 'DiskCounters' : [ 0x6f0, ['pointer64', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x6f8, ['pointer64', ['void']]], + 'TrustletIdentity' : [ 0x700, ['unsigned long long']], + 'KeepAliveCounter' : [ 0x708, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x70c, ['unsigned long']], + 'HighPriorityFaultsAllowed' : [ 0x710, ['unsigned long']], + 'EnergyValues' : [ 0x718, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'VmContext' : [ 0x720, ['pointer64', ['void']]], + 'SequenceNumber' : [ 0x728, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x730, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x738, ['unsigned long long']], + 'TotalUnbiasedFrozenTime' : [ 0x740, ['unsigned long long']], + 'LastAppStateUpdateTime' : [ 0x748, ['unsigned long long']], + 'LastAppStateUptime' : [ 0x750, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'LastAppState' : [ 0x750, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SharedCommitCharge' : [ 0x758, ['unsigned long long']], + 'SharedCommitLock' : [ 0x760, ['_EX_PUSH_LOCK']], + 'SharedCommitLinks' : [ 0x768, ['_LIST_ENTRY']], + 'AllowedCpuSets' : [ 0x778, ['unsigned long long']], + 'DefaultCpuSets' : [ 0x780, ['unsigned long long']], + 'AllowedCpuSetsIndirect' : [ 0x778, ['pointer64', ['unsigned long long']]], + 'DefaultCpuSetsIndirect' : [ 0x780, ['pointer64', ['unsigned long long']]], +} ], + '_EWOW64PROCESS' : [ 0x10, { + 'Peb' : [ 0x0, ['pointer64', ['void']]], + 'Machine' : [ 0x8, ['unsigned short']], +} ], + '_ETHREAD' : [ 0x7c0, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x5d8, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x5e0, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x5e0, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x5f0, ['pointer64', ['void']]], + 'PostBlockList' : [ 0x5f8, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x5f8, ['pointer64', ['void']]], + 'StartAddress' : [ 0x600, ['pointer64', ['void']]], + 'TerminationPort' : [ 0x608, ['pointer64', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x608, ['pointer64', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x608, ['pointer64', ['void']]], + 'ActiveTimerListLock' : [ 0x610, ['unsigned long long']], + 'ActiveTimerListHead' : [ 0x618, ['_LIST_ENTRY']], + 'Cid' : [ 0x628, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x658, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x660, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x670, ['unsigned long long']], + 'DeviceToVerify' : [ 0x678, ['pointer64', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x680, ['pointer64', ['void']]], + 'LegacyPowerObject' : [ 0x688, ['pointer64', ['void']]], + 'ThreadListEntry' : [ 0x690, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x6a0, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x6a8, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x6b0, ['unsigned long']], + 'MmLockOrdering' : [ 0x6b4, ['long']], + 'CmLockOrdering' : [ 0x6b8, ['long']], + 'CrossThreadFlags' : [ 0x6bc, ['unsigned long']], + 'Terminated' : [ 0x6bc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x6bc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x6bc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x6bc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x6bc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x6bc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x6bc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x6bc, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x6bc, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x6bc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x6bc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6bc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x6bc, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x6c0, ['unsigned long']], + 'ActiveExWorker' : [ 0x6c0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x6c0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'StoreLockThread' : [ 0x6c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x6c0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x6c0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x6c0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'RespectIoPriority' : [ 0x6c0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'ReservedSameThreadPassiveFlags' : [ 0x6c0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x6c4, ['unsigned long']], + 'OwnsProcessAddressSpaceExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x6c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardFaultBehavior' : [ 0x6c4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x6c4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x6c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x6c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Prefetching' : [ 0x6c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x6c5, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x6c5, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x6c8, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x6c9, ['unsigned char']], + 'ActiveFaultCount' : [ 0x6ca, ['unsigned char']], + 'LockOrderState' : [ 0x6cb, ['unsigned char']], + 'AlpcMessageId' : [ 0x6d0, ['unsigned long long']], + 'AlpcMessage' : [ 0x6d8, ['pointer64', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x6d8, ['unsigned long']], + 'ExitStatus' : [ 0x6e0, ['long']], + 'AlpcWaitListEntry' : [ 0x6e8, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x6f8, ['unsigned long']], + 'IoBoostCount' : [ 0x6fc, ['unsigned long']], + 'BoostList' : [ 0x700, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x710, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x720, ['unsigned long long']], + 'IrpListLock' : [ 0x728, ['unsigned long long']], + 'ReservedForSynchTracking' : [ 0x730, ['pointer64', ['void']]], + 'CmCallbackListHead' : [ 0x738, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x740, ['pointer64', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x748, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x750, ['pointer64', ['void']]], + 'KernelStackReference' : [ 0x758, ['unsigned long']], + 'AdjustedClientToken' : [ 0x760, ['pointer64', ['void']]], + 'WorkingOnBehalfClient' : [ 0x768, ['pointer64', ['void']]], + 'PropertySet' : [ 0x770, ['_PS_PROPERTY_SET']], + 'PicoContext' : [ 0x788, ['pointer64', ['void']]], + 'UserFsBase' : [ 0x790, ['unsigned long']], + 'UserGsBase' : [ 0x798, ['unsigned long long']], + 'EnergyValues' : [ 0x7a0, ['pointer64', ['_THREAD_ENERGY_VALUES']]], + 'CmCellReferences' : [ 0x7a8, ['unsigned long']], + 'SelectedCpuSets' : [ 0x7b0, ['unsigned long long']], + 'SelectedCpuSetsIndirect' : [ 0x7b0, ['pointer64', ['unsigned long long']]], + 'Silo' : [ 0x7b8, ['pointer64', ['_EJOB']]], +} ], + '__unnamed_13c5' : [ 0x8, { + 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_13cb' : [ 0x10, { + 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], + 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_13cd' : [ 0x10, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_13cb']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_13d6' : [ 0x58, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], + 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x40, ['unsigned long']], + 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x50, ['pointer64', ['void']]], +} ], + '__unnamed_13d8' : [ 0x58, { + 'Overlay' : [ 0x0, ['__unnamed_13d6']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IRP' : [ 0xd0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'AllocationProcessorNumber' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'AssociatedIrp' : [ 0x18, ['__unnamed_13c5']], + 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x40, ['unsigned char']], + 'PendingReturned' : [ 0x41, ['unsigned char']], + 'StackCount' : [ 0x42, ['unsigned char']], + 'CurrentLocation' : [ 0x43, ['unsigned char']], + 'Cancel' : [ 0x44, ['unsigned char']], + 'CancelIrql' : [ 0x45, ['unsigned char']], + 'ApcEnvironment' : [ 0x46, ['unsigned char']], + 'AllocationFlags' : [ 0x47, ['unsigned char']], + 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Overlay' : [ 0x58, ['__unnamed_13cd']], + 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], + 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], + 'Tail' : [ 0x78, ['__unnamed_13d8']], +} ], + '__unnamed_13df' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'FileAttributes' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'EaLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13e3' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13e7' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13e9' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_13ed' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13ef' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13f1' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], +} ], + '__unnamed_13f3' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0x18, ['unsigned char']], + 'AdvanceOnly' : [ 0x19, ['unsigned char']], + 'ClusterCount' : [ 0x18, ['unsigned long']], + 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13f5' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x8, ['pointer64', ['void']]], + 'EaListLength' : [ 0x10, ['unsigned long']], + 'EaIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13f7' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13fb' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13fd' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'FsControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13ff' : [ 0x18, { + 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1401' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'IoControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1403' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1405' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_1409' : [ 0x10, { + 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_140d' : [ 0x8, { + 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_1411' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x8, ['pointer64', ['void']]], + 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1415' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_1419' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Version' : [ 0xa, ['unsigned short']], + 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_141d' : [ 0x8, { + 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_1421' : [ 0x8, { + 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_1423' : [ 0x20, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['void']]], + 'Offset' : [ 0x10, ['unsigned long']], + 'Length' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1425' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_1429' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_142d' : [ 0x10, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1431' : [ 0x10, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_1435' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_1439' : [ 0x8, { + 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1441' : [ 0x20, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x10, ['_POWER_STATE']], + 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], +} ], + '__unnamed_1445' : [ 0x10, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1447' : [ 0x20, { + 'ProviderId' : [ 0x0, ['unsigned long long']], + 'DataPath' : [ 0x8, ['pointer64', ['void']]], + 'BufferSize' : [ 0x10, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1449' : [ 0x20, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_144b' : [ 0x20, { + 'Create' : [ 0x0, ['__unnamed_13df']], + 'CreatePipe' : [ 0x0, ['__unnamed_13e3']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13e7']], + 'Read' : [ 0x0, ['__unnamed_13e9']], + 'Write' : [ 0x0, ['__unnamed_13e9']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13ed']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13ef']], + 'QueryFile' : [ 0x0, ['__unnamed_13f1']], + 'SetFile' : [ 0x0, ['__unnamed_13f3']], + 'QueryEa' : [ 0x0, ['__unnamed_13f5']], + 'SetEa' : [ 0x0, ['__unnamed_13f7']], + 'QueryVolume' : [ 0x0, ['__unnamed_13fb']], + 'SetVolume' : [ 0x0, ['__unnamed_13fb']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13fd']], + 'LockControl' : [ 0x0, ['__unnamed_13ff']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1401']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1403']], + 'SetSecurity' : [ 0x0, ['__unnamed_1405']], + 'MountVolume' : [ 0x0, ['__unnamed_1409']], + 'VerifyVolume' : [ 0x0, ['__unnamed_1409']], + 'Scsi' : [ 0x0, ['__unnamed_140d']], + 'QueryQuota' : [ 0x0, ['__unnamed_1411']], + 'SetQuota' : [ 0x0, ['__unnamed_13f7']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1415']], + 'QueryInterface' : [ 0x0, ['__unnamed_1419']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_141d']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1421']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1423']], + 'SetLock' : [ 0x0, ['__unnamed_1425']], + 'QueryId' : [ 0x0, ['__unnamed_1429']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_142d']], + 'UsageNotification' : [ 0x0, ['__unnamed_1431']], + 'WaitWake' : [ 0x0, ['__unnamed_1435']], + 'PowerSequence' : [ 0x0, ['__unnamed_1439']], + 'Power' : [ 0x0, ['__unnamed_1441']], + 'StartDevice' : [ 0x0, ['__unnamed_1445']], + 'WMI' : [ 0x0, ['__unnamed_1447']], + 'Others' : [ 0x0, ['__unnamed_1449']], +} ], + '_IO_STACK_LOCATION' : [ 0x48, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x8, ['__unnamed_144b']], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_1461' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], + 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'Characteristics' : [ 0x34, ['unsigned long']], + 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], + 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], + 'DeviceType' : [ 0x48, ['unsigned long']], + 'StackSize' : [ 0x4c, ['unsigned char']], + 'Queue' : [ 0x50, ['__unnamed_1461']], + 'AlignmentRequirement' : [ 0x98, ['unsigned long']], + 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0xc8, ['_KDPC']], + 'ActiveThreadCount' : [ 0x108, ['unsigned long']], + 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], + 'DeviceLock' : [ 0x118, ['_KEVENT']], + 'SectorSize' : [ 0x130, ['unsigned short']], + 'Spare1' : [ 0x132, ['unsigned short']], + 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0x140, ['pointer64', ['void']]], +} ], + '_KDPC' : [ 0x40, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x10, ['unsigned long long']], + 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], + 'DpcData' : [ 0x38, ['pointer64', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x28, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], + 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], + 'SiloContext' : [ 0x20, ['pointer64', ['_EJOB']]], +} ], + '_EJOB' : [ 0x528, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], + 'JobLock' : [ 0x38, ['_ERESOURCE']], + 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0xc0, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0xc8, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0xd0, ['unsigned long']], + 'TotalProcesses' : [ 0xd4, ['unsigned long']], + 'ActiveProcesses' : [ 0xd8, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0xdc, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0xe0, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xf0, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0xf8, ['unsigned long long']], + 'LimitFlags' : [ 0x100, ['unsigned long']], + 'ActiveProcessLimit' : [ 0x104, ['unsigned long']], + 'Affinity' : [ 0x108, ['_KAFFINITY_EX']], + 'AccessState' : [ 0x1b0, ['pointer64', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0x1b8, ['pointer64', ['void']]], + 'UIRestrictionsClass' : [ 0x1c0, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0x1c4, ['unsigned long']], + 'CompletionPort' : [ 0x1c8, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x1d0, ['pointer64', ['void']]], + 'CompletionCount' : [ 0x1d8, ['unsigned long long']], + 'SessionId' : [ 0x1e0, ['unsigned long']], + 'SchedulingClass' : [ 0x1e4, ['unsigned long']], + 'ReadOperationCount' : [ 0x1e8, ['unsigned long long']], + 'WriteOperationCount' : [ 0x1f0, ['unsigned long long']], + 'OtherOperationCount' : [ 0x1f8, ['unsigned long long']], + 'ReadTransferCount' : [ 0x200, ['unsigned long long']], + 'WriteTransferCount' : [ 0x208, ['unsigned long long']], + 'OtherTransferCount' : [ 0x210, ['unsigned long long']], + 'DiskIoInfo' : [ 0x218, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x240, ['unsigned long long']], + 'JobMemoryLimit' : [ 0x248, ['unsigned long long']], + 'JobTotalMemoryLimit' : [ 0x250, ['unsigned long long']], + 'PeakProcessMemoryUsed' : [ 0x258, ['unsigned long long']], + 'PeakJobMemoryUsed' : [ 0x260, ['unsigned long long']], + 'EffectiveAffinity' : [ 0x268, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x310, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x318, ['unsigned long long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x320, ['unsigned long long']], + 'EffectiveProcessMemoryLimit' : [ 0x328, ['unsigned long long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x330, ['pointer64', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x338, ['pointer64', ['_EJOB']]], + 'EffectiveDiskIoRateLimitJob' : [ 0x340, ['pointer64', ['_EJOB']]], + 'EffectiveNetIoRateLimitJob' : [ 0x348, ['pointer64', ['_EJOB']]], + 'EffectiveHeapAttributionJob' : [ 0x350, ['pointer64', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x358, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x35c, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x360, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x364, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x368, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x36c, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x370, ['unsigned char']], + 'PriorityClass' : [ 0x371, ['unsigned char']], + 'NestingDepth' : [ 0x372, ['unsigned char']], + 'Reserved1' : [ 0x373, ['array', 1, ['unsigned char']]], + 'CompletionFilter' : [ 0x374, ['unsigned long']], + 'WakeChannel' : [ 0x378, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x378, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x3b0, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x3b8, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x3bc, ['unsigned long']], + 'NotificationLink' : [ 0x3c0, ['pointer64', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x3c8, ['unsigned long long']], + 'NotificationInfo' : [ 0x3d0, ['pointer64', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x3d8, ['pointer64', ['void']]], + 'NotificationPacket' : [ 0x3e0, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x3e8, ['pointer64', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x3f0, ['pointer64', ['void']]], + 'ReadyTime' : [ 0x3f8, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x400, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x408, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x418, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x428, ['pointer64', ['_EJOB']]], + 'RootJob' : [ 0x430, ['pointer64', ['_EJOB']]], + 'IteratorListHead' : [ 0x438, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x448, ['unsigned long long']], + 'Ancestors' : [ 0x450, ['pointer64', ['pointer64', ['_EJOB']]]], + 'SessionObject' : [ 0x450, ['pointer64', ['void']]], + 'Accounting' : [ 0x458, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x4a8, ['unsigned long']], + 'ActiveAuxiliaryProcessCount' : [ 0x4ac, ['unsigned long']], + 'SequenceNumber' : [ 0x4b0, ['unsigned long']], + 'TimerListLock' : [ 0x4b8, ['unsigned long long']], + 'TimerListHead' : [ 0x4c0, ['_LIST_ENTRY']], + 'ContainerId' : [ 0x4d0, ['_GUID']], + 'Container' : [ 0x4e0, ['pointer64', ['_SILO_CONTEXT']]], + 'PropertySet' : [ 0x4e8, ['_PS_PROPERTY_SET']], + 'NetRateControl' : [ 0x500, ['pointer64', ['_JOB_NET_RATE_CONTROL']]], + 'IoRateControl' : [ 0x508, ['pointer64', ['_JOB_IO_RATE_CONTROL']]], + 'JobFlags' : [ 0x510, ['unsigned long']], + 'CloseDone' : [ 0x510, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x510, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x510, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x510, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x510, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x510, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x510, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x510, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x510, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x510, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x510, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x510, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x510, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x510, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x510, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x510, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x510, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x510, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x510, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'NetRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'OwnNetRateControl' : [ 0x510, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IoRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'OwnIoRateControl' : [ 0x510, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'DisallowNewProcesses' : [ 0x510, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'SpareJobFlags' : [ 0x510, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x514, ['unsigned long']], + 'EnergyValues' : [ 0x518, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'SharedCommitCharge' : [ 0x520, ['unsigned long long']], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_MDL' : [ 0x30, { + 'Next' : [ 0x0, ['pointer64', ['_MDL']]], + 'Size' : [ 0x8, ['short']], + 'MdlFlags' : [ 0xa, ['short']], + 'AllocationProcessorNumber' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], + 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'ByteCount' : [ 0x28, ['unsigned long']], + 'ByteOffset' : [ 0x2c, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x70, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer64', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x60, ['pointer64', ['void']]], + 'UserContext' : [ 0x68, ['pointer64', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0xd8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], + 'FsContext' : [ 0x18, ['pointer64', ['void']]], + 'FsContext2' : [ 0x20, ['pointer64', ['void']]], + 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], + 'FinalStatus' : [ 0x38, ['long']], + 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x48, ['unsigned char']], + 'DeletePending' : [ 0x49, ['unsigned char']], + 'ReadAccess' : [ 0x4a, ['unsigned char']], + 'WriteAccess' : [ 0x4b, ['unsigned char']], + 'DeleteAccess' : [ 0x4c, ['unsigned char']], + 'SharedRead' : [ 0x4d, ['unsigned char']], + 'SharedWrite' : [ 0x4e, ['unsigned char']], + 'SharedDelete' : [ 0x4f, ['unsigned char']], + 'Flags' : [ 0x50, ['unsigned long']], + 'FileName' : [ 0x58, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x70, ['unsigned long']], + 'Busy' : [ 0x74, ['unsigned long']], + 'LastLock' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['_KEVENT']], + 'Event' : [ 0x98, ['_KEVENT']], + 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0xb8, ['unsigned long long']], + 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], + 'CurrentFileIndex' : [ 0xc, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], + 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], + 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], + 'SessionId' : [ 0x40, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], + 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], + 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'Oplock' : [ 0x58, ['pointer64', ['void']]], + 'ReservedForRemote' : [ 0x58, ['pointer64', ['void']]], + 'ReservedContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_iobuf' : [ 0x30, { + '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], + '_cnt' : [ 0x8, ['long']], + '_base' : [ 0x10, ['pointer64', ['unsigned char']]], + '_flag' : [ 0x18, ['long']], + '_file' : [ 0x1c, ['long']], + '_charbuf' : [ 0x20, ['long']], + '_bufsiz' : [ 0x24, ['long']], + '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], +} ], + '_TlgProvider_t' : [ 0x40, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], + 'KeywordAny' : [ 0x10, ['unsigned long long']], + 'KeywordAll' : [ 0x18, ['unsigned long long']], + 'RegHandle' : [ 0x20, ['unsigned long long']], + 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], + 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '__unnamed_164b' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_164b']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0x10, { + 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'State' : [ 0x8, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], + 'Stats' : [ 0xc, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x68, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0x18, ['short']], + 'Flag' : [ 0x1a, ['unsigned short']], + 'ReservedLowFlags' : [ 0x1a, ['unsigned char']], + 'WaiterPriority' : [ 0x1b, ['unsigned char']], + 'SharedWaiters' : [ 0x20, ['_KWAIT_CHAIN']], + 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x40, ['unsigned long']], + 'ContentionCount' : [ 0x44, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], + 'Reserved2' : [ 0x50, ['pointer64', ['void']]], + 'Address' : [ 0x58, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], + 'SpinLock' : [ 0x60, ['unsigned long long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0x18, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x10, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x28, { + 'Total' : [ 0x0, ['unsigned long long']], + 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x10, ['unsigned long long']], + 'Blink' : [ 0x18, ['unsigned long long']], + 'Lock' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_1683' : [ 0x8, { + 'Flink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeFlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 64, native_type='unsigned long long')]], + 'WsIndex' : [ 0x0, ['unsigned long long']], + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1687' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], + 'VolatileShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_1689' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_1687']], +} ], + '__unnamed_1695' : [ 0x8, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'Channel' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 38, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'Partition' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 50, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 52, native_type='unsigned long long')]], + 'FileOnly' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'PfnExists' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], +} ], + '_MMPFN' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'u1' : [ 0x0, ['__unnamed_1683']], + 'PteAddress' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x8, ['pointer64', ['void']]], + 'PteLong' : [ 0x8, ['unsigned long long']], + 'OriginalPte' : [ 0x10, ['_MMPTE']], + 'u2' : [ 0x18, ['_MIPFNBLINK']], + 'u3' : [ 0x20, ['__unnamed_1689']], + 'NodeBlinkLow' : [ 0x24, ['unsigned short']], + 'Unused' : [ 0x26, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'VaType' : [ 0x26, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'ViewCount' : [ 0x27, ['unsigned char']], + 'NodeFlinkLow' : [ 0x27, ['unsigned char']], + 'u4' : [ 0x28, ['__unnamed_1695']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x60, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'BasePte' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'VaType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaMaximumType', 15: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], + 'PteFailures' : [ 0x28, ['unsigned long']], + 'SpinLock' : [ 0x30, ['unsigned long long']], + 'GlobalPushLock' : [ 0x30, ['pointer64', ['_EX_PUSH_LOCK']]], + 'Vm' : [ 0x38, ['pointer64', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x40, ['unsigned long long']], + 'Hint' : [ 0x48, ['unsigned long long']], + 'CachedPtes' : [ 0x50, ['pointer64', ['_MI_CACHED_PTES']]], + 'TotalFreeSystemPtes' : [ 0x58, ['unsigned long long']], +} ], + '_MMCLONE_DESCRIPTOR' : [ 0x50, { + 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Next' : [ 0x0, ['pointer64', ['_MMCLONE_DESCRIPTOR']]], + 'StartingCloneBlock' : [ 0x18, ['pointer64', ['_MMCLONE_BLOCK']]], + 'EndingCloneBlock' : [ 0x20, ['pointer64', ['_MMCLONE_BLOCK']]], + 'NumberOfPtes' : [ 0x28, ['unsigned long long']], + 'NumberOfReferences' : [ 0x30, ['unsigned long long']], + 'CloneHeader' : [ 0x38, ['pointer64', ['_MMCLONE_HEADER']]], + 'NonPagedPoolQuotaCharge' : [ 0x40, ['unsigned long long']], + 'NestingLevel' : [ 0x48, ['unsigned long long']], +} ], + '__unnamed_16c7' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_16c7']], +} ], + '_MMWSL' : [ 0x350, { + 'FirstFree' : [ 0x0, ['unsigned long long']], + 'FirstDynamic' : [ 0x8, ['unsigned long long']], + 'LastEntry' : [ 0x10, ['unsigned long long']], + 'NextSlot' : [ 0x18, ['unsigned long long']], + 'LastInitializedWsle' : [ 0x20, ['unsigned long long']], + 'NextAgingSlot' : [ 0x28, ['unsigned long long']], + 'NextAccessClearingSlot' : [ 0x30, ['unsigned long long']], + 'LastAccessClearingRemainder' : [ 0x38, ['unsigned long']], + 'LastAgingRemainder' : [ 0x3c, ['unsigned long']], + 'WsleSize' : [ 0x40, ['unsigned long']], + 'NonDirectCount' : [ 0x48, ['unsigned long long']], + 'LowestPagableAddress' : [ 0x50, ['pointer64', ['void']]], + 'NonDirectHash' : [ 0x58, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x60, ['pointer64', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x68, ['pointer64', ['_MMWSLE_HASH']]], + 'ActiveWsleCounts' : [ 0x70, ['array', 16, ['unsigned long long']]], + 'ActiveWsles' : [ 0xf0, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], + 'Wsle' : [ 0x1f0, ['pointer64', ['_MMWSLE']]], + 'UserVaInfo' : [ 0x1f8, ['_MI_USER_VA_INFO']], +} ], + '_MMSUPPORT' : [ 0xf8, { + 'WorkingSetLock' : [ 0x0, ['long']], + 'ExitOutswapGate' : [ 0x8, ['pointer64', ['_KGATE']]], + 'AccessLog' : [ 0x10, ['pointer64', ['void']]], + 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long long']]], + 'MinimumWorkingSetSize' : [ 0x60, ['unsigned long long']], + 'WorkingSetLeafSize' : [ 0x68, ['unsigned long long']], + 'WorkingSetLeafPrivateSize' : [ 0x70, ['unsigned long long']], + 'WorkingSetSize' : [ 0x78, ['unsigned long long']], + 'WorkingSetPrivateSize' : [ 0x80, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0x88, ['unsigned long long']], + 'ChargedWslePages' : [ 0x90, ['unsigned long long']], + 'ActualWslePages' : [ 0x98, ['unsigned long long']], + 'WorkingSetSizeOverhead' : [ 0xa0, ['unsigned long long']], + 'PeakWorkingSetSize' : [ 0xa8, ['unsigned long long']], + 'HardFaultCount' : [ 0xb0, ['unsigned long']], + 'PartitionId' : [ 0xb4, ['unsigned short']], + 'Pad0' : [ 0xb6, ['unsigned short']], + 'VmWorkingSetList' : [ 0xb8, ['pointer64', ['_MMWSL']]], + 'NextPageColor' : [ 0xc0, ['unsigned short']], + 'LastTrimStamp' : [ 0xc2, ['unsigned short']], + 'PageFaultCount' : [ 0xc4, ['unsigned long']], + 'TrimmedPageCount' : [ 0xc8, ['unsigned long long']], + 'Reserved0' : [ 0xd0, ['unsigned long long']], + 'Flags' : [ 0xd8, ['_MMSUPPORT_FLAGS']], + 'ReleasedCommitDebt' : [ 0xe0, ['unsigned long long']], + 'WsSwapSupport' : [ 0xe8, ['pointer64', ['void']]], + 'CommitReAcquireFailSupport' : [ 0xf0, ['pointer64', ['void']]], +} ], + '__unnamed_16e3' : [ 0x8, { + 'ImageCommitment' : [ 0x0, ['unsigned long long']], + 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_16e7' : [ 0x8, { + 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_SEGMENT' : [ 0x48, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x30, ['__unnamed_16e3']], + 'u2' : [ 0x38, ['__unnamed_16e7']], + 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], +} ], + '__unnamed_16ec' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_16ef' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS2']], +} ], + '__unnamed_16f9' : [ 0x10, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], + 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_16fb' : [ 0x10, { + 'e2' : [ 0x0, ['__unnamed_16f9']], +} ], + '_CONTROL_AREA' : [ 0x78, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], + 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], + 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16ec']], + 'u1' : [ 0x3c, ['__unnamed_16ef']], + 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x48, ['long']], + 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], + 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x58, ['__unnamed_16fb']], + 'LockedPages' : [ 0x68, ['unsigned long long']], + 'FileObjectLock' : [ 0x70, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1709' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_170c' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x40, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer64', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0x18, ['unsigned long']], + 'EndingVpn' : [ 0x1c, ['unsigned long']], + 'StartingVpnHigh' : [ 0x20, ['unsigned char']], + 'EndingVpnHigh' : [ 0x21, ['unsigned char']], + 'CommitChargeHigh' : [ 0x22, ['unsigned char']], + 'SpareNT64VadUChar' : [ 0x23, ['unsigned char']], + 'ReferenceCount' : [ 0x24, ['long']], + 'PushLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u' : [ 0x30, ['__unnamed_1709']], + 'u1' : [ 0x34, ['__unnamed_170c']], + 'EventList' : [ 0x38, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_MI_PARTITION' : [ 0x2740, { + 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], + 'Modwriter' : [ 0x158, ['_MI_PARTITION_MODWRITES']], + 'Store' : [ 0x430, ['_MI_PARTITION_STORES']], + 'Segments' : [ 0x4c0, ['_MI_PARTITION_SEGMENTS']], + 'PageLists' : [ 0x640, ['_MI_PARTITION_PAGE_LISTS']], + 'Commit' : [ 0x1380, ['_MI_PARTITION_COMMIT']], + 'Zeroing' : [ 0x1400, ['_MI_PARTITION_ZEROING']], + 'PageCombine' : [ 0x1468, ['_MI_PAGE_COMBINING_SUPPORT']], + 'WorkingSetControl' : [ 0x15f0, ['pointer64', ['void']]], + 'WorkingSetExpansionHead' : [ 0x15f8, ['_MMWORKING_SET_EXPANSION_HEAD']], + 'Vp' : [ 0x1640, ['_MI_VISIBLE_PARTITION']], +} ], + '_MM_STORE_KEY' : [ 0x8, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'EntireKey' : [ 0x0, ['unsigned long long']], +} ], + '_MMPAGING_FILE' : [ 0x120, { + 'Size' : [ 0x0, ['unsigned long long']], + 'MaximumSize' : [ 0x8, ['unsigned long long']], + 'MinimumSize' : [ 0x10, ['unsigned long long']], + 'FreeSpace' : [ 0x18, ['unsigned long long']], + 'PeakUsage' : [ 0x20, ['unsigned long long']], + 'HighestPage' : [ 0x28, ['unsigned long long']], + 'FreeReservationSpace' : [ 0x30, ['unsigned long long']], + 'File' : [ 0x38, ['pointer64', ['_FILE_OBJECT']]], + 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x50, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x60, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x70, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x78, ['unsigned long']], + 'LargestAllocationCluster' : [ 0x7c, ['unsigned long']], + 'RefreshAllocationCluster' : [ 0x80, ['unsigned long']], + 'LastRefreshAllocationCluster' : [ 0x84, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x88, ['unsigned long']], + 'MaximumRunLengthInBitmaps' : [ 0x8c, ['unsigned long']], + 'BitmapsCacheLengthTree' : [ 0x90, ['_RTL_RB_TREE']], + 'BitmapsCacheLocationTree' : [ 0xa0, ['_RTL_RB_TREE']], + 'BitmapsCacheFreeList' : [ 0xb0, ['_LIST_ENTRY']], + 'BitmapsCacheEntries' : [ 0xc0, ['pointer64', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], + 'ToBeEvictedCount' : [ 0xc8, ['unsigned long']], + 'HybridPriority' : [ 0xc8, ['unsigned long']], + 'PageFileNumber' : [ 0xcc, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0xcc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'NoReservations' : [ 0xcc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'VirtualStorePagefile' : [ 0xcc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SwapSupported' : [ 0xcc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'NodeInserted' : [ 0xcc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'StackNotified' : [ 0xcc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0xcc, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], + 'AdriftMdls' : [ 0xce, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0xce, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'IgnoreReservations' : [ 0xcf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare2' : [ 0xcf, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0xd0, ['unsigned long']], + 'PageHashPagesPeak' : [ 0xd4, ['unsigned long']], + 'PageHash' : [ 0xd8, ['pointer64', ['unsigned long']]], + 'FileHandle' : [ 0xe0, ['pointer64', ['void']]], + 'Lock' : [ 0xe8, ['unsigned long long']], + 'LockOwner' : [ 0xf0, ['pointer64', ['_ETHREAD']]], + 'FlowThroughReadRoot' : [ 0xf8, ['_RTL_AVL_TREE']], + 'Partition' : [ 0x100, ['pointer64', ['_MI_PARTITION']]], + 'FileObjectNode' : [ 0x108, ['_RTL_BALANCED_NODE']], +} ], + 'tagSWITCH_CONTEXT' : [ 0x68, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '_CMP_SILO_CONTEXT' : [ 0x20, { + 'LockEntryHead' : [ 0x0, ['_LIST_ENTRY']], + 'LockListUnderCleanup' : [ 0x10, ['unsigned char']], + 'ContextLock' : [ 0x18, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1756' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1759' : [ 0x18, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x8, ['pointer64', ['void']]], + 'Status' : [ 0x10, ['long']], +} ], + '__unnamed_175b' : [ 0x8, { + 'CheckStack' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_175f' : [ 0x20, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], + 'RootPoint' : [ 0x10, ['pointer64', ['void']]], + 'Index' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1761' : [ 0x18, { + 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], + 'Index' : [ 0x8, ['unsigned long']], + 'Cell' : [ 0xc, ['unsigned long']], + 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], +} ], + '__unnamed_1765' : [ 0x10, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], +} ], + '__unnamed_1769' : [ 0x10, { + 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], + 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], +} ], + '__unnamed_176b' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x160, { + 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], + 'Index' : [ 0x8, ['unsigned long']], + 'RecoverableIndex' : [ 0xc, ['unsigned long']], + 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1756']]], + 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1756']]], + 'RegistryIO' : [ 0xd0, ['__unnamed_1759']], + 'CheckRegistry2' : [ 0xe8, ['__unnamed_175b']], + 'CheckKey' : [ 0xf0, ['__unnamed_175f']], + 'CheckValueList' : [ 0x110, ['__unnamed_1761']], + 'CheckHive' : [ 0x128, ['__unnamed_1765']], + 'CheckHive1' : [ 0x138, ['__unnamed_1765']], + 'CheckBin' : [ 0x148, ['__unnamed_1769']], + 'RecoverData' : [ 0x158, ['__unnamed_176b']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x10, ['unsigned long']], + 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xc0, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'ParkingStatus' : [ 0x80, ['unsigned long']], + 'CurrentFrequency' : [ 0x84, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], + 'StateFlags' : [ 0x8c, ['unsigned long']], + 'NominalThroughput' : [ 0x90, ['unsigned long']], + 'ActiveThroughput' : [ 0x94, ['unsigned long']], + 'ScaledThroughput' : [ 0x98, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb8, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x10, { + 'Data' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_TEB32' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], + 'SystemReserved1' : [ 0x10c, ['array', 38, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_TEB64' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], + 'SystemReserved1' : [ 0x190, ['array', 38, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], + 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], + 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], + 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], + 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x2200, { + 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], + 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x20, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['_LIST_ENTRY']], + 'Time' : [ 0x18, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x38, { + 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Level' : [ 0x10, ['unsigned char']], + 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x260, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'ReadySummary' : [ 0x8, ['unsigned long']], + 'ReadyListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x210, ['array', 64, ['unsigned char']]], + 'Span' : [ 0x250, ['unsigned char']], + 'LowProcIndex' : [ 0x251, ['unsigned char']], + 'QueueIndex' : [ 0x252, ['unsigned char']], + 'ProcCount' : [ 0x253, ['unsigned char']], + 'ScanOwner' : [ 0x254, ['unsigned char']], + 'Spare' : [ 0x255, ['array', 3, ['unsigned char']]], + 'Affinity' : [ 0x258, ['unsigned long long']], +} ], + '_KEXCEPTION_FRAME' : [ 0x140, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'Spare1' : [ 0x28, ['unsigned long long']], + 'Xmm6' : [ 0x30, ['_M128A']], + 'Xmm7' : [ 0x40, ['_M128A']], + 'Xmm8' : [ 0x50, ['_M128A']], + 'Xmm9' : [ 0x60, ['_M128A']], + 'Xmm10' : [ 0x70, ['_M128A']], + 'Xmm11' : [ 0x80, ['_M128A']], + 'Xmm12' : [ 0x90, ['_M128A']], + 'Xmm13' : [ 0xa0, ['_M128A']], + 'Xmm14' : [ 0xb0, ['_M128A']], + 'Xmm15' : [ 0xc0, ['_M128A']], + 'TrapFrame' : [ 0xd0, ['unsigned long long']], + 'OutputBuffer' : [ 0xd8, ['unsigned long long']], + 'OutputLength' : [ 0xe0, ['unsigned long long']], + 'Spare2' : [ 0xe8, ['unsigned long long']], + 'MxCsr' : [ 0xf0, ['unsigned long long']], + 'Rbp' : [ 0xf8, ['unsigned long long']], + 'Rbx' : [ 0x100, ['unsigned long long']], + 'Rdi' : [ 0x108, ['unsigned long long']], + 'Rsi' : [ 0x110, ['unsigned long long']], + 'R12' : [ 0x118, ['unsigned long long']], + 'R13' : [ 0x120, ['unsigned long long']], + 'R14' : [ 0x128, ['unsigned long long']], + 'R15' : [ 0x130, ['unsigned long long']], + 'Return' : [ 0x138, ['unsigned long long']], +} ], + '_KTRAP_FRAME' : [ 0x190, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'PreviousMode' : [ 0x28, ['unsigned char']], + 'PreviousIrql' : [ 0x29, ['unsigned char']], + 'FaultIndicator' : [ 0x2a, ['unsigned char']], + 'ExceptionActive' : [ 0x2b, ['unsigned char']], + 'MxCsr' : [ 0x2c, ['unsigned long']], + 'Rax' : [ 0x30, ['unsigned long long']], + 'Rcx' : [ 0x38, ['unsigned long long']], + 'Rdx' : [ 0x40, ['unsigned long long']], + 'R8' : [ 0x48, ['unsigned long long']], + 'R9' : [ 0x50, ['unsigned long long']], + 'R10' : [ 0x58, ['unsigned long long']], + 'R11' : [ 0x60, ['unsigned long long']], + 'GsBase' : [ 0x68, ['unsigned long long']], + 'GsSwap' : [ 0x68, ['unsigned long long']], + 'Xmm0' : [ 0x70, ['_M128A']], + 'Xmm1' : [ 0x80, ['_M128A']], + 'Xmm2' : [ 0x90, ['_M128A']], + 'Xmm3' : [ 0xa0, ['_M128A']], + 'Xmm4' : [ 0xb0, ['_M128A']], + 'Xmm5' : [ 0xc0, ['_M128A']], + 'FaultAddress' : [ 0xd0, ['unsigned long long']], + 'ContextRecord' : [ 0xd0, ['unsigned long long']], + 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], + 'Dr0' : [ 0xd8, ['unsigned long long']], + 'Dr1' : [ 0xe0, ['unsigned long long']], + 'Dr2' : [ 0xe8, ['unsigned long long']], + 'Dr3' : [ 0xf0, ['unsigned long long']], + 'Dr6' : [ 0xf8, ['unsigned long long']], + 'Dr7' : [ 0x100, ['unsigned long long']], + 'DebugControl' : [ 0x108, ['unsigned long long']], + 'LastBranchToRip' : [ 0x110, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], + 'SegDs' : [ 0x130, ['unsigned short']], + 'SegEs' : [ 0x132, ['unsigned short']], + 'SegFs' : [ 0x134, ['unsigned short']], + 'SegGs' : [ 0x136, ['unsigned short']], + 'TrapFrame' : [ 0x138, ['unsigned long long']], + 'Rbx' : [ 0x140, ['unsigned long long']], + 'Rdi' : [ 0x148, ['unsigned long long']], + 'Rsi' : [ 0x150, ['unsigned long long']], + 'Rbp' : [ 0x158, ['unsigned long long']], + 'ErrorCode' : [ 0x160, ['unsigned long long']], + 'ExceptionFrame' : [ 0x160, ['unsigned long long']], + 'TimeStampKlog' : [ 0x160, ['unsigned long long']], + 'Rip' : [ 0x168, ['unsigned long long']], + 'SegCs' : [ 0x170, ['unsigned short']], + 'Fill0' : [ 0x172, ['unsigned char']], + 'Logging' : [ 0x173, ['unsigned char']], + 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], + 'EFlags' : [ 0x178, ['unsigned long']], + 'Fill2' : [ 0x17c, ['unsigned long']], + 'Rsp' : [ 0x180, ['unsigned long long']], + 'SegSs' : [ 0x188, ['unsigned short']], + 'Fill3' : [ 0x18a, ['unsigned short']], + 'Fill4' : [ 0x18c, ['unsigned long']], +} ], + '__unnamed_1866' : [ 0x8, { + 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1868' : [ 0x8, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], +} ], + '__unnamed_186c' : [ 0x20, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0x18, ['pointer64', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x2c8, { + 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x58, ['long']], + 'FxRemoveEvent' : [ 0x60, ['_KEVENT']], + 'FxActivationCount' : [ 0x78, ['long']], + 'FxSleepCount' : [ 0x7c, ['long']], + 'Plugin' : [ 0x80, ['pointer64', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x88, ['unsigned long']], + 'CurrentPowerState' : [ 0x8c, ['_POWER_STATE']], + 'Notify' : [ 0x90, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0xf8, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0x118, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0x128, ['unsigned long']], + 'State' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0x130, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0x134, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x184, ['unsigned long']], + 'CompletionStatus' : [ 0x188, ['long']], + 'Flags' : [ 0x18c, ['unsigned long']], + 'UserFlags' : [ 0x190, ['unsigned long']], + 'Problem' : [ 0x194, ['unsigned long']], + 'ProblemStatus' : [ 0x198, ['long']], + 'ResourceList' : [ 0x1a0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x1a8, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x1b0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x1b8, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x1c4, ['unsigned long']], + 'ChildInterfaceType' : [ 0x1c8, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x1cc, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x1d0, ['unsigned short']], + 'RemovalPolicy' : [ 0x1d2, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x1d3, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x1d8, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x1e8, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x1f8, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x208, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x20a, ['unsigned short']], + 'NoArbiterMask' : [ 0x20c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x20e, ['unsigned short']], + 'OverUsed1' : [ 0x210, ['__unnamed_1866']], + 'OverUsed2' : [ 0x218, ['__unnamed_1868']], + 'BootResources' : [ 0x220, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x228, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x230, ['unsigned long']], + 'DockInfo' : [ 0x238, ['__unnamed_186c']], + 'DisableableDepends' : [ 0x258, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x260, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x270, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x280, ['unsigned long']], + 'PreviousParent' : [ 0x288, ['pointer64', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x290, ['long']], + 'NumaNodeIndex' : [ 0x294, ['unsigned long']], + 'ContainerID' : [ 0x298, ['_GUID']], + 'OverrideFlags' : [ 0x2a8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x2ac, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x2b0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x2b8, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x2c0, ['unsigned long']], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x48, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x30, ['pointer64', ['unsigned long']]], + 'EnableKeyWords' : [ 0x38, ['pointer64', ['unsigned long long']]], + 'EnableLevel' : [ 0x40, ['pointer64', ['unsigned char']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x10, ['unsigned long']], + 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x48, ['unsigned long long']], +} ], + '_KSEMAPHORE' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x18, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x68, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x10, ['unsigned long']], + 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x20, ['unsigned long']], + 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], + 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x38, ['long']], + 'StartIoKey' : [ 0x3c, ['long']], + 'StartIoFlags' : [ 0x40, ['unsigned long']], + 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], + 'DependencyNode' : [ 0x50, ['pointer64', ['void']]], + 'InterruptContext' : [ 0x58, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_GROUP_AFFINITY' : [ 0x10, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Group' : [ 0x8, ['unsigned short']], + 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], +} ], + '_KAFFINITY_EX' : [ 0xa8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 20, ['unsigned long long']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x40, { + 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0x10, ['unsigned long']], + 'Position' : [ 0x14, ['unsigned long']], + 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x20, ['pointer64', ['void']]], + 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x38, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1969' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_1969']], +} ], + '__unnamed_1970' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_1970']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PEP_ACPI_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], + 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], + 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], + 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], + 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], + 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], + 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], +} ], + '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Information' : [ 0x4, ['unsigned char']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Alignment' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'Count' : [ 0x10, ['unsigned char']], + 'Pins' : [ 0x18, ['pointer64', ['unsigned long']]], +} ], + '_PEP_ACPI_GPIO_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], + 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], + 'DriveStrength' : [ 0x18, ['unsigned short']], + 'DebounceTimeout' : [ 0x1a, ['unsigned short']], + 'PinTable' : [ 0x20, ['pointer64', ['unsigned short']]], + 'PinCount' : [ 0x28, ['unsigned short']], + 'ResourceSourceIndex' : [ 0x2a, ['unsigned char']], + 'ResourceSourceName' : [ 0x30, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x38, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x40, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x30, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'SlaveAddress' : [ 0x2c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'BaudRate' : [ 0x28, ['unsigned long']], + 'RxBufferSize' : [ 0x2c, ['unsigned short']], + 'TxBufferSize' : [ 0x2e, ['unsigned short']], + 'Parity' : [ 0x30, ['unsigned char']], + 'LinesInUse' : [ 0x31, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'DataBitLength' : [ 0x2c, ['unsigned char']], + 'Phase' : [ 0x2d, ['unsigned char']], + 'Polarity' : [ 0x2e, ['unsigned char']], + 'DeviceSelection' : [ 0x30, ['unsigned short']], +} ], + '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'ResourceFlags' : [ 0x8, ['unsigned char']], + 'GeneralFlags' : [ 0x9, ['unsigned char']], + 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], + 'RevisionId' : [ 0xb, ['unsigned char']], + 'Reserved' : [ 0xc, ['unsigned char']], + 'Granularity' : [ 0x10, ['unsigned long long']], + 'MinimumAddress' : [ 0x18, ['unsigned long long']], + 'MaximumAddress' : [ 0x20, ['unsigned long long']], + 'TranslationAddress' : [ 0x28, ['unsigned long long']], + 'AddressLength' : [ 0x30, ['unsigned long long']], + 'TypeAttribute' : [ 0x38, ['unsigned long long']], + 'DescriptorName' : [ 0x40, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_PPM_PLATFORM_STATES' : [ 0x1c0, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'InterfaceVersion' : [ 0x4, ['unsigned long']], + 'ProcessorCount' : [ 0x8, ['unsigned long']], + 'CoordinatedInterface' : [ 0xc, ['unsigned char']], + 'IdleTest' : [ 0x10, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x18, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x20, ['pointer64', ['void']]], + 'QueryPlatformStateResidency' : [ 0x28, ['pointer64', ['void']]], + 'Accounting' : [ 0x30, ['pointer64', ['_PLATFORM_IDLE_ACCOUNTING']]], + 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_PPM_PROFILE' : [ 0xb30, { + 'Name' : [ 0x0, ['pointer64', ['unsigned short']]], + 'Id' : [ 0x8, ['unsigned char']], + 'Guid' : [ 0xc, ['_GUID']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Priority' : [ 0x20, ['unsigned char']], + 'Settings' : [ 0x28, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], + 'StartTime' : [ 0xb08, ['unsigned long long']], + 'Count' : [ 0xb10, ['unsigned long long']], + 'MaxDuration' : [ 0xb18, ['unsigned long long']], + 'MinDuration' : [ 0xb20, ['unsigned long long']], + 'TotalDuration' : [ 0xb28, ['unsigned long long']], +} ], + '_PPM_ENGINE_SETTINGS' : [ 0x570, { + 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], + 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], + 'PerfTimeCheck' : [ 0x14, ['unsigned long']], + 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], + 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], + 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], + 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], + 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], + 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], + 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], + 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], + 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], + 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], + 'PerfBoostMode' : [ 0x30, ['unsigned long']], + 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], + 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], + 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], + 'AutonomousPreference' : [ 0x40, ['unsigned char']], + 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], + 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], + 'DutyCycling' : [ 0x45, ['unsigned char']], + 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], + 'DistributeUtility' : [ 0x48, ['unsigned char']], + 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], + 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], + 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], + 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], + 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], + 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], + 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], + 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], + 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], + 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], + 'AllowScaling' : [ 0x5c, ['unsigned char']], + 'IdleDisabled' : [ 0x5d, ['unsigned char']], + 'IdleTimeCheck' : [ 0x60, ['unsigned long']], + 'IdleDemotePercent' : [ 0x64, ['unsigned char']], + 'IdlePromotePercent' : [ 0x65, ['unsigned char']], + 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], + 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], + 'HeteroDecreaseThreshold' : [ 0x68, ['array', 640, ['unsigned char']]], + 'HeteroIncreaseThreshold' : [ 0x2e8, ['array', 640, ['unsigned char']]], + 'Class0FloorPerformance' : [ 0x568, ['unsigned char']], + 'Class1InitialPerformance' : [ 0x569, ['unsigned char']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_PERF_FLAGS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], + 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], + 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0xd0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x20, ['unsigned long long']], + 'LogHandleContext' : [ 0x28, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0xc0, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0xc4, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0xc8, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x210, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], + 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x70, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], + 'Flags' : [ 0x98, ['unsigned long']], + 'Status' : [ 0x9c, ['long']], + 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], + 'Section' : [ 0xa8, ['pointer64', ['void']]], + 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], + 'PagesToWrite' : [ 0xc0, ['unsigned long']], + 'BeyondLastFlush' : [ 0xc8, ['long long']], + 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], + 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], + 'V1' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0x100, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0x108, ['unsigned long']], + 'LazyWritePassCount' : [ 0x10c, ['unsigned long']], + 'UninitializeEvent' : [ 0x110, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0x118, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0x150, ['_LARGE_INTEGER']], + 'Event' : [ 0x158, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0x170, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0x178, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x1f0, ['pointer64', ['void']]], + 'VolumeCacheMap' : [ 0x1f8, ['pointer64', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x200, ['unsigned long']], + 'WritesInProgress' : [ 0x204, ['unsigned long']], + 'AsyncReadRequestCount' : [ 0x208, ['unsigned long']], +} ], + '__unnamed_1a53' : [ 0x10, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x28, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x10, ['__unnamed_1a53']], + 'ArrayHead' : [ 0x20, ['pointer64', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1a77' : [ 0x8, { + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], +} ], + '__unnamed_1a79' : [ 0x8, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1a7b' : [ 0x8, { + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], +} ], + '__unnamed_1a7d' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1a7f' : [ 0x30, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x8, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x10, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x28, ['unsigned char']], +} ], + '__unnamed_1a83' : [ 0x58, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Length' : [ 0x18, ['unsigned long']], + 'PrefetchList' : [ 0x20, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'PrefetchPagePriority' : [ 0x28, ['unsigned long']], + 'Mdl' : [ 0x30, ['pointer64', ['_MDL']]], + 'IoStatusBlock' : [ 0x38, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallbackContext' : [ 0x40, ['pointer64', ['_CC_ASYNC_READ_CONTEXT']]], + 'OriginatingProcess' : [ 0x48, ['pointer64', ['_EPROCESS']]], + 'RequestorMode' : [ 0x50, ['unsigned char']], + 'NestingLevel' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1a85' : [ 0x58, { + 'Read' : [ 0x0, ['__unnamed_1a77']], + 'Write' : [ 0x0, ['__unnamed_1a79']], + 'Event' : [ 0x0, ['__unnamed_1a7b']], + 'Notification' : [ 0x0, ['__unnamed_1a7d']], + 'LowPriWrite' : [ 0x0, ['__unnamed_1a7f']], + 'AsyncRead' : [ 0x0, ['__unnamed_1a83']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x70, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x10, ['__unnamed_1a85']], + 'Function' : [ 0x68, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x30, { + 'Callback' : [ 0x0, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x8, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x98, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x10, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x18, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x30, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x68, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x6c, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x70, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x78, ['pointer64', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x80, ['unsigned long long']], + 'LastLWTimeStamp' : [ 0x88, ['_LARGE_INTEGER']], + 'Flags' : [ 0x90, ['unsigned long']], +} ], + '_MBCB' : [ 0xc0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x20, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], + 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x30, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x10, ['long long']], + 'FirstDirtyPage' : [ 0x18, ['unsigned long']], + 'LastDirtyPage' : [ 0x1c, ['unsigned long']], + 'DirtyPages' : [ 0x20, ['unsigned long']], + 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], + 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x38, { + 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x8, ['unsigned long']], + 'ExtraItem' : [ 0xc, ['unsigned long']], + 'ItemCount' : [ 0x10, ['unsigned long']], + 'OutOfRangeItems' : [ 0x14, ['unsigned long']], + 'BaseIndex' : [ 0x18, ['unsigned long']], + 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], + 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x298, { + 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], + 'Flags' : [ 0x70, ['unsigned long']], + 'ForceFlags' : [ 0x74, ['unsigned long']], + 'CompatibilityFlags' : [ 0x78, ['unsigned long']], + 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], + 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x90, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x94, ['unsigned long']], + 'Signature' : [ 0x98, ['unsigned long']], + 'SegmentReserve' : [ 0xa0, ['unsigned long long']], + 'SegmentCommit' : [ 0xa8, ['unsigned long long']], + 'DeCommitFreeBlockThreshold' : [ 0xb0, ['unsigned long long']], + 'DeCommitTotalFreeThreshold' : [ 0xb8, ['unsigned long long']], + 'TotalFreeSize' : [ 0xc0, ['unsigned long long']], + 'MaximumAllocationSize' : [ 0xc8, ['unsigned long long']], + 'ProcessHeapsListIndex' : [ 0xd0, ['unsigned short']], + 'HeaderValidateLength' : [ 0xd2, ['unsigned short']], + 'HeaderValidateCopy' : [ 0xd8, ['pointer64', ['void']]], + 'NextAvailableTagIndex' : [ 0xe0, ['unsigned short']], + 'MaximumTagIndex' : [ 0xe2, ['unsigned short']], + 'TagEntries' : [ 0xe8, ['pointer64', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0xf0, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x100, ['unsigned long long']], + 'AlignMask' : [ 0x108, ['unsigned long long']], + 'VirtualAllocdBlocks' : [ 0x110, ['_LIST_ENTRY']], + 'SegmentList' : [ 0x120, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0x130, ['unsigned short']], + 'NonDedicatedListLength' : [ 0x134, ['unsigned long']], + 'BlocksIndex' : [ 0x138, ['pointer64', ['void']]], + 'UCRIndex' : [ 0x140, ['pointer64', ['void']]], + 'PseudoTagEntries' : [ 0x148, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0x150, ['_LIST_ENTRY']], + 'LockVariable' : [ 0x160, ['pointer64', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0x168, ['pointer64', ['void']]], + 'FrontEndHeap' : [ 0x170, ['pointer64', ['void']]], + 'FrontHeapLockCount' : [ 0x178, ['unsigned short']], + 'FrontEndHeapType' : [ 0x17a, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0x17b, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0x180, ['pointer64', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0x188, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0x18a, ['array', 129, ['unsigned char']]], + 'Counters' : [ 0x210, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x288, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1af3' : [ 0x68, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x68, { + 'Lock' : [ 0x0, ['__unnamed_1af3']], +} ], + '_HEAP_ENTRY' : [ 0x10, { + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x70, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x20, ['unsigned long long']], + 'ReserveSize' : [ 0x28, ['unsigned long long']], + 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x20, { + 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], + 'FreeList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '__unnamed_1b46' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1b48' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b46']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1b4a' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1b4c' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1b4a']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_1b48']], + 'u2' : [ 0x4, ['__unnamed_1b4c']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x18, ['unsigned long']], + 'ClientViewSize' : [ 0x20, ['unsigned long long']], + 'CallbackId' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x30, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer64', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], + 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], + 'UsualSize' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_1b67' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1b69' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1b67']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x30, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_1b69']], + 'ResourceId' : [ 0x11, ['unsigned char']], + 'CachedReferences' : [ 0x12, ['short']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Lock' : [ 0x20, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1b7b' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1b7d' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b7b']], +} ], + '_KALPC_SECTION' : [ 0x48, { + 'SectionObject' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], + 'u1' : [ 0x30, ['__unnamed_1b7d']], + 'NumberOfRegions' : [ 0x34, ['unsigned long']], + 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], +} ], + '__unnamed_1b86' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1b88' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b86']], +} ], + '_KALPC_REGION' : [ 0x58, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], + 'Offset' : [ 0x18, ['unsigned long long']], + 'Size' : [ 0x20, ['unsigned long long']], + 'ViewSize' : [ 0x28, ['unsigned long long']], + 'u1' : [ 0x30, ['__unnamed_1b88']], + 'NumberOfViews' : [ 0x34, ['unsigned long']], + 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], +} ], + '__unnamed_1b8e' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1b90' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b8e']], +} ], + '_KALPC_VIEW' : [ 0x60, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'Address' : [ 0x28, ['pointer64', ['void']]], + 'Size' : [ 0x30, ['unsigned long long']], + 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], + 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], + 'u1' : [ 0x48, ['__unnamed_1b90']], + 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x48, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x40, ['pointer64', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1bae' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1bb0' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bae']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x1d8, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], + 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x38, ['pointer64', ['void']]], + 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x90, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0xa0, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0xb8, ['_LIST_ENTRY']], + 'DirectQueueLock' : [ 0xc8, ['_EX_PUSH_LOCK']], + 'DirectQueue' : [ 0xd0, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0xe8, ['_LIST_ENTRY']], + 'Semaphore' : [ 0xf8, ['pointer64', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0xf8, ['pointer64', ['_KEVENT']]], + 'PortAttributes' : [ 0x100, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0x148, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0x150, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0x168, ['pointer64', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0x170, ['pointer64', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0x178, ['pointer64', ['void']]], + 'CanceledQueue' : [ 0x180, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0x190, ['long']], + 'ReferenceNo' : [ 0x194, ['long']], + 'ReferenceNoWait' : [ 0x198, ['pointer64', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0x1a0, ['__unnamed_1bb0']], + 'TargetQueuePort' : [ 0x1a8, ['pointer64', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0x1b0, ['pointer64', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x1b8, ['pointer64', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x1c0, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x1c4, ['unsigned long']], + 'PendingQueueLength' : [ 0x1c8, ['unsigned long']], + 'DirectQueueLength' : [ 0x1cc, ['unsigned long']], + 'CanceledQueueLength' : [ 0x1d0, ['unsigned long']], + 'WaitQueueLength' : [ 0x1d4, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0xa0, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'CompletionListLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x20, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x28, ['pointer64', ['void']]], + 'UserLimit' : [ 0x30, ['pointer64', ['void']]], + 'DataUserVa' : [ 0x38, ['pointer64', ['void']]], + 'SystemVa' : [ 0x40, ['pointer64', ['void']]], + 'TotalSize' : [ 0x48, ['unsigned long long']], + 'Header' : [ 0x50, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x58, ['pointer64', ['void']]], + 'ListSize' : [ 0x60, ['unsigned long long']], + 'Bitmap' : [ 0x68, ['pointer64', ['void']]], + 'BitmapSize' : [ 0x70, ['unsigned long long']], + 'Data' : [ 0x78, ['pointer64', ['void']]], + 'DataSize' : [ 0x80, ['unsigned long long']], + 'BitmapLimit' : [ 0x88, ['unsigned long']], + 'BitmapNextHint' : [ 0x8c, ['unsigned long']], + 'ConcurrencyCount' : [ 0x90, ['unsigned long']], + 'AttributeFlags' : [ 0x94, ['unsigned long']], + 'AttributeSize' : [ 0x98, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'Attributes' : [ 0x18, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0xd8, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], + 'Index' : [ 0x28, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], + 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0xb8, ['_EX_PUSH_LOCK']], + 'Key' : [ 0xc0, ['unsigned long']], + 'CallbackList' : [ 0xc8, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x20, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x18, ['long']], +} ], + '_PORT_MESSAGE32' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1b48']], + 'u2' : [ 0x4, ['__unnamed_1b4c']], + 'ClientId' : [ 0x8, ['_CLIENT_ID32']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1bd6' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1bd8' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bd6']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x108, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'u1' : [ 0x28, ['__unnamed_1bd8']], + 'SequenceNo' : [ 0x2c, ['long']], + 'QuotaProcess' : [ 0x30, ['pointer64', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x30, ['pointer64', ['void']]], + 'CancelSequencePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x40, ['pointer64', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x48, ['long']], + 'CancelListEntry' : [ 0x50, ['_LIST_ENTRY']], + 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x68, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0xa8, ['pointer64', ['void']]], + 'CommunicationInfo' : [ 0xb0, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0xb8, ['pointer64', ['_ALPC_PORT']]], + 'ServerThread' : [ 0xc0, ['pointer64', ['_ETHREAD']]], + 'WakeReference' : [ 0xc8, ['pointer64', ['void']]], + 'ExtensionBuffer' : [ 0xd0, ['pointer64', ['void']]], + 'ExtensionBufferSize' : [ 0xd8, ['unsigned long long']], + 'PortMessage' : [ 0xe0, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x40, { + 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], + 'DirectEvent' : [ 0x28, ['_KALPC_DIRECT_EVENT']], + 'Flags' : [ 0x30, ['unsigned long']], + 'TotalLength' : [ 0x34, ['unsigned short']], + 'Type' : [ 0x36, ['unsigned short']], + 'DataInfoOffset' : [ 0x38, ['unsigned short']], + 'SignalCompletion' : [ 0x3a, ['unsigned char']], + 'PostedToCompletionList' : [ 0x3b, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x8, ['unsigned long long']], + 'ViewBase' : [ 0x10, ['pointer64', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x28, { + 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x20, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x30, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x40, { + 'ClientContext' : [ 0x0, ['pointer64', ['void']]], + 'ServerContext' : [ 0x8, ['pointer64', ['void']]], + 'PortContext' : [ 0x10, ['pointer64', ['void']]], + 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], + 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], + 'DirectEvent' : [ 0x38, ['_KALPC_DIRECT_EVENT']], +} ], + '__unnamed_1c1c' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1c1e' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c1c']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x70, { + 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], + 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x68, ['__unnamed_1c1e']], +} ], + '_KALPC_DIRECT_EVENT' : [ 0x8, { + 'Event' : [ 0x0, ['unsigned long long']], + 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x10, ['unsigned long']], + 'KeyContext' : [ 0x18, ['pointer64', ['void']]], + 'ApcContext' : [ 0x20, ['pointer64', ['void']]], + 'IoStatus' : [ 0x28, ['long']], + 'IoStatusInformation' : [ 0x30, ['unsigned long long']], + 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Allocated' : [ 0x48, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x30, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer64', ['void']]], + 'ActivityId' : [ 0x10, ['_GUID']], + 'Timestamp' : [ 0x20, ['_LARGE_INTEGER']], + 'ZeroingOffset' : [ 0x20, ['unsigned long']], + 'FsTrackOffsetBlob' : [ 0x20, ['pointer64', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], + 'FsTrackedOffset' : [ 0x28, ['long long']], +} ], + '_DRIVER_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'DriverStart' : [ 0x18, ['pointer64', ['void']]], + 'DriverSize' : [ 0x20, ['unsigned long']], + 'DriverSection' : [ 0x28, ['pointer64', ['void']]], + 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x38, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x58, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x20, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x50, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], + 'FoIoPriorityHint' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0xc0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x10, ['long']], + 'Information' : [ 0x18, ['unsigned long long']], + 'ParseCheck' : [ 0x20, ['unsigned long']], + 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x40, ['unsigned long']], + 'FileAttributes' : [ 0x44, ['unsigned short']], + 'ShareAccess' : [ 0x46, ['unsigned short']], + 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], + 'EaLength' : [ 0x50, ['unsigned long']], + 'Options' : [ 0x54, ['unsigned long']], + 'Disposition' : [ 0x58, ['unsigned long']], + 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], + 'Override' : [ 0x80, ['unsigned char']], + 'QueryOnly' : [ 0x81, ['unsigned char']], + 'DeleteOnly' : [ 0x82, ['unsigned char']], + 'FullAttributes' : [ 0x83, ['unsigned char']], + 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x90, ['unsigned long']], + 'AccessMode' : [ 0x94, ['unsigned char']], + 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1ce5' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x118, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1ce5']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer64', ['unsigned short']]], + 'LogFileName' : [ 0x40, ['pointer64', ['unsigned short']]], + 'TimeZone' : [ 0x48, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf8, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0x100, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x108, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x110, ['unsigned long']], + 'BuffersLost' : [ 0x114, ['unsigned long']], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x390, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 2, ['unsigned long']]], + 'ErrorMarker' : [ 0x1c, ['unsigned long']], + 'SizeMask' : [ 0x20, ['unsigned long']], + 'GetCpuClock' : [ 0x28, ['pointer64', ['void']]], + 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x38, ['long']], + 'FailureReason' : [ 0x3c, ['unsigned long']], + 'BufferQueue' : [ 0x40, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x58, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x70, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x80, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x90, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x90, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x98, ['_UNICODE_STRING']], + 'LogFileName' : [ 0xa8, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0xb8, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0xc8, ['_UNICODE_STRING']], + 'ClockType' : [ 0xd8, ['unsigned long']], + 'LastFlushedBuffer' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'FlushThreshold' : [ 0xe4, ['unsigned long']], + 'ByteOffset' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0xf0, ['unsigned long']], + 'BuffersAvailable' : [ 0xf4, ['long']], + 'NumberOfBuffers' : [ 0xf8, ['long']], + 'MaximumBuffers' : [ 0xfc, ['unsigned long']], + 'EventsLost' : [ 0x100, ['unsigned long']], + 'PeakBuffersCount' : [ 0x104, ['long']], + 'BuffersWritten' : [ 0x108, ['unsigned long']], + 'LogBuffersLost' : [ 0x10c, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0x110, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0x114, ['unsigned long']], + 'SequencePtr' : [ 0x118, ['pointer64', ['long']]], + 'LocalSequence' : [ 0x120, ['unsigned long']], + 'InstanceGuid' : [ 0x124, ['_GUID']], + 'MaximumFileSize' : [ 0x134, ['unsigned long']], + 'FileCounter' : [ 0x138, ['long']], + 'PoolType' : [ 0x13c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0x140, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0x150, ['long']], + 'ProviderInfoSize' : [ 0x154, ['unsigned long']], + 'Consumers' : [ 0x158, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x168, ['unsigned long']], + 'TransitionConsumer' : [ 0x170, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x178, ['pointer64', ['void']]], + 'RealtimeLogfileName' : [ 0x180, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x190, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x198, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x1a0, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x1a8, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x1b0, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x1b8, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x1c0, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x1d0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x1d8, ['_KEVENT']], + 'FlushEvent' : [ 0x1f0, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x208, ['_KTIMER']], + 'LoggerDpc' : [ 0x248, ['_KDPC']], + 'LoggerMutex' : [ 0x288, ['_KMUTANT']], + 'LoggerLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x2c8, ['unsigned long long']], + 'BufferListPushLock' : [ 0x2c8, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x2d0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x318, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x320, ['_EX_FAST_REF']], + 'StartTime' : [ 0x328, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x330, ['pointer64', ['void']]], + 'BufferSequenceNumber' : [ 0x338, ['long long']], + 'Flags' : [ 0x340, ['unsigned long']], + 'Persistent' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x340, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x340, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x340, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x340, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x340, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x340, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x340, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x340, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'StackLookasideListAllocated' : [ 0x340, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SecurityTrace' : [ 0x340, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x340, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x340, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x340, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x340, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x344, ['unsigned long']], + 'DbgRequestNewFile' : [ 0x344, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x344, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x344, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x344, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x344, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x344, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDeferredFlush' : [ 0x344, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDeferredFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x344, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x344, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x348, ['_RTL_BITMAP']], + 'StackCache' : [ 0x358, ['pointer64', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x360, ['pointer64', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x368, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x378, ['pointer64', ['pointer64', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x380, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x28, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer64', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_SILODRIVERSTATE' : [ 0x13a8, { + 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], + 'EtwpLoggerRundown' : [ 0x190, ['array', 64, ['pointer64', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], + 'WmipLoggerContext' : [ 0x390, ['array', 64, ['pointer64', ['_WMI_LOGGER_CONTEXT']]]], + 'EtwpGuidHashTable' : [ 0x590, ['array', 64, ['_ETW_HASH_BUCKET']]], + 'EtwpSecurityLoggers' : [ 0x1390, ['array', 8, ['unsigned short']]], + 'EtwpSecurityProviderEnableMask' : [ 0x13a0, ['unsigned char']], + 'EtwpShutdownInProgress' : [ 0x13a1, ['unsigned char']], + 'EtwpSecurityProviderPID' : [ 0x13a4, ['unsigned long']], +} ], + '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x18, { + 'RunRefs' : [ 0x0, ['pointer64', ['_EX_RUNDOWN_REF']]], + 'PoolToFree' : [ 0x8, ['pointer64', ['void']]], + 'RunRefSize' : [ 0x10, ['unsigned long']], + 'Number' : [ 0x14, ['unsigned long']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x480, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x38, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0xa0, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0xa8, ['pointer64', ['void']]], + 'DynamicPart' : [ 0xb0, ['pointer64', ['unsigned long']]], + 'DefaultDacl' : [ 0xb8, ['pointer64', ['_ACL']]], + 'TokenType' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xc8, ['unsigned long']], + 'TokenInUse' : [ 0xcc, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xd0, ['unsigned long']], + 'MandatoryPolicy' : [ 0xd4, ['unsigned long']], + 'LogonSession' : [ 0xd8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xe0, ['_LUID']], + 'SidHash' : [ 0xe8, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x1f8, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x308, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x310, ['pointer64', ['void']]], + 'Capabilities' : [ 0x318, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x320, ['unsigned long']], + 'CapabilitiesHash' : [ 0x328, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x438, ['pointer64', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x440, ['pointer64', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x448, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x450, ['pointer64', ['void']]], + 'TrustLinkedToken' : [ 0x458, ['pointer64', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x460, ['pointer64', ['void']]], + 'TokenSidValues' : [ 0x468, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'IndexEntry' : [ 0x470, ['pointer64', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], + 'VariablePart' : [ 0x478, ['unsigned long long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0xb0, { + 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x8, ['_LUID']], + 'BuddyLogonId' : [ 0x10, ['_LUID']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'pDeviceMap' : [ 0x28, ['pointer64', ['_DEVICE_MAP']]], + 'Token' : [ 0x30, ['pointer64', ['void']]], + 'AccountName' : [ 0x38, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x48, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x58, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x70, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x78, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'RevocationBlock' : [ 0x80, ['_OB_HANDLE_REVOCATION_BLOCK']], + 'ServerSilo' : [ 0xa0, ['pointer64', ['_EJOB']]], + 'SiblingAuthId' : [ 0xa8, ['_LUID']], +} ], + '_OBJECT_HEADER' : [ 0x38, { + 'PointerCount' : [ 0x0, ['long long']], + 'HandleCount' : [ 0x8, ['long long']], + 'NextToFree' : [ 0x8, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0x18, ['unsigned char']], + 'TraceFlags' : [ 0x19, ['unsigned char']], + 'DbgRefTrace' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0x1a, ['unsigned char']], + 'Flags' : [ 0x1b, ['unsigned char']], + 'NewObject' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0x1b, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0x1b, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0x1b, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0x1b, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare' : [ 0x1c, ['unsigned long']], + 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], + 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], + 'Body' : [ 0x30, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], + 'Reserved' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { + 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { + 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0x18, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], + 'Reserved' : [ 0x1a, ['unsigned short']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x10, { + 'SecurityDescriptor' : [ 0x0, ['pointer64', ['void']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_REVOCATION_INFO' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'RevocationBlock' : [ 0x10, ['pointer64', ['_OB_HANDLE_REVOCATION_BLOCK']]], + 'Padding1' : [ 0x18, ['array', 4, ['unsigned char']]], + 'Padding2' : [ 0x1c, ['array', 4, ['unsigned char']]], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x28, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'EntryLink' : [ 0x10, ['pointer64', ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0x18, ['unsigned long']], + 'HashIndex' : [ 0x1c, ['unsigned short']], + 'DirectoryLocked' : [ 0x1e, ['unsigned char']], + 'LockedExclusive' : [ 0x1f, ['unsigned char']], + 'LockStateSignature' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0x158, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x138, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0x140, ['unsigned long']], + 'NamespaceEntry' : [ 0x148, ['pointer64', ['void']]], + 'Flags' : [ 0x150, ['unsigned long']], +} ], + '_OBP_SILODRIVERSTATE' : [ 0x2e0, { + 'SystemDeviceMap' : [ 0x0, ['pointer64', ['_DEVICE_MAP']]], + 'SystemDosDeviceState' : [ 0x8, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], + 'DeviceMapLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'PrivateNamespaceLookupTable' : [ 0x80, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], +} ], + '_DEVICE_MAP' : [ 0x40, { + 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x18, ['long']], + 'DriveMap' : [ 0x1c, ['unsigned long']], + 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], +} ], + '_WHEAP_INFO_BLOCK' : [ 0x18, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x8, ['pointer64', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x10, ['pointer64', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x428, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x10, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x14, ['unsigned long']], + 'ErrorCount' : [ 0x18, ['long']], + 'RecordCount' : [ 0x1c, ['unsigned long']], + 'RecordLength' : [ 0x20, ['unsigned long']], + 'PoolTag' : [ 0x24, ['unsigned long']], + 'Type' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x30, ['pointer64', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x38, ['pointer64', ['void']]], + 'SectionCount' : [ 0x40, ['unsigned long']], + 'SectionLength' : [ 0x44, ['unsigned long']], + 'TickCountAtLastError' : [ 0x48, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x50, ['unsigned long']], + 'TotalErrors' : [ 0x54, ['unsigned long']], + 'Deferred' : [ 0x58, ['unsigned char']], + 'Descriptor' : [ 0x59, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xf0, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x10, ['unsigned long']], + 'ProcessorNumber' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x1c, ['long']], + 'ErrorSource' : [ 0x20, ['pointer64', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x28, ['_WHEA_ERROR_RECORD']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x30, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'ConnectLock' : [ 0x8, ['_KEVENT']], + 'LineMasked' : [ 0x20, ['unsigned char']], + 'InterruptList' : [ 0x28, ['pointer64', ['_KINTERRUPT']]], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { + 'ImpersonationData' : [ 0x0, ['unsigned long long']], + 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { + 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], +} ], + '_POP_FX_PLUGIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long long']], + 'WorkQueue' : [ 0x20, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x60, ['pointer64', ['void']]], + 'AcceptProcessorNotification' : [ 0x68, ['pointer64', ['void']]], + 'AcceptAcpiNotification' : [ 0x70, ['pointer64', ['void']]], + 'WorkOrderCount' : [ 0x78, ['unsigned long']], + 'WorkOrders' : [ 0x80, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x50, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x8, ['unsigned long']], + 'SenderPort' : [ 0x10, ['pointer64', ['void']]], + 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'PortContext' : [ 0x20, ['pointer64', ['void']]], + 'Request' : [ 0x28, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long long']], + 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], + 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], + 'MaxSectionSize' : [ 0x28, ['unsigned long long']], + 'MaxViewSize' : [ 0x30, ['unsigned long long']], + 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], + 'DupObjectTypes' : [ 0x40, ['unsigned long']], + 'Reserved' : [ 0x44, ['unsigned long']], +} ], + '_MI_PARTITION_SEGMENTS' : [ 0x180, { + 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], + 'UnusedSegmentCleanup' : [ 0x18, ['_KEVENT']], + 'SubsectionDeletePtes' : [ 0x30, ['unsigned long long']], + 'DereferenceSegmentHeader' : [ 0x38, ['_MMDEREFERENCE_SEGMENT_HEADER']], + 'DeleteOnCloseList' : [ 0x68, ['_LIST_ENTRY']], + 'DeleteOnCloseTimer' : [ 0x78, ['_KTIMER']], + 'DeleteOnCloseTimerActive' : [ 0xb8, ['unsigned char']], + 'DeleteOnCloseCount' : [ 0xbc, ['unsigned long']], + 'UnusedSegmentList' : [ 0xc0, ['_LIST_ENTRY']], + 'UnusedSubsectionList' : [ 0xd0, ['_LIST_ENTRY']], + 'DeleteSubsectionList' : [ 0xe0, ['_LIST_ENTRY']], + 'ControlAreaDeleteEvent' : [ 0xf0, ['_KEVENT']], + 'ControlAreaDeleteList' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'SegmentListLock' : [ 0x140, ['long']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { + 'Version' : [ 0x0, ['unsigned char']], + 'DataCount' : [ 0x1, ['unsigned char']], + 'SemanticType' : [ 0x2, ['unsigned char']], + 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], + 'AttributeType' : [ 0x0, ['unsigned long']], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x150, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x108, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x148, ['unsigned long']], +} ], + '_HEAP_UNPACKED_ENTRY' : [ 0x10, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], +} ], + '_PEP_ACPI_SPB_RESOURCE' : [ 0x28, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], + 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], + 'ResourceSourceName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x18, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x20, ['unsigned short']], +} ], + '_DISPATCHER_HEADER' : [ 0x18, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Minimal' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved4' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_ETW_GUID_ENTRY' : [ 0x190, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x10, ['long long']], + 'Guid' : [ 0x18, ['_GUID']], + 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x40, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x170, ['pointer64', ['_ETW_FILTER_HEADER']]], + 'HostSilo' : [ 0x178, ['unsigned char']], + 'Lock' : [ 0x180, ['_EX_PUSH_LOCK']], + 'LockOwner' : [ 0x188, ['pointer64', ['_ETHREAD']]], +} ], + '_VI_POOL_ENTRY' : [ 0x20, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'WaitResponse' : [ 0xc, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], +} ], + '_HEAP_COUNTERS' : [ 0x78, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], + 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], + 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], + 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], + 'TotalSegments' : [ 0x20, ['unsigned long']], + 'TotalUCRs' : [ 0x24, ['unsigned long']], + 'CommittOps' : [ 0x28, ['unsigned long']], + 'DeCommitOps' : [ 0x2c, ['unsigned long']], + 'LockAcquires' : [ 0x30, ['unsigned long']], + 'LockCollisions' : [ 0x34, ['unsigned long']], + 'CommitRate' : [ 0x38, ['unsigned long']], + 'DecommittRate' : [ 0x3c, ['unsigned long']], + 'CommitFailures' : [ 0x40, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], + 'PollIntervalCounter' : [ 0x48, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x4c, ['unsigned long']], + 'HeapPollInterval' : [ 0x50, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x54, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x58, ['unsigned long']], + 'InBlockDeccommits' : [ 0x5c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x60, ['unsigned long long']], + 'HighWatermarkSize' : [ 0x68, ['unsigned long long']], + 'LastPolledSize' : [ 0x70, ['unsigned long long']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_MI_VISIBLE_PARTITION' : [ 0x1100, { + 'LowestPhysicalPage' : [ 0x0, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x8, ['unsigned long long']], + 'NumberOfPhysicalPages' : [ 0x10, ['unsigned long long']], + 'NumberOfPagingFiles' : [ 0x18, ['unsigned long']], + 'PagingFile' : [ 0x20, ['array', 16, ['pointer64', ['_MMPAGING_FILE']]]], + 'AvailablePages' : [ 0xc0, ['unsigned long long']], + 'ResidentAvailablePages' : [ 0x100, ['unsigned long long']], + 'TotalCommittedPages' : [ 0x108, ['unsigned long long']], + 'ModifiedPageListHead' : [ 0x140, ['_MMPFNLIST']], + 'ModifiedNoWritePageListHead' : [ 0x180, ['_MMPFNLIST']], + 'TotalCommitLimit' : [ 0x1a8, ['unsigned long long']], + 'TotalPagesForPagingFile' : [ 0x1b0, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x1b8, ['unsigned long long']], + 'ProcessLockedFilePages' : [ 0x1c0, ['unsigned long long']], + 'ChargeCommitmentFailures' : [ 0x1c8, ['array', 4, ['unsigned long']]], + 'PageTableBitmapPages' : [ 0x1d8, ['unsigned long long']], + 'PageFileTraceIndex' : [ 0x1e0, ['long']], + 'PageFileTraces' : [ 0x1e8, ['array', 32, ['_MI_PAGEFILE_TRACES']]], +} ], + '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x20, { + 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'Rundown' : [ 0x18, ['_EX_RUNDOWN_REF']], +} ], + '_SYSPTES_HEADER' : [ 0x118, { + 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], + 'Count' : [ 0x100, ['unsigned long long']], + 'NumberOfEntries' : [ 0x108, ['unsigned long long']], + 'NumberOfEntriesPeak' : [ 0x110, ['unsigned long long']], +} ], + '_EXCEPTION_RECORD' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], + 'NumberParameters' : [ 0x18, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x54, ['unsigned long']], + 'ProfileChangingEject' : [ 0x58, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], + 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x68, ['unsigned char']], + 'DeleteType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_PPM_PLATFORM_STATE' : [ 0x180, { + 'Latency' : [ 0x0, ['unsigned long']], + 'BreakEvenDuration' : [ 0x4, ['unsigned long']], + 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], + 'TransitionDebugger' : [ 0x30, ['unsigned char']], + 'Platform' : [ 0x31, ['unsigned char']], + 'DependencyListCount' : [ 0x34, ['unsigned long']], + 'Processors' : [ 0x38, ['_KAFFINITY_EX']], + 'Name' : [ 0xe0, ['_UNICODE_STRING']], + 'DependencyLists' : [ 0xf0, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], + 'Synchronization' : [ 0xf8, ['_PPM_COORDINATED_SYNCHRONIZATION']], + 'EnterTime' : [ 0x100, ['unsigned long long']], + 'RefCount' : [ 0x140, ['long']], + 'CacheAlign0' : [ 0x140, ['array', 64, ['unsigned char']]], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x58, { + 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'AppContainerNumber' : [ 0x30, ['unsigned long']], + 'PackageSid' : [ 0x38, ['pointer64', ['void']]], + 'CapabilitiesHash' : [ 0x40, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x48, ['pointer64', ['void']]], + 'SecurityAttributes' : [ 0x50, ['pointer64', ['void']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x10, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { + 'Key' : [ 0x0, ['pointer64', ['void']]], + 'Index' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x20, ['long']], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'WatchdogTimerInfo' : [ 0x30, ['pointer64', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'FloppyMedia' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_KAPC' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], + 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], + 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Reserved' : [ 0x20, ['array', 3, ['pointer64', ['void']]]], + 'NormalContext' : [ 0x38, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], + 'ApcStateIndex' : [ 0x50, ['unsigned char']], + 'ApcMode' : [ 0x51, ['unsigned char']], + 'Inserted' : [ 0x52, ['unsigned char']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { + 'Va' : [ 0x0, ['unsigned long long']], + 'Key' : [ 0x8, ['unsigned long']], + 'Pattern' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolType' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], + 'SlushSize' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ulTargetPlatform' : [ 0x8, ['unsigned long']], + 'ullContextMinimum' : [ 0x10, ['unsigned long long']], + 'guPlatform' : [ 0x18, ['_GUID']], + 'guMinPlatform' : [ 0x28, ['_GUID']], + 'ulContextSource' : [ 0x38, ['unsigned long']], + 'ulElementCount' : [ 0x3c, ['unsigned long']], + 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x30, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x18, ['_KEVENT']], +} ], + '_ETW_HASH_BUCKET' : [ 0x38, { + 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], + 'BucketLock' : [ 0x30, ['_EX_PUSH_LOCK']], +} ], + '_TEB_ACTIVE_FRAME' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0x18, ['pointer64', ['void']]], + 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], + 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], + 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x30, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x10, ['unsigned char']], + 'BlockState' : [ 0x11, ['unsigned char']], + 'WaitKey' : [ 0x12, ['unsigned short']], + 'SpareLong' : [ 0x14, ['long']], + 'Thread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NotificationQueue' : [ 0x18, ['pointer64', ['_KQUEUE']]], + 'Object' : [ 0x20, ['pointer64', ['void']]], + 'SparePtr' : [ 0x28, ['pointer64', ['void']]], +} ], + '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { + 'Continue' : [ 0x0, ['unsigned long']], + 'TraceFlag' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], + 'MinimumThrottle' : [ 0x50, ['unsigned long']], + 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1ed8' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1eda' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1ed8']], + 'Private' : [ 0x0, ['__unnamed_1eda']], +} ], + '_KTIMER2' : [ 0x88, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'RbNodes' : [ 0x18, ['array', 2, ['_RTL_BALANCED_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'DueTime' : [ 0x48, ['array', 2, ['unsigned long long']]], + 'Period' : [ 0x58, ['long long']], + 'Callback' : [ 0x60, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x68, ['pointer64', ['void']]], + 'DisableCallback' : [ 0x70, ['pointer64', ['void']]], + 'DisableContext' : [ 0x78, ['pointer64', ['void']]], + 'AbsoluteSystemTime' : [ 0x80, ['unsigned char']], + 'TypeFlags' : [ 0x81, ['unsigned char']], + 'Unused' : [ 0x81, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IdleResilient' : [ 0x81, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HighResolution' : [ 0x81, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'NoWake' : [ 0x81, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Unused1' : [ 0x81, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CollectionIndex' : [ 0x82, ['array', 2, ['unsigned char']]], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x20, { + 'IssueType' : [ 0x0, ['unsigned long long']], + 'Address' : [ 0x8, ['pointer64', ['void']]], + 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x10, { + 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], +} ], + '_KMUTANT' : [ 0x38, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], + 'Abandoned' : [ 0x30, ['unsigned char']], + 'ApcDisable' : [ 0x31, ['unsigned char']], +} ], + '_OBJECT_REF_INFO' : [ 0x28, { + 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x20, ['unsigned short']], + 'MaxStacks' : [ 0x22, ['unsigned short']], + 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x18, { + 'DynamicRelocations' : [ 0x0, ['pointer64', ['void']]], + 'SecurityContext' : [ 0x8, ['_IMAGE_SECURITY_CONTEXT']], + 'StrongImageReference' : [ 0x10, ['unsigned long long']], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x260, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x10, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0x18, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x20, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x130, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x240, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x248, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x250, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x258, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x48, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], + 'TagIndex' : [ 0x10, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], + 'TagName' : [ 0x14, ['array', 24, ['wchar']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 28, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NT_TIB' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x8, ['pointer64', ['void']]], + 'StackLimit' : [ 0x10, ['pointer64', ['void']]], + 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], + 'FiberData' : [ 0x20, ['pointer64', ['void']]], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], + 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PPM_IDLE_STATES' : [ 0x418, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'UnaccountedTransition' : [ 0x5, ['unsigned char']], + 'IdleDurationLimited' : [ 0x6, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0xe0, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x188, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x190, ['pointer64', ['void']]], + 'IdleExecute' : [ 0x198, ['pointer64', ['void']]], + 'IdlePreselect' : [ 0x1a0, ['pointer64', ['void']]], + 'IdleTest' : [ 0x1a8, ['pointer64', ['void']]], + 'IdleAvailabilityCheck' : [ 0x1b0, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x1b8, ['pointer64', ['void']]], + 'IdleCancel' : [ 0x1c0, ['pointer64', ['void']]], + 'IdleIsHalted' : [ 0x1c8, ['pointer64', ['void']]], + 'IdleInitiateWake' : [ 0x1d0, ['pointer64', ['void']]], + 'PrepareInfo' : [ 0x1d8, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'DeepIdleSnapshot' : [ 0x230, ['_KAFFINITY_EX']], + 'Tracing' : [ 0x2d8, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'CoordinatedTracing' : [ 0x2e0, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'ProcessorMenu' : [ 0x2e8, ['_PPM_SELECTION_MENU']], + 'CoordinatedMenu' : [ 0x2f8, ['_PPM_SELECTION_MENU']], + 'CoordinatedSelection' : [ 0x308, ['_PPM_COORDINATED_SELECTION']], + 'State' : [ 0x320, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x28, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x8, ['_LIST_ENTRY']], + 'CsAccountingBlocks' : [ 0x18, ['unsigned char']], + 'BlocksDrips' : [ 0x19, ['unsigned char']], + 'PreallocatedVetoCount' : [ 0x1c, ['unsigned long']], + 'PreallocatedVetoList' : [ 0x20, ['pointer64', ['_PPM_VETO_ENTRY']]], +} ], + '_PEB' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['pointer64', ['void']]], + 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], + 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], + 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], + 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], + 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], + 'SparePvoid0' : [ 0x90, ['pointer64', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], + 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], + 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], + 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], + 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], + 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], + 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], + 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], + 'pUnused' : [ 0x368, ['pointer64', ['void']]], + 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['_LIST_ENTRY']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['pointer64', ['void']]]], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Address' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x98, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], + 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], + 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], + 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], + 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], + 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x50, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], + 'LoggerId' : [ 0x58, ['unsigned short']], + 'Flags' : [ 0x5a, ['unsigned char']], + 'ShutDownRequested' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x5a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x5a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Wow' : [ 0x5a, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], + 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], + 'UserPagesReused' : [ 0x80, ['unsigned long']], + 'EventsLostCount' : [ 0x88, ['pointer64', ['unsigned long']]], + 'BuffersLostCount' : [ 0x90, ['pointer64', ['unsigned long']]], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x8, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x8, ['unsigned long long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'PendingFreeDepth' : [ 0x108, ['long']], + 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_KGATE' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x20, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], +} ], + '_DRIVER_EXTENSION' : [ 0x50, { + 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x8, ['pointer64', ['void']]], + 'Count' : [ 0x10, ['unsigned long']], + 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x38, ['pointer64', ['void']]], + 'DvCallbacks' : [ 0x40, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x48, ['pointer64', ['void']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x88, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x10, ['unsigned long long']], + 'ItemCount' : [ 0x18, ['long']], + 'Dpc' : [ 0x20, ['_KDPC']], + 'WorkItem' : [ 0x60, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x80, ['pointer64', ['void']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x58, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_KINTERRUPT' : [ 0x100, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], + 'MessageIndex' : [ 0x28, ['unsigned long']], + 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], + 'SpinLock' : [ 0x38, ['unsigned long long']], + 'TickCount' : [ 0x40, ['unsigned long']], + 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], + 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], + 'Vector' : [ 0x58, ['unsigned long']], + 'Irql' : [ 0x5c, ['unsigned char']], + 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], + 'FloatingSave' : [ 0x5e, ['unsigned char']], + 'Connected' : [ 0x5f, ['unsigned char']], + 'Number' : [ 0x60, ['unsigned long']], + 'ShareVector' : [ 0x64, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x65, ['unsigned char']], + 'ActiveCount' : [ 0x66, ['unsigned short']], + 'InternalState' : [ 0x68, ['long']], + 'Mode' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x74, ['unsigned long']], + 'DispatchCount' : [ 0x78, ['unsigned long']], + 'PassiveEvent' : [ 0x80, ['pointer64', ['_KEVENT']]], + 'TrapFrame' : [ 0x88, ['pointer64', ['_KTRAP_FRAME']]], + 'DisconnectData' : [ 0x90, ['pointer64', ['void']]], + 'ServiceThread' : [ 0x98, ['pointer64', ['_KTHREAD']]], + 'ConnectionData' : [ 0xa0, ['pointer64', ['_INTERRUPT_CONNECTION_DATA']]], + 'IntTrackEntry' : [ 0xa8, ['pointer64', ['void']]], + 'IsrDpcStats' : [ 0xb0, ['_ISRDPCSTATS']], + 'RedirectObject' : [ 0xf0, ['pointer64', ['void']]], + 'Padding' : [ 0xf8, ['array', 8, ['unsigned char']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x98, { + 'FileName' : [ 0x0, ['pointer64', ['unsigned short']]], + 'BaseName' : [ 0x8, ['pointer64', ['unsigned short']]], + 'RegRootName' : [ 0x10, ['pointer64', ['unsigned short']]], + 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x20, ['unsigned long']], + 'CmHiveFlags' : [ 0x24, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], + 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'HiveMounted' : [ 0x38, ['unsigned char']], + 'ThreadFinished' : [ 0x39, ['unsigned char']], + 'ThreadStarted' : [ 0x3a, ['unsigned char']], + 'Allocate' : [ 0x3b, ['unsigned char']], + 'WinPERequired' : [ 0x3c, ['unsigned char']], + 'StartEvent' : [ 0x40, ['_KEVENT']], + 'FinishedEvent' : [ 0x58, ['_KEVENT']], + 'MountLock' : [ 0x70, ['_KEVENT']], + 'FilePath' : [ 0x88, ['_UNICODE_STRING']], +} ], + '_HMAP_DIRECTORY' : [ 0x2000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], +} ], + '_CONTEXT' : [ 0x4d0, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5Home' : [ 0x20, ['unsigned long long']], + 'P6Home' : [ 0x28, ['unsigned long long']], + 'ContextFlags' : [ 0x30, ['unsigned long']], + 'MxCsr' : [ 0x34, ['unsigned long']], + 'SegCs' : [ 0x38, ['unsigned short']], + 'SegDs' : [ 0x3a, ['unsigned short']], + 'SegEs' : [ 0x3c, ['unsigned short']], + 'SegFs' : [ 0x3e, ['unsigned short']], + 'SegGs' : [ 0x40, ['unsigned short']], + 'SegSs' : [ 0x42, ['unsigned short']], + 'EFlags' : [ 0x44, ['unsigned long']], + 'Dr0' : [ 0x48, ['unsigned long long']], + 'Dr1' : [ 0x50, ['unsigned long long']], + 'Dr2' : [ 0x58, ['unsigned long long']], + 'Dr3' : [ 0x60, ['unsigned long long']], + 'Dr6' : [ 0x68, ['unsigned long long']], + 'Dr7' : [ 0x70, ['unsigned long long']], + 'Rax' : [ 0x78, ['unsigned long long']], + 'Rcx' : [ 0x80, ['unsigned long long']], + 'Rdx' : [ 0x88, ['unsigned long long']], + 'Rbx' : [ 0x90, ['unsigned long long']], + 'Rsp' : [ 0x98, ['unsigned long long']], + 'Rbp' : [ 0xa0, ['unsigned long long']], + 'Rsi' : [ 0xa8, ['unsigned long long']], + 'Rdi' : [ 0xb0, ['unsigned long long']], + 'R8' : [ 0xb8, ['unsigned long long']], + 'R9' : [ 0xc0, ['unsigned long long']], + 'R10' : [ 0xc8, ['unsigned long long']], + 'R11' : [ 0xd0, ['unsigned long long']], + 'R12' : [ 0xd8, ['unsigned long long']], + 'R13' : [ 0xe0, ['unsigned long long']], + 'R14' : [ 0xe8, ['unsigned long long']], + 'R15' : [ 0xf0, ['unsigned long long']], + 'Rip' : [ 0xf8, ['unsigned long long']], + 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], + 'Header' : [ 0x100, ['array', 2, ['_M128A']]], + 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], + 'Xmm0' : [ 0x1a0, ['_M128A']], + 'Xmm1' : [ 0x1b0, ['_M128A']], + 'Xmm2' : [ 0x1c0, ['_M128A']], + 'Xmm3' : [ 0x1d0, ['_M128A']], + 'Xmm4' : [ 0x1e0, ['_M128A']], + 'Xmm5' : [ 0x1f0, ['_M128A']], + 'Xmm6' : [ 0x200, ['_M128A']], + 'Xmm7' : [ 0x210, ['_M128A']], + 'Xmm8' : [ 0x220, ['_M128A']], + 'Xmm9' : [ 0x230, ['_M128A']], + 'Xmm10' : [ 0x240, ['_M128A']], + 'Xmm11' : [ 0x250, ['_M128A']], + 'Xmm12' : [ 0x260, ['_M128A']], + 'Xmm13' : [ 0x270, ['_M128A']], + 'Xmm14' : [ 0x280, ['_M128A']], + 'Xmm15' : [ 0x290, ['_M128A']], + 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], + 'VectorControl' : [ 0x4a0, ['unsigned long long']], + 'DebugControl' : [ 0x4a8, ['unsigned long long']], + 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x18, { + 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1fa4' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1fa4']], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x10, { + 'Port' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['pointer64', ['void']]], +} ], + '_EX_WORK_QUEUE' : [ 0x2d0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x2b0, ['pointer64', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x2b8, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x2bc, ['unsigned long']], + 'ThreadCount' : [ 0x2c0, ['long']], + 'MinThreads' : [ 0x2c4, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x2c4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x2c8, ['long']], + 'QueueIndex' : [ 0x2cc, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x20, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], + 'Tag' : [ 0x18, ['unsigned long long']], +} ], + '_MI_FLAGS' : [ 0x4, { + 'EntireFlags' : [ 0x0, ['long']], + 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ZeroNonCachedByConverting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ZeroWriteCombinedByConverting' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], +} ], + '_INTERFACE' : [ 0x20, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_PS_PROPERTY_SET' : [ 0x18, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['unsigned long long']], +} ], + '_LAZY_WRITER' : [ 0x88, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x40, ['_KTIMER']], + 'ScanActive' : [ 0x80, ['unsigned char']], + 'OtherWork' : [ 0x81, ['unsigned char']], + 'PendingTeardownScan' : [ 0x82, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], + 'PendingPowerScan' : [ 0x85, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x86, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x70, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], + 'DataPortMapped' : [ 0x10, ['unsigned char']], + 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], + 'AddrPortMapped' : [ 0x20, ['unsigned char']], + 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], + 'CmdPortMapped' : [ 0x30, ['unsigned char']], + 'NextSlotNumber' : [ 0x34, ['unsigned long']], + 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x60, ['unsigned long']], + 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { + 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'AccessRights' : [ 0x0, ['unsigned char']], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x10, { + 'Sid' : [ 0x0, ['pointer64', ['void']]], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_IO_WORKITEM' : [ 0x58, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x20, ['pointer64', ['void']]], + 'IoObject' : [ 0x28, ['pointer64', ['void']]], + 'Context' : [ 0x30, ['pointer64', ['void']]], + 'WorkingOnBehalfClient' : [ 0x38, ['pointer64', ['void']]], + 'Type' : [ 0x40, ['unsigned long']], + 'ActivityId' : [ 0x44, ['_GUID']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMWSLE_HASH' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long long']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_UNEXPECTED_INTERRUPT' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x88, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x40, ['_KDPC']], + 'WorkOrder' : [ 0x80, ['pointer64', ['_POP_FX_WORK_ORDER']]], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], + 'SecureInfo' : [ 0x10, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x10, ['_RTL_BITMAP_EX']], + 'InPageSupport' : [ 0x10, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'LargePage' : [ 0x10, ['pointer64', ['_MI_LARGEPAGE_MEMORY_INFO']]], + 'CreatingThread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'PebTeb' : [ 0x10, ['_MI_SUB64K_FREE_RANGES']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x30, { + 'AllocAddress' : [ 0x0, ['unsigned long long']], + 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x10, ['unsigned long long']], + 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x20, ['unsigned long long']], + 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], + 'CallCount' : [ 0x20, ['unsigned long']], +} ], + '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Luid' : [ 0x20, ['unsigned long long']], + 'IndexIntoGlobalSingletonTable' : [ 0x28, ['unsigned long long']], + 'MarkedForDeletion' : [ 0x30, ['unsigned char']], +} ], + '_KTIMER2_COLLECTION' : [ 0x18, { + 'Tree' : [ 0x0, ['_RTL_RB_TREE']], + 'NextDueTime' : [ 0x10, ['unsigned long long']], +} ], + '_MIPFNBLINK' : [ 0x8, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeBlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 56, native_type='unsigned long long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 60, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 62, native_type='unsigned long long')]], + 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], + 'Lock' : [ 0x0, ['long long']], + 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VF_TRACKER_STAMP' : [ 0x10, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'OldIrql' : [ 0x8, ['unsigned char']], + 'NewIrql' : [ 0x9, ['unsigned char']], + 'Processor' : [ 0xa, ['unsigned short']], + 'TickCount' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], +} ], + '_MMCLONE_HEADER' : [ 0x18, { + 'NumberOfPtes' : [ 0x0, ['unsigned long long']], + 'NumberOfProcessReferences' : [ 0x8, ['unsigned long long']], + 'ClonePtes' : [ 0x10, ['pointer64', ['_MMCLONE_BLOCK']]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x10, ['unsigned long']], + 'LowboxMap' : [ 0x18, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_PEB_LDR_DATA' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer64', ['void']]], + 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], + 'ShutdownInProgress' : [ 0x48, ['unsigned char']], + 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0xb8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x10, ['unsigned long']], + 'ArgumentStatus' : [ 0x14, ['long']], + 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'Lock' : [ 0x44, ['unsigned long']], + 'Cancel' : [ 0x48, ['unsigned char']], + 'Parent' : [ 0x50, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'ActivityId' : [ 0x58, ['_GUID']], + 'Data' : [ 0x68, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_RH_OP_CONTEXT' : [ 0x48, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x10, ['pointer64', ['_IRP']]], + 'OplockRequestFileObject' : [ 0x18, ['pointer64', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x28, ['pointer64', ['_ETHREAD']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'AtomicLinks' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_KWAIT_CHAIN' : [ 0x8, { + 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_RTL_BITMAP_EX' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_MI_PARTITION_PAGE_LISTS' : [ 0xd40, { + 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer64', ['_MMPFNLIST']]]], + 'FreePageSlist' : [ 0x10, ['array', 2, ['pointer64', ['_SLIST_HEADER']]]], + 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], + 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], + 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], + 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], + 'ModifiedPageListNoReservation' : [ 0x240, ['_MMPFNLIST']], + 'ModifiedPageListByReservation' : [ 0x280, ['array', 16, ['_MMPFNLIST']]], + 'MappedPageListHead' : [ 0x500, ['array', 16, ['_MMPFNLIST']]], + 'BadPageListHead' : [ 0x780, ['_MMPFNLIST']], + 'EnclavePageListHead' : [ 0x7c0, ['_MMPFNLIST']], + 'PageLocationList' : [ 0x7e8, ['array', 8, ['pointer64', ['_MMPFNLIST']]]], + 'StandbyRepurposedByPriority' : [ 0x828, ['array', 8, ['unsigned long']]], + 'MappedPageListHeadEvent' : [ 0x848, ['array', 16, ['_KEVENT']]], + 'DecayClusterTimerHeads' : [ 0x9c8, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], + 'DecayHand' : [ 0x9e8, ['unsigned long']], + 'LastDecayHandUpdateTime' : [ 0x9f0, ['unsigned long long']], + 'LastChanceLdwContext' : [ 0x9f8, ['_MI_LDW_WORK_CONTEXT']], + 'AvailableEventsLock' : [ 0xa40, ['unsigned long long']], + 'AvailablePageWaitStates' : [ 0xa48, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], + 'LowMemoryThreshold' : [ 0xaa8, ['unsigned long long']], + 'HighMemoryThreshold' : [ 0xab0, ['unsigned long long']], + 'TransitionPrivatePages' : [ 0xac0, ['unsigned long long']], + 'StandbyListDiscard' : [ 0xac8, ['unsigned long']], + 'FreeListDiscard' : [ 0xacc, ['unsigned char']], + 'RebuildLargePagesInitialized' : [ 0xacd, ['unsigned char']], + 'RebuildLargePagesItem' : [ 0xad0, ['_MI_REBUILD_LARGE_PAGES']], + 'AddMemoryNotifyList' : [ 0xcf8, ['_LIST_ENTRY']], + 'MirrorListLocks' : [ 0xd08, ['pointer64', ['void']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x330, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], + 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], + 'AlignedFeatures' : [ 0x220, ['unsigned long long']], + 'AllFeatureSize' : [ 0x228, ['unsigned long']], + 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x10, ['unsigned long']], + 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x20, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x28, ['unsigned long']], + 'KcbPushlock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x38, ['pointer64', ['_KTHREAD']]], + 'SharedCount' : [ 0x38, ['long']], + 'SlotHint' : [ 0x40, ['unsigned long']], + 'ParentKcb' : [ 0x48, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x50, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x58, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x60, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x70, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x70, ['unsigned long']], + 'SubKeyCount' : [ 0x70, ['unsigned long']], + 'KeyBodyListHead' : [ 0x78, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x88, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], + 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], + 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_KLOCK_ENTRY' : [ 0x60, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'EntryFlags' : [ 0x18, ['unsigned long']], + 'EntryOffset' : [ 0x18, ['unsigned char']], + 'ThreadLocalFlags' : [ 0x19, ['unsigned char']], + 'WaitingBit' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare0' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'AcquiredByte' : [ 0x1a, ['unsigned char']], + 'AcquiredBit' : [ 0x1a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadFlags' : [ 0x1b, ['unsigned char']], + 'HeadNodeBit' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IoPriorityBit' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare1' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'StaticState' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'AllFlags' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'SpareFlags' : [ 0x1c, ['unsigned long']], + 'LockState' : [ 0x20, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x20, ['pointer64', ['void']]], + 'CrossThreadReleasableAndBusyByte' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x21, ['array', 6, ['unsigned char']]], + 'InTreeByte' : [ 0x27, ['unsigned char']], + 'SessionState' : [ 0x28, ['pointer64', ['void']]], + 'SessionId' : [ 0x28, ['unsigned long']], + 'SessionPad' : [ 0x2c, ['unsigned long']], + 'OwnerTree' : [ 0x30, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x40, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x30, ['unsigned char']], + 'EntryLock' : [ 0x50, ['unsigned long long']], + 'AllBoosts' : [ 0x58, ['unsigned short']], + 'IoBoost' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'CpuBoostsBitmap' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x5a, ['unsigned short']], + 'SparePad' : [ 0x5c, ['unsigned short']], +} ], + '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { + 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], + 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 24, native_type='unsigned long long')]], + 'LocalPartition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2080' : [ 0x10, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0x108, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x10, ['__unnamed_2080']], + 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], + 'u1' : [ 0x28, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x2c, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x30, ['_KAPC']], + 'ByteCount' : [ 0x88, ['unsigned long']], + 'ChargedPages' : [ 0x8c, ['unsigned long']], + 'PagingFile' : [ 0x90, ['pointer64', ['_MMPAGING_FILE']]], + 'File' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xa0, ['pointer64', ['_CONTROL_AREA']]], + 'FileResource' : [ 0xa8, ['pointer64', ['_ERESOURCE']]], + 'WriteOffset' : [ 0xb0, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'Partition' : [ 0xc0, ['pointer64', ['_MI_PARTITION']]], + 'PointerMdl' : [ 0xc8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0xd0, ['_MDL']], + 'Page' : [ 0x100, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PARTITION_COMMIT' : [ 0x80, { + 'PeakCommitment' : [ 0x0, ['unsigned long long']], + 'TotalCommitLimitMaximum' : [ 0x8, ['unsigned long long']], + 'Popups' : [ 0x10, ['array', 2, ['long']]], + 'LowCommitThreshold' : [ 0x18, ['unsigned long long']], + 'HighCommitThreshold' : [ 0x20, ['unsigned long long']], + 'EventLock' : [ 0x28, ['unsigned long long']], + 'SystemCommitReserve' : [ 0x30, ['unsigned long long']], + 'OverCommit' : [ 0x40, ['unsigned long long']], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_CM_RESOURCE_LIST' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x28, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0x10, ['unsigned long long']], + 'PagedAllocs' : [ 0x18, ['unsigned long']], + 'PagedFrees' : [ 0x1c, ['unsigned long']], + 'PagedBytes' : [ 0x20, ['unsigned long long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer64', ['void']]], + 'Pointer1' : [ 0x40, ['pointer64', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x50, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'CycleTime' : [ 0x10, ['unsigned long long']], + 'ContextSwitches' : [ 0x18, ['unsigned long long']], + 'ReadOperationCount' : [ 0x20, ['long long']], + 'WriteOperationCount' : [ 0x28, ['long long']], + 'OtherOperationCount' : [ 0x30, ['long long']], + 'ReadTransferCount' : [ 0x38, ['long long']], + 'WriteTransferCount' : [ 0x40, ['long long']], + 'OtherTransferCount' : [ 0x48, ['long long']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x1d0, { + 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x8, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x10, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x18, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x20, ['unsigned long long']], + 'IdleTimeExpiration' : [ 0x28, ['unsigned long long']], + 'NonInterruptibleTransition' : [ 0x30, ['unsigned char']], + 'PepWokenTransition' : [ 0x31, ['unsigned char']], + 'Class' : [ 0x32, ['unsigned char']], + 'TargetIdleState' : [ 0x34, ['unsigned long']], + 'IdlePolicy' : [ 0x38, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x40, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x48, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xd8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], + 'LastSysTime' : [ 0xdc, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xe0, ['unsigned long long']], + 'WmiInterfaceEnabled' : [ 0xe8, ['long']], + 'FFHThrottleStateInfo' : [ 0xf0, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0x110, ['_KDPC']], + 'PerfActionMask' : [ 0x150, ['long']], + 'HvIdleCheck' : [ 0x158, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x168, ['pointer64', ['_PROC_PERF_CHECK']]], + 'Domain' : [ 0x170, ['pointer64', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x178, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x180, ['pointer64', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x188, ['pointer64', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x190, ['pointer64', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x198, ['unsigned char']], + 'HvTargetState' : [ 0x199, ['unsigned char']], + 'Parked' : [ 0x19a, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x19c, ['unsigned long']], + 'AveragePerformancePercent' : [ 0x1a0, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x1a4, ['unsigned long']], + 'RelativePerformance' : [ 0x1a8, ['unsigned long']], + 'Utility' : [ 0x1ac, ['unsigned long']], + 'AffinitizedUtility' : [ 0x1b0, ['unsigned long']], + 'SnapTimeLast' : [ 0x1b8, ['unsigned long long']], + 'EnergyConsumed' : [ 0x1b8, ['unsigned long long']], + 'ActiveTime' : [ 0x1c0, ['unsigned long long']], + 'TotalTime' : [ 0x1c8, ['unsigned long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SystemChargedPage' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_THREAD_ENERGY_VALUES' : [ 0x40, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x28, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_CC_ASYNC_READ_CONTEXT' : [ 0x20, { + 'CompletionRoutine' : [ 0x0, ['pointer64', ['void']]], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'RequestorMode' : [ 0x18, ['unsigned char']], + 'NestingLevel' : [ 0x1c, ['unsigned long']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_CMHIVE' : [ 0x17a8, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0xa68, ['array', 6, ['pointer64', ['void']]]], + 'NotifyList' : [ 0xa98, ['_LIST_ENTRY']], + 'HiveList' : [ 0xaa8, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0xab8, ['_LIST_ENTRY']], + 'FailedUnloadList' : [ 0xac8, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0xad8, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0xae0, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0xaf0, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0xaf8, ['unsigned long']], + 'DeletedKcbTable' : [ 0xb00, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0xb08, ['unsigned long']], + 'Identity' : [ 0xb0c, ['unsigned long']], + 'HiveLock' : [ 0xb10, ['pointer64', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0xb18, ['pointer64', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0xb20, ['pointer64', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0xb28, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0xb38, ['unsigned long']], + 'FlushLogEntry' : [ 0xb40, ['pointer64', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0xb48, ['unsigned long']], + 'FlushHiveTruncated' : [ 0xb4c, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0xb50, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0xb58, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0xb68, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0xb70, ['pointer64', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0xb78, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0xb80, ['pointer64', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0xb88, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0xb90, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0xb94, ['unsigned long']], + 'ActualFileSize' : [ 0xb98, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0xba0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0xbb0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0xbc0, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0xbd0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0xbe0, ['unsigned long']], + 'SecurityCacheSize' : [ 0xbe4, ['unsigned long']], + 'SecurityHitHint' : [ 0xbe8, ['long']], + 'SecurityCache' : [ 0xbf0, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0xbf8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0xff8, ['unsigned long']], + 'UnloadEventArray' : [ 0x1000, ['pointer64', ['pointer64', ['_KEVENT']]]], + 'RootKcb' : [ 0x1008, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x1010, ['unsigned char']], + 'UnloadWorkItem' : [ 0x1018, ['pointer64', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x1020, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0x1048, ['unsigned char']], + 'GrowOffset' : [ 0x104c, ['unsigned long']], + 'KcbConvertListHead' : [ 0x1050, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0x1060, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0x1068, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0x14f0, ['unsigned long']], + 'TrustClassEntry' : [ 0x14f8, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0x1508, ['unsigned long long']], + 'UnreconciledTime' : [ 0x1510, ['unsigned long long']], + 'CmRm' : [ 0x1518, ['pointer64', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0x1520, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0x1524, ['long']], + 'CreatorOwner' : [ 0x1528, ['pointer64', ['_KTHREAD']]], + 'RundownThread' : [ 0x1530, ['pointer64', ['_KTHREAD']]], + 'LastWriteTime' : [ 0x1538, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0x1540, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0x1558, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0x1570, ['unsigned long']], + 'FlushActive' : [ 0x1570, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0x1570, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0x1570, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0x1570, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0x1574, ['unsigned long']], + 'ReferenceCount' : [ 0x1578, ['long']], + 'UnloadHistoryIndex' : [ 0x157c, ['long']], + 'UnloadHistory' : [ 0x1580, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0x1780, ['unsigned long']], + 'UnaccessedStart' : [ 0x1784, ['unsigned long']], + 'UnaccessedEnd' : [ 0x1788, ['unsigned long']], + 'LoadedKeyCount' : [ 0x178c, ['unsigned long']], + 'HandleClosePending' : [ 0x1790, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0x1798, ['_EX_PUSH_LOCK']], + 'FinalFlushSucceeded' : [ 0x17a0, ['unsigned char']], + 'FailedUnload' : [ 0x17a1, ['unsigned char']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x38, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long long']], + 'DirtyPageThresholdTop' : [ 0x8, ['unsigned long long']], + 'DirtyPageThresholdBottom' : [ 0x10, ['unsigned long long']], + 'DirtyPageTarget' : [ 0x18, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x20, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x28, ['unsigned long long']], + 'AvailableHistory' : [ 0x30, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], + 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0x18, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], + 'DataLength' : [ 0x10, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], +} ], + '_PPM_VETO_ENTRY' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'VetoReason' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'HitCount' : [ 0x18, ['unsigned long long']], + 'LastActivationTime' : [ 0x20, ['unsigned long long']], + 'TotalActiveTime' : [ 0x28, ['unsigned long long']], + 'CsActivationTime' : [ 0x30, ['unsigned long long']], + 'CsActiveTime' : [ 0x38, ['unsigned long long']], +} ], + '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], + 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], + 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], + 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], + 'LoaderFlags' : [ 0x68, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], + 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'ActiveCount' : [ 0xc, ['unsigned long']], + 'PendingNullCount' : [ 0x10, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], + 'PendingDelete' : [ 0x18, ['unsigned long']], + 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], + 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_TERMINATION_PORT' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], + 'Port' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderMaximum'})]], + 'BasePage' : [ 0x18, ['unsigned long long']], + 'PageCount' : [ 0x20, ['unsigned long long']], +} ], + '_CM_INTENT_LOCK' : [ 0x10, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x408, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['unsigned long long']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x28, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x8, ['_RTL_BITMAP']], + 'HashTable' : [ 0x18, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x20, ['unsigned char']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0xa8, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long long']], + 'NonPagedBytes' : [ 0x58, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], + 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], + 'SessionTrims' : [ 0x74, ['unsigned long']], + 'OptionChanges' : [ 0x78, ['unsigned long']], + 'VerifyMode' : [ 0x7c, ['unsigned long']], + 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], + 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], + 'ExecutePageProtections' : [ 0x94, ['unsigned long']], + 'ExecutePageMappings' : [ 0x98, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE' : [ 0x1810, { + 'CurrentSize' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'Epoch' : [ 0x8, ['unsigned long']], + 'Overflow' : [ 0xc, ['unsigned char']], + 'TableEntry' : [ 0x10, ['array', 256, ['_INVERTED_FUNCTION_TABLE_ENTRY']]], +} ], + '_VF_DRIVER_IO_CALLBACKS' : [ 0x100, { + 'DriverInit' : [ 0x0, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x8, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x10, ['pointer64', ['void']]], + 'AddDevice' : [ 0x18, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x20, ['array', 28, ['pointer64', ['void']]]], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0x18, { + 'ActiveThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'WaitList' : [ 0x8, ['pointer64', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x10, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x10, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_UMS_CONTROL_BLOCK' : [ 0x90, { + 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], + 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], + 'UmsQueue' : [ 0x20, ['_KQUEUE']], + 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], + 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], + 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], + 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], + 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], + 'UmsWaitEvent' : [ 0x30, ['_KEVENT']], + 'StagingArea' : [ 0x48, ['pointer64', ['void']]], + 'UmsPrimaryDeliveredContext' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsFlags' : [ 0x50, ['unsigned long']], + 'TebSelector' : [ 0x88, ['unsigned short']], +} ], + '_OWNER_ENTRY' : [ 0x10, { + 'OwnerThread' : [ 0x0, ['unsigned long long']], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x8, ['unsigned long']], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_ETIMER' : [ 0x138, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x40, ['unsigned long long']], + 'TimerApc' : [ 0x48, ['_KAPC']], + 'TimerDpc' : [ 0xa0, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0xe0, ['_LIST_ENTRY']], + 'Period' : [ 0xf0, ['unsigned long']], + 'TimerFlags' : [ 0xf4, ['unsigned char']], + 'ApcAssociated' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0xf5, ['unsigned char']], + 'Spare2' : [ 0xf6, ['unsigned short']], + 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x110, ['pointer64', ['void']]], + 'VirtualizedTimerLinks' : [ 0x118, ['_LIST_ENTRY']], + 'DueTime' : [ 0x128, ['unsigned long long']], + 'CoalescingWindow' : [ 0x130, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { + 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x90, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'Count' : [ 0x28, ['unsigned long long']], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'StackTrace' : [ 0x40, ['array', 8, ['pointer64', ['void']]]], + 'Who' : [ 0x80, ['unsigned long']], + 'Process' : [ 0x88, ['pointer64', ['_EPROCESS']]], +} ], + '_MI_CACHED_PTES' : [ 0x48, { + 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], + 'CachedPteCount' : [ 0x40, ['long']], +} ], + '_EXHANDLE' : [ 0x8, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_2155' : [ 0x8, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x10, { + 'u1' : [ 0x0, ['__unnamed_2155']], + 'EndVa' : [ 0x8, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { + 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_ARBITER_INSTANCE' : [ 0x150, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], + 'Name' : [ 0x10, ['pointer64', ['unsigned short']]], + 'OrderingName' : [ 0x18, ['pointer64', ['unsigned short']]], + 'ResourceType' : [ 0x20, ['long']], + 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x58, ['long']], + 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], + 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], + 'PackResource' : [ 0x80, ['pointer64', ['void']]], + 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], + 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], + 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], + 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], + 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], + 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], + 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], + 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], + 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], + 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], + 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], + 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], + 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], + 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], + 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], + 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], + 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], + 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], + 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], + 'TransactionInProgress' : [ 0x120, ['unsigned char']], + 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], + 'Extension' : [ 0x130, ['pointer64', ['void']]], + 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], + 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SYSTEM_INFORMATION' : [ 0x1bc0, { + 'Pools' : [ 0x0, ['_MI_POOL_STATE']], + 'Sections' : [ 0x100, ['_MI_SECTION_STATE']], + 'SystemImages' : [ 0x380, ['_MI_SYSTEM_IMAGE_STATE']], + 'Sessions' : [ 0x440, ['_MI_SESSION_STATE']], + 'Processes' : [ 0x4d0, ['_MI_PROCESS_STATE']], + 'Hardware' : [ 0x530, ['_MI_HARDWARE_STATE']], + 'SystemVa' : [ 0x600, ['_MI_SYSTEM_VA_STATE']], + 'PageCombines' : [ 0x8c0, ['_MI_COMBINE_STATE']], + 'Partitions' : [ 0xa60, ['_MI_PARTITION_STATE']], + 'Shutdowns' : [ 0xac0, ['_MI_SHUTDOWN_STATE']], + 'Errors' : [ 0xb40, ['_MI_ERROR_STATE']], + 'AccessLog' : [ 0xc00, ['_MI_ACCESS_LOG_STATE']], + 'Debugger' : [ 0xc80, ['_MI_DEBUGGER_STATE']], + 'Standby' : [ 0xdc0, ['_MI_STANDBY_STATE']], + 'SystemPtes' : [ 0xe80, ['_MI_SYSTEM_PTE_STATE']], + 'IoPages' : [ 0x1000, ['_MI_IO_PAGE_STATE']], + 'PagingIo' : [ 0x1060, ['_MI_PAGING_IO_STATE']], + 'CommonPages' : [ 0x10b0, ['_MI_COMMON_PAGE_STATE']], + 'Trims' : [ 0x1180, ['_MI_SYSTEM_TRIM_STATE']], + 'ResTrack' : [ 0x11c0, ['_MI_RESAVAIL_TRACKER']], + 'Cookie' : [ 0x1540, ['unsigned long long']], + 'ZeroingDisabled' : [ 0x1548, ['long']], + 'BootRegistryRuns' : [ 0x1550, ['pointer64', ['pointer64', ['void']]]], + 'FullyInitialized' : [ 0x1558, ['unsigned char']], + 'SafeBooted' : [ 0x1559, ['unsigned char']], + 'LargePfnBitMap' : [ 0x1560, ['_RTL_BITMAP_EX']], + 'TraceLogging' : [ 0x1570, ['pointer64', ['_TlgProvider_t']]], + 'Vs' : [ 0x1580, ['_MI_VISIBLE_STATE']], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x10, ['unsigned long']], + 'Inserted' : [ 0x14, ['unsigned char']], +} ], + '_PPM_SELECTION_DEPENDENCY' : [ 0x18, { + 'Processor' : [ 0x0, ['unsigned long']], + 'Menu' : [ 0x8, ['_PPM_SELECTION_MENU']], +} ], + '__unnamed_21cf' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_21d1' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_21cf']], +} ], + '__unnamed_21d3' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_21d1']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_21d3']], +} ], + '_MI_VISIBLE_STATE' : [ 0x640, { + 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], + 'SessionWsList' : [ 0x50, ['_LIST_ENTRY']], + 'SessionIdBitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'PagedPoolInfo' : [ 0x68, ['_MM_PAGED_POOL_INFO']], + 'MaximumNonPagedPoolInPages' : [ 0xa0, ['unsigned long long']], + 'SizeOfPagedPoolInPages' : [ 0xa8, ['unsigned long long']], + 'SystemPteInfo' : [ 0xb0, ['_MI_SYSTEM_PTE_TYPE']], + 'NonPagedPoolCommit' : [ 0x110, ['unsigned long long']], + 'BootCommit' : [ 0x118, ['unsigned long long']], + 'MdlPagesAllocated' : [ 0x120, ['unsigned long long']], + 'SystemPageTableCommit' : [ 0x128, ['unsigned long long']], + 'SpecialPagesInUse' : [ 0x130, ['unsigned long long']], + 'WsOverheadPages' : [ 0x138, ['unsigned long long']], + 'VadBitmapPages' : [ 0x140, ['unsigned long long']], + 'ProcessCommit' : [ 0x148, ['unsigned long long']], + 'SharedCommit' : [ 0x150, ['unsigned long long']], + 'DriverCommit' : [ 0x158, ['long']], + 'SystemWs' : [ 0x180, ['array', 3, ['_MMSUPPORT']]], + 'MapCacheFailures' : [ 0x468, ['unsigned long']], + 'PagefileHashPages' : [ 0x470, ['unsigned long long']], + 'PteHeader' : [ 0x478, ['_SYSPTES_HEADER']], + 'SessionSpecialPool' : [ 0x590, ['pointer64', ['_MI_SPECIAL_POOL']]], + 'SystemVaTypeCount' : [ 0x598, ['array', 14, ['unsigned long long']]], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_HMAP_TABLE' : [ 0x5000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'HandleCount' : [ 0x28, ['unsigned long']], + 'Handles' : [ 0x30, ['pointer64', ['pointer64', ['void']]]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x58, { + 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], + 'PerfContext' : [ 0x8, ['unsigned long long']], + 'ProcCap' : [ 0x10, ['unsigned long']], + 'ProcFloor' : [ 0x14, ['unsigned long']], + 'PlatformCap' : [ 0x18, ['unsigned long']], + 'ThermalCap' : [ 0x1c, ['unsigned long']], + 'LimitReasons' : [ 0x20, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x28, ['unsigned long long']], + 'TargetPercent' : [ 0x30, ['unsigned long']], + 'SelectedPercent' : [ 0x34, ['unsigned long']], + 'SelectedFrequency' : [ 0x38, ['unsigned long']], + 'PreviousFrequency' : [ 0x3c, ['unsigned long']], + 'PreviousPercent' : [ 0x40, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x44, ['unsigned long']], + 'SelectedState' : [ 0x48, ['unsigned long long']], + 'Force' : [ 0x50, ['unsigned char']], +} ], + '__unnamed_21ef' : [ 0x20, { + 'CallerCompletion' : [ 0x0, ['pointer64', ['void']]], + 'CallerContext' : [ 0x8, ['pointer64', ['void']]], + 'CallerDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_21f2' : [ 0x10, { + 'NotifyDevice' : [ 0x0, ['pointer64', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x8, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0xf8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x30, ['unsigned long long']], + 'WatchdogTimer' : [ 0x38, ['_KTIMER']], + 'WatchdogDpc' : [ 0x78, ['_KDPC']], + 'MinorFunction' : [ 0xb8, ['unsigned char']], + 'PowerStateType' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0xc0, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0xc4, ['unsigned char']], + 'FxDevice' : [ 0xc8, ['pointer64', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0xd0, ['unsigned char']], + 'NotifyPEP' : [ 0xd1, ['unsigned char']], + 'Device' : [ 0xd8, ['__unnamed_21ef']], + 'System' : [ 0xd8, ['__unnamed_21f2']], +} ], + '_MI_ERROR_STATE' : [ 0xb8, { + 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], + 'ProbeRaises' : [ 0x38, ['_MI_PROBE_RAISE_TRACKER']], + 'ForcedCommits' : [ 0x78, ['_MI_FORCED_COMMITS']], + 'WsleFailures' : [ 0x80, ['array', 2, ['unsigned long']]], + 'WsLinear' : [ 0x88, ['unsigned long']], + 'PageHashErrors' : [ 0x8c, ['unsigned long']], + 'CheckZeroCount' : [ 0x90, ['unsigned long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x94, ['long']], + 'BadPagesDetected' : [ 0x98, ['long']], + 'ScrubPasses' : [ 0x9c, ['long']], + 'ScrubBadPagesFound' : [ 0xa0, ['long']], + 'UserViewFailures' : [ 0xa4, ['unsigned long']], + 'UserViewCollisionFailures' : [ 0xa8, ['unsigned long']], + 'ResavailFailures' : [ 0xac, ['_MI_RESAVAIL_FAILURES']], + 'PendingBadPages' : [ 0xb4, ['unsigned char']], + 'InitFailure' : [ 0xb5, ['unsigned char']], + 'StopBadMaps' : [ 0xb6, ['unsigned char']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_MI_USER_VA_INFO' : [ 0x158, { + 'NumberOfCommittedPageTables' : [ 0x0, ['unsigned long']], + 'HighestTopDownAllocationAddress' : [ 0x8, ['pointer64', ['void']]], + 'VadCell' : [ 0x10, ['array', 2, ['_MI_VAD_ALLOCATION_CELL']]], + 'VadBitMapCommitment' : [ 0x60, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x64, ['unsigned long']], + 'VadsBeingDeleted' : [ 0x68, ['long']], + 'NumberOfDebugEnclaves' : [ 0x6c, ['long']], + 'PhysicalMappingCount' : [ 0x70, ['unsigned long long']], + 'LastVadDeletionEvent' : [ 0x78, ['pointer64', ['_KEVENT']]], + 'SubVadRanges' : [ 0x80, ['array', 3, ['_LIST_ENTRY']]], + 'NumaAware' : [ 0xb0, ['unsigned char']], + 'CloneNestingLevel' : [ 0xb8, ['unsigned long long']], + 'PrivateFixupVadCount' : [ 0xc0, ['unsigned long long']], + 'CfgBitMap' : [ 0xc8, ['array', 2, ['_MI_CFG_BITMAP_INFO']]], + 'CommittedPageTableBufferForTopLevel' : [ 0xf8, ['array', 8, ['unsigned long']]], + 'CommittedPageTableBitmaps' : [ 0x118, ['array', 3, ['_RTL_BITMAP']]], + 'PageTableBitmapPages' : [ 0x148, ['array', 3, ['unsigned long']]], +} ], + '_PROC_FEEDBACK' : [ 0x90, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer64', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x28, ['unsigned long long']], + 'UnscaledTime' : [ 0x30, ['unsigned long long']], + 'UnaccountedTime' : [ 0x38, ['long long']], + 'ScaledTime' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x50, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x58, ['unsigned long long']], + 'UserTimeLast' : [ 0x60, ['unsigned long']], + 'KernelTimeLast' : [ 0x64, ['unsigned long']], + 'IdleGenerationNumberLast' : [ 0x68, ['unsigned long long']], + 'HvActiveTimeLast' : [ 0x70, ['unsigned long long']], + 'StallCyclesLast' : [ 0x78, ['unsigned long long']], + 'StallTime' : [ 0x80, ['unsigned long long']], + 'KernelTimesIndex' : [ 0x88, ['unsigned char']], +} ], + '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x38, { + 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'LocationTreeNode' : [ 0x18, ['_RTL_BALANCED_NODE']], + 'StartingIndex' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_220f' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2213' : [ 0x18, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_2215' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2217' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_2219' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_221b' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_221d' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_221f' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2221' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2223' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2225' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2227' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_220f']], + 'Memory' : [ 0x0, ['__unnamed_220f']], + 'Interrupt' : [ 0x0, ['__unnamed_2213']], + 'Dma' : [ 0x0, ['__unnamed_2215']], + 'DmaV3' : [ 0x0, ['__unnamed_2217']], + 'Generic' : [ 0x0, ['__unnamed_220f']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], + 'BusNumber' : [ 0x0, ['__unnamed_221b']], + 'ConfigData' : [ 0x0, ['__unnamed_221d']], + 'Memory40' : [ 0x0, ['__unnamed_221f']], + 'Memory48' : [ 0x0, ['__unnamed_2221']], + 'Memory64' : [ 0x0, ['__unnamed_2223']], + 'Connection' : [ 0x0, ['__unnamed_2225']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_2227']], +} ], + '_POP_THERMAL_ZONE' : [ 0x348, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], + 'State' : [ 0x40, ['unsigned char']], + 'Flags' : [ 0x41, ['unsigned char']], + 'Removing' : [ 0x42, ['unsigned char']], + 'Mode' : [ 0x43, ['unsigned char']], + 'PendingMode' : [ 0x44, ['unsigned char']], + 'ActivePoint' : [ 0x45, ['unsigned char']], + 'PendingActivePoint' : [ 0x46, ['unsigned char']], + 'Critical' : [ 0x47, ['unsigned char']], + 'ThermalStandby' : [ 0x48, ['unsigned char']], + 'OverThrottled' : [ 0x49, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x4c, ['long']], + 'Throttle' : [ 0x50, ['long']], + 'PendingThrottle' : [ 0x54, ['long']], + 'ThrottleReasons' : [ 0x58, ['unsigned long']], + 'LastTime' : [ 0x60, ['unsigned long long']], + 'SampleRate' : [ 0x68, ['unsigned long']], + 'LastTemp' : [ 0x6c, ['unsigned long']], + 'PassiveTimer' : [ 0x70, ['_KTIMER']], + 'PassiveDpc' : [ 0xb0, ['_KDPC']], + 'Info' : [ 0xf0, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0x148, ['_LARGE_INTEGER']], + 'Policy' : [ 0x150, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x168, ['unsigned char']], + 'LastActiveStartTime' : [ 0x170, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x178, ['unsigned long long']], + 'WorkItem' : [ 0x180, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x1a0, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x1b0, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x1c8, ['_KEVENT']], + 'InstanceId' : [ 0x1e0, ['unsigned long']], + 'TelemetryTracker' : [ 0x1e8, ['_POP_THERMAL_TELEMETRY_TRACKER']], + 'Description' : [ 0x338, ['_UNICODE_STRING']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 28, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0x18, { + 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], + 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_MI_REBUILD_LARGE_PAGES' : [ 0x228, { + 'Active' : [ 0x0, ['long']], + 'Timer' : [ 0x4, ['array', 64, ['array', 4, ['_MI_REBUILD_LARGE_PAGE_COUNTDOWN']]]], + 'WorkItem' : [ 0x208, ['_WORK_QUEUE_ITEM']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x48, ['unsigned long']], + 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_HHIVE' : [ 0xa68, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], + 'ReleaseCellRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Allocate' : [ 0x18, ['pointer64', ['void']]], + 'Free' : [ 0x20, ['pointer64', ['void']]], + 'FileWrite' : [ 0x28, ['pointer64', ['void']]], + 'FileRead' : [ 0x30, ['pointer64', ['void']]], + 'HiveLoadFailure' : [ 0x38, ['pointer64', ['void']]], + 'BaseBlock' : [ 0x40, ['pointer64', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x48, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x58, ['unsigned long']], + 'DirtyAlloc' : [ 0x5c, ['unsigned long']], + 'UnreconciledVector' : [ 0x60, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x70, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x74, ['unsigned long']], + 'Cluster' : [ 0x78, ['unsigned long']], + 'Flat' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SystemCacheBacked' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x7d, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x80, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x84, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x88, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x8c, ['unsigned long']], + 'HiveFlags' : [ 0x90, ['unsigned long']], + 'CurrentLog' : [ 0x94, ['unsigned long']], + 'CurrentLogSequence' : [ 0x98, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x9c, ['unsigned long']], + 'CurrentLogOffset' : [ 0xa0, ['unsigned long']], + 'MinimumLogSequence' : [ 0xa4, ['unsigned long']], + 'LogFileSizeCap' : [ 0xa8, ['unsigned long']], + 'LogDataPresent' : [ 0xac, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0xae, ['unsigned char']], + 'BaseBlockDirty' : [ 0xaf, ['unsigned char']], + 'LastLogSwapTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'FirstLogFile' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0xb8, ['unsigned short']], + 'LogEntriesRecovered' : [ 0xba, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0xbc, ['unsigned long']], + 'StorageTypeCount' : [ 0xc0, ['unsigned long']], + 'Version' : [ 0xc4, ['unsigned long']], + 'ViewMap' : [ 0xc8, ['_HVIEW_MAP']], + 'Storage' : [ 0x578, ['array', 2, ['_DUAL']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_ETW_FILTER_HEADER' : [ 0x48, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x8, ['pointer64', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x10, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0x18, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x20, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x28, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x30, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x38, ['pointer64', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x40, ['pointer64', ['_EVENT_FILTER_HEADER']]], +} ], + '_CM_WORKITEM' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x10, ['unsigned long']], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Parameter' : [ 0x20, ['pointer64', ['void']]], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_CM_TRANS' : [ 0xa8, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x30, ['pointer64', ['void']]], + 'CmRm' : [ 0x38, ['pointer64', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x40, ['pointer64', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x48, ['pointer64', ['void']]], + 'KtmUow' : [ 0x50, ['_GUID']], + 'StartLsn' : [ 0x60, ['unsigned long long']], + 'TransState' : [ 0x68, ['unsigned long']], + 'HiveCount' : [ 0x6c, ['unsigned long']], + 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x20, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Count' : [ 0x14, ['unsigned long']], + 'Stamp' : [ 0x18, ['unsigned long']], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x150, { + 'AccountingDisabled' : [ 0x0, ['unsigned char']], + 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], + 'TotalPassiveTime' : [ 0x10, ['array', 20, ['unsigned long long']]], + 'PassiveTimeSnap' : [ 0xb0, ['array', 20, ['unsigned long long']]], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x40, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ProbeMode' : [ 0x10, ['unsigned char']], + 'PagedPoolCharge' : [ 0x14, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_HVIEW_MAP' : [ 0x4b0, { + 'MappedLength' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Directory' : [ 0x18, ['pointer64', ['_HVIEW_MAP_DIRECTORY']]], + 'PagesCharged' : [ 0x20, ['unsigned long']], + 'PinLog' : [ 0x28, ['_HVIEW_MAP_PIN_LOG']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_DISALLOWED_GUIDS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], +} ], + '_HVIEW_MAP_DIRECTORY' : [ 0x400, { + 'Tables' : [ 0x0, ['array', 128, ['pointer64', ['_HVIEW_MAP_TABLE']]]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x10, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0x18, { + 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], + 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1f, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1e, ['unsigned char']], +} ], + '__unnamed_229f' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_22a1' : [ 0x20, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_229f']], +} ], + '_VF_TARGET_DRIVER' : [ 0x38, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x10, ['__unnamed_22a1']], + 'VerifiedData' : [ 0x30, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '__unnamed_22aa' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ac' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ae' : [ 0x10, { + 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], + 'DeviceId' : [ 0x8, ['array', 1, ['wchar']]], +} ], + '__unnamed_22b0' : [ 0x8, { + 'Notification' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_22b2' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_22b4' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_22b6' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_22b8' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_22ba' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_22bc' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_22aa']], + 'TargetDevice' : [ 0x0, ['__unnamed_22ac']], + 'InstallDevice' : [ 0x0, ['__unnamed_22ac']], + 'CustomNotification' : [ 0x0, ['__unnamed_22ae']], + 'ProfileNotification' : [ 0x0, ['__unnamed_22b0']], + 'PowerNotification' : [ 0x0, ['__unnamed_22b2']], + 'VetoNotification' : [ 0x0, ['__unnamed_22b4']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_22b6']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_22b8']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_22ba']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_22ac']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_22ac']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], + 'u' : [ 0x30, ['__unnamed_22bc']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x10, ['unsigned long']], + 'Unloads' : [ 0x14, ['unsigned long']], + 'BaseName' : [ 0x18, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x58, { + 'Context' : [ 0x0, ['pointer64', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x38, ['unsigned long']], + 'DependencyUsed' : [ 0x3c, ['unsigned long']], + 'DependencyArray' : [ 0x40, ['pointer64', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x48, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x4c, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x50, ['unsigned long']], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], + 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], +} ], + '__unnamed_22d8' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_22d8']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x8, ['unsigned long long']], + 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x28, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x18, ['unsigned long long']], + 'Busy' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_MI_HARDWARE_STATE' : [ 0xa8, { + 'NodeMask' : [ 0x0, ['unsigned long']], + 'NodeGraph' : [ 0x8, ['pointer64', ['unsigned short']]], + 'SystemNodeInformation' : [ 0x10, ['pointer64', ['_MI_SYSTEM_NODE_INFORMATION']]], + 'NumaLastRangeIndex' : [ 0x18, ['unsigned long']], + 'NumaMemoryRanges' : [ 0x20, ['pointer64', ['_HAL_NODE_RANGE']]], + 'NumaTableCaptured' : [ 0x28, ['unsigned char']], + 'NodeShift' : [ 0x29, ['unsigned char']], + 'ChannelMemoryRanges' : [ 0x30, ['pointer64', ['_HAL_CHANNEL_MEMORY_RANGES']]], + 'ChannelShift' : [ 0x38, ['unsigned char']], + 'SecondLevelCacheSize' : [ 0x3c, ['unsigned long']], + 'FirstLevelCacheSize' : [ 0x40, ['unsigned long']], + 'PhysicalAddressBits' : [ 0x44, ['unsigned long']], + 'AllMainMemoryMustBeCached' : [ 0x48, ['unsigned char']], + 'TotalPagesAllowed' : [ 0x50, ['unsigned long long']], + 'SecondaryColorMask' : [ 0x58, ['unsigned long']], + 'SecondaryColors' : [ 0x5c, ['unsigned long']], + 'FlushTbForAttributeChange' : [ 0x60, ['unsigned long']], + 'FlushCacheForAttributeChange' : [ 0x64, ['unsigned long']], + 'FlushCacheForPageAttributeChange' : [ 0x68, ['unsigned long']], + 'CacheFlushPromoteThreshold' : [ 0x6c, ['unsigned long']], + 'FlushTbThreshold' : [ 0x70, ['unsigned long long']], + 'ZeroCostCounts' : [ 0x78, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], + 'PrimaryPfns' : [ 0x98, ['unsigned long long']], + 'HighestPossiblePhysicalPage' : [ 0xa0, ['unsigned long long']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x78, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], + 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], + 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], + 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], + 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], + 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], + 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], + 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], + 'WaitObjectFlagMask' : [ 0x70, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x74, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x76, ['unsigned short']], +} ], + '__unnamed_231c' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], +} ], + '_MI_DECAY_TIMER_LINK' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_231c']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_KPROCESSOR_STATE' : [ 0x5b0, { + 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], + 'ContextFrame' : [ 0xe0, ['_CONTEXT']], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x10, { + 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_HEAP_EXTENDED_ENTRY' : [ 0x10, { + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], +} ], + '_MI_SYSTEM_VA_STATE' : [ 0x2c0, { + 'SystemTablesLock' : [ 0x0, ['unsigned long long']], + 'AvailableSystemCacheVa' : [ 0x8, ['unsigned long long']], + 'DynamicBitMapSystemPtes' : [ 0x10, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapDriverImages' : [ 0x60, ['array', 2, ['_MI_DYNAMIC_BITMAP']]], + 'DynamicBitMapPagedPool' : [ 0x100, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSpecialPool' : [ 0x150, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSystemCache' : [ 0x1a0, ['_MI_DYNAMIC_BITMAP']], + 'WorkingSetListHashStart' : [ 0x1f0, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListHashEnd' : [ 0x1f8, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListIndirectHashStart' : [ 0x200, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'FreeSystemCacheVa' : [ 0x208, ['_KEVENT']], + 'SystemVaLock' : [ 0x220, ['unsigned long long']], + 'DeleteKvaLock' : [ 0x228, ['long']], + 'FreeSystemCache' : [ 0x230, ['_MI_PTE_CHAIN_HEAD']], + 'SystemCacheViewLock' : [ 0x248, ['unsigned long long']], + 'UnusableWsles' : [ 0x250, ['array', 5, ['unsigned long long']]], + 'PossibleWsles' : [ 0x278, ['array', 5, ['unsigned long long']]], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0x18, { + 'DirtyPages' : [ 0x0, ['unsigned long long']], + 'DirtyPagesLastScan' : [ 0x8, ['unsigned long long']], + 'DirtyPagesScheduledLastScan' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], + 'BreakPointHandle' : [ 0x10, ['unsigned long']], + 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], + 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'StackLimit' : [ 0x8, ['unsigned long long']], + 'KernelStack' : [ 0x10, ['unsigned long long']], + 'InitialStack' : [ 0x18, ['unsigned long long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_MI_DEBUGGER_STATE' : [ 0x118, { + 'TransientWrite' : [ 0x0, ['unsigned char']], + 'CodePageEdited' : [ 0x1, ['unsigned char']], + 'DebugPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'PoisonedTb' : [ 0x10, ['unsigned long']], + 'InDebugger' : [ 0x14, ['long']], + 'Pfns' : [ 0x18, ['array', 32, ['pointer64', ['void']]]], +} ], + '_MI_PROCESS_STATE' : [ 0x60, { + 'ColorSeed' : [ 0x0, ['unsigned long']], + 'CloneDereferenceEvent' : [ 0x8, ['_KEVENT']], + 'CloneProtosSListHead' : [ 0x20, ['_SLIST_HEADER']], + 'SystemDllBase' : [ 0x30, ['pointer64', ['void']]], + 'RotatingUniprocessorNumber' : [ 0x38, ['long']], + 'CriticalSectionTimeout' : [ 0x40, ['_LARGE_INTEGER']], + 'ProcessList' : [ 0x48, ['_LIST_ENTRY']], + 'SharedUserDataPte' : [ 0x58, ['pointer64', ['_MMPTE']]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x50, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x30, ['unsigned long']], + 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x40, ['unsigned short']], + 'RangeAttributes' : [ 0x42, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], + 'WorkSpace' : [ 0x48, ['unsigned long long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'HighActiveFlink' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'HighActiveBlink' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 56, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'HiberFileType' : [ 0x16, ['unsigned char']], + 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], + 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_MI_REBUILD_LARGE_PAGE_COUNTDOWN' : [ 0x2, { + 'SecondsLeft' : [ 0x0, ['unsigned char']], + 'SecondsAssigned' : [ 0x1, ['unsigned char']], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_REQUEST_MAILBOX' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x8, ['unsigned long long']], + 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x30, ['pointer64', ['long']]], + 'NodeTargetCount' : [ 0x38, ['long']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_PEB32' : [ 0x460, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['unsigned long']], + 'ImageBaseAddress' : [ 0x8, ['unsigned long']], + 'Ldr' : [ 0xc, ['unsigned long']], + 'ProcessParameters' : [ 0x10, ['unsigned long']], + 'SubSystemData' : [ 0x14, ['unsigned long']], + 'ProcessHeap' : [ 0x18, ['unsigned long']], + 'FastPebLock' : [ 0x1c, ['unsigned long']], + 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], + 'IFEOKey' : [ 0x24, ['unsigned long']], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], + 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['unsigned long']], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['unsigned long']], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], + 'SparePvoid0' : [ 0x50, ['unsigned long']], + 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], + 'AnsiCodePageData' : [ 0x58, ['unsigned long']], + 'OemCodePageData' : [ 0x5c, ['unsigned long']], + 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['unsigned long']], + 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], + 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['unsigned long']], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], + 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['unsigned long']], + 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], + 'CSDVersion' : [ 0x1f0, ['_STRING32']], + 'ActivationContextData' : [ 0x1f8, ['unsigned long']], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], + 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], + 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['unsigned long']], + 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], + 'FlsBitmap' : [ 0x218, ['unsigned long']], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['unsigned long']], + 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], + 'pUnused' : [ 0x238, ['unsigned long']], + 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], + 'TppWorkerpList' : [ 0x254, ['LIST_ENTRY32']], + 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['unsigned long']]], +} ], + '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x10, { + 'Validation' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'TrackedOffsetCallback' : [ 0x8, ['pointer64', ['void']]], +} ], + '_VPB' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], +} ], + '_MI_SESSION_STATE' : [ 0x88, { + 'SystemSession' : [ 0x0, ['_MMSESSION']], + 'CodePageEdited' : [ 0x20, ['unsigned char']], + 'DynamicVaBitBuffer' : [ 0x28, ['pointer64', ['unsigned long']]], + 'DynamicVaBitBufferPages' : [ 0x30, ['unsigned long long']], + 'DynamicPoolBitBuffer' : [ 0x38, ['pointer64', ['unsigned long']]], + 'DynamicVaStart' : [ 0x40, ['pointer64', ['void']]], + 'DynamicPtesBitBuffer' : [ 0x48, ['pointer64', ['unsigned long']]], + 'IdLock' : [ 0x50, ['_EX_PUSH_LOCK']], + 'DetachTimeStamp' : [ 0x58, ['unsigned long']], + 'LeaderProcess' : [ 0x60, ['pointer64', ['_EPROCESS']]], + 'InitializeLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'WorkingSetList' : [ 0x70, ['pointer64', ['_MMWSL']]], + 'WsHashStart' : [ 0x78, ['pointer64', ['_MMWSLE_HASH']]], + 'WsHashEnd' : [ 0x80, ['pointer64', ['_MMWSLE_HASH']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_MMSESSION' : [ 0x20, { + 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'SystemSpaceViewLockPointer' : [ 0x8, ['pointer64', ['_EX_PUSH_LOCK']]], + 'ViewRoot' : [ 0x10, ['_RTL_AVL_TREE']], + 'ViewCount' : [ 0x18, ['unsigned long']], + 'BitmapFailures' : [ 0x1c, ['unsigned long']], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x260, { + 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], + 'Lock' : [ 0x250, ['_EX_PUSH_LOCK']], + 'NumberOfPrivateSpaces' : [ 0x258, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { + 'ClientToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], + 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], +} ], + '_MI_DECAY_TIMER_LINKAGE' : [ 0x8, { + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x60, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], + 'AccessBufferMax' : [ 0x28, ['unsigned long']], + 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x50, ['long']], + 'Flags' : [ 0x54, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x58, ['long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '__unnamed_23a3' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], +} ], + '_MI_PARTITION_CORE' : [ 0x158, { + 'PartitionId' : [ 0x0, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_23a3']], + 'ReferenceCount' : [ 0x8, ['unsigned long long']], + 'ParentPartition' : [ 0x10, ['pointer64', ['_MI_PARTITION']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeInformation' : [ 0x28, ['pointer64', ['_MI_NODE_INFORMATION']]], + 'MdlPhysicalMemoryBlock' : [ 0x30, ['pointer64', ['_MDL']]], + 'MemoryNodeRuns' : [ 0x38, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'MemoryBlockReferences' : [ 0x40, ['unsigned long long']], + 'PfnUnmapWorkItem' : [ 0x48, ['_WORK_QUEUE_ITEM']], + 'PfnUnmapActive' : [ 0x68, ['unsigned char']], + 'PfnUnmapCount' : [ 0x70, ['unsigned long long']], + 'PfnUnmapWaitList' : [ 0x78, ['pointer64', ['void']]], + 'MemoryRuns' : [ 0x80, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'ExitEvent' : [ 0x88, ['_KEVENT']], + 'SystemThreadHandles' : [ 0xa0, ['array', 5, ['pointer64', ['void']]]], + 'PartitionObject' : [ 0xc8, ['pointer64', ['void']]], + 'PartitionObjectHandle' : [ 0xd0, ['pointer64', ['void']]], + 'DynamicMemoryPushLock' : [ 0xd8, ['_EX_PUSH_LOCK']], + 'DynamicMemoryLock' : [ 0xe0, ['long']], + 'TemporaryMemoryEvent' : [ 0xe8, ['_KEVENT']], + 'MemoryEvents' : [ 0x100, ['array', 11, ['pointer64', ['_KEVENT']]]], +} ], + '_MI_PARTITION_MODWRITES' : [ 0x2d0, { + 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], + 'PageFileContract' : [ 0x60, ['_MMPAGE_FILE_EXPANSION']], + 'NumberOfMappedMdls' : [ 0xc0, ['unsigned long long']], + 'NumberOfMappedMdlsInUse' : [ 0xc8, ['long']], + 'NumberOfMappedMdlsInUsePeak' : [ 0xcc, ['unsigned long']], + 'MappedFileHeader' : [ 0xd0, ['_MMMOD_WRITER_LISTHEAD']], + 'NeedMappedMdl' : [ 0xf8, ['unsigned char']], + 'NeedPageFileMdl' : [ 0xf9, ['unsigned char']], + 'TransitionInserted' : [ 0xfa, ['unsigned char']], + 'LastModifiedWriteError' : [ 0xfc, ['long']], + 'LastMappedWriteError' : [ 0x100, ['long']], + 'MappedFileWriteSucceeded' : [ 0x104, ['unsigned long']], + 'MappedWriteBurstCount' : [ 0x108, ['unsigned long']], + 'LowPriorityModWritesOutstanding' : [ 0x10c, ['unsigned long']], + 'BoostModWriteIoPriorityEvent' : [ 0x110, ['_KEVENT']], + 'ModifiedWriterThreadPriority' : [ 0x128, ['long']], + 'ModifiedPagesLowPriorityGoal' : [ 0x130, ['unsigned long long']], + 'ModifiedPageWriterEvent' : [ 0x138, ['_KEVENT']], + 'ModifiedWriterExitedEvent' : [ 0x150, ['_KEVENT']], + 'WriteAllPagefilePages' : [ 0x168, ['long']], + 'WriteAllMappedPages' : [ 0x16c, ['long']], + 'MappedPageWriterEvent' : [ 0x170, ['_KEVENT']], + 'ModWriteData' : [ 0x188, ['_MI_MODWRITE_DATA']], + 'RescanPageFilesEvent' : [ 0x1c8, ['_KEVENT']], + 'PagingFileHeader' : [ 0x1e0, ['_MMMOD_WRITER_LISTHEAD']], + 'ModifiedPageWriterThread' : [ 0x208, ['pointer64', ['_ETHREAD']]], + 'ModifiedPageWriterRundown' : [ 0x210, ['_EX_RUNDOWN_REF']], + 'PagefileScanWorkItem' : [ 0x218, ['_WORK_QUEUE_ITEM']], + 'PagefileScanCount' : [ 0x238, ['unsigned long']], + 'ClusterWritesDisabled' : [ 0x23c, ['array', 2, ['long']]], + 'NotifyStoreMemoryConditions' : [ 0x248, ['_KEVENT']], + 'DelayMappedWrite' : [ 0x260, ['unsigned char']], + 'PagefileReservationsEnabled' : [ 0x264, ['unsigned long']], + 'PageFileCreationLock' : [ 0x268, ['_EX_PUSH_LOCK']], + 'TrimPagefileWorkItem' : [ 0x270, ['_WORK_QUEUE_ITEM']], + 'LastTrimPagefileTime' : [ 0x290, ['unsigned long long']], + 'WsSwapPagefileContractWorkItem' : [ 0x298, ['_WORK_QUEUE_ITEM']], + 'WsSwapPageFileContractionInProgress' : [ 0x2b8, ['long']], + 'WorkingSetSwapLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'WorkingSetInswapLock' : [ 0x2c8, ['long']], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_KPRIQUEUE' : [ 0x2b0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x218, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x298, ['unsigned long']], + 'ThreadListHead' : [ 0x2a0, ['_LIST_ENTRY']], +} ], + '__unnamed_23c0' : [ 0x4, { + 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_NODE_INFORMATION' : [ 0x538, { + 'LargePageFreeCount' : [ 0x0, ['array', 2, ['unsigned long long']]], + 'LargePages' : [ 0x10, ['array', 2, ['array', 2, ['array', 4, ['_LIST_ENTRY']]]]], + 'LargePagesCount' : [ 0x110, ['array', 2, ['array', 2, ['array', 4, ['unsigned long long']]]]], + 'StandbyPageList' : [ 0x190, ['array', 4, ['array', 8, ['_MMPFNLIST_SHORT']]]], + 'FreeCount' : [ 0x490, ['array', 2, ['unsigned long long']]], + 'TotalPages' : [ 0x4a0, ['array', 4, ['unsigned long long']]], + 'TotalPagesEntireNode' : [ 0x4c0, ['unsigned long long']], + 'MmShiftedColor' : [ 0x4c8, ['unsigned long']], + 'Color' : [ 0x4cc, ['unsigned long']], + 'ChannelFreeCount' : [ 0x4d0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'Flags' : [ 0x510, ['__unnamed_23c0']], + 'NodeLock' : [ 0x518, ['_EX_PUSH_LOCK']], + 'ChannelStatus' : [ 0x520, ['unsigned char']], + 'ChannelOrdering' : [ 0x521, ['array', 4, ['unsigned char']]], + 'LockedChannelOrdering' : [ 0x525, ['array', 4, ['unsigned char']]], + 'PowerAttribute' : [ 0x529, ['array', 4, ['unsigned char']]], + 'LargePageLock' : [ 0x530, ['unsigned long long']], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WAITING_IRP' : [ 0x38, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'CompletionRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'Information' : [ 0x30, ['unsigned long']], + 'BreakAllRH' : [ 0x34, ['unsigned char']], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_PPM_SELECTION_MENU' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Entries' : [ 0x8, ['pointer64', ['_PPM_SELECTION_MENU_ENTRY']]], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x20, { + 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0x18, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_KSCHEDULING_GROUP' : [ 0x240, { + 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], + 'RelativeWeight' : [ 0x8, ['unsigned long']], + 'ChildMinRate' : [ 0xc, ['unsigned long']], + 'ChildMinWeight' : [ 0x10, ['unsigned long']], + 'ChildTotalWeight' : [ 0x14, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], + 'NotificationCycles' : [ 0x20, ['long long']], + 'SchedulingGroupList' : [ 0x28, ['_LIST_ENTRY']], + 'Sibling' : [ 0x28, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x38, ['pointer64', ['_KDPC']]], + 'ChildList' : [ 0x40, ['_LIST_ENTRY']], + 'Parent' : [ 0x50, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'PerProcessor' : [ 0x80, ['array', 1, ['_KSCB']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { + 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], + 'Object' : [ 0x10, ['pointer64', ['void']]], + 'TargetAccess' : [ 0x18, ['unsigned long']], + 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x20, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 15, native_type='unsigned long long')]], + 'ExecutePrivilege' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x30, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'Irp' : [ 0x18, ['pointer64', ['_IRP']]], + 'Device' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x28, ['unsigned char']], +} ], + '_POP_POLICY_DEVICE' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], +} ], + '__unnamed_23f3' : [ 0x8, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], + 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], +} ], + '_SECTION' : [ 0x40, { + 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u1' : [ 0x28, ['__unnamed_23f3']], + 'SizeOfSection' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16ec']], + 'InitialPageProtection' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'SessionId' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x3c, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_SECTION_STATE' : [ 0x280, { + 'SectionObjectPointersLock' : [ 0x0, ['long']], + 'SectionExtendLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'SectionExtendSetLock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'SectionBasedRoot' : [ 0x18, ['_RTL_AVL_TREE']], + 'SectionBasedLock' : [ 0x20, ['_EX_PUSH_LOCK']], + 'UnusedSubsectionPagedPool' : [ 0x28, ['unsigned long long']], + 'UnusedSegmentForceFree' : [ 0x30, ['unsigned long']], + 'DataSectionProtectionMask' : [ 0x34, ['unsigned long']], + 'HighSectionBase' : [ 0x38, ['pointer64', ['void']]], + 'PhysicalSubsection' : [ 0x40, ['_MSUBSECTION']], + 'PhysicalControlArea' : [ 0xb0, ['_CONTROL_AREA']], + 'DanglingExtentsPages' : [ 0x128, ['pointer64', ['_MMPFN']]], + 'DanglingExtentsLock' : [ 0x130, ['long']], + 'DanglingExtentsWorkItem' : [ 0x138, ['_WORK_QUEUE_ITEM']], + 'DanglingExtentsWorkerActive' : [ 0x158, ['unsigned char']], + 'PageFileSectionHead' : [ 0x160, ['_RTL_AVL_TREE']], + 'PageFileSectionListSpinLock' : [ 0x168, ['long']], + 'SharedSegmentCharges' : [ 0x170, ['_MI_CROSS_PARTITION_CHARGES']], + 'SharedPageCombineCharges' : [ 0x198, ['_MI_CROSS_PARTITION_CHARGES']], + 'ImageBias' : [ 0x1c0, ['unsigned long']], + 'RelocateBitmapsLock' : [ 0x1c8, ['_EX_PUSH_LOCK']], + 'ImageBitMap' : [ 0x1d0, ['_RTL_BITMAP']], + 'ImageBias64Low' : [ 0x1e0, ['unsigned long']], + 'ImageBias64High' : [ 0x1e4, ['unsigned long']], + 'ImageBitMap64Low' : [ 0x1e8, ['_RTL_BITMAP']], + 'ImageBitMap64High' : [ 0x1f8, ['_RTL_BITMAP']], + 'ImageBitMapWow64Dll' : [ 0x208, ['_RTL_BITMAP']], + 'ApiSetSection' : [ 0x218, ['pointer64', ['void']]], + 'ApiSetSchema' : [ 0x220, ['pointer64', ['void']]], + 'ApiSetSchemaSize' : [ 0x228, ['unsigned long long']], + 'LostDataFiles' : [ 0x230, ['unsigned long']], + 'LostDataPages' : [ 0x234, ['unsigned long']], + 'ImageFailureReason' : [ 0x238, ['unsigned long']], + 'CfgBitMapSection32' : [ 0x240, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea32' : [ 0x248, ['pointer64', ['_CONTROL_AREA']]], + 'CfgBitMapSection64' : [ 0x250, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea64' : [ 0x258, ['pointer64', ['_CONTROL_AREA']]], + 'ImageCfgFailure' : [ 0x260, ['unsigned long']], + 'ImageValidationFailed' : [ 0x264, ['long']], +} ], + '_MI_PARTITION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], +} ], + '__unnamed_2400' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2402' : [ 0x10, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2404' : [ 0x10, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2406' : [ 0x10, { + 'Raw' : [ 0x0, ['__unnamed_2404']], + 'Translated' : [ 0x0, ['__unnamed_2402']], +} ], + '__unnamed_2408' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_240a' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_240c' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_240e' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2410' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2412' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2414' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2416' : [ 0x10, { + 'Generic' : [ 0x0, ['__unnamed_2400']], + 'Port' : [ 0x0, ['__unnamed_2400']], + 'Interrupt' : [ 0x0, ['__unnamed_2402']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_2406']], + 'Memory' : [ 0x0, ['__unnamed_2400']], + 'Dma' : [ 0x0, ['__unnamed_2408']], + 'DmaV3' : [ 0x0, ['__unnamed_240a']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], + 'BusNumber' : [ 0x0, ['__unnamed_240c']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_240e']], + 'Memory40' : [ 0x0, ['__unnamed_2410']], + 'Memory48' : [ 0x0, ['__unnamed_2412']], + 'Memory64' : [ 0x0, ['__unnamed_2414']], + 'Connection' : [ 0x0, ['__unnamed_2225']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_2416']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_241e' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_241e']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE_ENTRY' : [ 0x18, { + 'FunctionTable' : [ 0x0, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'DynamicTable' : [ 0x0, ['pointer64', ['_DYNAMIC_FUNCTION_TABLE']]], + 'ImageBase' : [ 0x8, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'SizeOfTable' : [ 0x14, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { + 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x38, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'PagedPoolAllocationMap' : [ 0x8, ['_RTL_BITMAP_EX']], + 'FirstPteForPagedPool' : [ 0x18, ['pointer64', ['_MMPTE']]], + 'MaximumSize' : [ 0x20, ['unsigned long long']], + 'PagedPoolHint' : [ 0x28, ['unsigned long long']], + 'AllocatedPagedPool' : [ 0x30, ['unsigned long long']], +} ], + '__unnamed_2430' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x58, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x8, ['__unnamed_2430']], +} ], + '_PPM_COORDINATED_SELECTION' : [ 0x18, { + 'MaximumStates' : [ 0x0, ['unsigned long']], + 'SelectedStates' : [ 0x4, ['unsigned long']], + 'DefaultSelection' : [ 0x8, ['unsigned long']], + 'Selection' : [ 0x10, ['pointer64', ['unsigned long']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_MI_PAGE_COMBINING_SUPPORT' : [ 0x188, { + 'Partition' : [ 0x0, ['pointer64', ['_MI_PARTITION']]], + 'ArbitraryPfnMapList' : [ 0x8, ['_LIST_ENTRY']], + 'FreeCombinePoolItem' : [ 0x18, ['_MI_COMBINE_WORKITEM']], + 'CombiningThreadCount' : [ 0x40, ['unsigned long']], + 'CombinePageFreeList' : [ 0x48, ['_LIST_ENTRY']], + 'CombineFreeListLock' : [ 0x58, ['unsigned long long']], + 'CombinePageListHeads' : [ 0x60, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], + 'PageCombineStats' : [ 0x160, ['_MI_PAGE_COMBINE_STATISTICS']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x10, { + 'p' : [ 0x0, ['pointer64', ['void']]], + 'RangeSize' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_DEVICE' : [ 0x278, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DevNode' : [ 0x30, ['pointer64', ['_DEVICE_NODE']]], + 'DpmContext' : [ 0x38, ['pointer64', ['PEPHANDLE__']]], + 'Plugin' : [ 0x40, ['pointer64', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x48, ['pointer64', ['PEPHANDLE__']]], + 'AcpiPlugin' : [ 0x50, ['pointer64', ['_POP_FX_PLUGIN']]], + 'AcpiPluginHandle' : [ 0x58, ['pointer64', ['PEPHANDLE__']]], + 'DeviceObject' : [ 0x60, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x68, ['pointer64', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x70, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0xa8, ['pointer64', ['void']]], + 'AcpiLink' : [ 0xb0, ['_LIST_ENTRY']], + 'DeviceId' : [ 0xc0, ['_UNICODE_STRING']], + 'RemoveLock' : [ 0xd0, ['_IO_REMOVE_LOCK']], + 'AcpiRemoveLock' : [ 0xf0, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0x110, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0x148, ['unsigned long long']], + 'IdleTimer' : [ 0x150, ['_KTIMER']], + 'IdleDpc' : [ 0x190, ['_KDPC']], + 'IdleTimeout' : [ 0x1d0, ['unsigned long long']], + 'IdleStamp' : [ 0x1d8, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x1e0, ['array', 2, ['pointer64', ['_DEVICE_OBJECT']]]], + 'NextIrpPowerState' : [ 0x1f0, ['array', 2, ['_POWER_STATE']]], + 'NextIrpCallerCompletion' : [ 0x1f8, ['array', 2, ['pointer64', ['void']]]], + 'NextIrpCallerContext' : [ 0x208, ['array', 2, ['pointer64', ['void']]]], + 'IrpCompleteEvent' : [ 0x218, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x230, ['pointer64', ['void']]], + 'Accounting' : [ 0x238, ['_POP_FX_ACCOUNTING']], + 'Flags' : [ 0x268, ['unsigned long']], + 'ComponentCount' : [ 0x26c, ['unsigned long']], + 'Components' : [ 0x270, ['pointer64', ['pointer64', ['_POP_FX_COMPONENT']]]], +} ], + '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { + 'AsULong' : [ 0x0, ['unsigned long']], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2458' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_245a' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_2458']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x60, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x20, ['_LIST_ENTRY']], + 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CoolingExtension' : [ 0x40, ['pointer64', ['_POP_COOLING_EXTENSION']]], + 'Volume' : [ 0x48, ['_LIST_ENTRY']], + 'Specific' : [ 0x58, ['__unnamed_245a']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MI_COMBINE_STATE' : [ 0x1a0, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'CombiningThreadCount' : [ 0x4, ['unsigned long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], + 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], + 'CrossPartition' : [ 0x18, ['_MI_PAGE_COMBINING_SUPPORT']], +} ], + '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x30, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'ListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { + 'BadPageCount' : [ 0x0, ['unsigned long long']], + 'BadPagesDetected' : [ 0x8, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0xc, ['long']], + 'ScrubPasses' : [ 0x10, ['long']], + 'ScrubBadPagesFound' : [ 0x14, ['long']], + 'PageHashErrors' : [ 0x18, ['unsigned long']], + 'FeatureBits' : [ 0x20, ['unsigned long long']], + 'TimeZoneId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['_MI_FLAGS']], + 'VsmConnection' : [ 0x30, ['pointer64', ['void']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x68, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], + 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], + 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], + 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], + 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KENLISTMENT' : [ 0x1e0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x30, ['_GUID']], + 'Mutex' : [ 0x40, ['_KMUTANT']], + 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], + 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0xac, ['unsigned long']], + 'NotificationMask' : [ 0xb0, ['unsigned long']], + 'Key' : [ 0xb8, ['pointer64', ['void']]], + 'KeyRefCount' : [ 0xc0, ['unsigned long']], + 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], + 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], + 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], + 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], + 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], + 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], + 'NextHistory' : [ 0x138, ['unsigned long']], + 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['unsigned long']], +} ], + '_DELAY_ACK_FO' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_MI_CROSS_PARTITION_CHARGES' : [ 0x28, { + 'CurrentCharges' : [ 0x0, ['unsigned long long']], + 'ChargeFailures' : [ 0x8, ['unsigned long long']], + 'ChargePeak' : [ 0x10, ['unsigned long long']], + 'ChargeMinimum' : [ 0x18, ['unsigned long long']], + 'ChargeMaximum' : [ 0x20, ['unsigned long long']], +} ], + '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x38, { + 'BugCheckCode' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['long']], + 'Data' : [ 0x8, ['unsigned long']], + 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { + 'ExpansionLock' : [ 0x0, ['unsigned long long']], + 'TrimInProgressCount' : [ 0x8, ['long']], + 'PeriodicWorkingSetEvent' : [ 0x10, ['_KEVENT']], + 'TrimAllPageFaultCount' : [ 0x28, ['array', 3, ['unsigned long']]], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_MI_ZERO_COST_COUNTS' : [ 0x10, { + 'NativeSum' : [ 0x0, ['unsigned long long']], + 'CachedSum' : [ 0x8, ['unsigned long long']], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MI_RESAVAIL_TRACKER' : [ 0x380, { + 'AllocateKernelStack' : [ 0x0, ['unsigned long long']], + 'AllocateGrowKernelStack' : [ 0x8, ['unsigned long long']], + 'FreeKernelStack' : [ 0x10, ['unsigned long long']], + 'FreeKernelStackError' : [ 0x18, ['unsigned long long']], + 'FreeGrowKernelStackError' : [ 0x20, ['unsigned long long']], + 'AllocateCreateProcess' : [ 0x28, ['unsigned long long']], + 'FreeCreateProcessError' : [ 0x30, ['unsigned long long']], + 'FreeDeleteProcess' : [ 0x38, ['unsigned long long']], + 'FreeCleanProcess' : [ 0x40, ['unsigned long long']], + 'FreeCleanProcessError' : [ 0x48, ['unsigned long long']], + 'AllocateAddProcessWsMetaPage' : [ 0x50, ['unsigned long long']], + 'AllocateWsIncrease' : [ 0x58, ['unsigned long long']], + 'FreeWsIncreaseError' : [ 0x60, ['unsigned long long']], + 'FreeWsIncreaseErrorMax' : [ 0x68, ['unsigned long long']], + 'FreeWsDecrease' : [ 0x70, ['unsigned long long']], + 'AllocateWorkingSetPage' : [ 0x78, ['unsigned long long']], + 'FreeWorkingSetPageError' : [ 0x80, ['unsigned long long']], + 'FreeDeletePteRange' : [ 0x88, ['unsigned long long']], + 'AllocatePageTablesForProcessMetadata' : [ 0x90, ['unsigned long long']], + 'FreePageTablesForProcessMetadataError2' : [ 0x98, ['unsigned long long']], + 'AllocatePageTablesForSystem' : [ 0xa0, ['unsigned long long']], + 'FreePageTablesExcess' : [ 0xa8, ['unsigned long long']], + 'FreeSystemVaPageTables' : [ 0xb0, ['unsigned long long']], + 'FreeSessionVaPageTables' : [ 0xb8, ['unsigned long long']], + 'AllocateCreateSession' : [ 0xc0, ['unsigned long long']], + 'FreeSessionWsDereference' : [ 0xc8, ['unsigned long long']], + 'FreeSessionDereference' : [ 0xd0, ['unsigned long long']], + 'AllocateLockedSessionImage' : [ 0xd8, ['unsigned long long']], + 'FreeLockedSessionImage' : [ 0xe0, ['unsigned long long']], + 'FreeSessionImageConversion' : [ 0xe8, ['unsigned long long']], + 'AllocateWsAdjustPageTable' : [ 0xf0, ['unsigned long long']], + 'FreeWsAdjustPageTable' : [ 0xf8, ['unsigned long long']], + 'FreeWsAdjustPageTableError' : [ 0x100, ['unsigned long long']], + 'AllocateNoLowMemory' : [ 0x108, ['unsigned long long']], + 'AllocatePagedPoolLockedDown' : [ 0x110, ['unsigned long long']], + 'FreePagedPoolLockedDown' : [ 0x118, ['unsigned long long']], + 'AllocateSystemBitmaps' : [ 0x120, ['unsigned long long']], + 'FreeSystemBitmapsError' : [ 0x128, ['unsigned long long']], + 'AllocateForMdl' : [ 0x130, ['unsigned long long']], + 'FreeFromMdl' : [ 0x138, ['unsigned long long']], + 'AllocateForMdlPartition' : [ 0x140, ['unsigned long long']], + 'FreeFromMdlPartition' : [ 0x148, ['unsigned long long']], + 'FreeMdlExcess' : [ 0x150, ['unsigned long long']], + 'AllocateExpansionNonPagedPool' : [ 0x158, ['unsigned long long']], + 'FreeExpansionNonPagedPool' : [ 0x160, ['unsigned long long']], + 'AllocateVad' : [ 0x168, ['unsigned long long']], + 'RemoveVad' : [ 0x170, ['unsigned long long']], + 'FreeVad' : [ 0x178, ['unsigned long long']], + 'AllocateContiguous' : [ 0x180, ['unsigned long long']], + 'FreeContiguousPages' : [ 0x188, ['unsigned long long']], + 'FreeContiguousError' : [ 0x190, ['unsigned long long']], + 'FreeLargePageMemory' : [ 0x198, ['unsigned long long']], + 'AllocateSystemWsles' : [ 0x1a0, ['unsigned long long']], + 'FreeSystemWsles' : [ 0x1a8, ['unsigned long long']], + 'AllocateSystemInitWs' : [ 0x1b0, ['unsigned long long']], + 'AllocateSessionInitWs' : [ 0x1b8, ['unsigned long long']], + 'FreeSessionInitWsError' : [ 0x1c0, ['unsigned long long']], + 'AllocateSystemImage' : [ 0x1c8, ['unsigned long long']], + 'AllocateSystemImageLoad' : [ 0x1d0, ['unsigned long long']], + 'AllocateSessionSharedImage' : [ 0x1d8, ['unsigned long long']], + 'FreeSystemImageInitCode' : [ 0x1e0, ['unsigned long long']], + 'FreeSystemImageLargePageConversion' : [ 0x1e8, ['unsigned long long']], + 'FreeSystemImageError' : [ 0x1f0, ['unsigned long long']], + 'FreeSystemImageLoadExcess' : [ 0x1f8, ['unsigned long long']], + 'FreeUnloadSystemImage' : [ 0x200, ['unsigned long long']], + 'FreeReloadBootImageLarge' : [ 0x208, ['unsigned long long']], + 'FreeIndependent' : [ 0x210, ['unsigned long long']], + 'AllocateHotRemove' : [ 0x218, ['unsigned long long']], + 'FreeHotAdd' : [ 0x220, ['unsigned long long']], + 'AllocateBoot' : [ 0x228, ['unsigned long long']], + 'FreeLoaderBlock' : [ 0x230, ['unsigned long long']], + 'AllocateNonPagedSpecialPool' : [ 0x238, ['unsigned long long']], + 'FreeNonPagedSpecialPoolError' : [ 0x240, ['unsigned long long']], + 'FreeNonPagedSpecialPool' : [ 0x248, ['unsigned long long']], + 'AllocateSharedSegmentPage' : [ 0x250, ['unsigned long long']], + 'FreeSharedSegmentPage' : [ 0x258, ['unsigned long long']], + 'AllocateZeroPage' : [ 0x260, ['unsigned long long']], + 'FreeZeroPage' : [ 0x268, ['unsigned long long']], + 'AllocateForPo' : [ 0x270, ['unsigned long long']], + 'AllocateForPoForce' : [ 0x278, ['unsigned long long']], + 'FreeForPo' : [ 0x280, ['unsigned long long']], + 'AllocateThreadHardFaultBehavior' : [ 0x288, ['unsigned long long']], + 'FreeThreadHardFaultBehavior' : [ 0x290, ['unsigned long long']], + 'ObtainFaultCharges' : [ 0x298, ['unsigned long long']], + 'FreeFaultCharges' : [ 0x2a0, ['unsigned long long']], + 'AllocateStoreCharges' : [ 0x2a8, ['unsigned long long']], + 'FreeStoreCharges' : [ 0x2b0, ['unsigned long long']], + 'ObtainLockedPageCharge' : [ 0x2c0, ['unsigned long long']], + 'FreeLockedPageCharge' : [ 0x300, ['unsigned long long']], + 'AllocateStore' : [ 0x308, ['unsigned long long']], + 'FreeStore' : [ 0x310, ['unsigned long long']], + 'AllocateSystemImageProtos' : [ 0x318, ['unsigned long long']], + 'FreeSystemImageProtos' : [ 0x320, ['unsigned long long']], + 'AllocateModWriterCharge' : [ 0x328, ['unsigned long long']], + 'FreeModWriterCharge' : [ 0x330, ['unsigned long long']], + 'AllocateMappedWriterCharge' : [ 0x338, ['unsigned long long']], + 'FreeMappedWriterCharge' : [ 0x340, ['unsigned long long']], + 'AllocateRegistryCharges' : [ 0x348, ['unsigned long long']], + 'FreeRegistryCharges' : [ 0x350, ['unsigned long long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'CompactionMask' : [ 0x8, ['unsigned long long']], + 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x28, { + 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x8, ['long']], + 'RecursionCount' : [ 0xc, ['long']], + 'OwningThread' : [ 0x10, ['pointer64', ['void']]], + 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], + 'SpinCount' : [ 0x20, ['unsigned long long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'Context' : [ 0x18, ['pointer64', ['void']]], + 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x24, ['unsigned long']], + 'Status' : [ 0x28, ['long']], + 'Information' : [ 0x30, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x38, ['long']], +} ], + '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x10, { + 'Table' : [ 0x0, ['_RTL_AVL_TREE']], + 'Lock' : [ 0x8, ['long']], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x8, ['unsigned long long']], + 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '_KTSS64' : [ 0x68, { + 'Reserved0' : [ 0x0, ['unsigned long']], + 'Rsp0' : [ 0x4, ['unsigned long long']], + 'Rsp1' : [ 0xc, ['unsigned long long']], + 'Rsp2' : [ 0x14, ['unsigned long long']], + 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], + 'Reserved1' : [ 0x5c, ['unsigned long long']], + 'Reserved2' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], +} ], + '__unnamed_24ce' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d0' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d2' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_24d4' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_24ce']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_24d0']], + 'Raw' : [ 0x0, ['__unnamed_24d2']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'Operation' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0xc, ['__unnamed_24d4']], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '_MI_SYSTEM_NODE_INFORMATION' : [ 0x1a0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x10, ['array', 3, ['_SLIST_HEADER']]], + 'NonPagedPoolSListHeadNx' : [ 0x40, ['array', 3, ['_SLIST_HEADER']]], + 'CachedKernelStacks' : [ 0x70, ['array', 2, ['_CACHED_KSTACK_LIST']]], + 'NonPagedBitMapMaximum' : [ 0xb0, ['unsigned long long']], + 'DynamicBitMapNonPagedPool' : [ 0xb8, ['_MI_DYNAMIC_BITMAP']], + 'NonPagedPoolLowestPage' : [ 0x108, ['unsigned long long']], + 'NonPagedPoolHighestPage' : [ 0x110, ['unsigned long long']], + 'AllocatedNonPagedPool' : [ 0x118, ['unsigned long long']], + 'PartialLargePoolRegions' : [ 0x120, ['unsigned long long']], + 'PagesInPartialLargePoolRegions' : [ 0x128, ['unsigned long long']], + 'CachedNonPagedPoolCount' : [ 0x130, ['unsigned long long']], + 'NonPagedPoolSpinLock' : [ 0x138, ['unsigned long long']], + 'CachedNonPagedPool' : [ 0x140, ['pointer64', ['_MMPFN']]], + 'NonPagedPoolFirstVa' : [ 0x148, ['pointer64', ['void']]], + 'NonPagedPoolLastVa' : [ 0x150, ['pointer64', ['void']]], + 'NonPagedBitMap' : [ 0x158, ['array', 3, ['_RTL_BITMAP_EX']]], + 'NonPagedHint' : [ 0x188, ['array', 2, ['unsigned long long']]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x10, { + 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 63, native_type='unsigned long long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'LockState' : [ 0x0, ['pointer64', ['void']]], + 'SessionState' : [ 0x8, ['pointer64', ['void']]], + 'SessionId' : [ 0x8, ['unsigned long']], + 'SessionPad' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_24e4' : [ 0x4, { + 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], + 'Long' : [ 0x0, ['long']], +} ], + '_MI_PARTITION_STORES' : [ 0x80, { + 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_24e4']], + 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], + 'Registered' : [ 0x8, ['unsigned long']], + 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], + 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], + 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], + 'WriteIssueFailures' : [ 0x18, ['unsigned long']], + 'EvictionThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'EvictEvent' : [ 0x28, ['_KEVENT']], + 'EvictFlushCompleteEvent' : [ 0x40, ['_KEVENT']], + 'WriteSupportSListHead' : [ 0x60, ['_SLIST_HEADER']], + 'EvictFlushLock' : [ 0x70, ['long']], + 'ModifiedWriteFailedBitmap' : [ 0x78, ['pointer64', ['_RTL_BITMAP']]], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x48, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x10, ['unsigned long']], + 'SyncCallback' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x14, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], + 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], + 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], + 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], + 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x8, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0x18, ['unsigned short']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_MI_SUB64K_FREE_RANGES' : [ 0x30, { + 'BitMap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Vad' : [ 0x20, ['pointer64', ['_MMVAD_SHORT']]], + 'SubListIndex' : [ 0x28, ['unsigned short']], + 'Hint' : [ 0x2a, ['unsigned short']], + 'SetBits' : [ 0x2c, ['unsigned long']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x40, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'LastTotalAllocates' : [ 0x24, ['unsigned long']], + 'LastAllocateMisses' : [ 0x28, ['unsigned long']], + 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], +} ], + '_KTIMER' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], + 'Processor' : [ 0x38, ['unsigned long']], + 'Period' : [ 0x3c, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0x10, ['pointer64', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'NumberOfBuckets' : [ 0x1c, ['unsigned long']], + 'Buckets' : [ 0x20, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '__unnamed_2522' : [ 0x18, { + 'RequestedTime' : [ 0x0, ['unsigned long long']], + 'ProgrammedTime' : [ 0x8, ['unsigned long long']], + 'TimerInfo' : [ 0x10, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0x110, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x48, ['unsigned long long']], + 'SleepTime' : [ 0x50, ['unsigned long long']], + 'WakeFirstUnattendedTime' : [ 0x58, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x68, ['array', 3, ['__unnamed_2522']]], + 'WakeAlarmPaused' : [ 0xb0, ['unsigned char']], + 'WakeAlarmLastTime' : [ 0xb8, ['unsigned long long']], + 'FilteredCapabilities' : [ 0xc0, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_CM_KEY_HASH' : [ 0x20, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_KAPC_STATE' : [ 0x30, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x28, ['unsigned char']], + 'KernelApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x29, ['unsigned char']], + 'UserApcPending' : [ 0x2a, ['unsigned char']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x38, ['unsigned char']], + 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x48, ['pointer64', ['unsigned short']]], + 'DriverName' : [ 0x50, ['pointer64', ['unsigned short']]], + 'ChildCount' : [ 0x58, ['unsigned long']], + 'ActiveChild' : [ 0x5c, ['unsigned long']], + 'ParentCount' : [ 0x60, ['unsigned long']], + 'ActiveParent' : [ 0x64, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { + 'PageHashes' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0xe0, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], + 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], + 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], + 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], + 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], + 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], + 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], + 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], + 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], + 'MdlRead' : [ 0x80, ['pointer64', ['void']]], + 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], + 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], + 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], + 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], + 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], + 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], + 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], + 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], + 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], + 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KIDTENTRY64' : [ 0x10, { + 'OffsetLow' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'OffsetMiddle' : [ 0x6, ['unsigned short']], + 'OffsetHigh' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x10, ['unsigned char']], + 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], + 'State' : [ 0x68, ['unsigned char']], + 'ResourcesChanged' : [ 0x69, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x28, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Group' : [ 0x10, ['pointer64', ['void']]], + 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], + 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer64', ['_MMPTE']]], +} ], + '_PPM_SELECTION_MENU_ENTRY' : [ 0x18, { + 'StrictDependency' : [ 0x0, ['unsigned char']], + 'InitiatingState' : [ 0x1, ['unsigned char']], + 'DependentState' : [ 0x2, ['unsigned char']], + 'StateIndex' : [ 0x4, ['unsigned long']], + 'Dependencies' : [ 0x8, ['unsigned long']], + 'DependencyList' : [ 0x10, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x28, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x8, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0x18, ['_RTL_BITMAP']], + 'EvictedBitmap' : [ 0x18, ['_RTL_BITMAP']], +} ], + '_KQUEUE' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x28, ['unsigned long']], + 'MaximumCount' : [ 0x2c, ['unsigned long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], +} ], + '_MI_COMBINE_WORKITEM' : [ 0x28, { + 'NextEntry' : [ 0x0, ['pointer64', ['void']]], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x410, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], + 'ConsoleFlags' : [ 0x18, ['unsigned long']], + 'StandardInput' : [ 0x20, ['pointer64', ['void']]], + 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], + 'StandardError' : [ 0x30, ['pointer64', ['void']]], + 'CurrentDirectory' : [ 0x38, ['_CURDIR']], + 'DllPath' : [ 0x50, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], + 'Environment' : [ 0x80, ['pointer64', ['void']]], + 'StartingX' : [ 0x88, ['unsigned long']], + 'StartingY' : [ 0x8c, ['unsigned long']], + 'CountX' : [ 0x90, ['unsigned long']], + 'CountY' : [ 0x94, ['unsigned long']], + 'CountCharsX' : [ 0x98, ['unsigned long']], + 'CountCharsY' : [ 0x9c, ['unsigned long']], + 'FillAttribute' : [ 0xa0, ['unsigned long']], + 'WindowFlags' : [ 0xa4, ['unsigned long']], + 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], + 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], + 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], + 'PackageDependencyData' : [ 0x400, ['pointer64', ['void']]], + 'ProcessGroupId' : [ 0x408, ['unsigned long']], + 'LoaderThreads' : [ 0x40c, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x10, { + 'BasePage' : [ 0x0, ['unsigned long long']], + 'PageCount' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_SRWLOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x20, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], + 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], + 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer64', ['void']]], + 'Owner' : [ 0x18, ['pointer64', ['void']]], + 'Attributes' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], +} ], + '_LOCK_HEADER' : [ 0x20, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x8, ['unsigned long long']], + 'Lock' : [ 0x10, ['unsigned long long']], + 'Valid' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MMSECTION_FLAGS2' : [ 0x4, { + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'NumberOfChildViews' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_KSPECIAL_REGISTERS' : [ 0xe0, { + 'Cr0' : [ 0x0, ['unsigned long long']], + 'Cr2' : [ 0x8, ['unsigned long long']], + 'Cr3' : [ 0x10, ['unsigned long long']], + 'Cr4' : [ 0x18, ['unsigned long long']], + 'KernelDr0' : [ 0x20, ['unsigned long long']], + 'KernelDr1' : [ 0x28, ['unsigned long long']], + 'KernelDr2' : [ 0x30, ['unsigned long long']], + 'KernelDr3' : [ 0x38, ['unsigned long long']], + 'KernelDr6' : [ 0x40, ['unsigned long long']], + 'KernelDr7' : [ 0x48, ['unsigned long long']], + 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], + 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], + 'Tr' : [ 0x70, ['unsigned short']], + 'Ldtr' : [ 0x72, ['unsigned short']], + 'MxCsr' : [ 0x74, ['unsigned long']], + 'DebugControl' : [ 0x78, ['unsigned long long']], + 'LastBranchToRip' : [ 0x80, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], + 'Cr8' : [ 0xa0, ['unsigned long long']], + 'MsrGsBase' : [ 0xa8, ['unsigned long long']], + 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], + 'MsrStar' : [ 0xb8, ['unsigned long long']], + 'MsrLStar' : [ 0xc0, ['unsigned long long']], + 'MsrCStar' : [ 0xc8, ['unsigned long long']], + 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], + 'Xcr0' : [ 0xd8, ['unsigned long long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_PEB64' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['unsigned long long']], + 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], + 'Ldr' : [ 0x18, ['unsigned long long']], + 'ProcessParameters' : [ 0x20, ['unsigned long long']], + 'SubSystemData' : [ 0x28, ['unsigned long long']], + 'ProcessHeap' : [ 0x30, ['unsigned long long']], + 'FastPebLock' : [ 0x38, ['unsigned long long']], + 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], + 'IFEOKey' : [ 0x48, ['unsigned long long']], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], + 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['unsigned long long']], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['unsigned long long']], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], + 'SparePvoid0' : [ 0x90, ['unsigned long long']], + 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], + 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], + 'OemCodePageData' : [ 0xa8, ['unsigned long long']], + 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], + 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], + 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['unsigned long long']], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], + 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['unsigned long long']], + 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], + 'CSDVersion' : [ 0x2e8, ['_STRING64']], + 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], + 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], + 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], + 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['unsigned long long']], + 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], + 'FlsBitmap' : [ 0x338, ['unsigned long long']], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['unsigned long long']], + 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], + 'pUnused' : [ 0x368, ['unsigned long long']], + 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['LIST_ENTRY64']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['unsigned long long']]], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_MSUBSECTION' : [ 0x70, { + 'Core' : [ 0x0, ['_SUBSECTION']], + 'SubsectionNode' : [ 0x38, ['_RTL_BALANCED_NODE']], + 'DereferenceList' : [ 0x50, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x60, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x68, ['unsigned long']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { + 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x10, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x8, ['unsigned long long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], + 'ZeroInit1' : [ 0x8, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x80, { + 'Address' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '__unnamed_25ee' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x1f40, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_25ee']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long long']], + 'NonPagablePages' : [ 0x28, ['unsigned long long']], + 'CommittedPages' : [ 0x30, ['unsigned long long']], + 'PagedPoolStart' : [ 0x38, ['pointer64', ['void']]], + 'PagedPoolEnd' : [ 0x40, ['pointer64', ['void']]], + 'SessionObject' : [ 0x48, ['pointer64', ['void']]], + 'SessionObjectHandle' : [ 0x50, ['pointer64', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x58, ['array', 4, ['unsigned long']]], + 'ImageTree' : [ 0x68, ['_RTL_AVL_TREE']], + 'LocaleId' : [ 0x70, ['unsigned long']], + 'AttachCount' : [ 0x74, ['unsigned long']], + 'AttachGate' : [ 0x78, ['_KGATE']], + 'WsListEntry' : [ 0x90, ['_LIST_ENTRY']], + 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xb40, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xb60, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xb98, ['_MMSUPPORT']], + 'Wsle' : [ 0xc90, ['pointer64', ['_MMWSLE']]], + 'DriverUnload' : [ 0xc98, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xcc0, ['_POOL_DESCRIPTOR']], + 'PageDirectory' : [ 0x1e00, ['_MMPTE']], + 'SessionVaLock' : [ 0x1e08, ['_EX_PUSH_LOCK']], + 'DynamicVaBitMap' : [ 0x1e10, ['_RTL_BITMAP']], + 'DynamicVaHint' : [ 0x1e20, ['unsigned long']], + 'SpecialPool' : [ 0x1e28, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1e78, ['_EX_PUSH_LOCK']], + 'PoolBigEntriesInUse' : [ 0x1e80, ['long']], + 'PagedPoolPdeCount' : [ 0x1e84, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1e88, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1e8c, ['unsigned long']], + 'SystemPteInfo' : [ 0x1e90, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1ef0, ['pointer64', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1ef8, ['unsigned long long']], + 'PoolTrackBigPages' : [ 0x1f00, ['pointer64', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1f08, ['unsigned long long']], + 'IoState' : [ 0x1f10, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1f14, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1f18, ['_KEVENT']], + 'ServerSilo' : [ 0x1f30, ['pointer64', ['_EJOB']]], + 'CreateTime' : [ 0x1f38, ['unsigned long long']], +} ], + '_MMPAGE_FILE_EXPANSION' : [ 0x60, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'DereferenceList' : [ 0x8, ['_LIST_ENTRY']], + 'Partition' : [ 0x18, ['pointer64', ['_MI_PARTITION']]], + 'RequestedExpansionSize' : [ 0x20, ['unsigned long long']], + 'ActualExpansion' : [ 0x28, ['unsigned long long']], + 'Event' : [ 0x30, ['_KEVENT']], + 'InProgress' : [ 0x48, ['long']], + 'u' : [ 0x4c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], + 'ActiveEntry' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'AttemptForCantExtend' : [ 0x58, ['unsigned char']], + 'PageFileContract' : [ 0x59, ['unsigned char']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '__unnamed_25ff' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_2603' : [ 0x8, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x88, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x40, ['__unnamed_25ff']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], + 'u4' : [ 0x78, ['__unnamed_2603']], + 'FileObject' : [ 0x80, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x20, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x8, ['long long']], + 'SidCount' : [ 0x10, ['unsigned long']], + 'SidValuesStart' : [ 0x18, ['unsigned long long']], +} ], + '_MI_PARTITION_STATE' : [ 0x60, { + 'PartitionLock' : [ 0x0, ['unsigned long long']], + 'PartitionIdLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'InitialPartitionIdBits' : [ 0x10, ['unsigned long long']], + 'PartitionList' : [ 0x18, ['_LIST_ENTRY']], + 'PartitionIdBitmap' : [ 0x28, ['pointer64', ['_RTL_BITMAP']]], + 'InitialPartitionIdBitmap' : [ 0x30, ['_RTL_BITMAP']], + 'TempPartitionPointers' : [ 0x40, ['array', 1, ['pointer64', ['_MI_PARTITION']]]], + 'Partition' : [ 0x48, ['pointer64', ['pointer64', ['_MI_PARTITION']]]], + 'TotalPagesInChildPartitions' : [ 0x50, ['unsigned long long']], + 'CrossPartitionDenials' : [ 0x58, ['unsigned long']], +} ], + '_MMMOD_WRITER_LISTHEAD' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Gate' : [ 0x10, ['_KGATE']], + 'Event' : [ 0x10, ['_KEVENT']], +} ], + '_CM_RM' : [ 0x88, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x20, ['pointer64', ['void']]], + 'Tm' : [ 0x28, ['pointer64', ['void']]], + 'RmHandle' : [ 0x30, ['pointer64', ['void']]], + 'KtmRm' : [ 0x38, ['pointer64', ['void']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'ContainerNum' : [ 0x44, ['unsigned long']], + 'ContainerSize' : [ 0x48, ['unsigned long long']], + 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], + 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], + 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], + 'RmFlags' : [ 0x68, ['unsigned long']], + 'LogStartStatus1' : [ 0x6c, ['long']], + 'LogStartStatus2' : [ 0x70, ['long']], + 'BaseLsn' : [ 0x78, ['unsigned long long']], + 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0xa0, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer64', ['_IRP']]], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x20, ['unsigned char']], + 'IrpOplocksR' : [ 0x28, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x38, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x48, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x58, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x68, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x78, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x88, ['pointer64', ['_GUID']]], + 'OplockState' : [ 0x90, ['unsigned long']], + 'FastMutex' : [ 0x98, ['pointer64', ['_FAST_MUTEX']]], +} ], + '_MI_LARGEPAGE_MEMORY_INFO' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ColoredPageInfoBase' : [ 0x10, ['pointer64', ['_COLORED_PAGE_INFO']]], + 'PagesNeedZeroing' : [ 0x18, ['unsigned long']], + 'LargeImageBias' : [ 0x1c, ['unsigned char']], + 'Spare' : [ 0x1d, ['array', 3, ['unsigned char']]], + 'ActualImageViewSize' : [ 0x20, ['unsigned long long']], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { + 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PROCESS_ENERGY_VALUES' : [ 0x90, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'DiskEnergy' : [ 0x40, ['unsigned long long']], + 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], + 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], + 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], + 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], + 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'WindowInformation' : [ 0x68, ['unsigned long']], + 'PixelArea' : [ 0x6c, ['unsigned long']], + 'PixelReportTimestamp' : [ 0x70, ['long long']], + 'PixelTime' : [ 0x78, ['unsigned long long']], + 'ForegroundReportTimestamp' : [ 0x80, ['long long']], + 'ForegroundTime' : [ 0x88, ['unsigned long long']], +} ], + '_CLIENT_ID' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], + 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_MI_COMMON_PAGE_STATE' : [ 0x98, { + 'PageOfOnesPfn' : [ 0x0, ['pointer64', ['_MMPFN']]], + 'PageOfOnes' : [ 0x8, ['unsigned long long']], + 'DummyPagePfn' : [ 0x10, ['pointer64', ['_MMPFN']]], + 'DummyPage' : [ 0x18, ['unsigned long long']], + 'PageOfZeroes' : [ 0x20, ['unsigned long long']], + 'ZeroMapping' : [ 0x28, ['pointer64', ['void']]], + 'OnesMapping' : [ 0x30, ['pointer64', ['void']]], + 'BitmapGapFrames' : [ 0x38, ['array', 4, ['unsigned long long']]], + 'PfnGapFrames' : [ 0x58, ['array', 4, ['unsigned long long']]], + 'PageTableOfZeroes' : [ 0x78, ['unsigned long long']], + 'PdeOfZeroes' : [ 0x80, ['_MMPTE']], + 'PageTableOfOnes' : [ 0x88, ['unsigned long long']], + 'PdeOfOnes' : [ 0x90, ['_MMPTE']], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], + 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], + 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], + 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_MMPFNLIST_SHORT' : [ 0x18, { + 'Total' : [ 0x0, ['unsigned long long']], + 'Flink' : [ 0x8, ['unsigned long long']], + 'Blink' : [ 0x10, ['unsigned long long']], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0x10, ['pointer64', ['void']]], + 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], + 'ServerIsRemote' : [ 0x1a, ['unsigned char']], + 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], +} ], + '_MI_VAD_ALLOCATION_CELL' : [ 0x28, { + 'AllocationBitMap' : [ 0x0, ['_RTL_BITMAP']], + 'BitMapHint' : [ 0x10, ['unsigned long']], + 'LastAllocationSize' : [ 0x14, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0x18, ['unsigned long']], + 'LowestBottomUpVadBit' : [ 0x1c, ['unsigned long']], + 'LowestBottomUpAllocationAddress' : [ 0x20, ['pointer64', ['void']]], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x28, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x10, ['pointer64', ['void']]], + 'SessionViewVa' : [ 0x10, ['pointer64', ['void']]], + 'VadsProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'Type' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionType' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SectionOffset' : [ 0x20, ['unsigned long long']], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x18, { + 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x10, ['unsigned long']], + 'FullCreateOptions' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_2647' : [ 0x38, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x30, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x78, { + 'Status' : [ 0x0, ['long']], + 'PartitionId' : [ 0x4, ['unsigned short']], + 'Priority' : [ 0x6, ['unsigned char']], + 'IrpPriority' : [ 0x7, ['unsigned char']], + 'ReservationWrite' : [ 0x8, ['unsigned char']], + 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x18, ['unsigned long long']], + 'ModifiedPagesTotal' : [ 0x20, ['unsigned long long']], + 'ModifiedPagefilePages' : [ 0x28, ['unsigned long long']], + 'ModifiedNoWritePages' : [ 0x30, ['unsigned long long']], + 'ModifiedPagefileNoReservationPages' : [ 0x38, ['unsigned long long']], + 'MdlHack' : [ 0x40, ['__unnamed_2647']], +} ], + '_PROC_PERF_DOMAIN' : [ 0x190, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], + 'Members' : [ 0x18, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0xc0, ['unsigned long']], + 'Class' : [ 0xc4, ['unsigned char']], + 'Spare' : [ 0xc5, ['array', 3, ['unsigned char']]], + 'Processors' : [ 0xc8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0xd0, ['pointer64', ['void']]], + 'TimeWindowHandler' : [ 0xd8, ['pointer64', ['void']]], + 'BoostPolicyHandler' : [ 0xe0, ['pointer64', ['void']]], + 'BoostModeHandler' : [ 0xe8, ['pointer64', ['void']]], + 'EnergyPerfPreferenceHandler' : [ 0xf0, ['pointer64', ['void']]], + 'AutonomousActivityWindowHandler' : [ 0xf8, ['pointer64', ['void']]], + 'AutonomousModeHandler' : [ 0x100, ['pointer64', ['void']]], + 'ReinitializeHandler' : [ 0x108, ['pointer64', ['void']]], + 'PerfSelectionHandler' : [ 0x110, ['pointer64', ['void']]], + 'PerfControlHandler' : [ 0x118, ['pointer64', ['void']]], + 'MaxFrequency' : [ 0x120, ['unsigned long']], + 'NominalFrequency' : [ 0x124, ['unsigned long']], + 'MaxPercent' : [ 0x128, ['unsigned long']], + 'MinPerfPercent' : [ 0x12c, ['unsigned long']], + 'MinThrottlePercent' : [ 0x130, ['unsigned long']], + 'MinimumRelativePerformance' : [ 0x138, ['unsigned long long']], + 'NominalRelativePerformance' : [ 0x140, ['unsigned long long']], + 'Coordination' : [ 0x148, ['unsigned char']], + 'HardPlatformCap' : [ 0x149, ['unsigned char']], + 'AffinitizeControl' : [ 0x14a, ['unsigned char']], + 'EfficientThrottle' : [ 0x14b, ['unsigned char']], + 'AutonomousMode' : [ 0x14c, ['unsigned char']], + 'SelectedPercent' : [ 0x150, ['unsigned long']], + 'SelectedFrequency' : [ 0x154, ['unsigned long']], + 'DesiredPercent' : [ 0x158, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x15c, ['unsigned long']], + 'MinPolicyPercent' : [ 0x160, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x164, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x168, ['unsigned long']], + 'GuaranteedPercent' : [ 0x16c, ['unsigned long']], + 'TolerancePercent' : [ 0x170, ['unsigned long']], + 'SelectedState' : [ 0x178, ['unsigned long long']], + 'PerfChangeTime' : [ 0x180, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0x188, ['unsigned long']], + 'Force' : [ 0x18c, ['unsigned char']], + 'ProvideGuidance' : [ 0x18d, ['unsigned char']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_TABLE' : [ 0x800, { + 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Type' : [ 0x18, ['unsigned long']], + 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0x110, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], +} ], + '_TRIAGE_9F_PNP' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'CompletionQueue' : [ 0x8, ['pointer64', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], + 'DelayedWorkQueue' : [ 0x10, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_RELATION_LIST' : [ 0x10, { + 'DeviceObjectList' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT_LIST']]], + 'Sorted' : [ 0x8, ['unsigned char']], +} ], + '_IO_TIMER' : [ 0x30, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x8, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_MI_STANDBY_STATE' : [ 0xc0, { + 'TransitionSharedPages' : [ 0x0, ['unsigned long long']], + 'TransitionSharedPagesPeak' : [ 0x8, ['array', 3, ['unsigned long long']]], + 'FirstDecayPage' : [ 0x20, ['unsigned long long']], + 'PfnDecayFreeSList' : [ 0x30, ['_SLIST_HEADER']], + 'PfnRepurposeLog' : [ 0x40, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'AllocatePfnRepurposeDpc' : [ 0x48, ['_KDPC']], +} ], + '_MI_ACCESS_LOG_STATE' : [ 0x80, { + 'CcAccessLog' : [ 0x0, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'Enabled' : [ 0x8, ['unsigned long']], + 'DisableAccessLogging' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'MinLoggingPriority' : [ 0x30, ['unsigned long']], + 'AccessLoggingLock' : [ 0x40, ['unsigned long long']], +} ], + '_ETW_BUFFER_QUEUE' : [ 0x18, { + 'QueueHead' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueTail' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x10, ['_SINGLE_LIST_ENTRY']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0x40, ['_RTL_BITMAP']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x8, { + 'LogHandleContext' : [ 0x0, ['pointer64', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], + 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x18, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'DeviceState' : [ 0x10, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '__unnamed_2691' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHigh' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_2695' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_KGDTENTRY64' : [ 0x10, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'Bytes' : [ 0x4, ['__unnamed_2691']], + 'Bits' : [ 0x4, ['__unnamed_2695']], + 'BaseUpper' : [ 0x8, ['unsigned long']], + 'MustBeZero' : [ 0xc, ['unsigned long']], + 'DataLow' : [ 0x0, ['long long']], + 'DataHigh' : [ 0x8, ['long long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], + 'Lock' : [ 0x40, ['_FAST_MUTEX']], + 'List' : [ 0x78, ['_LIST_ENTRY']], +} ], + '_IOV_IRP_TRACE' : [ 0x80, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x10, ['short']], + 'SpecialApcDisable' : [ 0x12, ['short']], + 'CombinedApcDisable' : [ 0x10, ['unsigned long']], + 'Irql' : [ 0x14, ['unsigned char']], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x20, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], +} ], + '_DYNAMIC_FUNCTION_TABLE' : [ 0x58, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FunctionTable' : [ 0x10, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'TimeStamp' : [ 0x18, ['_LARGE_INTEGER']], + 'MinimumAddress' : [ 0x20, ['unsigned long long']], + 'MaximumAddress' : [ 0x28, ['unsigned long long']], + 'BaseAddress' : [ 0x30, ['unsigned long long']], + 'Callback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'OutOfProcessCallbackDll' : [ 0x48, ['pointer64', ['unsigned short']]], + 'Type' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'RF_SORTED', 1: 'RF_UNSORTED', 2: 'RF_CALLBACK', 3: 'RF_KERNEL_DYNAMIC'})]], + 'EntryCount' : [ 0x54, ['unsigned long']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x8, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_PROC_IDLE_POLICY' : [ 0x6, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], + 'ForceLightIdle' : [ 0x5, ['unsigned char']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_26b7' : [ 0x4, { + 'PercentLevel' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_26b9' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0x10, ['__unnamed_26b7']], + 'Button' : [ 0x10, ['__unnamed_26b9']], +} ], + '_KDPC_DATA' : [ 0x28, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x10, ['unsigned long long']], + 'DpcQueueDepth' : [ 0x18, ['long']], + 'DpcCount' : [ 0x1c, ['unsigned long']], + 'ActiveDpc' : [ 0x20, ['pointer64', ['_KDPC']]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_KSCB' : [ 0x198, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], + 'RankCycleTarget' : [ 0x18, ['unsigned long long']], + 'LongTermCycles' : [ 0x20, ['unsigned long long']], + 'LastReportedCycles' : [ 0x28, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], + 'ReadyTime' : [ 0x38, ['unsigned long long']], + 'InsertTime' : [ 0x40, ['unsigned long long']], + 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x58, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x70, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'MaxOverQuota' : [ 0x70, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'MinOverQuota' : [ 0x70, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x70, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SoftCap' : [ 0x70, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Spare1' : [ 0x70, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Depth' : [ 0x71, ['unsigned char']], + 'ReadySummary' : [ 0x72, ['unsigned short']], + 'Rank' : [ 0x74, ['unsigned long']], + 'ReadyListHead' : [ 0x78, ['array', 16, ['_LIST_ENTRY']]], + 'ChildScbQueue' : [ 0x178, ['_RTL_RB_TREE']], + 'Parent' : [ 0x188, ['pointer64', ['_KSCB']]], + 'Root' : [ 0x190, ['pointer64', ['_KSCB']]], +} ], + '__unnamed_26c8' : [ 0x10, { + 'UserData' : [ 0x0, ['pointer64', ['void']]], + 'Owner' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_26c9' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_26c8']], + 'Merged' : [ 0x10, ['__unnamed_26c9']], + 'Attributes' : [ 0x20, ['unsigned char']], + 'PublicFlags' : [ 0x21, ['unsigned char']], + 'PrivateFlags' : [ 0x22, ['unsigned short']], + 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'UtilityTotal' : [ 0x8, ['unsigned long']], + 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], + 'FrequencyTotal' : [ 0x10, ['unsigned long']], + 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], + 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_MI_PARTITION_ZEROING' : [ 0x68, { + 'PageEvent' : [ 0x0, ['_KEVENT']], + 'ThreadActive' : [ 0x18, ['unsigned char']], + 'ZeroFreePageSlistMinimum' : [ 0x1c, ['long']], + 'FirstReservedZeroingPte' : [ 0x20, ['pointer64', ['_MMPTE']]], + 'RebalanceZeroFreeWorkItem' : [ 0x28, ['_WORK_QUEUE_ITEM']], + 'ThreadCount' : [ 0x48, ['long']], + 'Gate' : [ 0x50, ['_KGATE']], +} ], + '_IMAGE_RUNTIME_FUNCTION_ENTRY' : [ 0xc, { + 'BeginAddress' : [ 0x0, ['unsigned long']], + 'EndAddress' : [ 0x4, ['unsigned long']], + 'UnwindInfoAddress' : [ 0x8, ['unsigned long']], + 'UnwindData' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_26d8' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_26d8']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { + 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], + 'StackId' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Processors' : [ 0x8, ['unsigned long']], + 'ActiveProcessors' : [ 0xc, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x20, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0x18, ['unsigned long long']], +} ], + '__unnamed_26f0' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_26f2' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_26f0']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x110, { + 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x8, ['pointer64', ['void']]], + 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], + 'u1' : [ 0x20, ['__unnamed_26f2']], + 'Signature' : [ 0x28, ['unsigned long long']], + 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], + 'PagedBytes' : [ 0x60, ['unsigned long long']], + 'NonPagedBytes' : [ 0x68, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], + 'RaiseIrqls' : [ 0x80, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], + 'AllocationsFailed' : [ 0x90, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], + 'LockedBytes' : [ 0x98, ['unsigned long long']], + 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], + 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], + 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], + 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], + 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], + 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], + 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], + 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], + 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], + 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], + 'ExecutePoolTypes' : [ 0xf8, ['unsigned long']], + 'ExecutePageProtections' : [ 0xfc, ['unsigned long']], + 'ExecutePageMappings' : [ 0x100, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x104, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0x108, ['unsigned long']], +} ], + '_TRIAGE_DEVICE_NODE' : [ 0x58, { + 'Sibling' : [ 0x0, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_TRIAGE_POP_FX_DEVICE']]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x78, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long long']], + 'PipelinedReadAheadRequestSize' : [ 0x58, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x5c, ['unsigned long']], + 'PrivateLinks' : [ 0x60, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x70, ['pointer64', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MI_SYSTEM_IMAGE_STATE' : [ 0xc0, { + 'FixupLock' : [ 0x0, ['long']], + 'FixupList' : [ 0x8, ['_LIST_ENTRY']], + 'LoadLock' : [ 0x18, ['_KMUTANT']], + 'FirstLoadEver' : [ 0x50, ['unsigned char']], + 'LargePageAll' : [ 0x51, ['unsigned char']], + 'LastPage' : [ 0x58, ['unsigned long long']], + 'LargePageList' : [ 0x60, ['_LIST_ENTRY']], + 'BeingDeleted' : [ 0x70, ['pointer64', ['_KLDR_DATA_TABLE_ENTRY']]], + 'MappingRangesPushLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'MappingRanges' : [ 0x80, ['array', 2, ['pointer64', ['_MI_DRIVER_VA']]]], + 'PageCount' : [ 0x90, ['unsigned long long']], + 'PageCounts' : [ 0x98, ['_MM_SYSTEM_PAGE_COUNTS']], + 'CollidedLock' : [ 0xa8, ['_EX_PUSH_LOCK']], + 'ErrataPte' : [ 0xb0, ['pointer64', ['_MMPTE']]], + 'ErrataPteMapped' : [ 0xb8, ['unsigned long']], +} ], + '_PTE_TRACKER' : [ 0x80, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'Count' : [ 0x18, ['unsigned long long']], + 'SystemVa' : [ 0x20, ['pointer64', ['void']]], + 'StartVa' : [ 0x28, ['pointer64', ['void']]], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'GuardPte' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x48, ['array', 7, ['pointer64', ['void']]]], +} ], + '_HV_GET_CELL_CONTEXT' : [ 0x4, { + 'Cell' : [ 0x0, ['unsigned long']], + 'IsInTempBin' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ContextSwitches' : [ 0x14, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_2724' : [ 0x2, { + 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'EntireField' : [ 0x0, ['unsigned short']], +} ], + '_KLDR_DATA_TABLE_ENTRY' : [ 0xa0, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'ExceptionTable' : [ 0x10, ['pointer64', ['void']]], + 'ExceptionTableSize' : [ 0x18, ['unsigned long']], + 'GpValue' : [ 0x20, ['pointer64', ['void']]], + 'NonPagedDebugInfo' : [ 0x28, ['pointer64', ['_NON_PAGED_DEBUG_INFO']]], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'Flags' : [ 0x68, ['unsigned long']], + 'LoadCount' : [ 0x6c, ['unsigned short']], + 'u1' : [ 0x6e, ['__unnamed_2724']], + 'SectionPointer' : [ 0x70, ['pointer64', ['void']]], + 'CheckSum' : [ 0x78, ['unsigned long']], + 'CoverageSectionSize' : [ 0x7c, ['unsigned long']], + 'CoverageSection' : [ 0x80, ['pointer64', ['void']]], + 'LoadedImports' : [ 0x88, ['pointer64', ['void']]], + 'Spare' : [ 0x90, ['pointer64', ['void']]], + 'SizeOfImageNotRounded' : [ 0x98, ['unsigned long']], + 'TimeDateStamp' : [ 0x9c, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x30, { + 'InstantaneousRead' : [ 0x0, ['pointer64', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer64', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'Scaling' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x28, ['unsigned long long']], +} ], + '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], + 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PAGING_IO_STATE' : [ 0x50, { + 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], + 'PageFileHeadSpinLock' : [ 0x8, ['long']], + 'PrefetchSeekThreshold' : [ 0xc, ['long']], + 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], + 'InPageSupportSListMinimum' : [ 0x30, ['array', 2, ['unsigned char']]], + 'InPageSinglePages' : [ 0x34, ['unsigned long']], + 'DelayPageFaults' : [ 0x38, ['long']], + 'FileCompressionBoundary' : [ 0x3c, ['unsigned long']], + 'MdlsAdjusted' : [ 0x40, ['unsigned char']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_MI_FORCED_COMMITS' : [ 0x8, { + 'Regular' : [ 0x0, ['unsigned long']], + 'Wrap' : [ 0x4, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x28, { + 'BlockOffset' : [ 0x0, ['unsigned long long']], + 'PermanentBinAddress' : [ 0x8, ['unsigned long long']], + 'TemporaryBinAddress' : [ 0x10, ['unsigned long long']], + 'TemporaryBinRundown' : [ 0x18, ['_EX_RUNDOWN_REF']], + 'MemAlloc' : [ 0x20, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x30, { + 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x8, ['unsigned short']], + 'Atom' : [ 0xa, ['unsigned short']], + 'Reference' : [ 0x10, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x28, ['unsigned char']], + 'Name' : [ 0x2a, ['array', 1, ['wchar']]], +} ], + '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { + 'ResetCount' : [ 0x0, ['unsigned long']], + 'StateCount' : [ 0x4, ['unsigned long']], + 'DeepSleepCount' : [ 0x8, ['unsigned long']], + 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DUAL' : [ 0x278, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], + 'Guard' : [ 0x18, ['unsigned long']], + 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x260, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x270, ['unsigned long']], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x8, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2753' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2756' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0x1b0, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Event' : [ 0x20, ['_KEVENT']], + 'CollidedEvent' : [ 0x38, ['_KEVENT']], + 'IoStatus' : [ 0x50, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x60, ['_LARGE_INTEGER']], + 'ApcState' : [ 0x68, ['_KAPC_STATE']], + 'Thread' : [ 0x98, ['pointer64', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0xa0, ['pointer64', ['_MMPFN']]], + 'PteContents' : [ 0xa8, ['_MMPTE']], + 'WaitCount' : [ 0xb0, ['long']], + 'ByteCount' : [ 0xb4, ['unsigned long']], + 'u3' : [ 0xb8, ['__unnamed_2753']], + 'u1' : [ 0xbc, ['__unnamed_2756']], + 'FilePointer' : [ 0xc0, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xc8, ['pointer64', ['_CONTROL_AREA']]], + 'Subsection' : [ 0xc8, ['pointer64', ['_SUBSECTION']]], + 'Autoboost' : [ 0xd0, ['pointer64', ['void']]], + 'FaultingAddress' : [ 0xd8, ['pointer64', ['void']]], + 'PointerPte' : [ 0xe0, ['pointer64', ['_MMPTE']]], + 'BasePte' : [ 0xe8, ['pointer64', ['_MMPTE']]], + 'Pfn' : [ 0xf0, ['pointer64', ['_MMPFN']]], + 'PrefetchMdl' : [ 0xf8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0x100, ['_MDL']], + 'Page' : [ 0x130, ['array', 16, ['unsigned long long']]], + 'FlowThrough' : [ 0x130, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], +} ], + '_HAL_NODE_RANGE' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'Node' : [ 0x8, ['unsigned long']], +} ], + '_MMCLONE_BLOCK' : [ 0x20, { + 'ProtoPte' : [ 0x0, ['_MMPTE']], + 'PaddingFor16ByteAlignment' : [ 0x8, ['unsigned long long']], + 'CloneCommitCount' : [ 0x10, ['unsigned long long']], + 'u1' : [ 0x10, ['_MI_CLONE_BLOCK_FLAGS']], + 'CloneRefCount' : [ 0x18, ['unsigned long long']], +} ], + '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { + 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], + 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], + 'RequestArgument' : [ 0x20, ['unsigned long long']], + 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], + 'ActivityId' : [ 0x38, ['_GUID']], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'LowboxNumber' : [ 0x28, ['unsigned long']], + 'AtomTable' : [ 0x30, ['pointer64', ['void']]], +} ], + '_MI_LDW_WORK_CONTEXT' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'FileObject' : [ 0x20, ['pointer64', ['_FILE_OBJECT']]], + 'ErrorStatus' : [ 0x28, ['long']], + 'Active' : [ 0x2c, ['long']], + 'FreeWhenDone' : [ 0x30, ['unsigned char']], +} ], + '_MI_CFG_BITMAP_INFO' : [ 0x18, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'RegionSize' : [ 0x8, ['unsigned long long']], + 'BitmapVad' : [ 0x10, ['pointer64', ['_MMVAD']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MI_SHUTDOWN_STATE' : [ 0x80, { + 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], + 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], + 'SystemShutdown' : [ 0x4, ['unsigned long']], + 'ShutdownFlushInProgress' : [ 0x8, ['long']], + 'ResumeItem' : [ 0x10, ['_MI_RESUME_WORKITEM']], + 'MirrorHoldsPfn' : [ 0x48, ['pointer64', ['_ETHREAD']]], + 'MirroringActive' : [ 0x50, ['unsigned long']], + 'MirrorBitMaps' : [ 0x58, ['array', 2, ['_RTL_BITMAP_EX']]], + 'CrashDumpPte' : [ 0x78, ['pointer64', ['_MMPTE']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x40, { + 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], + 'ZeroBits' : [ 0x8, ['unsigned long']], + 'MaximumStackSize' : [ 0x10, ['unsigned long long']], + 'CommittedStackSize' : [ 0x18, ['unsigned long long']], + 'SubSystemType' : [ 0x20, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], + 'SubSystemVersion' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'OperatingSystemVersion' : [ 0x28, ['unsigned long']], + 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], + 'DllCharacteristics' : [ 0x2e, ['unsigned short']], + 'Machine' : [ 0x30, ['unsigned short']], + 'ImageContainsCode' : [ 0x32, ['unsigned char']], + 'ImageFlags' : [ 0x33, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ComPlusPrefer32bit' : [ 0x33, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x34, ['unsigned long']], + 'ImageFileSize' : [ 0x38, ['unsigned long']], + 'CheckSum' : [ 0x3c, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x70, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x30, ['pointer64', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x30, ['array', 4, ['pointer64', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x30, ['pointer64', ['void']]], + 'SessionId' : [ 0x38, ['unsigned long']], + 'Process' : [ 0x50, ['pointer64', ['_EPROCESS']]], + 'CallbackContext' : [ 0x50, ['pointer64', ['void']]], + 'Callback' : [ 0x58, ['pointer64', ['void']]], + 'Index' : [ 0x60, ['unsigned short']], + 'Flags' : [ 0x62, ['unsigned char']], + 'DbgKernelRegistration' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgUserRegistration' : [ 0x62, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DbgReplyRegistration' : [ 0x62, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'DbgClassicRegistration' : [ 0x62, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'DbgSessionSpaceRegistration' : [ 0x62, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DbgModernRegistration' : [ 0x62, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DbgClosed' : [ 0x62, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DbgInserted' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'EnableMask' : [ 0x63, ['unsigned char']], + 'GroupEnableMask' : [ 0x64, ['unsigned char']], + 'UseDescriptorType' : [ 0x65, ['unsigned char']], + 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0x100, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x30, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], + 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], + 'PortContext' : [ 0x50, ['pointer64', ['void']]], + 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0xe0, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], + 'Flags' : [ 0xe4, ['unsigned long']], + 'WaitEvent' : [ 0xe8, ['_KEVENT']], +} ], + '_HVIEW_MAP_PIN_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x60, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x10, ['unsigned long']], + 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x2c, ['unsigned long']], + 'WorkSpace' : [ 0x30, ['long long']], + 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x3c, ['unsigned long']], + 'BusNumber' : [ 0x40, ['unsigned long']], + 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { + 'UserRangeInKernel' : [ 0x0, ['unsigned long']], + 'FaultFailed' : [ 0x4, ['unsigned long']], + 'WriteFaultFailed' : [ 0x8, ['unsigned long']], + 'LargePageFailed' : [ 0xc, ['unsigned long']], + 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], + 'BadPageLocation' : [ 0x14, ['unsigned long']], + 'InsufficientCharge' : [ 0x18, ['unsigned long']], + 'PageTableCharge' : [ 0x1c, ['unsigned long']], + 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], + 'NoIoReference' : [ 0x24, ['unsigned long']], + 'ProbeFailed' : [ 0x28, ['unsigned long']], + 'PteIsZero' : [ 0x2c, ['unsigned long']], + 'StrongCodeWrite' : [ 0x30, ['unsigned long']], + 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], + 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], + 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x20, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0x60, { + 'Count' : [ 0x0, ['unsigned long']], + 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_MI_CLONE_BLOCK_FLAGS' : [ 0x8, { + 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 59, native_type='unsigned long long')]], + 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0x118, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x68, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x68, ['unsigned long']], + 'PackagedBinary' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x68, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x68, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LoadConfigProcessed' : [ 0x68, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x68, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x68, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x68, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x68, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x68, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x68, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x68, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x68, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x68, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x68, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x68, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x68, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x6c, ['unsigned short']], + 'TlsIndex' : [ 0x6e, ['unsigned short']], + 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x80, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x90, ['pointer64', ['void']]], + 'DdagNode' : [ 0x98, ['pointer64', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0xa0, ['_LIST_ENTRY']], + 'LoadContext' : [ 0xb0, ['pointer64', ['_LDRP_LOAD_CONTEXT']]], + 'ParentDllBase' : [ 0xb8, ['pointer64', ['void']]], + 'SwitchBackContext' : [ 0xc0, ['pointer64', ['void']]], + 'BaseAddressIndexNode' : [ 0xc8, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0xe0, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0xf8, ['unsigned long long']], + 'LoadTime' : [ 0x100, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x108, ['unsigned long']], + 'LoadReason' : [ 0x10c, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x110, ['unsigned long']], + 'ReferenceCount' : [ 0x114, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x20, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x10, ['long']], + 'Misses' : [ 0x14, ['unsigned long']], + 'MissesLast' : [ 0x18, ['unsigned long']], + 'AllStacksInUse' : [ 0x1c, ['unsigned long']], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_DRIVER_VA' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_DRIVER_VA']]], + 'PointerPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'BitMap' : [ 0x10, ['_RTL_BITMAP']], + 'Hint' : [ 0x20, ['unsigned long']], +} ], + '_LDR_DDAG_NODE' : [ 0x50, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x10, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0x18, ['unsigned long']], + 'LoadWhileUnloadingCount' : [ 0x1c, ['unsigned long']], + 'LowestLink' : [ 0x20, ['unsigned long']], + 'Dependencies' : [ 0x28, ['_LDRP_CSLIST']], + 'IncomingDependencies' : [ 0x30, ['_LDRP_CSLIST']], + 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x48, ['unsigned long']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x1d0, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], + 'Order' : [ 0x30, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x1a8, ['_LIST_ENTRY']], + 'Status' : [ 0x1b8, ['long']], + 'FailedDevice' : [ 0x1c0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x1c8, ['unsigned char']], + 'Cancelled' : [ 0x1c9, ['unsigned char']], + 'IgnoreErrors' : [ 0x1ca, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x1cb, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x1cc, ['unsigned char']], +} ], + '_KHETERO_PROCESSOR_SET' : [ 0x10, { + 'PreferredMask' : [ 0x0, ['unsigned long long']], + 'AvailableMask' : [ 0x8, ['unsigned long long']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x10, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x28, { + 'Size' : [ 0x0, ['unsigned long long']], + 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], + 'ProcessId' : [ 0x18, ['unsigned long']], + 'ServiceTag' : [ 0x1c, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], + 'DevicePathOffset' : [ 0x18, ['unsigned long long']], + 'ReasonOffset' : [ 0x20, ['unsigned long long']], +} ], + '_KWAIT_CHAIN_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '__unnamed_27d1' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '__unnamed_27d3' : [ 0x4, { + 'NumberOfChildViews' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_27d5' : [ 0x4, { + 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SUBSECTION' : [ 0x38, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'GlobalPerSessionHead' : [ 0x18, ['_RTL_AVL_TREE']], + 'CreationWaitList' : [ 0x18, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'SessionDriverProtos' : [ 0x18, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], + 'u' : [ 0x20, ['__unnamed_27d1']], + 'StartingSector' : [ 0x24, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x28, ['unsigned long']], + 'PtesInSubsection' : [ 0x2c, ['unsigned long']], + 'u1' : [ 0x30, ['__unnamed_27d3']], + 'UnusedPtes' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u2' : [ 0x34, ['__unnamed_27d5']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x28, ['unsigned long']], + 'PagingCount' : [ 0x2c, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0xf8, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Name' : [ 0xa8, ['_UNICODE_STRING']], + 'Latency' : [ 0xb8, ['unsigned long']], + 'BreakEvenDuration' : [ 0xbc, ['unsigned long']], + 'Power' : [ 0xc0, ['unsigned long']], + 'StateFlags' : [ 0xc4, ['unsigned long']], + 'VetoAccounting' : [ 0xc8, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0xf0, ['unsigned char']], + 'InterruptsEnabled' : [ 0xf1, ['unsigned char']], + 'Interruptible' : [ 0xf2, ['unsigned char']], + 'ContextRetained' : [ 0xf3, ['unsigned char']], + 'CacheCoherent' : [ 0xf4, ['unsigned char']], + 'WakesSpuriously' : [ 0xf5, ['unsigned char']], + 'PlatformOnly' : [ 0xf6, ['unsigned char']], + 'NoCState' : [ 0xf7, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x250, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x20, ['unsigned long']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x88, ['_GUID']], + 'NotificationQueue' : [ 0x98, ['_KQUEUE']], + 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], + 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x120, ['unsigned long']], + 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], + 'Key' : [ 0x130, ['pointer64', ['void']]], + 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], + 'Description' : [ 0x170, ['_UNICODE_STRING']], + 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_MI_SYSTEM_PTE_STATE' : [ 0x180, { + 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'PteTrackerLock' : [ 0x10, ['unsigned long long']], + 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], + 'PteTrackingBitmap' : [ 0xc0, ['_RTL_BITMAP_EX']], + 'CachedPteHeads' : [ 0xd0, ['pointer64', ['_MI_CACHED_PTES']]], + 'SystemViewPteInfo' : [ 0xd8, ['_MI_SYSTEM_PTE_TYPE']], + 'KernelStackPages' : [ 0x138, ['unsigned char']], + 'QueuedStacks' : [ 0x140, ['_SLIST_HEADER']], + 'StackGrowthFailures' : [ 0x150, ['unsigned long']], + 'TrackPtesAborted' : [ 0x154, ['unsigned char']], + 'AdjustCounter' : [ 0x155, ['unsigned char']], + 'QueuedStacksWorkItem' : [ 0x158, ['_MI_QUEUED_DEADSTACK_WORKITEM']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x10, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x18, ['long']], + 'HighWaterMark' : [ 0x1c, ['unsigned long']], + 'Reserved' : [ 0x20, ['array', 8, ['unsigned long']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long long']], + 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2805' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x20, { + 'NodeRangeSize' : [ 0x0, ['unsigned long long']], + 'NodeCount' : [ 0x8, ['unsigned long long']], + 'Tables' : [ 0x10, ['pointer64', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x18, ['unsigned long']], + 'u1' : [ 0x1c, ['__unnamed_2805']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned char']], + 'DripsRequiredState' : [ 0xc, ['unsigned long']], + 'Level' : [ 0x10, ['long']], + 'ActiveStamp' : [ 0x18, ['long long']], + 'CsActiveTime' : [ 0x20, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x28, ['long long']], +} ], + '_MI_RESUME_WORKITEM' : [ 0x38, { + 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x38, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Link' : [ 0x20, ['_LIST_ENTRY']], + 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ISR_THUNK' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_TRIAGE_EX_WORK_QUEUE' : [ 0x2b0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], +} ], + '_POP_FX_COMPONENT' : [ 0x100, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x18, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x58, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x60, ['long']], + 'ActiveEvent' : [ 0x68, ['_KEVENT']], + 'IdleLock' : [ 0x80, ['unsigned long long']], + 'IdleConditionComplete' : [ 0x88, ['long']], + 'IdleStateComplete' : [ 0x8c, ['long']], + 'IdleStamp' : [ 0x90, ['unsigned long long']], + 'CurrentIdleState' : [ 0x98, ['unsigned long']], + 'IdleStateCount' : [ 0x9c, ['unsigned long']], + 'IdleStates' : [ 0xa0, ['pointer64', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0xa8, ['unsigned long']], + 'ProviderCount' : [ 0xac, ['unsigned long']], + 'Providers' : [ 0xb0, ['pointer64', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0xb8, ['unsigned long']], + 'DependentCount' : [ 0xbc, ['unsigned long']], + 'Dependents' : [ 0xc0, ['pointer64', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0xc8, ['_POP_FX_ACCOUNTING']], + 'Performance' : [ 0xf8, ['pointer64', ['_POP_FX_PERF_INFO']]], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x10, { + 'DeviceHandle' : [ 0x0, ['pointer64', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x38, { + 'ComponentActive' : [ 0x0, ['pointer64', ['void']]], + 'ComponentIdle' : [ 0x8, ['pointer64', ['void']]], + 'ComponentIdleState' : [ 0x10, ['pointer64', ['void']]], + 'DevicePowerRequired' : [ 0x18, ['pointer64', ['void']]], + 'DevicePowerNotRequired' : [ 0x20, ['pointer64', ['void']]], + 'PowerControl' : [ 0x28, ['pointer64', ['void']]], + 'ComponentCriticalTransition' : [ 0x30, ['pointer64', ['void']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x10, ['unsigned char']], + 'Spare' : [ 0x11, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0x14, ['unsigned long']], + 'DebugId' : [ 0x18, ['_CVDD']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x8180, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], + 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], + 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x8010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], + 'NodesSearched' : [ 0x801c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], + 'SequenceNumber' : [ 0x8024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], + 'DepthLimitHits' : [ 0x8030, ['unsigned long']], + 'SearchLimitHits' : [ 0x8034, ['unsigned long']], + 'StackLimitHits' : [ 0x8038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x803c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x8040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x8044, ['unsigned long']], + 'TotalReleases' : [ 0x8048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x804c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x8050, ['unsigned long']], + 'Instigator' : [ 0x8058, ['pointer64', ['void']]], + 'NumberOfParticipants' : [ 0x8060, ['unsigned long']], + 'Participant' : [ 0x8068, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x8168, ['long']], + 'StackType' : [ 0x816c, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x8170, ['unsigned long long']], + 'StackHighLimit' : [ 0x8178, ['unsigned long long']], +} ], + '_KTM' : [ 0x3c0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x8, ['_KMUTANT']], + 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x70, ['_GUID']], + 'Flags' : [ 0x80, ['unsigned long']], + 'VolatileFlags' : [ 0x84, ['unsigned long']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], + 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], + 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x288, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], + 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], + 'LogFlags' : [ 0x378, ['unsigned long']], + 'LogFullStatus' : [ 0x37c, ['long']], + 'RecoveryStatus' : [ 0x380, ['long']], + 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], +} ], + '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { + 'SystemCodePage' : [ 0x0, ['unsigned long']], + 'SystemDriverPage' : [ 0x4, ['unsigned long']], + 'TotalSystemCodePages' : [ 0x8, ['long']], + 'TotalSystemDriverPages' : [ 0xc, ['long']], +} ], + '_MI_MODWRITE_DATA' : [ 0x40, { + 'PagesLoad' : [ 0x0, ['long long']], + 'PagesAverage' : [ 0x8, ['unsigned long long']], + 'AverageAvailablePages' : [ 0x10, ['unsigned long long']], + 'PagesWritten' : [ 0x18, ['unsigned long long']], + 'WritesIssued' : [ 0x20, ['unsigned long']], + 'IgnoredReservationsCount' : [ 0x24, ['unsigned long']], + 'FreedReservationsCount' : [ 0x28, ['unsigned long']], + 'WriteBurstCount' : [ 0x2c, ['unsigned long']], + 'IgnoreReservationsStartTime' : [ 0x30, ['unsigned long long']], + 'ReservationClusterInfo' : [ 0x38, ['_MI_RESERVATION_CLUSTER_INFO']], + 'IgnoreReservations' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'Spare1' : [ 0x3e, ['unsigned short']], +} ], + '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { + 'CancelCount' : [ 0x0, ['unsigned long']], + 'FailureCount' : [ 0x4, ['unsigned long']], + 'SuccessCount' : [ 0x8, ['unsigned long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'TotalTime' : [ 0x20, ['unsigned long long']], + 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], + 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_KTRANSACTION' : [ 0x2d8, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x20, ['_KMUTANT']], + 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0xb0, ['_GUID']], + 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xd8, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], + 'PendingResponses' : [ 0xec, ['unsigned long']], + 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xf8, ['_CLS_LSN']], + 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], + 'IsolationLevel' : [ 0x120, ['unsigned long']], + 'IsolationFlags' : [ 0x124, ['unsigned long']], + 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], + 'Description' : [ 0x130, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0x168, ['_KDPC']], + 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], + 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], + 'CommitReservation' : [ 0x208, ['long long']], + 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], + 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], + 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x60, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], + 'UoWState' : [ 0x40, ['unsigned long']], + 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x50, ['unsigned long']], + 'OldValueCell' : [ 0x50, ['unsigned long']], + 'NewValueCell' : [ 0x54, ['unsigned long']], + 'UserFlags' : [ 0x50, ['unsigned long']], + 'LastWriteTime' : [ 0x50, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x50, ['unsigned long']], + 'OldChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], +} ], + '_KREQUEST_PACKET' : [ 0x20, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], +} ], + '_VF_WATCHDOG_IRP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'DueTickCount' : [ 0x18, ['unsigned long']], + 'Inserted' : [ 0x1c, ['unsigned char']], + 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_2880' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2882' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_2880']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2882']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x38, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x18, ['unsigned long']], + 'RealRefCount' : [ 0x1c, ['unsigned long']], + 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_CM_NAME_HASH' : [ 0x18, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x10, ['unsigned short']], + 'Name' : [ 0x12, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_PO_IRP_QUEUE' : [ 0x10, { + 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_2897' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0xd0, { + 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x48, ['__unnamed_2897']], + 'ChildrenCount' : [ 0x4c, ['long']], + 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], + 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0xa8, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x68, ['_KMUTANT']], + 'LinksOffset' : [ 0xa0, ['unsigned short']], + 'GuidOffset' : [ 0xa2, ['unsigned short']], + 'Expired' : [ 0xa4, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x20, { + 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x10, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_HVIEW_MAP_ENTRY' : [ 0x20, { + 'ViewStart' : [ 0x0, ['pointer64', ['void']]], + 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Bcb' : [ 0x8, ['pointer64', ['void']]], + 'PinnedPages' : [ 0x10, ['unsigned long long']], + 'Size' : [ 0x18, ['unsigned long']], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x10, { + 'Stream' : [ 0x0, ['pointer64', ['void']]], + 'Detail' : [ 0x8, ['unsigned long']], +} ], + '_POP_COOLING_EXTENSION' : [ 0x90, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'RequestListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Lock' : [ 0x20, ['_POP_RW_LOCK']], + 'DeviceObject' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'NotificationEntry' : [ 0x38, ['pointer64', ['void']]], + 'Enabled' : [ 0x40, ['unsigned char']], + 'ActiveEngaged' : [ 0x41, ['unsigned char']], + 'ThrottleLimit' : [ 0x42, ['unsigned char']], + 'UpdatingToCurrent' : [ 0x43, ['unsigned char']], + 'RemovalFlushEvent' : [ 0x48, ['pointer64', ['_KEVENT']]], + 'PnpFlushEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Interface' : [ 0x58, ['_THERMAL_COOLING_INTERFACE']], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_CM_INDEX' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], + 'HashKey' : [ 0x4, ['unsigned long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x10, { + 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], + 'End' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], +} ], + '_THERMAL_POLICY' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ThermalStandby' : [ 0x7, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], + 'OverThrottled' : [ 0x14, ['unsigned char']], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x10, ['pointer64', ['void']]], + 'Key' : [ 0x18, ['unsigned long long']], + 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x408, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_RTL_UMS_CONTEXT' : [ 0x520, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Context' : [ 0x10, ['_CONTEXT']], + 'Teb' : [ 0x4e0, ['pointer64', ['void']]], + 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Flags' : [ 0x4f0, ['long']], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], + 'ContextLock' : [ 0x4f8, ['unsigned long long']], + 'PrimaryUmsContext' : [ 0x500, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'SwitchCount' : [ 0x508, ['unsigned long']], + 'KernelYieldCount' : [ 0x50c, ['unsigned long']], + 'MixedYieldCount' : [ 0x510, ['unsigned long']], + 'YieldCount' : [ 0x514, ['unsigned long']], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x40, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], +} ], + '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'EventSets' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_COLORED_PAGE_INFO' : [ 0x18, { + 'BeingZeroed' : [ 0x0, ['long']], + 'Processor' : [ 0x4, ['unsigned long']], + 'PagesQueued' : [ 0x8, ['unsigned long long']], + 'PfnAllocation' : [ 0x10, ['pointer64', ['_MMPFN']]], +} ], + '_TRIAGE_9F_POWER' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'IrpList' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadList' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'DelayedWorkQueue' : [ 0x18, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_MI_POOL_STATE' : [ 0xf8, { + 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long long']], + 'NonPagedPoolSListMaximum' : [ 0x8, ['array', 3, ['unsigned long']]], + 'AllocatedNonPagedPool' : [ 0x18, ['unsigned long long']], + 'BadPoolHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'HighEventSets' : [ 0x28, ['unsigned long']], + 'HighEventSetsValid' : [ 0x2c, ['unsigned char']], + 'PoolFailures' : [ 0x30, ['array', 3, ['array', 3, ['unsigned long']]]], + 'PoolFailureReasons' : [ 0x54, ['_MI_POOL_FAILURE_REASONS']], + 'LowPagedPoolThreshold' : [ 0x80, ['unsigned long long']], + 'HighPagedPoolThreshold' : [ 0x88, ['unsigned long long']], + 'PagedPoolSListMaximum' : [ 0x90, ['unsigned long']], + 'PreemptiveTrims' : [ 0x94, ['array', 4, ['unsigned long']]], + 'SpecialPagesInUsePeak' : [ 0xa8, ['unsigned long long']], + 'SpecialPoolRejected' : [ 0xb0, ['array', 9, ['unsigned long']]], + 'SpecialPagesNonPaged' : [ 0xd8, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0xe0, ['long']], + 'SessionSpecialPoolPdesMax' : [ 0xe4, ['unsigned long']], + 'TotalPagedPoolQuota' : [ 0xe8, ['unsigned long long']], + 'TotalNonPagedPoolQuota' : [ 0xf0, ['unsigned long long']], +} ], + '_STACK_TABLE' : [ 0x8088, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], +} ], + '_POP_POWER_SETTING_VALUES' : [ 0x13c, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], + 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], + 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], + 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], + 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], + 'AwayModeIgnoreAction' : [ 0xf8, ['long']], + 'DisableFastS4' : [ 0xfc, ['unsigned char']], + 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], + 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], + 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], + 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], + 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], + 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], + 'VideoDimBrightness' : [ 0x114, ['unsigned long']], + 'AlsOffset' : [ 0x118, ['unsigned long']], + 'AlsEnabled' : [ 0x11c, ['unsigned long']], + 'EsBrightness' : [ 0x120, ['unsigned long']], + 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], + 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], + 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], + 'OffloadedAudio' : [ 0x12d, ['unsigned char']], + 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], + 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], + 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], + 'EsUserAwaySetting' : [ 0x134, ['unsigned char']], + 'WiFiInStandby' : [ 0x138, ['unsigned long']], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_KUMS_CONTEXT_HEADER' : [ 0x70, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'StackTop' : [ 0x20, ['pointer64', ['void']]], + 'StackSize' : [ 0x28, ['unsigned long long']], + 'RspOffset' : [ 0x30, ['unsigned long long']], + 'Rip' : [ 0x38, ['unsigned long long']], + 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], + 'Flags' : [ 0x48, ['unsigned long long']], + 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], + 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], + 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], + 'Return' : [ 0x68, ['unsigned long long']], +} ], + '_DEFERRED_WRITE' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x10, ['unsigned long']], + 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Context1' : [ 0x38, ['pointer64', ['void']]], + 'Context2' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_2911' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2913' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2911']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2913']], +} ], + '_MI_RESAVAIL_FAILURES' : [ 0x8, { + 'Wrap' : [ 0x0, ['unsigned long']], + 'NoCharge' : [ 0x4, ['unsigned long']], +} ], + '_MI_IO_PAGE_STATE' : [ 0x58, { + 'IoPfnLock' : [ 0x0, ['unsigned long long']], + 'IoPfnRoot' : [ 0x8, ['array', 3, ['_RTL_AVL_TREE']]], + 'UnusedCachedMaps' : [ 0x20, ['_LIST_ENTRY']], + 'OldestCacheFlushTimeStamp' : [ 0x30, ['unsigned long']], + 'IoCacheStats' : [ 0x38, ['_MI_IO_CACHE_STATS']], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], +} ], + '_VF_AVL_TABLE' : [ 0xc0, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x70, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1e, { + 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], +} ], + '_TRIAGE_POP_FX_DEVICE' : [ 0x38, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_TRIAGE_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['long']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DeviceNode' : [ 0x30, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '__unnamed_292f' : [ 0x10, { + 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], +} ], + '__unnamed_2931' : [ 0x8, { + 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], +} ], + '__unnamed_2937' : [ 0x10, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], + 'OutputInformation' : [ 0x8, ['pointer64', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], +} ], + '__unnamed_293b' : [ 0x10, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x8, ['unsigned char']], +} ], + '__unnamed_293d' : [ 0x28, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], + 'Argument5' : [ 0x20, ['pointer64', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x28, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_292f']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2931']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2937']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_293b']], + 'Others' : [ 0x0, ['__unnamed_293d']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x8, { + 'Function' : [ 0x0, ['pointer64', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long long']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x78, { + 'SelectedCount' : [ 0x0, ['unsigned long long']], + 'VetoCount' : [ 0x8, ['unsigned long long']], + 'PreVetoCount' : [ 0x10, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'IdleDurationCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], + 'InterruptibleCount' : [ 0x48, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], + 'CstateCheckCount' : [ 0x58, ['unsigned long long']], + 'NoCStateCount' : [ 0x60, ['unsigned long long']], + 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], + 'PreVetoAccounting' : [ 0x70, ['pointer64', ['_PPM_VETO_ACCOUNTING']]], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { + 'PagesScannedActive' : [ 0x0, ['unsigned long long']], + 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], + 'PagesCombined' : [ 0x10, ['unsigned long long']], + 'CombineScanCount' : [ 0x18, ['unsigned long']], + 'CombinedBlocksInUse' : [ 0x1c, ['long']], + 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], +} ], + '_THERMAL_COOLING_INTERFACE' : [ 0x38, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'ActiveCooling' : [ 0x28, ['pointer64', ['void']]], + 'PassiveCooling' : [ 0x30, ['pointer64', ['void']]], +} ], + '_HIVE_WAIT_PACKET' : [ 0x28, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Next' : [ 0x20, ['pointer64', ['_HIVE_WAIT_PACKET']]], +} ], + '_PROC_PERF_CHECK' : [ 0xc0, { + 'LastActive' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'LastStall' : [ 0x10, ['unsigned long long']], + 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], + 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], + 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], + 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], + 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], +} ], + '__unnamed_2956' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2958' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_295a' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_2956']], + 'Interrupt' : [ 0x0, ['__unnamed_2958']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_2958']], + 'Sci' : [ 0x0, ['__unnamed_2958']], + 'Nmi' : [ 0x0, ['__unnamed_2958']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_295a']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x1d0, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'VerifyKernelPhaseOnResume' : [ 0x3, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x4, ['unsigned char']], + 'InitializationFinished' : [ 0x5, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'HvCaptureReadyBarrier' : [ 0x14, ['long']], + 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], + 'MapFrozen' : [ 0x1c, ['unsigned char']], + 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x30, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x40, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x50, ['unsigned long']], + 'ClonedPageCount' : [ 0x58, ['unsigned long long']], + 'CurrentMap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x68, ['pointer64', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x70, ['unsigned long long']], + 'LoaderMdl' : [ 0x78, ['pointer64', ['_MDL']]], + 'AllocatedMdl' : [ 0x80, ['pointer64', ['_MDL']]], + 'PagesOut' : [ 0x88, ['unsigned long long']], + 'IoPages' : [ 0x90, ['pointer64', ['void']]], + 'IoPagesCount' : [ 0x98, ['unsigned long']], + 'CurrentMcb' : [ 0xa0, ['pointer64', ['void']]], + 'DumpStack' : [ 0xa8, ['pointer64', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0xb0, ['pointer64', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0xb8, ['unsigned long']], + 'Status' : [ 0xbc, ['long']], + 'GraphicsProc' : [ 0xc0, ['unsigned long']], + 'MemoryImage' : [ 0xc8, ['pointer64', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0xd0, ['pointer64', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0xd8, ['pointer64', ['_MDL']]], + 'SiLogOffset' : [ 0xe0, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0xe8, ['pointer64', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0xf0, ['pointer64', ['void']]], + 'ResumeContext' : [ 0xf8, ['pointer64', ['void']]], + 'ResumeContextPages' : [ 0x100, ['unsigned long']], + 'SecurePages' : [ 0x104, ['unsigned long']], + 'ProcessorCount' : [ 0x108, ['unsigned long']], + 'ProcessorContext' : [ 0x110, ['pointer64', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0x118, ['pointer64', ['unsigned char']]], + 'ProdConsSize' : [ 0x120, ['unsigned long']], + 'MaxDataPages' : [ 0x124, ['unsigned long']], + 'ExtraBuffer' : [ 0x128, ['pointer64', ['void']]], + 'ExtraBufferSize' : [ 0x130, ['unsigned long long']], + 'ExtraMapVa' : [ 0x138, ['pointer64', ['void']]], + 'BitlockerKeyPFN' : [ 0x140, ['unsigned long long']], + 'IoInfo' : [ 0x148, ['_POP_IO_INFO']], + 'IoChecksums' : [ 0x1b8, ['pointer64', ['unsigned short']]], + 'IoChecksumsSize' : [ 0x1c0, ['unsigned long long']], + 'HardwareConfigurationSignature' : [ 0x1c8, ['unsigned long']], + 'IumEnabled' : [ 0x1cc, ['unsigned char']], +} ], + '_OBJECT_REF_TRACE' : [ 0x80, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x10, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_POP_FX_PERF_INFO' : [ 0xa0, { + 'Component' : [ 0x0, ['pointer64', ['_POP_FX_COMPONENT']]], + 'CompletedEvent' : [ 0x8, ['_KEVENT']], + 'ComponentPerfState' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['_POP_FX_PERF_FLAGS']], + 'LastChange' : [ 0x30, ['pointer64', ['_PO_FX_PERF_STATE_CHANGE']]], + 'LastChangeCount' : [ 0x38, ['unsigned long']], + 'LastChangeStamp' : [ 0x40, ['unsigned long long']], + 'LastChangeNominal' : [ 0x48, ['unsigned char']], + 'PepRegistered' : [ 0x49, ['unsigned char']], + 'QueryOnIdleStates' : [ 0x4a, ['unsigned char']], + 'RequestDriverContext' : [ 0x50, ['pointer64', ['void']]], + 'WorkOrder' : [ 0x58, ['_POP_FX_WORK_ORDER']], + 'SetsCount' : [ 0x90, ['unsigned long']], + 'Sets' : [ 0x98, ['pointer64', ['_POP_FX_PERF_SET']]], +} ], + '_KDESCRIPTOR' : [ 0x10, { + 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], + 'Limit' : [ 0x6, ['unsigned short']], + 'Base' : [ 0x8, ['pointer64', ['void']]], +} ], + '_HAL_CHANNEL_MEMORY_RANGES' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'MpnId' : [ 0x8, ['unsigned short']], + 'Node' : [ 0xa, ['unsigned short']], + 'Channel' : [ 0xc, ['unsigned short']], + 'IsPowerManageable' : [ 0xe, ['unsigned char']], + 'DeepPowerState' : [ 0xf, ['unsigned char']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x178, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0x108, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0x110, ['pointer64', ['void']]], + 'PointersLength' : [ 0x118, ['unsigned long']], + 'ModulePrefix' : [ 0x120, ['pointer64', ['unsigned short']]], + 'DriverList' : [ 0x128, ['_LIST_ENTRY']], + 'InitMsg' : [ 0x138, ['_STRING']], + 'ProgMsg' : [ 0x148, ['_STRING']], + 'DoneMsg' : [ 0x158, ['_STRING']], + 'FileObject' : [ 0x168, ['pointer64', ['void']]], + 'UsageType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x8, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x48, { + 'InitiatingThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ThreadId' : [ 0x10, ['pointer64', ['void']]], + 'ProcessId' : [ 0x18, ['pointer64', ['void']]], + 'Code' : [ 0x20, ['unsigned long']], + 'Parameter1' : [ 0x28, ['unsigned long long']], + 'Parameter2' : [ 0x30, ['unsigned long long']], + 'Parameter3' : [ 0x38, ['unsigned long long']], + 'Parameter4' : [ 0x40, ['unsigned long long']], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_PCW_MASK_INFORMATION' : [ 0x28, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0x10, ['unsigned long']], + 'CollectMultiple' : [ 0x14, ['unsigned char']], + 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'SizeReturned' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], +} ], + '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x48, { + 'ViewOffset' : [ 0x0, ['unsigned long']], + 'Pinned' : [ 0x4, ['unsigned char']], + 'PinMask' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '__unnamed_299a' : [ 0x20, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x20, { + 'Parameters' : [ 0x0, ['__unnamed_299a']], +} ], + '__unnamed_299e' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_299e']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SUBSECTION_WAIT_BLOCK' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], + 'Gate' : [ 0x8, ['_KGATE']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long']], + 'Weight' : [ 0x0, ['unsigned short']], + 'MinRate' : [ 0x0, ['unsigned short']], + 'MaxRate' : [ 0x2, ['unsigned short']], + 'AllFlags' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x3b0, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long long']], + 'PageSize' : [ 0x18, ['unsigned long']], + 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x28, ['unsigned long long']], + 'FeatureFlags' : [ 0x30, ['unsigned long long']], + 'HiberFlags' : [ 0x38, ['unsigned char']], + 'spare' : [ 0x39, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x3c, ['unsigned long']], + 'HiberVa' : [ 0x40, ['unsigned long long']], + 'NoFreePages' : [ 0x48, ['unsigned long']], + 'FreeMapCheck' : [ 0x4c, ['unsigned long']], + 'WakeCheck' : [ 0x50, ['unsigned long']], + 'NumPagesForLoader' : [ 0x58, ['unsigned long long']], + 'FirstSecureRestorePage' : [ 0x60, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x68, ['unsigned long long']], + 'FirstKernelRestorePage' : [ 0x70, ['unsigned long long']], + 'FirstChecksumRestorePage' : [ 0x78, ['unsigned long long']], + 'NoChecksumEntries' : [ 0x80, ['unsigned long long']], + 'PerfInfo' : [ 0x88, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x268, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x270, ['array', 1, ['unsigned long long']]], + 'SiLogOffset' : [ 0x278, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x27c, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x280, ['array', 24, ['unsigned long long']]], + 'NotUsed' : [ 0x340, ['unsigned long']], + 'ResumeContextCheck' : [ 0x344, ['unsigned long']], + 'ResumeContextPages' : [ 0x348, ['unsigned long']], + 'Hiberboot' : [ 0x34c, ['unsigned char']], + 'HvCr3' : [ 0x350, ['unsigned long long']], + 'HvEntryPoint' : [ 0x358, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x360, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x368, ['unsigned long long']], + 'BootFlags' : [ 0x370, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x378, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x380, ['unsigned long long']], + 'BitlockerKeyPfns' : [ 0x388, ['array', 4, ['unsigned long long']]], + 'HardwareSignature' : [ 0x3a8, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x18, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned short']], + 'Flags' : [ 0x16, ['unsigned short']], +} ], + '_CURDIR' : [ 0x18, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x1e0, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], + 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x48, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x4c, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x50, ['unsigned long']], + 'ResumeAppTicks' : [ 0x58, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x60, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x68, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x70, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x78, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x80, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x88, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x90, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0x98, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeMapTicks' : [ 0xa8, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xb0, ['unsigned long long']], + 'ResumeChecksumTicks' : [ 0xb8, ['unsigned long long']], + 'ResumeChecksumIoTicks' : [ 0xc0, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xc8, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xd0, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xd8, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xe0, ['unsigned long long']], + 'HalTscOffset' : [ 0xe8, ['unsigned long long']], + 'HvlTscOffset' : [ 0xf0, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0xf8, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0x100, ['unsigned long long']], + 'IoBoundedness' : [ 0x108, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0x110, ['unsigned long long']], + 'KernelIoTicks' : [ 0x118, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x120, ['unsigned long long']], + 'ReadCheckCount' : [ 0x128, ['unsigned long long']], + 'KernelInitTicks' : [ 0x130, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x138, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x140, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x148, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x150, ['unsigned long long']], + 'KernelChecksumTicks' : [ 0x158, ['unsigned long long']], + 'KernelChecksumIoTicks' : [ 0x160, ['unsigned long long']], + 'AnimationStart' : [ 0x168, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x170, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x178, ['unsigned long']], + 'SecurePagesProcessed' : [ 0x180, ['unsigned long long']], + 'BootPagesProcessed' : [ 0x188, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x190, ['unsigned long long']], + 'BootBytesWritten' : [ 0x198, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x1a0, ['unsigned long long']], + 'BootPagesWritten' : [ 0x1a8, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x1b0, ['unsigned long long']], + 'BytesWritten' : [ 0x1b8, ['unsigned long long']], + 'PagesWritten' : [ 0x1c0, ['unsigned long']], + 'FileRuns' : [ 0x1c4, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x1c8, ['unsigned long']], + 'MaxHuffRatio' : [ 0x1cc, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x1d0, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1d8, ['unsigned long long']], +} ], + '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x28, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Active' : [ 0x20, ['long']], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_RTL_BALANCED_LINKS' : [ 0x20, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0x18, ['unsigned char']], + 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], +} ], + '_FREE_DISPLAY' : [ 0x18, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x38, { + 'Page' : [ 0x0, ['array', 1, ['unsigned long long']]], + 'InitialInPageSupport' : [ 0x8, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'PagingFile' : [ 0x10, ['pointer64', ['_MMPAGING_FILE']]], + 'PageFileOffset' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['_RTL_BALANCED_NODE']], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x80, { + 'UncompressedData' : [ 0x0, ['pointer64', ['unsigned char']]], + 'MappingVa' : [ 0x8, ['pointer64', ['void']]], + 'XpressEncodeWorkspace' : [ 0x10, ['pointer64', ['void']]], + 'CompressedDataBuffer' : [ 0x18, ['pointer64', ['unsigned char']]], + 'CopyTicks' : [ 0x20, ['unsigned long long']], + 'CompressTicks' : [ 0x28, ['unsigned long long']], + 'BytesCopied' : [ 0x30, ['unsigned long long']], + 'PagesProcessed' : [ 0x38, ['unsigned long long']], + 'DecompressTicks' : [ 0x40, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x48, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x50, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x68, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x78, ['unsigned long']], + 'HuffCompressCount' : [ 0x7c, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK' : [ 0x20, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_MI_DYNAMIC_BITMAP' : [ 0x50, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'MaximumSize' : [ 0x10, ['unsigned long long']], + 'Hint' : [ 0x18, ['unsigned long long']], + 'BaseVa' : [ 0x20, ['pointer64', ['void']]], + 'SizeTopDown' : [ 0x28, ['unsigned long long']], + 'HintTopDown' : [ 0x30, ['unsigned long long']], + 'BaseVaTopDown' : [ 0x38, ['pointer64', ['void']]], + 'SpinLock' : [ 0x40, ['unsigned long long']], + 'Vm' : [ 0x48, ['pointer64', ['_MMSUPPORT']]], +} ], + '_POP_IO_INFO' : [ 0x70, { + 'DumpMdl' : [ 0x0, ['pointer64', ['_MDL']]], + 'IoStatus' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x10, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x18, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x20, ['unsigned long long']], + 'RequestSize' : [ 0x28, ['unsigned long long']], + 'IoLocation' : [ 0x30, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x38, ['unsigned long long']], + 'Buffer' : [ 0x40, ['pointer64', ['void']]], + 'AsyncCapable' : [ 0x48, ['unsigned char']], + 'BytesToRead' : [ 0x50, ['unsigned long long']], + 'Pages' : [ 0x58, ['unsigned long']], + 'HighestChecksumIndex' : [ 0x60, ['unsigned long long']], + 'PreviousChecksum' : [ 0x68, ['unsigned short']], +} ], + '_LDRP_CSLIST' : [ 0x8, { + 'Tail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_NON_PAGED_DEBUG_INFO' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Machine' : [ 0x8, ['unsigned short']], + 'Characteristics' : [ 0xa, ['unsigned short']], + 'TimeDateStamp' : [ 0xc, ['unsigned long']], + 'CheckSum' : [ 0x10, ['unsigned long']], + 'SizeOfImage' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], +} ], + '_POP_FX_PERF_SET' : [ 0x20, { + 'PerfSet' : [ 0x0, ['pointer64', ['_PO_FX_COMPONENT_PERF_SET']]], + 'CurrentPerf' : [ 0x8, ['unsigned long long']], + 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], + 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'Flags' : [ 0x28, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], + 'SpareUSHORT' : [ 0x2e, ['unsigned short']], +} ], + '__unnamed_29dd' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_29df' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_29e2' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_29e6' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x58, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x18, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x28, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x38, ['__unnamed_29dd']], + 'HvDeviceId' : [ 0x40, ['unsigned long long']], + 'XapicMessage' : [ 0x48, ['__unnamed_29df']], + 'Hypertransport' : [ 0x48, ['__unnamed_29e2']], + 'GenericMessage' : [ 0x48, ['__unnamed_29df']], + 'MessageRequest' : [ 0x48, ['__unnamed_29e6']], +} ], + '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { + 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_29f4' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['pointer64', ['_PO_FX_PERF_STATE']]], +} ], + '__unnamed_29f6' : [ 0x10, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], +} ], + '_PO_FX_COMPONENT_PERF_SET' : [ 0x30, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], + 'Flags' : [ 0x10, ['unsigned long long']], + 'Unit' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], + 'Discrete' : [ 0x20, ['__unnamed_29f4']], + 'Range' : [ 0x20, ['__unnamed_29f6']], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2a07' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a09' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2a0b' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2a07']], + 'Gpt' : [ 0x0, ['__unnamed_2a09']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0x108, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], + 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], + 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], + 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], + 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], + 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], + 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], + 'CrashDump' : [ 0x68, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x69, ['unsigned char']], + 'HiberResume' : [ 0x6a, ['unsigned char']], + 'Reserved1' : [ 0x6b, ['unsigned char']], + 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], + 'CommonBufferSize' : [ 0x70, ['unsigned long']], + 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], + 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], + 'PartitionStyle' : [ 0x88, ['unsigned long']], + 'DiskInfo' : [ 0x8c, ['__unnamed_2a0b']], + 'ReadRoutine' : [ 0xa0, ['pointer64', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0xa8, ['pointer64', ['void']]], + 'LogSectionTruncateSize' : [ 0xb0, ['unsigned long']], + 'Parameters' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xf8, ['pointer64', ['void']]], + 'DumpNotifyRoutine' : [ 0x100, ['pointer64', ['void']]], +} ], + '_MI_IO_CACHE_STATS' : [ 0x20, { + 'UnusedBlocks' : [ 0x0, ['unsigned long long']], + 'ActiveCacheMatch' : [ 0x8, ['unsigned long']], + 'ActiveCacheOverride' : [ 0xc, ['unsigned long']], + 'UnmappedCacheFlush' : [ 0x10, ['unsigned long']], + 'UnmappedCacheMatch' : [ 0x14, ['unsigned long']], + 'UnmappedCacheConflict' : [ 0x18, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x10, ['pointer64', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0x18, ['pointer64', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x20, ['pointer64', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x28, ['pointer64', ['void']]], + 'RegIndex' : [ 0x30, ['unsigned short']], + 'ReplyIndex' : [ 0x32, ['unsigned short']], + 'Flags' : [ 0x34, ['unsigned long']], +} ], + '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { + 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'EntireInfo' : [ 0x0, ['long']], +} ], + '_TRIAGE_POP_IRP_DATA' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_KDPC_LIST' : [ 0x10, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x178, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x10, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { + 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], + 'PriorityTooLow' : [ 0x4, ['unsigned long']], + 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], + 'PagedNoPtes' : [ 0xc, ['unsigned long']], + 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], + 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], + 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], + 'PagedNoCommit' : [ 0x1c, ['unsigned long']], + 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], + 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], + 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x20, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer64', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '__unnamed_2a42' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2a44' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2a42']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2a47' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2a49' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2a47']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_2a44']], + 'HighPart' : [ 0x4, ['__unnamed_2a49']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x48, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x40, ['long']], +} ], + '_PROC_PERF_CHECK_SNAP' : [ 0x50, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned long long']], + 'Stall' : [ 0x10, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], + 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '__unnamed_2a57' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned long']], + 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], +} ], + '_MI_PER_SESSION_PROTOS' : [ 0x30, { + 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'DriverAddress' : [ 0x0, ['pointer64', ['void']]], + 'SessionId' : [ 0x18, ['unsigned long']], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionBase' : [ 0x20, ['pointer64', ['_MMPTE']]], + 'u2' : [ 0x28, ['__unnamed_2a57']], +} ], + '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { + 'Set' : [ 0x0, ['unsigned long']], + 'StateIndex' : [ 0x8, ['unsigned long']], + 'StateValue' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2a5d' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_2a5f' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_2a5d']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_2a5f']], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { + 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_AVL_TABLE' : [ 0x68, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], + 'WhichOrderedElement' : [ 0x28, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], + 'DepthOfTree' : [ 0x30, ['unsigned long']], + 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x40, ['unsigned long']], + 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], + 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], + 'TableContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_PO_FX_PERF_STATE' : [ 0x10, { + 'Value' : [ 0x0, ['unsigned long long']], + 'Context' : [ 0x8, ['pointer64', ['void']]], +} ], +} From b808995ce55086274537c092433221795dc2bd21 Mon Sep 17 00:00:00 2001 From: gleeda Date: Wed, 7 Sep 2016 10:11:16 -0400 Subject: [PATCH 023/304] readme update --- README.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/README.txt b/README.txt index 51ea50816..ac4cdbba2 100644 --- a/README.txt +++ b/README.txt @@ -168,6 +168,7 @@ VistaSP2x64 - A Profile for Windows Vista SP2 x64 VistaSP2x86 - A Profile for Windows Vista SP2 x86 Win10x64 - A Profile for Windows 10 x64 Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB +Win10x64_DDA2B209 - A Profile for Windows 10 x64 from PDB DDA2B209 Win10x86 - A Profile for Windows 10 x86 Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 From 1a60a710342a5d0186b6afa1d3359234febbc48c Mon Sep 17 00:00:00 2001 From: gleeda Date: Wed, 7 Sep 2016 17:44:08 -0400 Subject: [PATCH 024/304] reverting 6e51c593ead725400c633e08d65271d9e1073fd1 --- README.txt | 1 - volatility/plugins/overlays/windows/win10.py | 13 +- .../windows/win10_x64_DDA2B209_vtypes.py | 13258 ---------------- 3 files changed, 2 insertions(+), 13270 deletions(-) delete mode 100644 volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py diff --git a/README.txt b/README.txt index ac4cdbba2..51ea50816 100644 --- a/README.txt +++ b/README.txt @@ -168,7 +168,6 @@ VistaSP2x64 - A Profile for Windows Vista SP2 x64 VistaSP2x86 - A Profile for Windows Vista SP2 x86 Win10x64 - A Profile for Windows 10 x64 Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB -Win10x64_DDA2B209 - A Profile for Windows 10 x64 from PDB DDA2B209 Win10x86 - A Profile for Windows 10 x86 Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index 2626127fb..aa033d3e6 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -385,7 +385,7 @@ def modification(self, profile): metadata = profile.metadata build = metadata.get("build", 0) - if build >= 10240: + if build == 10240: header = _OBJECT_HEADER_10_1AC738FB else: header = _OBJECT_HEADER_10 @@ -397,7 +397,7 @@ class Win10PoolHeader(obj.ProfileModification): conditions = {'os': lambda x: x == 'windows', 'major': lambda x: x == 6, 'minor': lambda x: x == 4, - 'build': lambda x: x >= 10240} + 'build': lambda x: x == 10240} def modification(self, profile): @@ -448,15 +448,6 @@ class Win10x64_1AC738FB(obj.Profile): _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes' -class Win10x64_DDA2B209(obj.Profile): - """ A Profile for Windows 10 x64 from PDB DDA2B209""" - _md_memory_model = '64bit' - _md_os = 'windows' - _md_major = 6 - _md_minor = 4 - _md_build = 10241 - _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_DDA2B209_vtypes' - class Win10x86(obj.Profile): """ A Profile for Windows 10 x86 """ _md_memory_model = '32bit' diff --git a/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py b/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py deleted file mode 100644 index 19868e643..000000000 --- a/volatility/plugins/overlays/windows/win10_x64_DDA2B209_vtypes.py +++ /dev/null @@ -1,13258 +0,0 @@ -ntkrnlmp_types = { - 'LIST_ENTRY64' : [ 0x10, { - 'Flink' : [ 0x0, ['unsigned long long']], - 'Blink' : [ 0x8, ['unsigned long long']], -} ], - 'LIST_ENTRY32' : [ 0x8, { - 'Flink' : [ 0x0, ['unsigned long']], - 'Blink' : [ 0x4, ['unsigned long']], -} ], - '_KUSER_SHARED_DATA' : [ 0x708, { - 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], - 'TickCountMultiplier' : [ 0x4, ['unsigned long']], - 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], - 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], - 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], - 'ImageNumberLow' : [ 0x2c, ['unsigned short']], - 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], - 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], - 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], - 'CryptoExponent' : [ 0x23c, ['unsigned long']], - 'TimeZoneId' : [ 0x240, ['unsigned long']], - 'LargePageMinimum' : [ 0x244, ['unsigned long']], - 'AitSamplingValue' : [ 0x248, ['unsigned long']], - 'AppCompatFlag' : [ 0x24c, ['unsigned long']], - 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], - 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], - 'TimeZoneBiasStamp' : [ 0x25c, ['long']], - 'NtBuildNumber' : [ 0x260, ['unsigned long']], - 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], - 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], - 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], - 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], - 'NtMajorVersion' : [ 0x26c, ['unsigned long']], - 'NtMinorVersion' : [ 0x270, ['unsigned long']], - 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], - 'Reserved1' : [ 0x2b4, ['unsigned long']], - 'Reserved3' : [ 0x2b8, ['unsigned long']], - 'TimeSlip' : [ 0x2bc, ['unsigned long']], - 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], - 'BootId' : [ 0x2c4, ['unsigned long']], - 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], - 'SuiteMask' : [ 0x2d0, ['unsigned long']], - 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], - 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], - 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], - 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], - 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], - 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], - 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], - 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], - 'DismountCount' : [ 0x2dc, ['unsigned long']], - 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], - 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], - 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], - 'SafeBootMode' : [ 0x2ec, ['unsigned char']], - 'Reserved12' : [ 0x2ed, ['array', 3, ['unsigned char']]], - 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], - 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], - 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], - 'QpcFrequency' : [ 0x300, ['long long']], - 'SystemCall' : [ 0x308, ['unsigned long']], - 'SystemCallPad0' : [ 0x30c, ['unsigned long']], - 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], - 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], - 'TickCountQuad' : [ 0x320, ['unsigned long long']], - 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], - 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], - 'Cookie' : [ 0x330, ['unsigned long']], - 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], - 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], - 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], - 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], - 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], - 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], - 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], - 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], - 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], - 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], - 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], - 'Reserved8' : [ 0x37c, ['unsigned long']], - 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], - 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], - 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], - 'Reserved4' : [ 0x3a8, ['unsigned long long']], - 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], - 'QpcBias' : [ 0x3b8, ['unsigned long long']], - 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], - 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], - 'Reserved9' : [ 0x3c5, ['unsigned char']], - 'QpcData' : [ 0x3c6, ['unsigned short']], - 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], - 'QpcShift' : [ 0x3c7, ['unsigned char']], - 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], - 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], - 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], -} ], - '__unnamed_1080' : [ 0x8, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'HighPart' : [ 0x4, ['unsigned long']], -} ], - '_ULARGE_INTEGER' : [ 0x8, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'HighPart' : [ 0x4, ['unsigned long']], - 'u' : [ 0x0, ['__unnamed_1080']], - 'QuadPart' : [ 0x0, ['unsigned long long']], -} ], - '__unnamed_1098' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_109a' : [ 0x4, { - 'Flags' : [ 0x0, ['unsigned long']], - 's' : [ 0x0, ['__unnamed_1098']], -} ], - '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { - 'Version' : [ 0x0, ['unsigned long']], - 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], - 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], - 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], - 'RaceDll' : [ 0x20, ['pointer64', ['void']]], - 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], - 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], - 'u' : [ 0x38, ['__unnamed_109a']], - 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], - 'Size' : [ 0x40, ['unsigned long']], -} ], - '_TEB' : [ 0x1838, { - 'NtTib' : [ 0x0, ['_NT_TIB']], - 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], - 'ClientId' : [ 0x40, ['_CLIENT_ID']], - 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], - 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], - 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], - 'LastErrorValue' : [ 0x68, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], - 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], - 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], - 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], - 'CurrentLocale' : [ 0x108, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], - 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['pointer64', ['void']]]], - 'SystemReserved1' : [ 0x190, ['array', 38, ['pointer64', ['void']]]], - 'ExceptionCode' : [ 0x2c0, ['long']], - 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], - 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], - 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], - 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], - 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], - 'TxFsContext' : [ 0x2e8, ['unsigned long']], - 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], - 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], - 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], - 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], - 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], - 'GdiClientPID' : [ 0x7f0, ['unsigned long']], - 'GdiClientTID' : [ 0x7f4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], - 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], - 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], - 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], - 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], - 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], - 'glSection' : [ 0x1230, ['pointer64', ['void']]], - 'glTable' : [ 0x1238, ['pointer64', ['void']]], - 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], - 'glContext' : [ 0x1248, ['pointer64', ['void']]], - 'LastStatusValue' : [ 0x1250, ['unsigned long']], - 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], - 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], - 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], - 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], - 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], - 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], - 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], - 'Vdm' : [ 0x1690, ['pointer64', ['void']]], - 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], - 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], - 'HardErrorMode' : [ 0x16b0, ['unsigned long']], - 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], - 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], - 'ActivityId' : [ 0x1710, ['_GUID']], - 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], - 'PerflibData' : [ 0x1728, ['pointer64', ['void']]], - 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], - 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], - 'GdiBatchCount' : [ 0x1740, ['unsigned long']], - 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], - 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], - 'ReservedPad0' : [ 0x1744, ['unsigned char']], - 'ReservedPad1' : [ 0x1745, ['unsigned char']], - 'ReservedPad2' : [ 0x1746, ['unsigned char']], - 'IdealProcessor' : [ 0x1747, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], - 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], - 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], - 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], - 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], - 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], - 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], - 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], - 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], - 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], - 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], - 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], - 'MuiGeneration' : [ 0x1798, ['unsigned long']], - 'IsImpersonating' : [ 0x179c, ['unsigned long']], - 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], - 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], - 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], - 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], - 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], - 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], - 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], - 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], - 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], - 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], - 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], - 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], - 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], - 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], - 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], - 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], - 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], - 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], - 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], - 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], - 'LockCount' : [ 0x1808, ['unsigned long']], - 'WowTebOffset' : [ 0x180c, ['long']], - 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], - 'ReservedForWdf' : [ 0x1818, ['pointer64', ['void']]], - 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], - 'EffectiveContainerId' : [ 0x1828, ['_GUID']], -} ], - '_LIST_ENTRY' : [ 0x10, { - 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], - 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], -} ], - '_SINGLE_LIST_ENTRY' : [ 0x8, { - 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], -} ], - '_RTL_SPLAY_LINKS' : [ 0x18, { - 'Parent' : [ 0x0, ['pointer64', ['_RTL_SPLAY_LINKS']]], - 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_SPLAY_LINKS']]], - 'RightChild' : [ 0x10, ['pointer64', ['_RTL_SPLAY_LINKS']]], -} ], - '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { - 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], - 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], - 'Signature' : [ 0x10, ['unsigned long long']], -} ], - '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { - 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], - 'CurEntry' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], - 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], - 'BucketIndex' : [ 0x20, ['unsigned long']], -} ], - '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { - 'Flags' : [ 0x0, ['unsigned long']], - 'Shift' : [ 0x4, ['unsigned long']], - 'TableSize' : [ 0x8, ['unsigned long']], - 'Pivot' : [ 0xc, ['unsigned long']], - 'DivisorMask' : [ 0x10, ['unsigned long']], - 'NumEntries' : [ 0x14, ['unsigned long']], - 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], - 'NumEnumerators' : [ 0x1c, ['unsigned long']], - 'Directory' : [ 0x20, ['pointer64', ['void']]], -} ], - '_UNICODE_STRING' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x8, ['pointer64', ['unsigned short']]], -} ], - '_STRING' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], -} ], - '__unnamed_1108' : [ 0x8, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'HighPart' : [ 0x4, ['long']], -} ], - '_LARGE_INTEGER' : [ 0x8, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'HighPart' : [ 0x4, ['long']], - 'u' : [ 0x0, ['__unnamed_1108']], - 'QuadPart' : [ 0x0, ['long long']], -} ], - '_RTL_BITMAP' : [ 0x10, { - 'SizeOfBitMap' : [ 0x0, ['unsigned long']], - 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], -} ], - '_LUID' : [ 0x8, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'HighPart' : [ 0x4, ['long']], -} ], - '_IMAGE_NT_HEADERS64' : [ 0x108, { - 'Signature' : [ 0x0, ['unsigned long']], - 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], - 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], -} ], - '_IMAGE_DOS_HEADER' : [ 0x40, { - 'e_magic' : [ 0x0, ['unsigned short']], - 'e_cblp' : [ 0x2, ['unsigned short']], - 'e_cp' : [ 0x4, ['unsigned short']], - 'e_crlc' : [ 0x6, ['unsigned short']], - 'e_cparhdr' : [ 0x8, ['unsigned short']], - 'e_minalloc' : [ 0xa, ['unsigned short']], - 'e_maxalloc' : [ 0xc, ['unsigned short']], - 'e_ss' : [ 0xe, ['unsigned short']], - 'e_sp' : [ 0x10, ['unsigned short']], - 'e_csum' : [ 0x12, ['unsigned short']], - 'e_ip' : [ 0x14, ['unsigned short']], - 'e_cs' : [ 0x16, ['unsigned short']], - 'e_lfarlc' : [ 0x18, ['unsigned short']], - 'e_ovno' : [ 0x1a, ['unsigned short']], - 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], - 'e_oemid' : [ 0x24, ['unsigned short']], - 'e_oeminfo' : [ 0x26, ['unsigned short']], - 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], - 'e_lfanew' : [ 0x3c, ['long']], -} ], - '_RTL_RB_TREE' : [ 0x10, { - 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], - 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], -} ], - '_RTL_BALANCED_NODE' : [ 0x18, { - 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], - 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], - 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], - 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], - 'ParentValue' : [ 0x10, ['unsigned long long']], -} ], - '_RTL_AVL_TREE' : [ 0x8, { - 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], -} ], - '_GUID' : [ 0x10, { - 'Data1' : [ 0x0, ['unsigned long']], - 'Data2' : [ 0x4, ['unsigned short']], - 'Data3' : [ 0x6, ['unsigned short']], - 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], -} ], - '_KPCR' : [ 0x6a80, { - 'NtTib' : [ 0x0, ['_NT_TIB']], - 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], - 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], - 'UserRsp' : [ 0x10, ['unsigned long long']], - 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], - 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], - 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], - 'Used_Self' : [ 0x30, ['pointer64', ['void']]], - 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], - 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], - 'Irql' : [ 0x50, ['unsigned char']], - 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], - 'ObsoleteNumber' : [ 0x52, ['unsigned char']], - 'Fill0' : [ 0x53, ['unsigned char']], - 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], - 'MajorVersion' : [ 0x60, ['unsigned short']], - 'MinorVersion' : [ 0x62, ['unsigned short']], - 'StallScaleFactor' : [ 0x64, ['unsigned long']], - 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], - 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], - 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], - 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], - 'Unused2' : [ 0x100, ['unsigned long']], - 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], - 'Unused3' : [ 0x110, ['pointer64', ['void']]], - 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], - 'Prcb' : [ 0x180, ['_KPRCB']], -} ], - '_KPRCB' : [ 0x6900, { - 'MxCsr' : [ 0x0, ['unsigned long']], - 'LegacyNumber' : [ 0x4, ['unsigned char']], - 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], - 'InterruptRequest' : [ 0x6, ['unsigned char']], - 'IdleHalt' : [ 0x7, ['unsigned char']], - 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], - 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], - 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], - 'NestingLevel' : [ 0x20, ['unsigned char']], - 'ClockOwner' : [ 0x21, ['unsigned char']], - 'PendingTickFlags' : [ 0x22, ['unsigned char']], - 'PendingTick' : [ 0x22, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'PendingBackupTick' : [ 0x22, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'IdleState' : [ 0x23, ['unsigned char']], - 'Number' : [ 0x24, ['unsigned long']], - 'RspBase' : [ 0x28, ['unsigned long long']], - 'PrcbLock' : [ 0x30, ['unsigned long long']], - 'PriorityState' : [ 0x38, ['pointer64', ['unsigned char']]], - 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], - 'CpuType' : [ 0x5f0, ['unsigned char']], - 'CpuID' : [ 0x5f1, ['unsigned char']], - 'CpuStep' : [ 0x5f2, ['unsigned short']], - 'CpuStepping' : [ 0x5f2, ['unsigned char']], - 'CpuModel' : [ 0x5f3, ['unsigned char']], - 'MHz' : [ 0x5f4, ['unsigned long']], - 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], - 'MinorVersion' : [ 0x638, ['unsigned short']], - 'MajorVersion' : [ 0x63a, ['unsigned short']], - 'BuildType' : [ 0x63c, ['unsigned char']], - 'CpuVendor' : [ 0x63d, ['unsigned char']], - 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], - 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], - 'ParentNode' : [ 0x640, ['pointer64', ['_KNODE']]], - 'GroupSetMember' : [ 0x648, ['unsigned long long']], - 'Group' : [ 0x650, ['unsigned char']], - 'GroupIndex' : [ 0x651, ['unsigned char']], - 'PrcbPad05' : [ 0x652, ['array', 2, ['unsigned char']]], - 'InitialApicId' : [ 0x654, ['unsigned long']], - 'ScbOffset' : [ 0x658, ['unsigned long']], - 'ApicMask' : [ 0x65c, ['unsigned long']], - 'AcpiReserved' : [ 0x660, ['pointer64', ['void']]], - 'CFlushSize' : [ 0x668, ['unsigned long']], - 'PrcbPad10' : [ 0x66c, ['unsigned long']], - 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], - 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], - 'PPNxPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], - 'PPNPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], - 'PPPagedLookasideList' : [ 0x2080, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], - 'PrcbPad20' : [ 0x2c80, ['unsigned long long']], - 'DeferredReadyListHead' : [ 0x2c88, ['_SINGLE_LIST_ENTRY']], - 'MmPageFaultCount' : [ 0x2c90, ['long']], - 'MmCopyOnWriteCount' : [ 0x2c94, ['long']], - 'MmTransitionCount' : [ 0x2c98, ['long']], - 'MmDemandZeroCount' : [ 0x2c9c, ['long']], - 'MmPageReadCount' : [ 0x2ca0, ['long']], - 'MmPageReadIoCount' : [ 0x2ca4, ['long']], - 'MmDirtyPagesWriteCount' : [ 0x2ca8, ['long']], - 'MmDirtyWriteIoCount' : [ 0x2cac, ['long']], - 'MmMappedPagesWriteCount' : [ 0x2cb0, ['long']], - 'MmMappedWriteIoCount' : [ 0x2cb4, ['long']], - 'KeSystemCalls' : [ 0x2cb8, ['unsigned long']], - 'KeContextSwitches' : [ 0x2cbc, ['unsigned long']], - 'LdtSelector' : [ 0x2cc0, ['unsigned short']], - 'PrcbPad40' : [ 0x2cc2, ['unsigned short']], - 'CcFastReadNoWait' : [ 0x2cc4, ['unsigned long']], - 'CcFastReadWait' : [ 0x2cc8, ['unsigned long']], - 'CcFastReadNotPossible' : [ 0x2ccc, ['unsigned long']], - 'CcCopyReadNoWait' : [ 0x2cd0, ['unsigned long']], - 'CcCopyReadWait' : [ 0x2cd4, ['unsigned long']], - 'CcCopyReadNoWaitMiss' : [ 0x2cd8, ['unsigned long']], - 'IoReadOperationCount' : [ 0x2cdc, ['long']], - 'IoWriteOperationCount' : [ 0x2ce0, ['long']], - 'IoOtherOperationCount' : [ 0x2ce4, ['long']], - 'IoReadTransferCount' : [ 0x2ce8, ['_LARGE_INTEGER']], - 'IoWriteTransferCount' : [ 0x2cf0, ['_LARGE_INTEGER']], - 'IoOtherTransferCount' : [ 0x2cf8, ['_LARGE_INTEGER']], - 'PacketBarrier' : [ 0x2d00, ['long']], - 'TargetCount' : [ 0x2d04, ['long']], - 'IpiFrozen' : [ 0x2d08, ['unsigned long']], - 'IsrDpcStats' : [ 0x2d10, ['pointer64', ['void']]], - 'DeviceInterrupts' : [ 0x2d18, ['unsigned long']], - 'LookasideIrpFloat' : [ 0x2d1c, ['long']], - 'InterruptLastCount' : [ 0x2d20, ['unsigned long']], - 'InterruptRate' : [ 0x2d24, ['unsigned long']], - 'PrcbPad41' : [ 0x2d28, ['array', 22, ['unsigned long']]], - 'DpcData' : [ 0x2d80, ['array', 2, ['_KDPC_DATA']]], - 'DpcStack' : [ 0x2dd0, ['pointer64', ['void']]], - 'MaximumDpcQueueDepth' : [ 0x2dd8, ['long']], - 'DpcRequestRate' : [ 0x2ddc, ['unsigned long']], - 'MinimumDpcRate' : [ 0x2de0, ['unsigned long']], - 'DpcLastCount' : [ 0x2de4, ['unsigned long']], - 'ThreadDpcEnable' : [ 0x2de8, ['unsigned char']], - 'QuantumEnd' : [ 0x2de9, ['unsigned char']], - 'DpcRoutineActive' : [ 0x2dea, ['unsigned char']], - 'IdleSchedule' : [ 0x2deb, ['unsigned char']], - 'DpcRequestSummary' : [ 0x2dec, ['long']], - 'DpcRequestSlot' : [ 0x2dec, ['array', 2, ['short']]], - 'NormalDpcState' : [ 0x2dec, ['short']], - 'ThreadDpcState' : [ 0x2dee, ['short']], - 'DpcNormalProcessingActive' : [ 0x2dec, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DpcNormalProcessingRequested' : [ 0x2dec, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'DpcNormalThreadSignal' : [ 0x2dec, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'DpcNormalTimerExpiration' : [ 0x2dec, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'DpcNormalDpcPresent' : [ 0x2dec, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'DpcNormalLocalInterrupt' : [ 0x2dec, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DpcNormalSpare' : [ 0x2dec, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], - 'DpcThreadActive' : [ 0x2dec, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'DpcThreadRequested' : [ 0x2dec, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'DpcThreadSpare' : [ 0x2dec, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], - 'LastTimerHand' : [ 0x2df0, ['unsigned long']], - 'LastTick' : [ 0x2df4, ['unsigned long']], - 'ClockInterrupts' : [ 0x2df8, ['unsigned long']], - 'ReadyScanTick' : [ 0x2dfc, ['unsigned long']], - 'InterruptObject' : [ 0x2e00, ['array', 256, ['pointer64', ['void']]]], - 'TimerTable' : [ 0x3600, ['_KTIMER_TABLE']], - 'DpcGate' : [ 0x5800, ['_KGATE']], - 'PrcbPad52' : [ 0x5818, ['pointer64', ['void']]], - 'CallDpc' : [ 0x5820, ['_KDPC']], - 'ClockKeepAlive' : [ 0x5860, ['long']], - 'PrcbPad60' : [ 0x5864, ['array', 2, ['unsigned char']]], - 'NmiActive' : [ 0x5866, ['unsigned short']], - 'DpcWatchdogPeriod' : [ 0x5868, ['long']], - 'DpcWatchdogCount' : [ 0x586c, ['long']], - 'KeSpinLockOrdering' : [ 0x5870, ['long']], - 'PrcbPad70' : [ 0x5874, ['array', 1, ['unsigned long']]], - 'CachedPtes' : [ 0x5878, ['pointer64', ['void']]], - 'WaitListHead' : [ 0x5880, ['_LIST_ENTRY']], - 'WaitLock' : [ 0x5890, ['unsigned long long']], - 'ReadySummary' : [ 0x5898, ['unsigned long']], - 'AffinitizedSelectionMask' : [ 0x589c, ['long']], - 'QueueIndex' : [ 0x58a0, ['unsigned long']], - 'PrcbPad75' : [ 0x58a4, ['array', 3, ['unsigned long']]], - 'TimerExpirationDpc' : [ 0x58b0, ['_KDPC']], - 'ScbQueue' : [ 0x58f0, ['_RTL_RB_TREE']], - 'DispatcherReadyListHead' : [ 0x5900, ['array', 32, ['_LIST_ENTRY']]], - 'InterruptCount' : [ 0x5b00, ['unsigned long']], - 'KernelTime' : [ 0x5b04, ['unsigned long']], - 'UserTime' : [ 0x5b08, ['unsigned long']], - 'DpcTime' : [ 0x5b0c, ['unsigned long']], - 'InterruptTime' : [ 0x5b10, ['unsigned long']], - 'AdjustDpcThreshold' : [ 0x5b14, ['unsigned long']], - 'DebuggerSavedIRQL' : [ 0x5b18, ['unsigned char']], - 'GroupSchedulingOverQuota' : [ 0x5b19, ['unsigned char']], - 'DeepSleep' : [ 0x5b1a, ['unsigned char']], - 'PrcbPad80' : [ 0x5b1b, ['array', 5, ['unsigned char']]], - 'DpcTimeCount' : [ 0x5b20, ['unsigned long']], - 'DpcTimeLimit' : [ 0x5b24, ['unsigned long']], - 'PeriodicCount' : [ 0x5b28, ['unsigned long']], - 'PeriodicBias' : [ 0x5b2c, ['unsigned long']], - 'AvailableTime' : [ 0x5b30, ['unsigned long']], - 'KeExceptionDispatchCount' : [ 0x5b34, ['unsigned long']], - 'StartCycles' : [ 0x5b38, ['unsigned long long']], - 'TaggedCyclesStart' : [ 0x5b40, ['unsigned long long']], - 'TaggedCycles' : [ 0x5b48, ['array', 2, ['unsigned long long']]], - 'GenerationTarget' : [ 0x5b58, ['unsigned long long']], - 'AffinitizedCycles' : [ 0x5b60, ['unsigned long long']], - 'PrcbPad81' : [ 0x5b68, ['array', 29, ['unsigned long']]], - 'MmSpinLockOrdering' : [ 0x5bdc, ['long']], - 'PageColor' : [ 0x5be0, ['unsigned long']], - 'NodeColor' : [ 0x5be4, ['unsigned long']], - 'NodeShiftedColor' : [ 0x5be8, ['unsigned long']], - 'SecondaryColorMask' : [ 0x5bec, ['unsigned long']], - 'PrcbPad83' : [ 0x5bf0, ['unsigned long']], - 'CycleTime' : [ 0x5bf8, ['unsigned long long']], - 'Cycles' : [ 0x5c00, ['array', 4, ['array', 2, ['unsigned long long']]]], - 'PrcbPad84' : [ 0x5c40, ['array', 16, ['unsigned long']]], - 'CcFastMdlReadNoWait' : [ 0x5c80, ['unsigned long']], - 'CcFastMdlReadWait' : [ 0x5c84, ['unsigned long']], - 'CcFastMdlReadNotPossible' : [ 0x5c88, ['unsigned long']], - 'CcMapDataNoWait' : [ 0x5c8c, ['unsigned long']], - 'CcMapDataWait' : [ 0x5c90, ['unsigned long']], - 'CcPinMappedDataCount' : [ 0x5c94, ['unsigned long']], - 'CcPinReadNoWait' : [ 0x5c98, ['unsigned long']], - 'CcPinReadWait' : [ 0x5c9c, ['unsigned long']], - 'CcMdlReadNoWait' : [ 0x5ca0, ['unsigned long']], - 'CcMdlReadWait' : [ 0x5ca4, ['unsigned long']], - 'CcLazyWriteHotSpots' : [ 0x5ca8, ['unsigned long']], - 'CcLazyWriteIos' : [ 0x5cac, ['unsigned long']], - 'CcLazyWritePages' : [ 0x5cb0, ['unsigned long']], - 'CcDataFlushes' : [ 0x5cb4, ['unsigned long']], - 'CcDataPages' : [ 0x5cb8, ['unsigned long']], - 'CcLostDelayedWrites' : [ 0x5cbc, ['unsigned long']], - 'CcFastReadResourceMiss' : [ 0x5cc0, ['unsigned long']], - 'CcCopyReadWaitMiss' : [ 0x5cc4, ['unsigned long']], - 'CcFastMdlReadResourceMiss' : [ 0x5cc8, ['unsigned long']], - 'CcMapDataNoWaitMiss' : [ 0x5ccc, ['unsigned long']], - 'CcMapDataWaitMiss' : [ 0x5cd0, ['unsigned long']], - 'CcPinReadNoWaitMiss' : [ 0x5cd4, ['unsigned long']], - 'CcPinReadWaitMiss' : [ 0x5cd8, ['unsigned long']], - 'CcMdlReadNoWaitMiss' : [ 0x5cdc, ['unsigned long']], - 'CcMdlReadWaitMiss' : [ 0x5ce0, ['unsigned long']], - 'CcReadAheadIos' : [ 0x5ce4, ['unsigned long']], - 'MmCacheTransitionCount' : [ 0x5ce8, ['long']], - 'MmCacheReadCount' : [ 0x5cec, ['long']], - 'MmCacheIoCount' : [ 0x5cf0, ['long']], - 'PrcbPad91' : [ 0x5cf4, ['array', 3, ['unsigned long']]], - 'PowerState' : [ 0x5d00, ['_PROCESSOR_POWER_STATE']], - 'ScbList' : [ 0x5ed0, ['_LIST_ENTRY']], - 'PrcbPad92' : [ 0x5ee0, ['array', 7, ['unsigned long']]], - 'KeAlignmentFixupCount' : [ 0x5efc, ['unsigned long']], - 'DpcWatchdogDpc' : [ 0x5f00, ['_KDPC']], - 'DpcWatchdogTimer' : [ 0x5f40, ['_KTIMER']], - 'Cache' : [ 0x5f80, ['array', 5, ['_CACHE_DESCRIPTOR']]], - 'CacheCount' : [ 0x5fbc, ['unsigned long']], - 'CachedCommit' : [ 0x5fc0, ['unsigned long']], - 'CachedResidentAvailable' : [ 0x5fc4, ['unsigned long']], - 'HyperPte' : [ 0x5fc8, ['pointer64', ['void']]], - 'WheaInfo' : [ 0x5fd0, ['pointer64', ['void']]], - 'EtwSupport' : [ 0x5fd8, ['pointer64', ['void']]], - 'InterruptObjectPool' : [ 0x5fe0, ['_SLIST_HEADER']], - 'HypercallPageList' : [ 0x5ff0, ['_SLIST_HEADER']], - 'HypercallCachedPages' : [ 0x6000, ['pointer64', ['void']]], - 'VirtualApicAssist' : [ 0x6008, ['pointer64', ['void']]], - 'StatisticsPage' : [ 0x6010, ['pointer64', ['unsigned long long']]], - 'PackageProcessorSet' : [ 0x6018, ['_KAFFINITY_EX']], - 'SharedReadyQueueMask' : [ 0x60c0, ['unsigned long long']], - 'SharedReadyQueue' : [ 0x60c8, ['pointer64', ['_KSHARED_READY_QUEUE']]], - 'SharedQueueScanOwner' : [ 0x60d0, ['unsigned long']], - 'ScanSiblingIndex' : [ 0x60d4, ['unsigned long']], - 'CoreProcessorSet' : [ 0x60d8, ['unsigned long long']], - 'ScanSiblingMask' : [ 0x60e0, ['unsigned long long']], - 'LLCMask' : [ 0x60e8, ['unsigned long long']], - 'CacheProcessorMask' : [ 0x60f0, ['array', 5, ['unsigned long long']]], - 'ProcessorProfileControlArea' : [ 0x6118, ['pointer64', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], - 'ProfileEventIndexAddress' : [ 0x6120, ['pointer64', ['void']]], - 'PrcbPad94' : [ 0x6128, ['array', 11, ['unsigned long long']]], - 'SynchCounters' : [ 0x6180, ['_SYNCH_COUNTERS']], - 'PteBitCache' : [ 0x6238, ['unsigned long long']], - 'PteBitOffset' : [ 0x6240, ['unsigned long']], - 'FsCounters' : [ 0x6248, ['_FILESYSTEM_DISK_COUNTERS']], - 'VendorString' : [ 0x6258, ['array', 13, ['unsigned char']]], - 'PrcbPad100' : [ 0x6265, ['array', 3, ['unsigned char']]], - 'FeatureBits' : [ 0x6268, ['unsigned long long']], - 'PrcbPad110' : [ 0x6270, ['unsigned long']], - 'UpdateSignature' : [ 0x6278, ['_LARGE_INTEGER']], - 'Context' : [ 0x6280, ['pointer64', ['_CONTEXT']]], - 'ContextFlagsInit' : [ 0x6288, ['unsigned long']], - 'ExtendedState' : [ 0x6290, ['pointer64', ['_XSAVE_AREA']]], - 'IsrStack' : [ 0x6298, ['pointer64', ['void']]], - 'EntropyTimingState' : [ 0x62a0, ['_KENTROPY_TIMING_STATE']], - 'AbSelfIoBoostsList' : [ 0x63f0, ['_SINGLE_LIST_ENTRY']], - 'AbPropagateBoostsList' : [ 0x63f8, ['_SINGLE_LIST_ENTRY']], - 'AbDpc' : [ 0x6400, ['_KDPC']], - 'IoIrpStackProfilerCurrent' : [ 0x6440, ['_IOP_IRP_STACK_PROFILER']], - 'IoIrpStackProfilerPrevious' : [ 0x6494, ['_IOP_IRP_STACK_PROFILER']], - 'LocalSharedReadyQueue' : [ 0x6500, ['_KSHARED_READY_QUEUE']], - 'TimerExpirationTrace' : [ 0x6760, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], - 'TimerExpirationTraceCount' : [ 0x6860, ['unsigned long']], - 'ExSaPageArray' : [ 0x6868, ['pointer64', ['void']]], - 'Mailbox' : [ 0x6880, ['pointer64', ['_REQUEST_MAILBOX']]], - 'RequestMailbox' : [ 0x68c0, ['array', 1, ['_REQUEST_MAILBOX']]], -} ], - '_KFLOATING_SAVE' : [ 0x4, { - 'Dummy' : [ 0x0, ['unsigned long']], -} ], - '_SINGLE_LIST_ENTRY32' : [ 0x4, { - 'Next' : [ 0x0, ['unsigned long']], -} ], - '_EXT_SET_PARAMETERS_V0' : [ 0x10, { - 'Version' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'NoWakeTolerance' : [ 0x8, ['long long']], -} ], - '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { - 'TrustletIdentity' : [ 0x0, ['unsigned long long']], - 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], -} ], - '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { - 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], - 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], -} ], - '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { - 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], - 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], -} ], - '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { - 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], -} ], - '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { - 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], -} ], - '_KPROCESS' : [ 0x2d8, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], - 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], - 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], - 'ProcessLock' : [ 0x40, ['unsigned long']], - 'Spare0' : [ 0x44, ['unsigned long']], - 'DeepFreezeStartTime' : [ 0x48, ['unsigned long long']], - 'Affinity' : [ 0x50, ['_KAFFINITY_EX']], - 'ReadyListHead' : [ 0xf8, ['_LIST_ENTRY']], - 'SwapListEntry' : [ 0x108, ['_SINGLE_LIST_ENTRY']], - 'ActiveProcessors' : [ 0x110, ['_KAFFINITY_EX']], - 'AutoAlignment' : [ 0x1b8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], - 'DisableBoost' : [ 0x1b8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], - 'DisableQuantum' : [ 0x1b8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], - 'DeepFreeze' : [ 0x1b8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'TimerVirtualization' : [ 0x1b8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'CheckStackExtents' : [ 0x1b8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'SpareFlags0' : [ 0x1b8, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], - 'ActiveGroupsMask' : [ 0x1b8, ['BitField', dict(start_bit = 8, end_bit = 28, native_type='unsigned long')]], - 'ReservedFlags' : [ 0x1b8, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='long')]], - 'ProcessFlags' : [ 0x1b8, ['long']], - 'BasePriority' : [ 0x1bc, ['unsigned char']], - 'QuantumReset' : [ 0x1bd, ['unsigned char']], - 'Visited' : [ 0x1be, ['unsigned char']], - 'Flags' : [ 0x1bf, ['_KEXECUTE_OPTIONS']], - 'ThreadSeed' : [ 0x1c0, ['array', 20, ['unsigned long']]], - 'IdealNode' : [ 0x210, ['array', 20, ['unsigned short']]], - 'IdealGlobalNode' : [ 0x238, ['unsigned short']], - 'Spare1' : [ 0x23a, ['unsigned short']], - 'StackCount' : [ 0x23c, ['_KSTACK_COUNT']], - 'ProcessListEntry' : [ 0x240, ['_LIST_ENTRY']], - 'CycleTime' : [ 0x250, ['unsigned long long']], - 'ContextSwitches' : [ 0x258, ['unsigned long long']], - 'SchedulingGroup' : [ 0x260, ['pointer64', ['_KSCHEDULING_GROUP']]], - 'FreezeCount' : [ 0x268, ['unsigned long']], - 'KernelTime' : [ 0x26c, ['unsigned long']], - 'UserTime' : [ 0x270, ['unsigned long']], - 'LdtFreeSelectorHint' : [ 0x274, ['unsigned short']], - 'LdtTableLength' : [ 0x276, ['unsigned short']], - 'LdtSystemDescriptor' : [ 0x278, ['_KGDTENTRY64']], - 'LdtBaseAddress' : [ 0x288, ['pointer64', ['void']]], - 'LdtProcessLock' : [ 0x290, ['_FAST_MUTEX']], - 'InstrumentationCallback' : [ 0x2c8, ['pointer64', ['void']]], - 'SecurePid' : [ 0x2d0, ['unsigned long long']], -} ], - '_KTHREAD' : [ 0x5d8, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'SListFaultAddress' : [ 0x18, ['pointer64', ['void']]], - 'QuantumTarget' : [ 0x20, ['unsigned long long']], - 'InitialStack' : [ 0x28, ['pointer64', ['void']]], - 'StackLimit' : [ 0x30, ['pointer64', ['void']]], - 'StackBase' : [ 0x38, ['pointer64', ['void']]], - 'ThreadLock' : [ 0x40, ['unsigned long long']], - 'CycleTime' : [ 0x48, ['unsigned long long']], - 'CurrentRunTime' : [ 0x50, ['unsigned long']], - 'ExpectedRunTime' : [ 0x54, ['unsigned long']], - 'KernelStack' : [ 0x58, ['pointer64', ['void']]], - 'StateSaveArea' : [ 0x60, ['pointer64', ['_XSAVE_FORMAT']]], - 'SchedulingGroup' : [ 0x68, ['pointer64', ['_KSCHEDULING_GROUP']]], - 'WaitRegister' : [ 0x70, ['_KWAIT_STATUS_REGISTER']], - 'Running' : [ 0x71, ['unsigned char']], - 'Alerted' : [ 0x72, ['array', 2, ['unsigned char']]], - 'AutoBoostActive' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ReadyTransition' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'WaitNext' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SystemAffinityActive' : [ 0x74, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Alertable' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'UserStackWalkActive' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'ApcInterruptRequest' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'QuantumEndMigrate' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'UmsDirectedSwitchEnable' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'TimerActive' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'SystemThread' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'ProcessDetachActive' : [ 0x74, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'CalloutActive' : [ 0x74, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'ScbReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'ApcQueueable' : [ 0x74, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'ReservedStackInUse' : [ 0x74, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'UmsPerformingSyscall' : [ 0x74, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'TimerSuspended' : [ 0x74, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'SuspendedWaitMode' : [ 0x74, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'SuspendSchedulerApcWait' : [ 0x74, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], - 'MiscFlags' : [ 0x74, ['long']], - 'AutoAlignment' : [ 0x78, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DisableBoost' : [ 0x78, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ThreadFlagsSpare0' : [ 0x78, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'AlertedByThreadId' : [ 0x78, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'QuantumDonation' : [ 0x78, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'EnableStackSwap' : [ 0x78, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'GuiThread' : [ 0x78, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'DisableQuantum' : [ 0x78, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'ChargeOnlySchedulingGroup' : [ 0x78, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'DeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'QueueDeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'ForceDeferSchedule' : [ 0x78, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'SharedReadyQueueAffinity' : [ 0x78, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'FreezeCount' : [ 0x78, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'TerminationApcRequest' : [ 0x78, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'AutoBoostEntriesExhausted' : [ 0x78, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'KernelStackResident' : [ 0x78, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'CommitFailTerminateRequest' : [ 0x78, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'ProcessStackCountDecremented' : [ 0x78, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'ThreadFlagsSpare' : [ 0x78, ['BitField', dict(start_bit = 19, end_bit = 24, native_type='unsigned long')]], - 'EtwStackTraceApcInserted' : [ 0x78, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], - 'ThreadFlags' : [ 0x78, ['long']], - 'Tag' : [ 0x7c, ['unsigned char']], - 'SystemHeteroCpuPolicy' : [ 0x7d, ['unsigned char']], - 'UserHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], - 'ExplicitSystemHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Spare0' : [ 0x7f, ['unsigned char']], - 'SystemCallNumber' : [ 0x80, ['unsigned long']], - 'Spare10' : [ 0x84, ['unsigned long']], - 'FirstArgument' : [ 0x88, ['pointer64', ['void']]], - 'TrapFrame' : [ 0x90, ['pointer64', ['_KTRAP_FRAME']]], - 'ApcState' : [ 0x98, ['_KAPC_STATE']], - 'ApcStateFill' : [ 0x98, ['array', 43, ['unsigned char']]], - 'Priority' : [ 0xc3, ['unsigned char']], - 'UserIdealProcessor' : [ 0xc4, ['unsigned long']], - 'WaitStatus' : [ 0xc8, ['long long']], - 'WaitBlockList' : [ 0xd0, ['pointer64', ['_KWAIT_BLOCK']]], - 'WaitListEntry' : [ 0xd8, ['_LIST_ENTRY']], - 'SwapListEntry' : [ 0xd8, ['_SINGLE_LIST_ENTRY']], - 'Queue' : [ 0xe8, ['pointer64', ['_DISPATCHER_HEADER']]], - 'Teb' : [ 0xf0, ['pointer64', ['void']]], - 'RelativeTimerBias' : [ 0xf8, ['unsigned long long']], - 'Timer' : [ 0x100, ['_KTIMER']], - 'WaitBlock' : [ 0x140, ['array', 4, ['_KWAIT_BLOCK']]], - 'WaitBlockFill4' : [ 0x140, ['array', 20, ['unsigned char']]], - 'ContextSwitches' : [ 0x154, ['unsigned long']], - 'WaitBlockFill5' : [ 0x140, ['array', 68, ['unsigned char']]], - 'State' : [ 0x184, ['unsigned char']], - 'Spare13' : [ 0x185, ['unsigned char']], - 'WaitIrql' : [ 0x186, ['unsigned char']], - 'WaitMode' : [ 0x187, ['unsigned char']], - 'WaitBlockFill6' : [ 0x140, ['array', 116, ['unsigned char']]], - 'WaitTime' : [ 0x1b4, ['unsigned long']], - 'WaitBlockFill7' : [ 0x140, ['array', 164, ['unsigned char']]], - 'KernelApcDisable' : [ 0x1e4, ['short']], - 'SpecialApcDisable' : [ 0x1e6, ['short']], - 'CombinedApcDisable' : [ 0x1e4, ['unsigned long']], - 'WaitBlockFill8' : [ 0x140, ['array', 40, ['unsigned char']]], - 'ThreadCounters' : [ 0x168, ['pointer64', ['_KTHREAD_COUNTERS']]], - 'WaitBlockFill9' : [ 0x140, ['array', 88, ['unsigned char']]], - 'XStateSave' : [ 0x198, ['pointer64', ['_XSTATE_SAVE']]], - 'WaitBlockFill10' : [ 0x140, ['array', 136, ['unsigned char']]], - 'Win32Thread' : [ 0x1c8, ['pointer64', ['void']]], - 'WaitBlockFill11' : [ 0x140, ['array', 176, ['unsigned char']]], - 'Ucb' : [ 0x1f0, ['pointer64', ['_UMS_CONTROL_BLOCK']]], - 'Uch' : [ 0x1f8, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], - 'TebMappedLowVa' : [ 0x200, ['pointer64', ['void']]], - 'QueueListEntry' : [ 0x208, ['_LIST_ENTRY']], - 'NextProcessor' : [ 0x218, ['unsigned long']], - 'NextProcessorNumber' : [ 0x218, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'SharedReadyQueue' : [ 0x218, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'QueuePriority' : [ 0x21c, ['long']], - 'Process' : [ 0x220, ['pointer64', ['_KPROCESS']]], - 'UserAffinity' : [ 0x228, ['_GROUP_AFFINITY']], - 'UserAffinityFill' : [ 0x228, ['array', 10, ['unsigned char']]], - 'PreviousMode' : [ 0x232, ['unsigned char']], - 'BasePriority' : [ 0x233, ['unsigned char']], - 'PriorityDecrement' : [ 0x234, ['unsigned char']], - 'ForegroundBoost' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], - 'UnusualBoost' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'Preempted' : [ 0x235, ['unsigned char']], - 'AdjustReason' : [ 0x236, ['unsigned char']], - 'AdjustIncrement' : [ 0x237, ['unsigned char']], - 'AffinityVersion' : [ 0x238, ['unsigned long long']], - 'Affinity' : [ 0x240, ['_GROUP_AFFINITY']], - 'AffinityFill' : [ 0x240, ['array', 10, ['unsigned char']]], - 'ApcStateIndex' : [ 0x24a, ['unsigned char']], - 'WaitBlockCount' : [ 0x24b, ['unsigned char']], - 'IdealProcessor' : [ 0x24c, ['unsigned long']], - 'NpxState' : [ 0x250, ['unsigned long long']], - 'SavedApcState' : [ 0x258, ['_KAPC_STATE']], - 'SavedApcStateFill' : [ 0x258, ['array', 43, ['unsigned char']]], - 'WaitReason' : [ 0x283, ['unsigned char']], - 'SuspendCount' : [ 0x284, ['unsigned char']], - 'Saturation' : [ 0x285, ['unsigned char']], - 'SListFaultCount' : [ 0x286, ['unsigned short']], - 'SchedulerApc' : [ 0x288, ['_KAPC']], - 'SchedulerApcFill0' : [ 0x288, ['array', 1, ['unsigned char']]], - 'ResourceIndex' : [ 0x289, ['unsigned char']], - 'SchedulerApcFill1' : [ 0x288, ['array', 3, ['unsigned char']]], - 'QuantumReset' : [ 0x28b, ['unsigned char']], - 'SchedulerApcFill2' : [ 0x288, ['array', 4, ['unsigned char']]], - 'KernelTime' : [ 0x28c, ['unsigned long']], - 'SchedulerApcFill3' : [ 0x288, ['array', 64, ['unsigned char']]], - 'WaitPrcb' : [ 0x2c8, ['pointer64', ['_KPRCB']]], - 'SchedulerApcFill4' : [ 0x288, ['array', 72, ['unsigned char']]], - 'LegoData' : [ 0x2d0, ['pointer64', ['void']]], - 'SchedulerApcFill5' : [ 0x288, ['array', 83, ['unsigned char']]], - 'CallbackNestingLevel' : [ 0x2db, ['unsigned char']], - 'UserTime' : [ 0x2dc, ['unsigned long']], - 'SuspendEvent' : [ 0x2e0, ['_KEVENT']], - 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], - 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], - 'AbEntrySummary' : [ 0x318, ['unsigned char']], - 'AbWaitEntryCount' : [ 0x319, ['unsigned char']], - 'Spare20' : [ 0x31a, ['unsigned short']], - 'SecureThreadCookie' : [ 0x31c, ['unsigned long']], - 'LockEntries' : [ 0x320, ['array', 6, ['_KLOCK_ENTRY']]], - 'PropagateBoostsEntry' : [ 0x560, ['_SINGLE_LIST_ENTRY']], - 'IoSelfBoostsEntry' : [ 0x568, ['_SINGLE_LIST_ENTRY']], - 'PriorityFloorCounts' : [ 0x570, ['array', 16, ['unsigned char']]], - 'PriorityFloorSummary' : [ 0x580, ['unsigned long']], - 'AbCompletedIoBoostCount' : [ 0x584, ['long']], - 'KeReferenceCount' : [ 0x588, ['short']], - 'AbOrphanedEntrySummary' : [ 0x58a, ['unsigned char']], - 'AbOwnedEntryCount' : [ 0x58b, ['unsigned char']], - 'ForegroundLossTime' : [ 0x58c, ['unsigned long']], - 'GlobalForegroundListEntry' : [ 0x590, ['_LIST_ENTRY']], - 'ForegroundDpcStackListEntry' : [ 0x590, ['_SINGLE_LIST_ENTRY']], - 'InGlobalForegroundList' : [ 0x598, ['unsigned long long']], - 'ReadOperationCount' : [ 0x5a0, ['long long']], - 'WriteOperationCount' : [ 0x5a8, ['long long']], - 'OtherOperationCount' : [ 0x5b0, ['long long']], - 'ReadTransferCount' : [ 0x5b8, ['long long']], - 'WriteTransferCount' : [ 0x5c0, ['long long']], - 'OtherTransferCount' : [ 0x5c8, ['long long']], - 'QueuedScb' : [ 0x5d0, ['pointer64', ['_KSCB']]], -} ], - '_KSTACK_CONTROL' : [ 0x30, { - 'StackBase' : [ 0x0, ['unsigned long long']], - 'ActualLimit' : [ 0x8, ['unsigned long long']], - 'StackExpansion' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], -} ], - '_KSPIN_LOCK_QUEUE' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], - 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], -} ], - '_FAST_MUTEX' : [ 0x38, { - 'Count' : [ 0x0, ['long']], - 'Owner' : [ 0x8, ['pointer64', ['void']]], - 'Contention' : [ 0x10, ['unsigned long']], - 'Event' : [ 0x18, ['_KEVENT']], - 'OldIrql' : [ 0x30, ['unsigned long']], -} ], - '_KEVENT' : [ 0x18, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], -} ], - '__unnamed_1269' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], -} ], - '_SLIST_HEADER' : [ 0x10, { - 'Alignment' : [ 0x0, ['unsigned long long']], - 'Region' : [ 0x8, ['unsigned long long']], - 'HeaderX64' : [ 0x0, ['__unnamed_1269']], -} ], - '_LOOKASIDE_LIST_EX' : [ 0x60, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], -} ], - '_SLIST_ENTRY' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], -} ], - '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], -} ], - '_PAGED_LOOKASIDE_LIST' : [ 0x80, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], -} ], - '_IO_STATUS_BLOCK' : [ 0x10, { - 'Status' : [ 0x0, ['long']], - 'Pointer' : [ 0x0, ['pointer64', ['void']]], - 'Information' : [ 0x8, ['unsigned long long']], -} ], - '_QUAD' : [ 0x8, { - 'UseThisFieldToCopy' : [ 0x0, ['long long']], - 'DoNotUseThisField' : [ 0x0, ['double']], -} ], - '_WORK_QUEUE_ITEM' : [ 0x20, { - 'List' : [ 0x0, ['_LIST_ENTRY']], - 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], - 'Parameter' : [ 0x18, ['pointer64', ['void']]], -} ], - '_EXT_DELETE_PARAMETERS' : [ 0x18, { - 'Version' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'DeleteCallback' : [ 0x8, ['pointer64', ['void']]], - 'DeleteContext' : [ 0x10, ['pointer64', ['void']]], -} ], - '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], - 'Value' : [ 0x0, ['unsigned long long']], - 'Ptr' : [ 0x0, ['pointer64', ['void']]], -} ], - '_PP_LOOKASIDE_LIST' : [ 0x10, { - 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], - 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], -} ], - '_GENERAL_LOOKASIDE' : [ 0x80, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Depth' : [ 0x10, ['unsigned short']], - 'MaximumDepth' : [ 0x12, ['unsigned short']], - 'TotalAllocates' : [ 0x14, ['unsigned long']], - 'AllocateMisses' : [ 0x18, ['unsigned long']], - 'AllocateHits' : [ 0x18, ['unsigned long']], - 'TotalFrees' : [ 0x1c, ['unsigned long']], - 'FreeMisses' : [ 0x20, ['unsigned long']], - 'FreeHits' : [ 0x20, ['unsigned long']], - 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'Tag' : [ 0x28, ['unsigned long']], - 'Size' : [ 0x2c, ['unsigned long']], - 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], - 'Allocate' : [ 0x30, ['pointer64', ['void']]], - 'FreeEx' : [ 0x38, ['pointer64', ['void']]], - 'Free' : [ 0x38, ['pointer64', ['void']]], - 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], - 'LastTotalAllocates' : [ 0x50, ['unsigned long']], - 'LastAllocateMisses' : [ 0x54, ['unsigned long']], - 'LastAllocateHits' : [ 0x54, ['unsigned long']], - 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], -} ], - '_KNODE' : [ 0x100, { - 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long long']], - 'IdleSmtSet' : [ 0x8, ['unsigned long long']], - 'IdleCpuSet' : [ 0x10, ['unsigned long long']], - 'DeepIdleSet' : [ 0x40, ['unsigned long long']], - 'IdleConstrainedSet' : [ 0x48, ['unsigned long long']], - 'NonParkedSet' : [ 0x50, ['unsigned long long']], - 'ParkLock' : [ 0x58, ['long']], - 'Seed' : [ 0x5c, ['unsigned long']], - 'SiblingMask' : [ 0x80, ['unsigned long']], - 'Affinity' : [ 0x88, ['_GROUP_AFFINITY']], - 'AffinityFill' : [ 0x88, ['array', 10, ['unsigned char']]], - 'NodeNumber' : [ 0x92, ['unsigned short']], - 'PrimaryNodeNumber' : [ 0x94, ['unsigned short']], - 'Stride' : [ 0x96, ['unsigned char']], - 'Spare0' : [ 0x97, ['unsigned char']], - 'SharedReadyQueueLeaders' : [ 0x98, ['unsigned long long']], - 'ProximityId' : [ 0xa0, ['unsigned long']], - 'Lowest' : [ 0xa4, ['unsigned long']], - 'Highest' : [ 0xa8, ['unsigned long']], - 'MaximumProcessors' : [ 0xac, ['unsigned char']], - 'Flags' : [ 0xad, ['_flags']], - 'Spare10' : [ 0xae, ['unsigned char']], - 'HeteroSets' : [ 0xb0, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], -} ], - '_ENODE' : [ 0x540, { - 'Ncb' : [ 0x0, ['_KNODE']], - 'ExWorkQueues' : [ 0x100, ['array', 8, ['pointer64', ['_EX_WORK_QUEUE']]]], - 'ExWorkQueue' : [ 0x140, ['_EX_WORK_QUEUE']], - 'ExpThreadSetManagerEvent' : [ 0x410, ['_KEVENT']], - 'ExpDeadlockTimer' : [ 0x428, ['_KTIMER']], - 'ExpThreadReaperEvent' : [ 0x468, ['_KEVENT']], - 'WaitBlocks' : [ 0x480, ['array', 3, ['_KWAIT_BLOCK']]], - 'ExpWorkerThreadBalanceManagerPtr' : [ 0x510, ['pointer64', ['_ETHREAD']]], - 'ExpWorkerSeed' : [ 0x518, ['unsigned long']], - 'ExWorkerFullInit' : [ 0x51c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ExWorkerStructInit' : [ 0x51c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ExWorkerFlags' : [ 0x51c, ['unsigned long']], -} ], - '_HANDLE_TABLE' : [ 0x80, { - 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], - 'ExtraInfoPages' : [ 0x4, ['long']], - 'TableCode' : [ 0x8, ['unsigned long long']], - 'QuotaProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'HandleTableList' : [ 0x18, ['_LIST_ENTRY']], - 'UniqueProcessId' : [ 0x28, ['unsigned long']], - 'Flags' : [ 0x2c, ['unsigned long']], - 'StrictFIFO' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'EnableHandleExceptions' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Rundown' : [ 0x2c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Duplicated' : [ 0x2c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x2c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], - 'HandleTableLock' : [ 0x38, ['_EX_PUSH_LOCK']], - 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], - 'ActualEntry' : [ 0x40, ['array', 32, ['unsigned char']]], - 'DebugInfo' : [ 0x60, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], -} ], - '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { - 'AuditMask' : [ 0x0, ['unsigned long']], -} ], - '_HANDLE_TABLE_ENTRY' : [ 0x10, { - 'VolatileLowValue' : [ 0x0, ['long long']], - 'LowValue' : [ 0x0, ['long long']], - 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], - 'HighValue' : [ 0x8, ['long long']], - 'NextFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], - 'LeafHandleValue' : [ 0x8, ['_EXHANDLE']], - 'RefCountField' : [ 0x0, ['long long']], - 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 17, native_type='unsigned long long')]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 20, native_type='unsigned long long')]], - 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 64, native_type='unsigned long long')]], - 'GrantedAccessBits' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], - 'NoRightsUpgrade' : [ 0x8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'Spare1' : [ 0x8, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], - 'Spare2' : [ 0xc, ['unsigned long']], -} ], - '_EX_FAST_REF' : [ 0x8, { - 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], - 'Value' : [ 0x0, ['unsigned long long']], -} ], - '__unnamed_135c' : [ 0x2c, { - 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], - 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], -} ], - '_ACCESS_STATE' : [ 0xa0, { - 'OperationID' : [ 0x0, ['_LUID']], - 'SecurityEvaluated' : [ 0x8, ['unsigned char']], - 'GenerateAudit' : [ 0x9, ['unsigned char']], - 'GenerateOnClose' : [ 0xa, ['unsigned char']], - 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], - 'Flags' : [ 0xc, ['unsigned long']], - 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], - 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], - 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], - 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], - 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], - 'AuxData' : [ 0x48, ['pointer64', ['void']]], - 'Privileges' : [ 0x50, ['__unnamed_135c']], - 'AuditPrivileges' : [ 0x7c, ['unsigned char']], - 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], - 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], -} ], - '_AUX_ACCESS_DATA' : [ 0xe0, { - 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], - 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], - 'AccessesToAudit' : [ 0x18, ['unsigned long']], - 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], - 'TransactionId' : [ 0x20, ['_GUID']], - 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], - 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], - 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], - 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], - 'SDLock' : [ 0x50, ['pointer64', ['void']]], - 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], - 'GenerateStagingEvents' : [ 0xd8, ['unsigned char']], -} ], - '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { - 'HandleAttributes' : [ 0x0, ['unsigned long']], - 'GrantedAccess' : [ 0x4, ['unsigned long']], -} ], - '_EPROCESS' : [ 0x788, { - 'Pcb' : [ 0x0, ['_KPROCESS']], - 'ProcessLock' : [ 0x2d8, ['_EX_PUSH_LOCK']], - 'RundownProtect' : [ 0x2e0, ['_EX_RUNDOWN_REF']], - 'UniqueProcessId' : [ 0x2e8, ['pointer64', ['void']]], - 'ActiveProcessLinks' : [ 0x2f0, ['_LIST_ENTRY']], - 'Flags2' : [ 0x300, ['unsigned long']], - 'JobNotReallyActive' : [ 0x300, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'AccountingFolded' : [ 0x300, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'NewProcessReported' : [ 0x300, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ExitProcessReported' : [ 0x300, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ReportCommitChanges' : [ 0x300, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'LastReportMemory' : [ 0x300, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'ForceWakeCharge' : [ 0x300, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'CrossSessionCreate' : [ 0x300, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'NeedsHandleRundown' : [ 0x300, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'RefTraceEnabled' : [ 0x300, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'DisableDynamicCode' : [ 0x300, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'EmptyJobEvaluated' : [ 0x300, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'DefaultPagePriority' : [ 0x300, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], - 'PrimaryTokenFrozen' : [ 0x300, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'ProcessVerifierTarget' : [ 0x300, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'StackRandomizationDisabled' : [ 0x300, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'AffinityPermanent' : [ 0x300, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'AffinityUpdateEnable' : [ 0x300, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'PropagateNode' : [ 0x300, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'ExplicitAffinity' : [ 0x300, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'ProcessExecutionState' : [ 0x300, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], - 'DisallowStrippedImages' : [ 0x300, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'HighEntropyASLREnabled' : [ 0x300, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'ExtensionPointDisable' : [ 0x300, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'ForceRelocateImages' : [ 0x300, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], - 'ProcessStateChangeRequest' : [ 0x300, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], - 'ProcessStateChangeInProgress' : [ 0x300, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'DisallowWin32kSystemCalls' : [ 0x300, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'Flags' : [ 0x304, ['unsigned long']], - 'CreateReported' : [ 0x304, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'NoDebugInherit' : [ 0x304, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ProcessExiting' : [ 0x304, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ProcessDelete' : [ 0x304, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ControlFlowGuardEnabled' : [ 0x304, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'VmDeleted' : [ 0x304, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'OutswapEnabled' : [ 0x304, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'Outswapped' : [ 0x304, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'FailFastOnCommitFail' : [ 0x304, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'Wow64VaSpace4Gb' : [ 0x304, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'AddressSpaceInitialized' : [ 0x304, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], - 'SetTimerResolution' : [ 0x304, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'BreakOnTermination' : [ 0x304, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'DeprioritizeViews' : [ 0x304, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'WriteWatch' : [ 0x304, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'ProcessInSession' : [ 0x304, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'OverrideAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'HasAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'LaunchPrefetched' : [ 0x304, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'Background' : [ 0x304, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'VmTopDown' : [ 0x304, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'ImageNotifyDone' : [ 0x304, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], - 'PdeUpdateNeeded' : [ 0x304, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], - 'VdmAllowed' : [ 0x304, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'ProcessRundown' : [ 0x304, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'ProcessInserted' : [ 0x304, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'DefaultIoPriority' : [ 0x304, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], - 'ProcessSelfDelete' : [ 0x304, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'SetTimerResolutionLink' : [ 0x304, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'CreateTime' : [ 0x308, ['_LARGE_INTEGER']], - 'ProcessQuotaUsage' : [ 0x310, ['array', 2, ['unsigned long long']]], - 'ProcessQuotaPeak' : [ 0x320, ['array', 2, ['unsigned long long']]], - 'PeakVirtualSize' : [ 0x330, ['unsigned long long']], - 'VirtualSize' : [ 0x338, ['unsigned long long']], - 'SessionProcessLinks' : [ 0x340, ['_LIST_ENTRY']], - 'ExceptionPortData' : [ 0x350, ['pointer64', ['void']]], - 'ExceptionPortValue' : [ 0x350, ['unsigned long long']], - 'ExceptionPortState' : [ 0x350, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], - 'Token' : [ 0x358, ['_EX_FAST_REF']], - 'WorkingSetPage' : [ 0x360, ['unsigned long long']], - 'AddressCreationLock' : [ 0x368, ['_EX_PUSH_LOCK']], - 'PageTableCommitmentLock' : [ 0x370, ['_EX_PUSH_LOCK']], - 'RotateInProgress' : [ 0x378, ['pointer64', ['_ETHREAD']]], - 'ForkInProgress' : [ 0x380, ['pointer64', ['_ETHREAD']]], - 'CommitChargeJob' : [ 0x388, ['pointer64', ['_EJOB']]], - 'CloneRoot' : [ 0x390, ['_RTL_AVL_TREE']], - 'NumberOfPrivatePages' : [ 0x398, ['unsigned long long']], - 'NumberOfLockedPages' : [ 0x3a0, ['unsigned long long']], - 'Win32Process' : [ 0x3a8, ['pointer64', ['void']]], - 'Job' : [ 0x3b0, ['pointer64', ['_EJOB']]], - 'SectionObject' : [ 0x3b8, ['pointer64', ['void']]], - 'SectionBaseAddress' : [ 0x3c0, ['pointer64', ['void']]], - 'Cookie' : [ 0x3c8, ['unsigned long']], - 'WorkingSetWatch' : [ 0x3d0, ['pointer64', ['_PAGEFAULT_HISTORY']]], - 'Win32WindowStation' : [ 0x3d8, ['pointer64', ['void']]], - 'InheritedFromUniqueProcessId' : [ 0x3e0, ['pointer64', ['void']]], - 'LdtInformation' : [ 0x3e8, ['pointer64', ['void']]], - 'OwnerProcessId' : [ 0x3f0, ['unsigned long long']], - 'Peb' : [ 0x3f8, ['pointer64', ['_PEB']]], - 'Session' : [ 0x400, ['pointer64', ['void']]], - 'AweInfo' : [ 0x408, ['pointer64', ['void']]], - 'QuotaBlock' : [ 0x410, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], - 'ObjectTable' : [ 0x418, ['pointer64', ['_HANDLE_TABLE']]], - 'DebugPort' : [ 0x420, ['pointer64', ['void']]], - 'WoW64Process' : [ 0x428, ['pointer64', ['_EWOW64PROCESS']]], - 'DeviceMap' : [ 0x430, ['pointer64', ['void']]], - 'EtwDataSource' : [ 0x438, ['pointer64', ['void']]], - 'PageDirectoryPte' : [ 0x440, ['unsigned long long']], - 'ImageFilePointer' : [ 0x448, ['pointer64', ['_FILE_OBJECT']]], - 'ImageFileName' : [ 0x450, ['array', 15, ['unsigned char']]], - 'PriorityClass' : [ 0x45f, ['unsigned char']], - 'SecurityPort' : [ 0x460, ['pointer64', ['void']]], - 'SeAuditProcessCreationInfo' : [ 0x468, ['_SE_AUDIT_PROCESS_CREATION_INFO']], - 'JobLinks' : [ 0x470, ['_LIST_ENTRY']], - 'HighestUserAddress' : [ 0x480, ['pointer64', ['void']]], - 'ThreadListHead' : [ 0x488, ['_LIST_ENTRY']], - 'ActiveThreads' : [ 0x498, ['unsigned long']], - 'ImagePathHash' : [ 0x49c, ['unsigned long']], - 'DefaultHardErrorProcessing' : [ 0x4a0, ['unsigned long']], - 'LastThreadExitStatus' : [ 0x4a4, ['long']], - 'PrefetchTrace' : [ 0x4a8, ['_EX_FAST_REF']], - 'LockedPagesList' : [ 0x4b0, ['pointer64', ['void']]], - 'ReadOperationCount' : [ 0x4b8, ['_LARGE_INTEGER']], - 'WriteOperationCount' : [ 0x4c0, ['_LARGE_INTEGER']], - 'OtherOperationCount' : [ 0x4c8, ['_LARGE_INTEGER']], - 'ReadTransferCount' : [ 0x4d0, ['_LARGE_INTEGER']], - 'WriteTransferCount' : [ 0x4d8, ['_LARGE_INTEGER']], - 'OtherTransferCount' : [ 0x4e0, ['_LARGE_INTEGER']], - 'CommitChargeLimit' : [ 0x4e8, ['unsigned long long']], - 'CommitCharge' : [ 0x4f0, ['unsigned long long']], - 'CommitChargePeak' : [ 0x4f8, ['unsigned long long']], - 'Vm' : [ 0x500, ['_MMSUPPORT']], - 'MmProcessLinks' : [ 0x5f8, ['_LIST_ENTRY']], - 'ModifiedPageCount' : [ 0x608, ['unsigned long']], - 'ExitStatus' : [ 0x60c, ['long']], - 'VadRoot' : [ 0x610, ['_RTL_AVL_TREE']], - 'VadHint' : [ 0x618, ['pointer64', ['void']]], - 'VadCount' : [ 0x620, ['unsigned long long']], - 'VadPhysicalPages' : [ 0x628, ['unsigned long long']], - 'VadPhysicalPagesLimit' : [ 0x630, ['unsigned long long']], - 'AlpcContext' : [ 0x638, ['_ALPC_PROCESS_CONTEXT']], - 'TimerResolutionLink' : [ 0x658, ['_LIST_ENTRY']], - 'TimerResolutionStackRecord' : [ 0x668, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], - 'RequestedTimerResolution' : [ 0x670, ['unsigned long']], - 'SmallestTimerResolution' : [ 0x674, ['unsigned long']], - 'ExitTime' : [ 0x678, ['_LARGE_INTEGER']], - 'InvertedFunctionTable' : [ 0x680, ['pointer64', ['_INVERTED_FUNCTION_TABLE']]], - 'InvertedFunctionTableLock' : [ 0x688, ['_EX_PUSH_LOCK']], - 'ActiveThreadsHighWatermark' : [ 0x690, ['unsigned long']], - 'LargePrivateVadCount' : [ 0x694, ['unsigned long']], - 'ThreadListLock' : [ 0x698, ['_EX_PUSH_LOCK']], - 'WnfContext' : [ 0x6a0, ['pointer64', ['void']]], - 'Spare0' : [ 0x6a8, ['unsigned long long']], - 'SignatureLevel' : [ 0x6b0, ['unsigned char']], - 'SectionSignatureLevel' : [ 0x6b1, ['unsigned char']], - 'Protection' : [ 0x6b2, ['_PS_PROTECTION']], - 'HangCount' : [ 0x6b3, ['unsigned char']], - 'Flags3' : [ 0x6b4, ['unsigned long']], - 'Minimal' : [ 0x6b4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ReplacingPageRoot' : [ 0x6b4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'DisableNonSystemFonts' : [ 0x6b4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'AuditNonSystemFontLoading' : [ 0x6b4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Crashed' : [ 0x6b4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'JobVadsAreTracked' : [ 0x6b4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'VadTrackingDisabled' : [ 0x6b4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'AuxiliaryProcess' : [ 0x6b4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'SubsystemProcess' : [ 0x6b4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'IndirectCpuSets' : [ 0x6b4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'InPrivate' : [ 0x6b4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'ProhibitRemoteImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'ProhibitLowILImageMap' : [ 0x6b4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'SignatureMitigationOptIn' : [ 0x6b4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'DeviceAsid' : [ 0x6b8, ['long']], - 'SvmData' : [ 0x6c0, ['pointer64', ['void']]], - 'SvmProcessLock' : [ 0x6c8, ['_EX_PUSH_LOCK']], - 'SvmLock' : [ 0x6d0, ['unsigned long long']], - 'SvmProcessDeviceListHead' : [ 0x6d8, ['_LIST_ENTRY']], - 'LastFreezeInterruptTime' : [ 0x6e8, ['unsigned long long']], - 'DiskCounters' : [ 0x6f0, ['pointer64', ['_PROCESS_DISK_COUNTERS']]], - 'PicoContext' : [ 0x6f8, ['pointer64', ['void']]], - 'TrustletIdentity' : [ 0x700, ['unsigned long long']], - 'KeepAliveCounter' : [ 0x708, ['unsigned long']], - 'NoWakeKeepAliveCounter' : [ 0x70c, ['unsigned long']], - 'HighPriorityFaultsAllowed' : [ 0x710, ['unsigned long']], - 'EnergyValues' : [ 0x718, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], - 'VmContext' : [ 0x720, ['pointer64', ['void']]], - 'SequenceNumber' : [ 0x728, ['unsigned long long']], - 'CreateInterruptTime' : [ 0x730, ['unsigned long long']], - 'CreateUnbiasedInterruptTime' : [ 0x738, ['unsigned long long']], - 'TotalUnbiasedFrozenTime' : [ 0x740, ['unsigned long long']], - 'LastAppStateUpdateTime' : [ 0x748, ['unsigned long long']], - 'LastAppStateUptime' : [ 0x750, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], - 'LastAppState' : [ 0x750, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], - 'SharedCommitCharge' : [ 0x758, ['unsigned long long']], - 'SharedCommitLock' : [ 0x760, ['_EX_PUSH_LOCK']], - 'SharedCommitLinks' : [ 0x768, ['_LIST_ENTRY']], - 'AllowedCpuSets' : [ 0x778, ['unsigned long long']], - 'DefaultCpuSets' : [ 0x780, ['unsigned long long']], - 'AllowedCpuSetsIndirect' : [ 0x778, ['pointer64', ['unsigned long long']]], - 'DefaultCpuSetsIndirect' : [ 0x780, ['pointer64', ['unsigned long long']]], -} ], - '_EWOW64PROCESS' : [ 0x10, { - 'Peb' : [ 0x0, ['pointer64', ['void']]], - 'Machine' : [ 0x8, ['unsigned short']], -} ], - '_ETHREAD' : [ 0x7c0, { - 'Tcb' : [ 0x0, ['_KTHREAD']], - 'CreateTime' : [ 0x5d8, ['_LARGE_INTEGER']], - 'ExitTime' : [ 0x5e0, ['_LARGE_INTEGER']], - 'KeyedWaitChain' : [ 0x5e0, ['_LIST_ENTRY']], - 'ChargeOnlySession' : [ 0x5f0, ['pointer64', ['void']]], - 'PostBlockList' : [ 0x5f8, ['_LIST_ENTRY']], - 'ForwardLinkShadow' : [ 0x5f8, ['pointer64', ['void']]], - 'StartAddress' : [ 0x600, ['pointer64', ['void']]], - 'TerminationPort' : [ 0x608, ['pointer64', ['_TERMINATION_PORT']]], - 'ReaperLink' : [ 0x608, ['pointer64', ['_ETHREAD']]], - 'KeyedWaitValue' : [ 0x608, ['pointer64', ['void']]], - 'ActiveTimerListLock' : [ 0x610, ['unsigned long long']], - 'ActiveTimerListHead' : [ 0x618, ['_LIST_ENTRY']], - 'Cid' : [ 0x628, ['_CLIENT_ID']], - 'KeyedWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], - 'AlpcWaitSemaphore' : [ 0x638, ['_KSEMAPHORE']], - 'ClientSecurity' : [ 0x658, ['_PS_CLIENT_SECURITY_CONTEXT']], - 'IrpList' : [ 0x660, ['_LIST_ENTRY']], - 'TopLevelIrp' : [ 0x670, ['unsigned long long']], - 'DeviceToVerify' : [ 0x678, ['pointer64', ['_DEVICE_OBJECT']]], - 'Win32StartAddress' : [ 0x680, ['pointer64', ['void']]], - 'LegacyPowerObject' : [ 0x688, ['pointer64', ['void']]], - 'ThreadListEntry' : [ 0x690, ['_LIST_ENTRY']], - 'RundownProtect' : [ 0x6a0, ['_EX_RUNDOWN_REF']], - 'ThreadLock' : [ 0x6a8, ['_EX_PUSH_LOCK']], - 'ReadClusterSize' : [ 0x6b0, ['unsigned long']], - 'MmLockOrdering' : [ 0x6b4, ['long']], - 'CmLockOrdering' : [ 0x6b8, ['long']], - 'CrossThreadFlags' : [ 0x6bc, ['unsigned long']], - 'Terminated' : [ 0x6bc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ThreadInserted' : [ 0x6bc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'HideFromDebugger' : [ 0x6bc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ActiveImpersonationInfo' : [ 0x6bc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'HardErrorsAreDisabled' : [ 0x6bc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'BreakOnTermination' : [ 0x6bc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'SkipCreationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'SkipTerminationMsg' : [ 0x6bc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'CopyTokenOnOpen' : [ 0x6bc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'ThreadIoPriority' : [ 0x6bc, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], - 'ThreadPagePriority' : [ 0x6bc, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], - 'RundownFail' : [ 0x6bc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'UmsForceQueueTermination' : [ 0x6bc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'IndirectCpuSets' : [ 0x6bc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'ReservedCrossThreadFlags' : [ 0x6bc, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], - 'SameThreadPassiveFlags' : [ 0x6c0, ['unsigned long']], - 'ActiveExWorker' : [ 0x6c0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'MemoryMaker' : [ 0x6c0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'StoreLockThread' : [ 0x6c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ClonedThread' : [ 0x6c0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'KeyedEventInUse' : [ 0x6c0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'SelfTerminate' : [ 0x6c0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'RespectIoPriority' : [ 0x6c0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'ReservedSameThreadPassiveFlags' : [ 0x6c0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], - 'SameThreadApcFlags' : [ 0x6c4, ['unsigned long']], - 'OwnsProcessAddressSpaceExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'OwnsProcessAddressSpaceShared' : [ 0x6c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'HardFaultBehavior' : [ 0x6c4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'StartAddressInvalid' : [ 0x6c4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'EtwCalloutActive' : [ 0x6c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'SuppressSymbolLoad' : [ 0x6c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'Prefetching' : [ 0x6c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'OwnsVadExclusive' : [ 0x6c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'SystemPagePriorityActive' : [ 0x6c5, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'SystemPagePriority' : [ 0x6c5, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], - 'CacheManagerActive' : [ 0x6c8, ['unsigned char']], - 'DisablePageFaultClustering' : [ 0x6c9, ['unsigned char']], - 'ActiveFaultCount' : [ 0x6ca, ['unsigned char']], - 'LockOrderState' : [ 0x6cb, ['unsigned char']], - 'AlpcMessageId' : [ 0x6d0, ['unsigned long long']], - 'AlpcMessage' : [ 0x6d8, ['pointer64', ['void']]], - 'AlpcReceiveAttributeSet' : [ 0x6d8, ['unsigned long']], - 'ExitStatus' : [ 0x6e0, ['long']], - 'AlpcWaitListEntry' : [ 0x6e8, ['_LIST_ENTRY']], - 'CacheManagerCount' : [ 0x6f8, ['unsigned long']], - 'IoBoostCount' : [ 0x6fc, ['unsigned long']], - 'BoostList' : [ 0x700, ['_LIST_ENTRY']], - 'DeboostList' : [ 0x710, ['_LIST_ENTRY']], - 'BoostListLock' : [ 0x720, ['unsigned long long']], - 'IrpListLock' : [ 0x728, ['unsigned long long']], - 'ReservedForSynchTracking' : [ 0x730, ['pointer64', ['void']]], - 'CmCallbackListHead' : [ 0x738, ['_SINGLE_LIST_ENTRY']], - 'ActivityId' : [ 0x740, ['pointer64', ['_GUID']]], - 'SeLearningModeListHead' : [ 0x748, ['_SINGLE_LIST_ENTRY']], - 'VerifierContext' : [ 0x750, ['pointer64', ['void']]], - 'KernelStackReference' : [ 0x758, ['unsigned long']], - 'AdjustedClientToken' : [ 0x760, ['pointer64', ['void']]], - 'WorkingOnBehalfClient' : [ 0x768, ['pointer64', ['void']]], - 'PropertySet' : [ 0x770, ['_PS_PROPERTY_SET']], - 'PicoContext' : [ 0x788, ['pointer64', ['void']]], - 'UserFsBase' : [ 0x790, ['unsigned long']], - 'UserGsBase' : [ 0x798, ['unsigned long long']], - 'EnergyValues' : [ 0x7a0, ['pointer64', ['_THREAD_ENERGY_VALUES']]], - 'CmCellReferences' : [ 0x7a8, ['unsigned long']], - 'SelectedCpuSets' : [ 0x7b0, ['unsigned long long']], - 'SelectedCpuSetsIndirect' : [ 0x7b0, ['pointer64', ['unsigned long long']]], - 'Silo' : [ 0x7b8, ['pointer64', ['_EJOB']]], -} ], - '__unnamed_13c5' : [ 0x8, { - 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], - 'IrpCount' : [ 0x0, ['long']], - 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], -} ], - '__unnamed_13cb' : [ 0x10, { - 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], - 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], - 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], -} ], - '__unnamed_13cd' : [ 0x10, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_13cb']], - 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], -} ], - '__unnamed_13d6' : [ 0x58, { - 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], - 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], - 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], - 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], - 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], - 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], - 'PacketType' : [ 0x40, ['unsigned long']], - 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], - 'IrpExtension' : [ 0x50, ['pointer64', ['void']]], -} ], - '__unnamed_13d8' : [ 0x58, { - 'Overlay' : [ 0x0, ['__unnamed_13d6']], - 'Apc' : [ 0x0, ['_KAPC']], - 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], -} ], - '_IRP' : [ 0xd0, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['unsigned short']], - 'AllocationProcessorNumber' : [ 0x4, ['unsigned short']], - 'Reserved' : [ 0x6, ['unsigned short']], - 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], - 'Flags' : [ 0x10, ['unsigned long']], - 'AssociatedIrp' : [ 0x18, ['__unnamed_13c5']], - 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], - 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], - 'RequestorMode' : [ 0x40, ['unsigned char']], - 'PendingReturned' : [ 0x41, ['unsigned char']], - 'StackCount' : [ 0x42, ['unsigned char']], - 'CurrentLocation' : [ 0x43, ['unsigned char']], - 'Cancel' : [ 0x44, ['unsigned char']], - 'CancelIrql' : [ 0x45, ['unsigned char']], - 'ApcEnvironment' : [ 0x46, ['unsigned char']], - 'AllocationFlags' : [ 0x47, ['unsigned char']], - 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], - 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], - 'Overlay' : [ 0x58, ['__unnamed_13cd']], - 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], - 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], - 'Tail' : [ 0x78, ['__unnamed_13d8']], -} ], - '__unnamed_13df' : [ 0x20, { - 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], - 'Options' : [ 0x8, ['unsigned long']], - 'FileAttributes' : [ 0x10, ['unsigned short']], - 'ShareAccess' : [ 0x12, ['unsigned short']], - 'EaLength' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_13e3' : [ 0x20, { - 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], - 'Options' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0x10, ['unsigned short']], - 'ShareAccess' : [ 0x12, ['unsigned short']], - 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], -} ], - '__unnamed_13e7' : [ 0x20, { - 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], - 'Options' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0x10, ['unsigned short']], - 'ShareAccess' : [ 0x12, ['unsigned short']], - 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], -} ], - '__unnamed_13e9' : [ 0x18, { - 'Length' : [ 0x0, ['unsigned long']], - 'Key' : [ 0x8, ['unsigned long']], - 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_13ed' : [ 0x20, { - 'Length' : [ 0x0, ['unsigned long']], - 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], - 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], - 'FileIndex' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_13ef' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned long']], - 'CompletionFilter' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_13f1' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned long']], - 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], -} ], - '__unnamed_13f3' : [ 0x20, { - 'Length' : [ 0x0, ['unsigned long']], - 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], - 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], - 'ReplaceIfExists' : [ 0x18, ['unsigned char']], - 'AdvanceOnly' : [ 0x19, ['unsigned char']], - 'ClusterCount' : [ 0x18, ['unsigned long']], - 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_13f5' : [ 0x20, { - 'Length' : [ 0x0, ['unsigned long']], - 'EaList' : [ 0x8, ['pointer64', ['void']]], - 'EaListLength' : [ 0x10, ['unsigned long']], - 'EaIndex' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_13f7' : [ 0x4, { - 'Length' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_13fb' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned long']], - 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], -} ], - '__unnamed_13fd' : [ 0x20, { - 'OutputBufferLength' : [ 0x0, ['unsigned long']], - 'InputBufferLength' : [ 0x8, ['unsigned long']], - 'FsControlCode' : [ 0x10, ['unsigned long']], - 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_13ff' : [ 0x18, { - 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], - 'Key' : [ 0x8, ['unsigned long']], - 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_1401' : [ 0x20, { - 'OutputBufferLength' : [ 0x0, ['unsigned long']], - 'InputBufferLength' : [ 0x8, ['unsigned long']], - 'IoControlCode' : [ 0x10, ['unsigned long']], - 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_1403' : [ 0x10, { - 'SecurityInformation' : [ 0x0, ['unsigned long']], - 'Length' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_1405' : [ 0x10, { - 'SecurityInformation' : [ 0x0, ['unsigned long']], - 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], -} ], - '__unnamed_1409' : [ 0x10, { - 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], -} ], - '__unnamed_140d' : [ 0x8, { - 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], -} ], - '__unnamed_1411' : [ 0x20, { - 'Length' : [ 0x0, ['unsigned long']], - 'StartSid' : [ 0x8, ['pointer64', ['void']]], - 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], - 'SidListLength' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_1415' : [ 0x4, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], -} ], - '__unnamed_1419' : [ 0x20, { - 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], - 'Size' : [ 0x8, ['unsigned short']], - 'Version' : [ 0xa, ['unsigned short']], - 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], - 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_141d' : [ 0x8, { - 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], -} ], - '__unnamed_1421' : [ 0x8, { - 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], -} ], - '__unnamed_1423' : [ 0x20, { - 'WhichSpace' : [ 0x0, ['unsigned long']], - 'Buffer' : [ 0x8, ['pointer64', ['void']]], - 'Offset' : [ 0x10, ['unsigned long']], - 'Length' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_1425' : [ 0x1, { - 'Lock' : [ 0x0, ['unsigned char']], -} ], - '__unnamed_1429' : [ 0x4, { - 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], -} ], - '__unnamed_142d' : [ 0x10, { - 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], - 'LocaleId' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_1431' : [ 0x10, { - 'InPath' : [ 0x0, ['unsigned char']], - 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], - 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], -} ], - '__unnamed_1435' : [ 0x4, { - 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], -} ], - '__unnamed_1439' : [ 0x8, { - 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], -} ], - '__unnamed_1441' : [ 0x20, { - 'SystemContext' : [ 0x0, ['unsigned long']], - 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], - 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], - 'State' : [ 0x10, ['_POWER_STATE']], - 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], -} ], - '__unnamed_1445' : [ 0x10, { - 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], -} ], - '__unnamed_1447' : [ 0x20, { - 'ProviderId' : [ 0x0, ['unsigned long long']], - 'DataPath' : [ 0x8, ['pointer64', ['void']]], - 'BufferSize' : [ 0x10, ['unsigned long']], - 'Buffer' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_1449' : [ 0x20, { - 'Argument1' : [ 0x0, ['pointer64', ['void']]], - 'Argument2' : [ 0x8, ['pointer64', ['void']]], - 'Argument3' : [ 0x10, ['pointer64', ['void']]], - 'Argument4' : [ 0x18, ['pointer64', ['void']]], -} ], - '__unnamed_144b' : [ 0x20, { - 'Create' : [ 0x0, ['__unnamed_13df']], - 'CreatePipe' : [ 0x0, ['__unnamed_13e3']], - 'CreateMailslot' : [ 0x0, ['__unnamed_13e7']], - 'Read' : [ 0x0, ['__unnamed_13e9']], - 'Write' : [ 0x0, ['__unnamed_13e9']], - 'QueryDirectory' : [ 0x0, ['__unnamed_13ed']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_13ef']], - 'QueryFile' : [ 0x0, ['__unnamed_13f1']], - 'SetFile' : [ 0x0, ['__unnamed_13f3']], - 'QueryEa' : [ 0x0, ['__unnamed_13f5']], - 'SetEa' : [ 0x0, ['__unnamed_13f7']], - 'QueryVolume' : [ 0x0, ['__unnamed_13fb']], - 'SetVolume' : [ 0x0, ['__unnamed_13fb']], - 'FileSystemControl' : [ 0x0, ['__unnamed_13fd']], - 'LockControl' : [ 0x0, ['__unnamed_13ff']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_1401']], - 'QuerySecurity' : [ 0x0, ['__unnamed_1403']], - 'SetSecurity' : [ 0x0, ['__unnamed_1405']], - 'MountVolume' : [ 0x0, ['__unnamed_1409']], - 'VerifyVolume' : [ 0x0, ['__unnamed_1409']], - 'Scsi' : [ 0x0, ['__unnamed_140d']], - 'QueryQuota' : [ 0x0, ['__unnamed_1411']], - 'SetQuota' : [ 0x0, ['__unnamed_13f7']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1415']], - 'QueryInterface' : [ 0x0, ['__unnamed_1419']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_141d']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1421']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_1423']], - 'SetLock' : [ 0x0, ['__unnamed_1425']], - 'QueryId' : [ 0x0, ['__unnamed_1429']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_142d']], - 'UsageNotification' : [ 0x0, ['__unnamed_1431']], - 'WaitWake' : [ 0x0, ['__unnamed_1435']], - 'PowerSequence' : [ 0x0, ['__unnamed_1439']], - 'Power' : [ 0x0, ['__unnamed_1441']], - 'StartDevice' : [ 0x0, ['__unnamed_1445']], - 'WMI' : [ 0x0, ['__unnamed_1447']], - 'Others' : [ 0x0, ['__unnamed_1449']], -} ], - '_IO_STACK_LOCATION' : [ 0x48, { - 'MajorFunction' : [ 0x0, ['unsigned char']], - 'MinorFunction' : [ 0x1, ['unsigned char']], - 'Flags' : [ 0x2, ['unsigned char']], - 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x8, ['__unnamed_144b']], - 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], - 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], - 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], - 'Context' : [ 0x40, ['pointer64', ['void']]], -} ], - '__unnamed_1461' : [ 0x48, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], -} ], - '_DEVICE_OBJECT' : [ 0x150, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['unsigned short']], - 'ReferenceCount' : [ 0x4, ['long']], - 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], - 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], - 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], - 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], - 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], - 'Flags' : [ 0x30, ['unsigned long']], - 'Characteristics' : [ 0x34, ['unsigned long']], - 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], - 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], - 'DeviceType' : [ 0x48, ['unsigned long']], - 'StackSize' : [ 0x4c, ['unsigned char']], - 'Queue' : [ 0x50, ['__unnamed_1461']], - 'AlignmentRequirement' : [ 0x98, ['unsigned long']], - 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], - 'Dpc' : [ 0xc8, ['_KDPC']], - 'ActiveThreadCount' : [ 0x108, ['unsigned long']], - 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], - 'DeviceLock' : [ 0x118, ['_KEVENT']], - 'SectorSize' : [ 0x130, ['unsigned short']], - 'Spare1' : [ 0x132, ['unsigned short']], - 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], - 'Reserved' : [ 0x140, ['pointer64', ['void']]], -} ], - '_KDPC' : [ 0x40, { - 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], - 'Type' : [ 0x0, ['unsigned char']], - 'Importance' : [ 0x1, ['unsigned char']], - 'Number' : [ 0x2, ['unsigned short']], - 'DpcListEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], - 'ProcessorHistory' : [ 0x10, ['unsigned long long']], - 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], - 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], - 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], - 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], - 'DpcData' : [ 0x38, ['pointer64', ['void']]], -} ], - '_IO_DRIVER_CREATE_CONTEXT' : [ 0x28, { - 'Size' : [ 0x0, ['short']], - 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], - 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], - 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], - 'SiloContext' : [ 0x20, ['pointer64', ['_EJOB']]], -} ], - '_EJOB' : [ 0x528, { - 'Event' : [ 0x0, ['_KEVENT']], - 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], - 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], - 'JobLock' : [ 0x38, ['_ERESOURCE']], - 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], - 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], - 'TotalCycleTime' : [ 0xb0, ['_LARGE_INTEGER']], - 'ThisPeriodTotalUserTime' : [ 0xb8, ['_LARGE_INTEGER']], - 'ThisPeriodTotalKernelTime' : [ 0xc0, ['_LARGE_INTEGER']], - 'TotalContextSwitches' : [ 0xc8, ['unsigned long long']], - 'TotalPageFaultCount' : [ 0xd0, ['unsigned long']], - 'TotalProcesses' : [ 0xd4, ['unsigned long']], - 'ActiveProcesses' : [ 0xd8, ['unsigned long']], - 'TotalTerminatedProcesses' : [ 0xdc, ['unsigned long']], - 'PerProcessUserTimeLimit' : [ 0xe0, ['_LARGE_INTEGER']], - 'PerJobUserTimeLimit' : [ 0xe8, ['_LARGE_INTEGER']], - 'MinimumWorkingSetSize' : [ 0xf0, ['unsigned long long']], - 'MaximumWorkingSetSize' : [ 0xf8, ['unsigned long long']], - 'LimitFlags' : [ 0x100, ['unsigned long']], - 'ActiveProcessLimit' : [ 0x104, ['unsigned long']], - 'Affinity' : [ 0x108, ['_KAFFINITY_EX']], - 'AccessState' : [ 0x1b0, ['pointer64', ['_JOB_ACCESS_STATE']]], - 'AccessStateQuotaReference' : [ 0x1b8, ['pointer64', ['void']]], - 'UIRestrictionsClass' : [ 0x1c0, ['unsigned long']], - 'EndOfJobTimeAction' : [ 0x1c4, ['unsigned long']], - 'CompletionPort' : [ 0x1c8, ['pointer64', ['void']]], - 'CompletionKey' : [ 0x1d0, ['pointer64', ['void']]], - 'CompletionCount' : [ 0x1d8, ['unsigned long long']], - 'SessionId' : [ 0x1e0, ['unsigned long']], - 'SchedulingClass' : [ 0x1e4, ['unsigned long']], - 'ReadOperationCount' : [ 0x1e8, ['unsigned long long']], - 'WriteOperationCount' : [ 0x1f0, ['unsigned long long']], - 'OtherOperationCount' : [ 0x1f8, ['unsigned long long']], - 'ReadTransferCount' : [ 0x200, ['unsigned long long']], - 'WriteTransferCount' : [ 0x208, ['unsigned long long']], - 'OtherTransferCount' : [ 0x210, ['unsigned long long']], - 'DiskIoInfo' : [ 0x218, ['_PROCESS_DISK_COUNTERS']], - 'ProcessMemoryLimit' : [ 0x240, ['unsigned long long']], - 'JobMemoryLimit' : [ 0x248, ['unsigned long long']], - 'JobTotalMemoryLimit' : [ 0x250, ['unsigned long long']], - 'PeakProcessMemoryUsed' : [ 0x258, ['unsigned long long']], - 'PeakJobMemoryUsed' : [ 0x260, ['unsigned long long']], - 'EffectiveAffinity' : [ 0x268, ['_KAFFINITY_EX']], - 'EffectivePerProcessUserTimeLimit' : [ 0x310, ['_LARGE_INTEGER']], - 'EffectiveMinimumWorkingSetSize' : [ 0x318, ['unsigned long long']], - 'EffectiveMaximumWorkingSetSize' : [ 0x320, ['unsigned long long']], - 'EffectiveProcessMemoryLimit' : [ 0x328, ['unsigned long long']], - 'EffectiveProcessMemoryLimitJob' : [ 0x330, ['pointer64', ['_EJOB']]], - 'EffectivePerProcessUserTimeLimitJob' : [ 0x338, ['pointer64', ['_EJOB']]], - 'EffectiveDiskIoRateLimitJob' : [ 0x340, ['pointer64', ['_EJOB']]], - 'EffectiveNetIoRateLimitJob' : [ 0x348, ['pointer64', ['_EJOB']]], - 'EffectiveHeapAttributionJob' : [ 0x350, ['pointer64', ['_EJOB']]], - 'EffectiveLimitFlags' : [ 0x358, ['unsigned long']], - 'EffectiveSchedulingClass' : [ 0x35c, ['unsigned long']], - 'EffectiveFreezeCount' : [ 0x360, ['unsigned long']], - 'EffectiveBackgroundCount' : [ 0x364, ['unsigned long']], - 'EffectiveSwapCount' : [ 0x368, ['unsigned long']], - 'EffectiveNotificationLimitCount' : [ 0x36c, ['unsigned long']], - 'EffectivePriorityClass' : [ 0x370, ['unsigned char']], - 'PriorityClass' : [ 0x371, ['unsigned char']], - 'NestingDepth' : [ 0x372, ['unsigned char']], - 'Reserved1' : [ 0x373, ['array', 1, ['unsigned char']]], - 'CompletionFilter' : [ 0x374, ['unsigned long']], - 'WakeChannel' : [ 0x378, ['_WNF_STATE_NAME']], - 'WakeInfo' : [ 0x378, ['_PS_WAKE_INFORMATION']], - 'WakeFilter' : [ 0x3b0, ['_JOBOBJECT_WAKE_FILTER']], - 'LowEdgeLatchFilter' : [ 0x3b8, ['unsigned long']], - 'OwnedHighEdgeFilters' : [ 0x3bc, ['unsigned long']], - 'NotificationLink' : [ 0x3c0, ['pointer64', ['_EJOB']]], - 'CurrentJobMemoryUsed' : [ 0x3c8, ['unsigned long long']], - 'NotificationInfo' : [ 0x3d0, ['pointer64', ['_JOB_NOTIFICATION_INFORMATION']]], - 'NotificationInfoQuotaReference' : [ 0x3d8, ['pointer64', ['void']]], - 'NotificationPacket' : [ 0x3e0, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], - 'CpuRateControl' : [ 0x3e8, ['pointer64', ['_JOB_CPU_RATE_CONTROL']]], - 'EffectiveSchedulingGroup' : [ 0x3f0, ['pointer64', ['void']]], - 'ReadyTime' : [ 0x3f8, ['unsigned long long']], - 'MemoryLimitsLock' : [ 0x400, ['_EX_PUSH_LOCK']], - 'SiblingJobLinks' : [ 0x408, ['_LIST_ENTRY']], - 'ChildJobListHead' : [ 0x418, ['_LIST_ENTRY']], - 'ParentJob' : [ 0x428, ['pointer64', ['_EJOB']]], - 'RootJob' : [ 0x430, ['pointer64', ['_EJOB']]], - 'IteratorListHead' : [ 0x438, ['_LIST_ENTRY']], - 'AncestorCount' : [ 0x448, ['unsigned long long']], - 'Ancestors' : [ 0x450, ['pointer64', ['pointer64', ['_EJOB']]]], - 'SessionObject' : [ 0x450, ['pointer64', ['void']]], - 'Accounting' : [ 0x458, ['_EPROCESS_VALUES']], - 'ShadowActiveProcessCount' : [ 0x4a8, ['unsigned long']], - 'ActiveAuxiliaryProcessCount' : [ 0x4ac, ['unsigned long']], - 'SequenceNumber' : [ 0x4b0, ['unsigned long']], - 'TimerListLock' : [ 0x4b8, ['unsigned long long']], - 'TimerListHead' : [ 0x4c0, ['_LIST_ENTRY']], - 'ContainerId' : [ 0x4d0, ['_GUID']], - 'Container' : [ 0x4e0, ['pointer64', ['_SILO_CONTEXT']]], - 'PropertySet' : [ 0x4e8, ['_PS_PROPERTY_SET']], - 'NetRateControl' : [ 0x500, ['pointer64', ['_JOB_NET_RATE_CONTROL']]], - 'IoRateControl' : [ 0x508, ['pointer64', ['_JOB_IO_RATE_CONTROL']]], - 'JobFlags' : [ 0x510, ['unsigned long']], - 'CloseDone' : [ 0x510, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'MultiGroup' : [ 0x510, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'OutstandingNotification' : [ 0x510, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'NotificationInProgress' : [ 0x510, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'UILimits' : [ 0x510, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'CpuRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'OwnCpuRateControl' : [ 0x510, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'Terminating' : [ 0x510, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'WorkingSetLock' : [ 0x510, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'JobFrozen' : [ 0x510, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'Background' : [ 0x510, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'WakeNotificationAllocated' : [ 0x510, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'WakeNotificationEnabled' : [ 0x510, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'WakeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'LimitNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'ZeroCountNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'CycleTimeNotificationRequired' : [ 0x510, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'CycleTimeNotificationPending' : [ 0x510, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'TimersVirtualized' : [ 0x510, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'JobSwapped' : [ 0x510, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'ViolationDetected' : [ 0x510, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'EmptyJobNotified' : [ 0x510, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'NoSystemCharge' : [ 0x510, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], - 'DropNoWakeCharges' : [ 0x510, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], - 'NoWakeChargePolicyDecided' : [ 0x510, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'NetRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'OwnNetRateControl' : [ 0x510, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'IoRateControlActive' : [ 0x510, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], - 'OwnIoRateControl' : [ 0x510, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'DisallowNewProcesses' : [ 0x510, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], - 'SpareJobFlags' : [ 0x510, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], - 'EffectiveHighEdgeFilters' : [ 0x514, ['unsigned long']], - 'EnergyValues' : [ 0x518, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], - 'SharedCommitCharge' : [ 0x520, ['unsigned long long']], -} ], - '_IO_PRIORITY_INFO' : [ 0x10, { - 'Size' : [ 0x0, ['unsigned long']], - 'ThreadPriority' : [ 0x4, ['unsigned long']], - 'PagePriority' : [ 0x8, ['unsigned long']], - 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], -} ], - '_MDL' : [ 0x30, { - 'Next' : [ 0x0, ['pointer64', ['_MDL']]], - 'Size' : [ 0x8, ['short']], - 'MdlFlags' : [ 0xa, ['short']], - 'AllocationProcessorNumber' : [ 0xc, ['unsigned short']], - 'Reserved' : [ 0xe, ['unsigned short']], - 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], - 'StartVa' : [ 0x20, ['pointer64', ['void']]], - 'ByteCount' : [ 0x28, ['unsigned long']], - 'ByteOffset' : [ 0x2c, ['unsigned long']], -} ], - '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { - 'Ptr' : [ 0x0, ['unsigned long long']], - 'Size' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0xc, ['unsigned long']], - 'Type' : [ 0xc, ['unsigned char']], - 'Reserved1' : [ 0xd, ['unsigned char']], - 'Reserved2' : [ 0xe, ['unsigned short']], -} ], - '_EVENT_DESCRIPTOR' : [ 0x10, { - 'Id' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned char']], - 'Channel' : [ 0x3, ['unsigned char']], - 'Level' : [ 0x4, ['unsigned char']], - 'Opcode' : [ 0x5, ['unsigned char']], - 'Task' : [ 0x6, ['unsigned short']], - 'Keyword' : [ 0x8, ['unsigned long long']], -} ], - '_EVENT_RECORD' : [ 0x70, { - 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], - 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], - 'ExtendedDataCount' : [ 0x54, ['unsigned short']], - 'UserDataLength' : [ 0x56, ['unsigned short']], - 'ExtendedData' : [ 0x58, ['pointer64', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], - 'UserData' : [ 0x60, ['pointer64', ['void']]], - 'UserContext' : [ 0x68, ['pointer64', ['void']]], -} ], - '_PERFINFO_GROUPMASK' : [ 0x20, { - 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], -} ], - '_FILE_OBJECT' : [ 0xd8, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], - 'FsContext' : [ 0x18, ['pointer64', ['void']]], - 'FsContext2' : [ 0x20, ['pointer64', ['void']]], - 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], - 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], - 'FinalStatus' : [ 0x38, ['long']], - 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], - 'LockOperation' : [ 0x48, ['unsigned char']], - 'DeletePending' : [ 0x49, ['unsigned char']], - 'ReadAccess' : [ 0x4a, ['unsigned char']], - 'WriteAccess' : [ 0x4b, ['unsigned char']], - 'DeleteAccess' : [ 0x4c, ['unsigned char']], - 'SharedRead' : [ 0x4d, ['unsigned char']], - 'SharedWrite' : [ 0x4e, ['unsigned char']], - 'SharedDelete' : [ 0x4f, ['unsigned char']], - 'Flags' : [ 0x50, ['unsigned long']], - 'FileName' : [ 0x58, ['_UNICODE_STRING']], - 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], - 'Waiters' : [ 0x70, ['unsigned long']], - 'Busy' : [ 0x74, ['unsigned long']], - 'LastLock' : [ 0x78, ['pointer64', ['void']]], - 'Lock' : [ 0x80, ['_KEVENT']], - 'Event' : [ 0x98, ['_KEVENT']], - 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], - 'IrpListLock' : [ 0xb8, ['unsigned long long']], - 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], - 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], -} ], - '_EX_RUNDOWN_REF' : [ 0x8, { - 'Count' : [ 0x0, ['unsigned long long']], - 'Ptr' : [ 0x0, ['pointer64', ['void']]], -} ], - '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { - 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], - 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], - 'CurrentFileIndex' : [ 0xc, ['unsigned long']], - 'CreateTime' : [ 0x10, ['unsigned long long']], - 'EmptyTime' : [ 0x18, ['unsigned long long']], - 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], - 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], - 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], - 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], - 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], - 'SessionId' : [ 0x40, ['unsigned long']], - 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], - 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], -} ], - '_WHEA_ERROR_PACKET_V2' : [ 0x50, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Version' : [ 0x4, ['unsigned long']], - 'Length' : [ 0x8, ['unsigned long']], - 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], - 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], - 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], - 'ErrorSourceId' : [ 0x18, ['unsigned long']], - 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], - 'NotifyType' : [ 0x20, ['_GUID']], - 'Context' : [ 0x30, ['unsigned long long']], - 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], - 'Reserved1' : [ 0x3c, ['unsigned long']], - 'DataOffset' : [ 0x40, ['unsigned long']], - 'DataLength' : [ 0x44, ['unsigned long']], - 'PshedDataOffset' : [ 0x48, ['unsigned long']], - 'PshedDataLength' : [ 0x4c, ['unsigned long']], -} ], - '_WHEA_ERROR_RECORD' : [ 0xc8, { - 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], - 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], -} ], - '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { - 'SectionOffset' : [ 0x0, ['unsigned long']], - 'SectionLength' : [ 0x4, ['unsigned long']], - 'Revision' : [ 0x8, ['_WHEA_REVISION']], - 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], - 'Reserved' : [ 0xb, ['unsigned char']], - 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], - 'SectionType' : [ 0x10, ['_GUID']], - 'FRUId' : [ 0x20, ['_GUID']], - 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], - 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], -} ], - '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x68, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteSize' : [ 0x2, ['short']], - 'Flags' : [ 0x4, ['unsigned char']], - 'IsFastIoPossible' : [ 0x5, ['unsigned char']], - 'Flags2' : [ 0x6, ['unsigned char']], - 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], - 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], - 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], - 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], - 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], - 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], - 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], - 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], - 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], - 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], - 'Oplock' : [ 0x58, ['pointer64', ['void']]], - 'ReservedForRemote' : [ 0x58, ['pointer64', ['void']]], - 'ReservedContext' : [ 0x60, ['pointer64', ['void']]], -} ], - '_iobuf' : [ 0x30, { - '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], - '_cnt' : [ 0x8, ['long']], - '_base' : [ 0x10, ['pointer64', ['unsigned char']]], - '_flag' : [ 0x18, ['long']], - '_file' : [ 0x1c, ['long']], - '_charbuf' : [ 0x20, ['long']], - '_bufsiz' : [ 0x24, ['long']], - '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], -} ], - '_TlgProvider_t' : [ 0x40, { - 'LevelPlus1' : [ 0x0, ['unsigned long']], - 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], - 'KeywordAny' : [ 0x10, ['unsigned long long']], - 'KeywordAll' : [ 0x18, ['unsigned long long']], - 'RegHandle' : [ 0x20, ['unsigned long long']], - 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], - 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], - 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], -} ], - '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { - 'Ptr' : [ 0x0, ['unsigned long long']], - 'Size' : [ 0x8, ['unsigned long']], - 'Type' : [ 0xc, ['unsigned long']], -} ], - '_TlgProviderMetadata_t' : [ 0x13, { - 'Type' : [ 0x0, ['unsigned char']], - 'ProviderId' : [ 0x1, ['_GUID']], - 'RemainingSize' : [ 0x11, ['unsigned short']], -} ], - '_SID' : [ 0xc, { - 'Revision' : [ 0x0, ['unsigned char']], - 'SubAuthorityCount' : [ 0x1, ['unsigned char']], - 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], - 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], -} ], - '__unnamed_164b' : [ 0x8, { - 'Long' : [ 0x0, ['unsigned long long']], - 'VolatileLong' : [ 0x0, ['unsigned long long']], - 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], - 'Flush' : [ 0x0, ['_HARDWARE_PTE']], - 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], - 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], - 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], - 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], - 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], - 'List' : [ 0x0, ['_MMPTE_LIST']], -} ], - '_MMPTE' : [ 0x8, { - 'u' : [ 0x0, ['__unnamed_164b']], -} ], - '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0x10, { - 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'State' : [ 0x8, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], - 'Stats' : [ 0xc, ['unsigned long']], -} ], - '_ERESOURCE' : [ 0x68, { - 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], - 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], - 'ActiveCount' : [ 0x18, ['short']], - 'Flag' : [ 0x1a, ['unsigned short']], - 'ReservedLowFlags' : [ 0x1a, ['unsigned char']], - 'WaiterPriority' : [ 0x1b, ['unsigned char']], - 'SharedWaiters' : [ 0x20, ['_KWAIT_CHAIN']], - 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], - 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], - 'ActiveEntries' : [ 0x40, ['unsigned long']], - 'ContentionCount' : [ 0x44, ['unsigned long']], - 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], - 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], - 'Reserved2' : [ 0x50, ['pointer64', ['void']]], - 'Address' : [ 0x58, ['pointer64', ['void']]], - 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], - 'SpinLock' : [ 0x60, ['unsigned long long']], -} ], - '_MI_CACHED_PTE' : [ 0x8, { - 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], - 'PteIndex' : [ 0x4, ['unsigned long']], - 'Long' : [ 0x0, ['long long']], -} ], - '_KLOCK_QUEUE_HANDLE' : [ 0x18, { - 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], - 'OldIrql' : [ 0x10, ['unsigned char']], -} ], - '_MMPFNLIST' : [ 0x28, { - 'Total' : [ 0x0, ['unsigned long long']], - 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], - 'Flink' : [ 0x10, ['unsigned long long']], - 'Blink' : [ 0x18, ['unsigned long long']], - 'Lock' : [ 0x20, ['unsigned long long']], -} ], - '__unnamed_1683' : [ 0x8, { - 'Flink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], - 'NodeFlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 64, native_type='unsigned long long')]], - 'WsIndex' : [ 0x0, ['unsigned long long']], - 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], - 'Next' : [ 0x0, ['pointer64', ['void']]], - 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], - 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], - 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], -} ], - '__unnamed_1687' : [ 0x4, { - 'ReferenceCount' : [ 0x0, ['unsigned short']], - 'ShortFlags' : [ 0x2, ['unsigned short']], - 'VolatileShortFlags' : [ 0x2, ['unsigned short']], -} ], - '__unnamed_1689' : [ 0x4, { - 'ReferenceCount' : [ 0x0, ['unsigned short']], - 'e1' : [ 0x2, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_1687']], -} ], - '__unnamed_1695' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], - 'Channel' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 38, native_type='unsigned long long')]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], - 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], - 'Partition' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 50, native_type='unsigned long long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 52, native_type='unsigned long long')]], - 'FileOnly' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], - 'PfnExists' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], - 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 57, native_type='unsigned long long')]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], - 'EntireField' : [ 0x0, ['unsigned long long']], -} ], - '_MMPFN' : [ 0x30, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'u1' : [ 0x0, ['__unnamed_1683']], - 'PteAddress' : [ 0x8, ['pointer64', ['_MMPTE']]], - 'VolatilePteAddress' : [ 0x8, ['pointer64', ['void']]], - 'PteLong' : [ 0x8, ['unsigned long long']], - 'OriginalPte' : [ 0x10, ['_MMPTE']], - 'u2' : [ 0x18, ['_MIPFNBLINK']], - 'u3' : [ 0x20, ['__unnamed_1689']], - 'NodeBlinkLow' : [ 0x24, ['unsigned short']], - 'Unused' : [ 0x26, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], - 'VaType' : [ 0x26, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'ViewCount' : [ 0x27, ['unsigned char']], - 'NodeFlinkLow' : [ 0x27, ['unsigned char']], - 'u4' : [ 0x28, ['__unnamed_1695']], -} ], - '_MI_SYSTEM_PTE_TYPE' : [ 0x60, { - 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], - 'BasePte' : [ 0x10, ['pointer64', ['_MMPTE']]], - 'Flags' : [ 0x18, ['unsigned long']], - 'VaType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaMaximumType', 15: 'MiVaSystemPtesLarge'})]], - 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], - 'PteFailures' : [ 0x28, ['unsigned long']], - 'SpinLock' : [ 0x30, ['unsigned long long']], - 'GlobalPushLock' : [ 0x30, ['pointer64', ['_EX_PUSH_LOCK']]], - 'Vm' : [ 0x38, ['pointer64', ['_MMSUPPORT']]], - 'TotalSystemPtes' : [ 0x40, ['unsigned long long']], - 'Hint' : [ 0x48, ['unsigned long long']], - 'CachedPtes' : [ 0x50, ['pointer64', ['_MI_CACHED_PTES']]], - 'TotalFreeSystemPtes' : [ 0x58, ['unsigned long long']], -} ], - '_MMCLONE_DESCRIPTOR' : [ 0x50, { - 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'Next' : [ 0x0, ['pointer64', ['_MMCLONE_DESCRIPTOR']]], - 'StartingCloneBlock' : [ 0x18, ['pointer64', ['_MMCLONE_BLOCK']]], - 'EndingCloneBlock' : [ 0x20, ['pointer64', ['_MMCLONE_BLOCK']]], - 'NumberOfPtes' : [ 0x28, ['unsigned long long']], - 'NumberOfReferences' : [ 0x30, ['unsigned long long']], - 'CloneHeader' : [ 0x38, ['pointer64', ['_MMCLONE_HEADER']]], - 'NonPagedPoolQuotaCharge' : [ 0x40, ['unsigned long long']], - 'NestingLevel' : [ 0x48, ['unsigned long long']], -} ], - '__unnamed_16c7' : [ 0x8, { - 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], - 'Long' : [ 0x0, ['unsigned long long']], - 'e1' : [ 0x0, ['_MMWSLENTRY']], - 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], -} ], - '_MMWSLE' : [ 0x8, { - 'u1' : [ 0x0, ['__unnamed_16c7']], -} ], - '_MMWSL' : [ 0x350, { - 'FirstFree' : [ 0x0, ['unsigned long long']], - 'FirstDynamic' : [ 0x8, ['unsigned long long']], - 'LastEntry' : [ 0x10, ['unsigned long long']], - 'NextSlot' : [ 0x18, ['unsigned long long']], - 'LastInitializedWsle' : [ 0x20, ['unsigned long long']], - 'NextAgingSlot' : [ 0x28, ['unsigned long long']], - 'NextAccessClearingSlot' : [ 0x30, ['unsigned long long']], - 'LastAccessClearingRemainder' : [ 0x38, ['unsigned long']], - 'LastAgingRemainder' : [ 0x3c, ['unsigned long']], - 'WsleSize' : [ 0x40, ['unsigned long']], - 'NonDirectCount' : [ 0x48, ['unsigned long long']], - 'LowestPagableAddress' : [ 0x50, ['pointer64', ['void']]], - 'NonDirectHash' : [ 0x58, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], - 'HashTableStart' : [ 0x60, ['pointer64', ['_MMWSLE_HASH']]], - 'HighestPermittedHashAddress' : [ 0x68, ['pointer64', ['_MMWSLE_HASH']]], - 'ActiveWsleCounts' : [ 0x70, ['array', 16, ['unsigned long long']]], - 'ActiveWsles' : [ 0xf0, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], - 'Wsle' : [ 0x1f0, ['pointer64', ['_MMWSLE']]], - 'UserVaInfo' : [ 0x1f8, ['_MI_USER_VA_INFO']], -} ], - '_MMSUPPORT' : [ 0xf8, { - 'WorkingSetLock' : [ 0x0, ['long']], - 'ExitOutswapGate' : [ 0x8, ['pointer64', ['_KGATE']]], - 'AccessLog' : [ 0x10, ['pointer64', ['void']]], - 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], - 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long long']]], - 'MinimumWorkingSetSize' : [ 0x60, ['unsigned long long']], - 'WorkingSetLeafSize' : [ 0x68, ['unsigned long long']], - 'WorkingSetLeafPrivateSize' : [ 0x70, ['unsigned long long']], - 'WorkingSetSize' : [ 0x78, ['unsigned long long']], - 'WorkingSetPrivateSize' : [ 0x80, ['unsigned long long']], - 'MaximumWorkingSetSize' : [ 0x88, ['unsigned long long']], - 'ChargedWslePages' : [ 0x90, ['unsigned long long']], - 'ActualWslePages' : [ 0x98, ['unsigned long long']], - 'WorkingSetSizeOverhead' : [ 0xa0, ['unsigned long long']], - 'PeakWorkingSetSize' : [ 0xa8, ['unsigned long long']], - 'HardFaultCount' : [ 0xb0, ['unsigned long']], - 'PartitionId' : [ 0xb4, ['unsigned short']], - 'Pad0' : [ 0xb6, ['unsigned short']], - 'VmWorkingSetList' : [ 0xb8, ['pointer64', ['_MMWSL']]], - 'NextPageColor' : [ 0xc0, ['unsigned short']], - 'LastTrimStamp' : [ 0xc2, ['unsigned short']], - 'PageFaultCount' : [ 0xc4, ['unsigned long']], - 'TrimmedPageCount' : [ 0xc8, ['unsigned long long']], - 'Reserved0' : [ 0xd0, ['unsigned long long']], - 'Flags' : [ 0xd8, ['_MMSUPPORT_FLAGS']], - 'ReleasedCommitDebt' : [ 0xe0, ['unsigned long long']], - 'WsSwapSupport' : [ 0xe8, ['pointer64', ['void']]], - 'CommitReAcquireFailSupport' : [ 0xf0, ['pointer64', ['void']]], -} ], - '__unnamed_16e3' : [ 0x8, { - 'ImageCommitment' : [ 0x0, ['unsigned long long']], - 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], -} ], - '__unnamed_16e7' : [ 0x8, { - 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], - 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], -} ], - '_SEGMENT' : [ 0x48, { - 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], - 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], - 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], - 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], - 'SizeOfSegment' : [ 0x18, ['unsigned long long']], - 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], - 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], - 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], - 'u1' : [ 0x30, ['__unnamed_16e3']], - 'u2' : [ 0x38, ['__unnamed_16e7']], - 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], -} ], - '__unnamed_16ec' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], -} ], - '__unnamed_16ef' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x0, ['_MMSECTION_FLAGS2']], -} ], - '__unnamed_16f9' : [ 0x10, { - 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], - 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], - 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], - 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], - 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'FlushInProgressCount' : [ 0x8, ['unsigned long']], - 'NumberOfSubsections' : [ 0x8, ['unsigned long']], - 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], -} ], - '__unnamed_16fb' : [ 0x10, { - 'e2' : [ 0x0, ['__unnamed_16f9']], -} ], - '_CONTROL_AREA' : [ 0x78, { - 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], - 'ListHead' : [ 0x8, ['_LIST_ENTRY']], - 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], - 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], - 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], - 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], - 'u' : [ 0x38, ['__unnamed_16ec']], - 'u1' : [ 0x3c, ['__unnamed_16ef']], - 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], - 'ControlAreaLock' : [ 0x48, ['long']], - 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], - 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], - 'u2' : [ 0x58, ['__unnamed_16fb']], - 'LockedPages' : [ 0x68, ['unsigned long long']], - 'FileObjectLock' : [ 0x70, ['_EX_PUSH_LOCK']], -} ], - '__unnamed_1709' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], -} ], - '__unnamed_170c' : [ 0x4, { - 'LongFlags1' : [ 0x0, ['unsigned long']], - 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], -} ], - '_MMVAD_SHORT' : [ 0x40, { - 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'NextVad' : [ 0x0, ['pointer64', ['_MMVAD_SHORT']]], - 'StartingVpn' : [ 0x18, ['unsigned long']], - 'EndingVpn' : [ 0x1c, ['unsigned long']], - 'StartingVpnHigh' : [ 0x20, ['unsigned char']], - 'EndingVpnHigh' : [ 0x21, ['unsigned char']], - 'CommitChargeHigh' : [ 0x22, ['unsigned char']], - 'SpareNT64VadUChar' : [ 0x23, ['unsigned char']], - 'ReferenceCount' : [ 0x24, ['long']], - 'PushLock' : [ 0x28, ['_EX_PUSH_LOCK']], - 'u' : [ 0x30, ['__unnamed_1709']], - 'u1' : [ 0x34, ['__unnamed_170c']], - 'EventList' : [ 0x38, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], -} ], - '_MI_PARTITION' : [ 0x2740, { - 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], - 'Modwriter' : [ 0x158, ['_MI_PARTITION_MODWRITES']], - 'Store' : [ 0x430, ['_MI_PARTITION_STORES']], - 'Segments' : [ 0x4c0, ['_MI_PARTITION_SEGMENTS']], - 'PageLists' : [ 0x640, ['_MI_PARTITION_PAGE_LISTS']], - 'Commit' : [ 0x1380, ['_MI_PARTITION_COMMIT']], - 'Zeroing' : [ 0x1400, ['_MI_PARTITION_ZEROING']], - 'PageCombine' : [ 0x1468, ['_MI_PAGE_COMBINING_SUPPORT']], - 'WorkingSetControl' : [ 0x15f0, ['pointer64', ['void']]], - 'WorkingSetExpansionHead' : [ 0x15f8, ['_MMWORKING_SET_EXPANSION_HEAD']], - 'Vp' : [ 0x1640, ['_MI_VISIBLE_PARTITION']], -} ], - '_MM_STORE_KEY' : [ 0x8, { - 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], - 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], - 'EntireKey' : [ 0x0, ['unsigned long long']], -} ], - '_MMPAGING_FILE' : [ 0x120, { - 'Size' : [ 0x0, ['unsigned long long']], - 'MaximumSize' : [ 0x8, ['unsigned long long']], - 'MinimumSize' : [ 0x10, ['unsigned long long']], - 'FreeSpace' : [ 0x18, ['unsigned long long']], - 'PeakUsage' : [ 0x20, ['unsigned long long']], - 'HighestPage' : [ 0x28, ['unsigned long long']], - 'FreeReservationSpace' : [ 0x30, ['unsigned long long']], - 'File' : [ 0x38, ['pointer64', ['_FILE_OBJECT']]], - 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], - 'PfnsToFree' : [ 0x50, ['_SLIST_HEADER']], - 'PageFileName' : [ 0x60, ['_UNICODE_STRING']], - 'Bitmaps' : [ 0x70, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], - 'AllocationBitmapHint' : [ 0x78, ['unsigned long']], - 'LargestAllocationCluster' : [ 0x7c, ['unsigned long']], - 'RefreshAllocationCluster' : [ 0x80, ['unsigned long']], - 'LastRefreshAllocationCluster' : [ 0x84, ['unsigned long']], - 'ReservedClusterSizeAggregate' : [ 0x88, ['unsigned long']], - 'MaximumRunLengthInBitmaps' : [ 0x8c, ['unsigned long']], - 'BitmapsCacheLengthTree' : [ 0x90, ['_RTL_RB_TREE']], - 'BitmapsCacheLocationTree' : [ 0xa0, ['_RTL_RB_TREE']], - 'BitmapsCacheFreeList' : [ 0xb0, ['_LIST_ENTRY']], - 'BitmapsCacheEntries' : [ 0xc0, ['pointer64', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], - 'ToBeEvictedCount' : [ 0xc8, ['unsigned long']], - 'HybridPriority' : [ 0xc8, ['unsigned long']], - 'PageFileNumber' : [ 0xcc, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], - 'WsSwapPagefile' : [ 0xcc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'NoReservations' : [ 0xcc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], - 'VirtualStorePagefile' : [ 0xcc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'SwapSupported' : [ 0xcc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], - 'NodeInserted' : [ 0xcc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], - 'StackNotified' : [ 0xcc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], - 'Spare0' : [ 0xcc, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], - 'AdriftMdls' : [ 0xce, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Spare1' : [ 0xce, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], - 'IgnoreReservations' : [ 0xcf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Spare2' : [ 0xcf, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], - 'PageHashPages' : [ 0xd0, ['unsigned long']], - 'PageHashPagesPeak' : [ 0xd4, ['unsigned long']], - 'PageHash' : [ 0xd8, ['pointer64', ['unsigned long']]], - 'FileHandle' : [ 0xe0, ['pointer64', ['void']]], - 'Lock' : [ 0xe8, ['unsigned long long']], - 'LockOwner' : [ 0xf0, ['pointer64', ['_ETHREAD']]], - 'FlowThroughReadRoot' : [ 0xf8, ['_RTL_AVL_TREE']], - 'Partition' : [ 0x100, ['pointer64', ['_MI_PARTITION']]], - 'FileObjectNode' : [ 0x108, ['_RTL_BALANCED_NODE']], -} ], - 'tagSWITCH_CONTEXT' : [ 0x68, { - 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], - 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], -} ], - '_CMP_SILO_CONTEXT' : [ 0x20, { - 'LockEntryHead' : [ 0x0, ['_LIST_ENTRY']], - 'LockListUnderCleanup' : [ 0x10, ['unsigned char']], - 'ContextLock' : [ 0x18, ['_EX_PUSH_LOCK']], -} ], - '__unnamed_1756' : [ 0xc, { - 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], - 'Status' : [ 0x4, ['long']], - 'Point' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_1759' : [ 0x18, { - 'Action' : [ 0x0, ['unsigned long']], - 'Handle' : [ 0x8, ['pointer64', ['void']]], - 'Status' : [ 0x10, ['long']], -} ], - '__unnamed_175b' : [ 0x8, { - 'CheckStack' : [ 0x0, ['pointer64', ['void']]], -} ], - '__unnamed_175f' : [ 0x20, { - 'Cell' : [ 0x0, ['unsigned long']], - 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], - 'RootPoint' : [ 0x10, ['pointer64', ['void']]], - 'Index' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_1761' : [ 0x18, { - 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], - 'Index' : [ 0x8, ['unsigned long']], - 'Cell' : [ 0xc, ['unsigned long']], - 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], -} ], - '__unnamed_1765' : [ 0x10, { - 'Space' : [ 0x0, ['unsigned long']], - 'MapPoint' : [ 0x4, ['unsigned long']], - 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], -} ], - '__unnamed_1769' : [ 0x10, { - 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], - 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], -} ], - '__unnamed_176b' : [ 0x4, { - 'FileOffset' : [ 0x0, ['unsigned long']], -} ], - '_HIVE_LOAD_FAILURE' : [ 0x160, { - 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], - 'Index' : [ 0x8, ['unsigned long']], - 'RecoverableIndex' : [ 0xc, ['unsigned long']], - 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1756']]], - 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1756']]], - 'RegistryIO' : [ 0xd0, ['__unnamed_1759']], - 'CheckRegistry2' : [ 0xe8, ['__unnamed_175b']], - 'CheckKey' : [ 0xf0, ['__unnamed_175f']], - 'CheckValueList' : [ 0x110, ['__unnamed_1761']], - 'CheckHive' : [ 0x128, ['__unnamed_1765']], - 'CheckHive1' : [ 0x138, ['__unnamed_1765']], - 'CheckBin' : [ 0x148, ['__unnamed_1769']], - 'RecoverData' : [ 0x158, ['__unnamed_176b']], -} ], - '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { - 'Id' : [ 0x0, ['unsigned short']], - 'StructIndex' : [ 0x2, ['unsigned short']], - 'Offset' : [ 0x4, ['unsigned short']], - 'Size' : [ 0x6, ['unsigned short']], -} ], - '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { - 'Version' : [ 0x0, ['unsigned long']], - 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], - 'CounterCount' : [ 0x10, ['unsigned long']], - 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], - 'Callback' : [ 0x20, ['pointer64', ['void']]], - 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], -} ], - '_PCW_PROCESSOR_INFO' : [ 0xc0, { - 'IdleTime' : [ 0x0, ['unsigned long long']], - 'AvailableTime' : [ 0x8, ['unsigned long long']], - 'UserTime' : [ 0x10, ['unsigned long long']], - 'KernelTime' : [ 0x18, ['unsigned long long']], - 'Interrupts' : [ 0x20, ['unsigned long']], - 'DpcTime' : [ 0x28, ['unsigned long long']], - 'InterruptTime' : [ 0x30, ['unsigned long long']], - 'ClockInterrupts' : [ 0x38, ['unsigned long']], - 'DpcCount' : [ 0x3c, ['unsigned long']], - 'DpcRate' : [ 0x40, ['unsigned long']], - 'C1Time' : [ 0x48, ['unsigned long long']], - 'C2Time' : [ 0x50, ['unsigned long long']], - 'C3Time' : [ 0x58, ['unsigned long long']], - 'C1Transitions' : [ 0x60, ['unsigned long long']], - 'C2Transitions' : [ 0x68, ['unsigned long long']], - 'C3Transitions' : [ 0x70, ['unsigned long long']], - 'StallTime' : [ 0x78, ['unsigned long long']], - 'ParkingStatus' : [ 0x80, ['unsigned long']], - 'CurrentFrequency' : [ 0x84, ['unsigned long']], - 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], - 'StateFlags' : [ 0x8c, ['unsigned long']], - 'NominalThroughput' : [ 0x90, ['unsigned long']], - 'ActiveThroughput' : [ 0x94, ['unsigned long']], - 'ScaledThroughput' : [ 0x98, ['unsigned long long']], - 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], - 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], - 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], - 'PerformanceLimit' : [ 0xb8, ['unsigned long']], - 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], -} ], - '_PCW_DATA' : [ 0x10, { - 'Data' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned long']], -} ], - '_SYNCH_COUNTERS' : [ 0xb8, { - 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], - 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], - 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], - 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], - 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], - 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], - 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], - 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], - 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], - 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], - 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], - 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], - 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], - 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], - 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], - 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], - 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], - 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], - 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], - 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], - 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], - 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], - 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], - 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], - 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], - 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], - 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], - 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], - 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], - 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], - 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], - 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], - 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], - 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], - 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], - 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], -} ], - '_ETW_PERF_COUNTERS' : [ 0x18, { - 'TotalActiveSessions' : [ 0x0, ['long']], - 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], - 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], - 'TotalGuidsEnabled' : [ 0xc, ['long']], - 'TotalGuidsNotEnabled' : [ 0x10, ['long']], - 'TotalGuidsPreEnabled' : [ 0x14, ['long']], -} ], - '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { - 'BufferMemoryPagedPool' : [ 0x0, ['long']], - 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], - 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], - 'EventsLost' : [ 0x10, ['long']], - 'NumConsumers' : [ 0x14, ['long']], -} ], - '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { - 'FsBytesRead' : [ 0x0, ['unsigned long long']], - 'FsBytesWritten' : [ 0x8, ['unsigned long long']], -} ], - '_THERMAL_ZONE_COUNTERS' : [ 0xc, { - 'Temperature' : [ 0x0, ['unsigned long']], - 'ThrottleLimit' : [ 0x4, ['unsigned long']], - 'ThrottleReasons' : [ 0x8, ['unsigned long']], -} ], - '_TEB32' : [ 0x1000, { - 'NtTib' : [ 0x0, ['_NT_TIB32']], - 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], - 'ClientId' : [ 0x20, ['_CLIENT_ID32']], - 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], - 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], - 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], - 'LastErrorValue' : [ 0x34, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], - 'CsrClientThread' : [ 0x3c, ['unsigned long']], - 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], - 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0xc0, ['unsigned long']], - 'CurrentLocale' : [ 0xc4, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], - 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], - 'SystemReserved1' : [ 0x10c, ['array', 38, ['unsigned long']]], - 'ExceptionCode' : [ 0x1a4, ['long']], - 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], - 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], - 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], - 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], - 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], - 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], - 'TxFsContext' : [ 0x1d0, ['unsigned long']], - 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], - 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], - 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], - 'GdiClientPID' : [ 0x6c0, ['unsigned long']], - 'GdiClientTID' : [ 0x6c4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], - 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], - 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], - 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], - 'glReserved2' : [ 0xbdc, ['unsigned long']], - 'glSectionInfo' : [ 0xbe0, ['unsigned long']], - 'glSection' : [ 0xbe4, ['unsigned long']], - 'glTable' : [ 0xbe8, ['unsigned long']], - 'glCurrentRC' : [ 0xbec, ['unsigned long']], - 'glContext' : [ 0xbf0, ['unsigned long']], - 'LastStatusValue' : [ 0xbf4, ['unsigned long']], - 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], - 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], - 'DeallocationStack' : [ 0xe0c, ['unsigned long']], - 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], - 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], - 'Vdm' : [ 0xf18, ['unsigned long']], - 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], - 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], - 'HardErrorMode' : [ 0xf28, ['unsigned long']], - 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], - 'ActivityId' : [ 0xf50, ['_GUID']], - 'SubProcessTag' : [ 0xf60, ['unsigned long']], - 'PerflibData' : [ 0xf64, ['unsigned long']], - 'EtwTraceData' : [ 0xf68, ['unsigned long']], - 'WinSockData' : [ 0xf6c, ['unsigned long']], - 'GdiBatchCount' : [ 0xf70, ['unsigned long']], - 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], - 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], - 'ReservedPad0' : [ 0xf74, ['unsigned char']], - 'ReservedPad1' : [ 0xf75, ['unsigned char']], - 'ReservedPad2' : [ 0xf76, ['unsigned char']], - 'IdealProcessor' : [ 0xf77, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], - 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], - 'ReservedForOle' : [ 0xf80, ['unsigned long']], - 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], - 'SavedPriorityState' : [ 0xf88, ['unsigned long']], - 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], - 'ThreadPoolData' : [ 0xf90, ['unsigned long']], - 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], - 'MuiGeneration' : [ 0xf98, ['unsigned long']], - 'IsImpersonating' : [ 0xf9c, ['unsigned long']], - 'NlsCache' : [ 0xfa0, ['unsigned long']], - 'pShimData' : [ 0xfa4, ['unsigned long']], - 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], - 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], - 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], - 'ActiveFrame' : [ 0xfb0, ['unsigned long']], - 'FlsData' : [ 0xfb4, ['unsigned long']], - 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], - 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], - 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], - 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], - 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], - 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], - 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], - 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], - 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], - 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], - 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], - 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], - 'LockCount' : [ 0xfd8, ['unsigned long']], - 'WowTebOffset' : [ 0xfdc, ['long']], - 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], - 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], - 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], - 'EffectiveContainerId' : [ 0xff0, ['_GUID']], -} ], - '_TEB64' : [ 0x1838, { - 'NtTib' : [ 0x0, ['_NT_TIB64']], - 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], - 'ClientId' : [ 0x40, ['_CLIENT_ID64']], - 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], - 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], - 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], - 'LastErrorValue' : [ 0x68, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], - 'CsrClientThread' : [ 0x70, ['unsigned long long']], - 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], - 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0x100, ['unsigned long long']], - 'CurrentLocale' : [ 0x108, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], - 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], - 'SystemReserved1' : [ 0x190, ['array', 38, ['unsigned long long']]], - 'ExceptionCode' : [ 0x2c0, ['long']], - 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], - 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], - 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], - 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], - 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], - 'TxFsContext' : [ 0x2e8, ['unsigned long']], - 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], - 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], - 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], - 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], - 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], - 'GdiClientPID' : [ 0x7f0, ['unsigned long']], - 'GdiClientTID' : [ 0x7f4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], - 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], - 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], - 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], - 'glReserved2' : [ 0x1220, ['unsigned long long']], - 'glSectionInfo' : [ 0x1228, ['unsigned long long']], - 'glSection' : [ 0x1230, ['unsigned long long']], - 'glTable' : [ 0x1238, ['unsigned long long']], - 'glCurrentRC' : [ 0x1240, ['unsigned long long']], - 'glContext' : [ 0x1248, ['unsigned long long']], - 'LastStatusValue' : [ 0x1250, ['unsigned long']], - 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], - 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], - 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], - 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], - 'DeallocationStack' : [ 0x1478, ['unsigned long long']], - 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], - 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], - 'Vdm' : [ 0x1690, ['unsigned long long']], - 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], - 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], - 'HardErrorMode' : [ 0x16b0, ['unsigned long']], - 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], - 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], - 'ActivityId' : [ 0x1710, ['_GUID']], - 'SubProcessTag' : [ 0x1720, ['unsigned long long']], - 'PerflibData' : [ 0x1728, ['unsigned long long']], - 'EtwTraceData' : [ 0x1730, ['unsigned long long']], - 'WinSockData' : [ 0x1738, ['unsigned long long']], - 'GdiBatchCount' : [ 0x1740, ['unsigned long']], - 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], - 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], - 'ReservedPad0' : [ 0x1744, ['unsigned char']], - 'ReservedPad1' : [ 0x1745, ['unsigned char']], - 'ReservedPad2' : [ 0x1746, ['unsigned char']], - 'IdealProcessor' : [ 0x1747, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], - 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], - 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], - 'ReservedForOle' : [ 0x1758, ['unsigned long long']], - 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], - 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], - 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], - 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], - 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], - 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], - 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], - 'BStoreLimit' : [ 0x1790, ['unsigned long long']], - 'MuiGeneration' : [ 0x1798, ['unsigned long']], - 'IsImpersonating' : [ 0x179c, ['unsigned long']], - 'NlsCache' : [ 0x17a0, ['unsigned long long']], - 'pShimData' : [ 0x17a8, ['unsigned long long']], - 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], - 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], - 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], - 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], - 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], - 'FlsData' : [ 0x17c8, ['unsigned long long']], - 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], - 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], - 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], - 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], - 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], - 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], - 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], - 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], - 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], - 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], - 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], - 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], - 'LockCount' : [ 0x1808, ['unsigned long']], - 'WowTebOffset' : [ 0x180c, ['long']], - 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], - 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], - 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], - 'EffectiveContainerId' : [ 0x1828, ['_GUID']], -} ], - '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { - 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], - 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], - 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], - 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], -} ], - '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { - 'AsUINT64' : [ 0x0, ['unsigned long long']], - 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], - 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], - 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], - 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], - 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], - 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], - 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long long')]], - 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], - 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], - 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], - 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], - 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], - 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], - 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], - 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], - 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], - 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], - 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], - 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], - 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], - 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], - 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], - 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], - 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], - 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], - 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], - 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], - 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], -} ], - '_KTIMER_TABLE' : [ 0x2200, { - 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], - 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], -} ], - '_KTIMER_TABLE_ENTRY' : [ 0x20, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'Entry' : [ 0x8, ['_LIST_ENTRY']], - 'Time' : [ 0x18, ['_ULARGE_INTEGER']], -} ], - '_XSTATE_SAVE' : [ 0x38, { - 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], - 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], - 'Level' : [ 0x10, ['unsigned char']], - 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], -} ], - '_XSAVE_AREA' : [ 0x240, { - 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], - 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], -} ], - '_KSHARED_READY_QUEUE' : [ 0x260, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'ReadySummary' : [ 0x8, ['unsigned long']], - 'ReadyListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], - 'RunningSummary' : [ 0x210, ['array', 64, ['unsigned char']]], - 'Span' : [ 0x250, ['unsigned char']], - 'LowProcIndex' : [ 0x251, ['unsigned char']], - 'QueueIndex' : [ 0x252, ['unsigned char']], - 'ProcCount' : [ 0x253, ['unsigned char']], - 'ScanOwner' : [ 0x254, ['unsigned char']], - 'Spare' : [ 0x255, ['array', 3, ['unsigned char']]], - 'Affinity' : [ 0x258, ['unsigned long long']], -} ], - '_KEXCEPTION_FRAME' : [ 0x140, { - 'P1Home' : [ 0x0, ['unsigned long long']], - 'P2Home' : [ 0x8, ['unsigned long long']], - 'P3Home' : [ 0x10, ['unsigned long long']], - 'P4Home' : [ 0x18, ['unsigned long long']], - 'P5' : [ 0x20, ['unsigned long long']], - 'Spare1' : [ 0x28, ['unsigned long long']], - 'Xmm6' : [ 0x30, ['_M128A']], - 'Xmm7' : [ 0x40, ['_M128A']], - 'Xmm8' : [ 0x50, ['_M128A']], - 'Xmm9' : [ 0x60, ['_M128A']], - 'Xmm10' : [ 0x70, ['_M128A']], - 'Xmm11' : [ 0x80, ['_M128A']], - 'Xmm12' : [ 0x90, ['_M128A']], - 'Xmm13' : [ 0xa0, ['_M128A']], - 'Xmm14' : [ 0xb0, ['_M128A']], - 'Xmm15' : [ 0xc0, ['_M128A']], - 'TrapFrame' : [ 0xd0, ['unsigned long long']], - 'OutputBuffer' : [ 0xd8, ['unsigned long long']], - 'OutputLength' : [ 0xe0, ['unsigned long long']], - 'Spare2' : [ 0xe8, ['unsigned long long']], - 'MxCsr' : [ 0xf0, ['unsigned long long']], - 'Rbp' : [ 0xf8, ['unsigned long long']], - 'Rbx' : [ 0x100, ['unsigned long long']], - 'Rdi' : [ 0x108, ['unsigned long long']], - 'Rsi' : [ 0x110, ['unsigned long long']], - 'R12' : [ 0x118, ['unsigned long long']], - 'R13' : [ 0x120, ['unsigned long long']], - 'R14' : [ 0x128, ['unsigned long long']], - 'R15' : [ 0x130, ['unsigned long long']], - 'Return' : [ 0x138, ['unsigned long long']], -} ], - '_KTRAP_FRAME' : [ 0x190, { - 'P1Home' : [ 0x0, ['unsigned long long']], - 'P2Home' : [ 0x8, ['unsigned long long']], - 'P3Home' : [ 0x10, ['unsigned long long']], - 'P4Home' : [ 0x18, ['unsigned long long']], - 'P5' : [ 0x20, ['unsigned long long']], - 'PreviousMode' : [ 0x28, ['unsigned char']], - 'PreviousIrql' : [ 0x29, ['unsigned char']], - 'FaultIndicator' : [ 0x2a, ['unsigned char']], - 'ExceptionActive' : [ 0x2b, ['unsigned char']], - 'MxCsr' : [ 0x2c, ['unsigned long']], - 'Rax' : [ 0x30, ['unsigned long long']], - 'Rcx' : [ 0x38, ['unsigned long long']], - 'Rdx' : [ 0x40, ['unsigned long long']], - 'R8' : [ 0x48, ['unsigned long long']], - 'R9' : [ 0x50, ['unsigned long long']], - 'R10' : [ 0x58, ['unsigned long long']], - 'R11' : [ 0x60, ['unsigned long long']], - 'GsBase' : [ 0x68, ['unsigned long long']], - 'GsSwap' : [ 0x68, ['unsigned long long']], - 'Xmm0' : [ 0x70, ['_M128A']], - 'Xmm1' : [ 0x80, ['_M128A']], - 'Xmm2' : [ 0x90, ['_M128A']], - 'Xmm3' : [ 0xa0, ['_M128A']], - 'Xmm4' : [ 0xb0, ['_M128A']], - 'Xmm5' : [ 0xc0, ['_M128A']], - 'FaultAddress' : [ 0xd0, ['unsigned long long']], - 'ContextRecord' : [ 0xd0, ['unsigned long long']], - 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], - 'Dr0' : [ 0xd8, ['unsigned long long']], - 'Dr1' : [ 0xe0, ['unsigned long long']], - 'Dr2' : [ 0xe8, ['unsigned long long']], - 'Dr3' : [ 0xf0, ['unsigned long long']], - 'Dr6' : [ 0xf8, ['unsigned long long']], - 'Dr7' : [ 0x100, ['unsigned long long']], - 'DebugControl' : [ 0x108, ['unsigned long long']], - 'LastBranchToRip' : [ 0x110, ['unsigned long long']], - 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], - 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], - 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], - 'SegDs' : [ 0x130, ['unsigned short']], - 'SegEs' : [ 0x132, ['unsigned short']], - 'SegFs' : [ 0x134, ['unsigned short']], - 'SegGs' : [ 0x136, ['unsigned short']], - 'TrapFrame' : [ 0x138, ['unsigned long long']], - 'Rbx' : [ 0x140, ['unsigned long long']], - 'Rdi' : [ 0x148, ['unsigned long long']], - 'Rsi' : [ 0x150, ['unsigned long long']], - 'Rbp' : [ 0x158, ['unsigned long long']], - 'ErrorCode' : [ 0x160, ['unsigned long long']], - 'ExceptionFrame' : [ 0x160, ['unsigned long long']], - 'TimeStampKlog' : [ 0x160, ['unsigned long long']], - 'Rip' : [ 0x168, ['unsigned long long']], - 'SegCs' : [ 0x170, ['unsigned short']], - 'Fill0' : [ 0x172, ['unsigned char']], - 'Logging' : [ 0x173, ['unsigned char']], - 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], - 'EFlags' : [ 0x178, ['unsigned long']], - 'Fill2' : [ 0x17c, ['unsigned long']], - 'Rsp' : [ 0x180, ['unsigned long long']], - 'SegSs' : [ 0x188, ['unsigned short']], - 'Fill3' : [ 0x18a, ['unsigned short']], - 'Fill4' : [ 0x18c, ['unsigned long']], -} ], - '__unnamed_1866' : [ 0x8, { - 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], - 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], - 'Information' : [ 0x0, ['pointer64', ['void']]], -} ], - '__unnamed_1868' : [ 0x8, { - 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], -} ], - '__unnamed_186c' : [ 0x20, { - 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], - 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], - 'SerialNumber' : [ 0x18, ['pointer64', ['unsigned short']]], -} ], - '_DEVICE_NODE' : [ 0x2c8, { - 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], - 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], - 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], - 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], - 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], - 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], - 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], - 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], - 'FxDevice' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], - 'FxDeviceLock' : [ 0x58, ['long']], - 'FxRemoveEvent' : [ 0x60, ['_KEVENT']], - 'FxActivationCount' : [ 0x78, ['long']], - 'FxSleepCount' : [ 0x7c, ['long']], - 'Plugin' : [ 0x80, ['pointer64', ['_POP_FX_PLUGIN']]], - 'Level' : [ 0x88, ['unsigned long']], - 'CurrentPowerState' : [ 0x8c, ['_POWER_STATE']], - 'Notify' : [ 0x90, ['_PO_DEVICE_NOTIFY']], - 'PoIrpManager' : [ 0xf8, ['_PO_IRP_MANAGER']], - 'UniqueId' : [ 0x118, ['_UNICODE_STRING']], - 'PowerFlags' : [ 0x128, ['unsigned long']], - 'State' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], - 'PreviousState' : [ 0x130, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], - 'StateHistory' : [ 0x134, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], - 'StateHistoryEntry' : [ 0x184, ['unsigned long']], - 'CompletionStatus' : [ 0x188, ['long']], - 'Flags' : [ 0x18c, ['unsigned long']], - 'UserFlags' : [ 0x190, ['unsigned long']], - 'Problem' : [ 0x194, ['unsigned long']], - 'ProblemStatus' : [ 0x198, ['long']], - 'ResourceList' : [ 0x1a0, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'ResourceListTranslated' : [ 0x1a8, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'DuplicatePDO' : [ 0x1b0, ['pointer64', ['_DEVICE_OBJECT']]], - 'ResourceRequirements' : [ 0x1b8, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], - 'InterfaceType' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'BusNumber' : [ 0x1c4, ['unsigned long']], - 'ChildInterfaceType' : [ 0x1c8, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'ChildBusNumber' : [ 0x1cc, ['unsigned long']], - 'ChildBusTypeIndex' : [ 0x1d0, ['unsigned short']], - 'RemovalPolicy' : [ 0x1d2, ['unsigned char']], - 'HardwareRemovalPolicy' : [ 0x1d3, ['unsigned char']], - 'TargetDeviceNotify' : [ 0x1d8, ['_LIST_ENTRY']], - 'DeviceArbiterList' : [ 0x1e8, ['_LIST_ENTRY']], - 'DeviceTranslatorList' : [ 0x1f8, ['_LIST_ENTRY']], - 'NoTranslatorMask' : [ 0x208, ['unsigned short']], - 'QueryTranslatorMask' : [ 0x20a, ['unsigned short']], - 'NoArbiterMask' : [ 0x20c, ['unsigned short']], - 'QueryArbiterMask' : [ 0x20e, ['unsigned short']], - 'OverUsed1' : [ 0x210, ['__unnamed_1866']], - 'OverUsed2' : [ 0x218, ['__unnamed_1868']], - 'BootResources' : [ 0x220, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'BootResourcesTranslated' : [ 0x228, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'CapabilityFlags' : [ 0x230, ['unsigned long']], - 'DockInfo' : [ 0x238, ['__unnamed_186c']], - 'DisableableDepends' : [ 0x258, ['unsigned long']], - 'PendedSetInterfaceState' : [ 0x260, ['_LIST_ENTRY']], - 'LegacyBusListEntry' : [ 0x270, ['_LIST_ENTRY']], - 'DriverUnloadRetryCount' : [ 0x280, ['unsigned long']], - 'PreviousParent' : [ 0x288, ['pointer64', ['_DEVICE_NODE']]], - 'DeletedChildren' : [ 0x290, ['long']], - 'NumaNodeIndex' : [ 0x294, ['unsigned long']], - 'ContainerID' : [ 0x298, ['_GUID']], - 'OverrideFlags' : [ 0x2a8, ['unsigned char']], - 'DeviceIdsHash' : [ 0x2ac, ['unsigned long']], - 'RequiresUnloadedDriver' : [ 0x2b0, ['unsigned char']], - 'PendingEjectRelations' : [ 0x2b8, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], - 'StateFlags' : [ 0x2c0, ['unsigned long']], -} ], - '_MCGEN_TRACE_CONTEXT' : [ 0x48, { - 'RegistrationHandle' : [ 0x0, ['unsigned long long']], - 'Logger' : [ 0x8, ['unsigned long long']], - 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], - 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], - 'Flags' : [ 0x20, ['unsigned long']], - 'IsEnabled' : [ 0x24, ['unsigned long']], - 'Level' : [ 0x28, ['unsigned char']], - 'Reserve' : [ 0x29, ['unsigned char']], - 'EnableBitsCount' : [ 0x2a, ['unsigned short']], - 'EnableBitMask' : [ 0x30, ['pointer64', ['unsigned long']]], - 'EnableKeyWords' : [ 0x38, ['pointer64', ['unsigned long long']]], - 'EnableLevel' : [ 0x40, ['pointer64', ['unsigned char']]], -} ], - '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { - 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], - 'DispatchedCount' : [ 0x10, ['unsigned long']], - 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], - 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], - 'SpinLock' : [ 0x48, ['unsigned long long']], -} ], - '_KSEMAPHORE' : [ 0x20, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'Limit' : [ 0x18, ['long']], -} ], - '_DEVOBJ_EXTENSION' : [ 0x68, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['unsigned short']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'PowerFlags' : [ 0x10, ['unsigned long']], - 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], - 'ExtensionFlags' : [ 0x20, ['unsigned long']], - 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], - 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], - 'StartIoCount' : [ 0x38, ['long']], - 'StartIoKey' : [ 0x3c, ['long']], - 'StartIoFlags' : [ 0x40, ['unsigned long']], - 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], - 'DependencyNode' : [ 0x50, ['pointer64', ['void']]], - 'InterruptContext' : [ 0x58, ['pointer64', ['void']]], - 'VerifierContext' : [ 0x60, ['pointer64', ['void']]], -} ], - '_GROUP_AFFINITY' : [ 0x10, { - 'Mask' : [ 0x0, ['unsigned long long']], - 'Group' : [ 0x8, ['unsigned short']], - 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], -} ], - '_KAFFINITY_EX' : [ 0xa8, { - 'Count' : [ 0x0, ['unsigned short']], - 'Size' : [ 0x2, ['unsigned short']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'Bitmap' : [ 0x8, ['array', 20, ['unsigned long long']]], -} ], - '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { - 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], - 'DeviceCount' : [ 0x4, ['unsigned long']], - 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], -} ], - '_PNP_RESOURCE_REQUEST' : [ 0x40, { - 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], - 'Flags' : [ 0x8, ['unsigned long']], - 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], - 'Priority' : [ 0x10, ['unsigned long']], - 'Position' : [ 0x14, ['unsigned long']], - 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], - 'ReqList' : [ 0x20, ['pointer64', ['void']]], - 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], - 'Status' : [ 0x38, ['long']], -} ], - '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { - 'ListSize' : [ 0x0, ['unsigned long']], - 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'BusNumber' : [ 0x8, ['unsigned long']], - 'SlotNumber' : [ 0xc, ['unsigned long']], - 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], - 'AlternativeLists' : [ 0x1c, ['unsigned long']], - 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], -} ], - '_EXCEPTION_RECORD64' : [ 0x98, { - 'ExceptionCode' : [ 0x0, ['long']], - 'ExceptionFlags' : [ 0x4, ['unsigned long']], - 'ExceptionRecord' : [ 0x8, ['unsigned long long']], - 'ExceptionAddress' : [ 0x10, ['unsigned long long']], - 'NumberParameters' : [ 0x18, ['unsigned long']], - '__unusedAlignment' : [ 0x1c, ['unsigned long']], - 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], -} ], - '_EXCEPTION_RECORD32' : [ 0x50, { - 'ExceptionCode' : [ 0x0, ['long']], - 'ExceptionFlags' : [ 0x4, ['unsigned long']], - 'ExceptionRecord' : [ 0x8, ['unsigned long']], - 'ExceptionAddress' : [ 0xc, ['unsigned long']], - 'NumberParameters' : [ 0x10, ['unsigned long']], - 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], -} ], - '_DBGKM_EXCEPTION64' : [ 0xa0, { - 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], - 'FirstChance' : [ 0x98, ['unsigned long']], -} ], - '_DBGKM_EXCEPTION32' : [ 0x54, { - 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], - 'FirstChance' : [ 0x50, ['unsigned long']], -} ], - '_X86_KTRAP_FRAME' : [ 0x8c, { - 'DbgEbp' : [ 0x0, ['unsigned long']], - 'DbgEip' : [ 0x4, ['unsigned long']], - 'DbgArgMark' : [ 0x8, ['unsigned long']], - 'DbgArgPointer' : [ 0xc, ['unsigned long']], - 'TempSegCs' : [ 0x10, ['unsigned long']], - 'TempEsp' : [ 0x14, ['unsigned long']], - 'Dr0' : [ 0x18, ['unsigned long']], - 'Dr1' : [ 0x1c, ['unsigned long']], - 'Dr2' : [ 0x20, ['unsigned long']], - 'Dr3' : [ 0x24, ['unsigned long']], - 'Dr6' : [ 0x28, ['unsigned long']], - 'Dr7' : [ 0x2c, ['unsigned long']], - 'SegGs' : [ 0x30, ['unsigned long']], - 'SegEs' : [ 0x34, ['unsigned long']], - 'SegDs' : [ 0x38, ['unsigned long']], - 'Edx' : [ 0x3c, ['unsigned long']], - 'Ecx' : [ 0x40, ['unsigned long']], - 'Eax' : [ 0x44, ['unsigned long']], - 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], - 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], - 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], - 'ExceptionList' : [ 0x4c, ['unsigned long']], - 'SegFs' : [ 0x50, ['unsigned long']], - 'Edi' : [ 0x54, ['unsigned long']], - 'Esi' : [ 0x58, ['unsigned long']], - 'Ebx' : [ 0x5c, ['unsigned long']], - 'Ebp' : [ 0x60, ['unsigned long']], - 'ErrCode' : [ 0x64, ['unsigned long']], - 'Eip' : [ 0x68, ['unsigned long']], - 'SegCs' : [ 0x6c, ['unsigned long']], - 'EFlags' : [ 0x70, ['unsigned long']], - 'HardwareEsp' : [ 0x74, ['unsigned long']], - 'HardwareSegSs' : [ 0x78, ['unsigned long']], - 'V86Es' : [ 0x7c, ['unsigned long']], - 'V86Ds' : [ 0x80, ['unsigned long']], - 'V86Fs' : [ 0x84, ['unsigned long']], - 'V86Gs' : [ 0x88, ['unsigned long']], -} ], - '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { - 'DbgEbp' : [ 0x0, ['unsigned long']], - 'DbgEip' : [ 0x4, ['unsigned long']], - 'DbgArgMark' : [ 0x8, ['unsigned long']], - 'TempSegCs' : [ 0xc, ['unsigned short']], - 'Logging' : [ 0xe, ['unsigned char']], - 'FrameType' : [ 0xf, ['unsigned char']], - 'TempEsp' : [ 0x10, ['unsigned long']], - 'Dr0' : [ 0x14, ['unsigned long']], - 'Dr1' : [ 0x18, ['unsigned long']], - 'Dr2' : [ 0x1c, ['unsigned long']], - 'Dr3' : [ 0x20, ['unsigned long']], - 'Dr6' : [ 0x24, ['unsigned long']], - 'Dr7' : [ 0x28, ['unsigned long']], - 'SegGs' : [ 0x2c, ['unsigned long']], - 'SegEs' : [ 0x30, ['unsigned long']], - 'SegDs' : [ 0x34, ['unsigned long']], - 'Edx' : [ 0x38, ['unsigned long']], - 'Ecx' : [ 0x3c, ['unsigned long']], - 'Eax' : [ 0x40, ['unsigned long']], - 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], - 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], - 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], - 'MxCsr' : [ 0x48, ['unsigned long']], - 'ExceptionList' : [ 0x4c, ['unsigned long']], - 'SegFs' : [ 0x50, ['unsigned long']], - 'Edi' : [ 0x54, ['unsigned long']], - 'Esi' : [ 0x58, ['unsigned long']], - 'Ebx' : [ 0x5c, ['unsigned long']], - 'Ebp' : [ 0x60, ['unsigned long']], - 'ErrCode' : [ 0x64, ['unsigned long']], - 'Eip' : [ 0x68, ['unsigned long']], - 'SegCs' : [ 0x6c, ['unsigned long']], - 'EFlags' : [ 0x70, ['unsigned long']], - 'HardwareEsp' : [ 0x74, ['unsigned long']], - 'HardwareSegSs' : [ 0x78, ['unsigned long']], - 'V86Es' : [ 0x7c, ['unsigned long']], - 'V86Ds' : [ 0x80, ['unsigned long']], - 'V86Fs' : [ 0x84, ['unsigned long']], - 'V86Gs' : [ 0x88, ['unsigned long']], -} ], - '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { - 'PathNameLength' : [ 0x0, ['unsigned long']], - 'BaseOfDll' : [ 0x8, ['unsigned long long']], - 'ProcessId' : [ 0x10, ['unsigned long long']], - 'CheckSum' : [ 0x18, ['unsigned long']], - 'SizeOfImage' : [ 0x1c, ['unsigned long']], - 'UnloadSymbols' : [ 0x20, ['unsigned char']], -} ], - '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { - 'PathNameLength' : [ 0x0, ['unsigned long']], - 'BaseOfDll' : [ 0x4, ['unsigned long']], - 'ProcessId' : [ 0x8, ['unsigned long']], - 'CheckSum' : [ 0xc, ['unsigned long']], - 'SizeOfImage' : [ 0x10, ['unsigned long']], - 'UnloadSymbols' : [ 0x14, ['unsigned char']], -} ], - '_DBGKD_READ_MEMORY64' : [ 0x10, { - 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], - 'TransferCount' : [ 0x8, ['unsigned long']], - 'ActualBytesRead' : [ 0xc, ['unsigned long']], -} ], - '_DBGKD_READ_MEMORY32' : [ 0xc, { - 'TargetBaseAddress' : [ 0x0, ['unsigned long']], - 'TransferCount' : [ 0x4, ['unsigned long']], - 'ActualBytesRead' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_WRITE_MEMORY64' : [ 0x10, { - 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], - 'TransferCount' : [ 0x8, ['unsigned long']], - 'ActualBytesWritten' : [ 0xc, ['unsigned long']], -} ], - '_DBGKD_WRITE_MEMORY32' : [ 0xc, { - 'TargetBaseAddress' : [ 0x0, ['unsigned long']], - 'TransferCount' : [ 0x4, ['unsigned long']], - 'ActualBytesWritten' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { - 'BreakPointAddress' : [ 0x0, ['unsigned long long']], - 'BreakPointHandle' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { - 'BreakPointAddress' : [ 0x0, ['unsigned long']], - 'BreakPointHandle' : [ 0x4, ['unsigned long']], -} ], - '_DBGKD_READ_WRITE_IO64' : [ 0x10, { - 'IoAddress' : [ 0x0, ['unsigned long long']], - 'DataSize' : [ 0x8, ['unsigned long']], - 'DataValue' : [ 0xc, ['unsigned long']], -} ], - '_DBGKD_READ_WRITE_IO32' : [ 0xc, { - 'DataSize' : [ 0x0, ['unsigned long']], - 'IoAddress' : [ 0x4, ['unsigned long']], - 'DataValue' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { - 'DataSize' : [ 0x0, ['unsigned long']], - 'InterfaceType' : [ 0x4, ['unsigned long']], - 'BusNumber' : [ 0x8, ['unsigned long']], - 'AddressSpace' : [ 0xc, ['unsigned long']], - 'IoAddress' : [ 0x10, ['unsigned long long']], - 'DataValue' : [ 0x18, ['unsigned long']], -} ], - '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { - 'DataSize' : [ 0x0, ['unsigned long']], - 'InterfaceType' : [ 0x4, ['unsigned long']], - 'BusNumber' : [ 0x8, ['unsigned long']], - 'AddressSpace' : [ 0xc, ['unsigned long']], - 'IoAddress' : [ 0x10, ['unsigned long']], - 'DataValue' : [ 0x14, ['unsigned long']], -} ], - '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { - 'SpecialCall' : [ 0x0, ['unsigned long']], -} ], - '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { - 'SpecialCall' : [ 0x0, ['unsigned long long']], -} ], - '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { - 'BreakpointAddress' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x4, ['unsigned long']], -} ], - '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { - 'BreakpointAddress' : [ 0x0, ['unsigned long long']], - 'Flags' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { - 'BreakpointAddress' : [ 0x0, ['unsigned long long']], - 'Flags' : [ 0x8, ['unsigned long']], - 'Calls' : [ 0xc, ['unsigned long']], - 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], - 'MinInstructions' : [ 0x14, ['unsigned long']], - 'MaxInstructions' : [ 0x18, ['unsigned long']], - 'TotalInstructions' : [ 0x1c, ['unsigned long']], -} ], - '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { - 'BreakpointAddress' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x4, ['unsigned long']], - 'Calls' : [ 0x8, ['unsigned long']], - 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], - 'MinInstructions' : [ 0x10, ['unsigned long']], - 'MaxInstructions' : [ 0x14, ['unsigned long']], - 'TotalInstructions' : [ 0x18, ['unsigned long']], -} ], - '__unnamed_1969' : [ 0x28, { - 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], - 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], - 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], - 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], - 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], - 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], - 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], - 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], - 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], - 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], - 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], - 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], - 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], - 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], - 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], - 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], - 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], - 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], - 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], - 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], - 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], - 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], - 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], - 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], - 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], -} ], - '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { - 'ApiNumber' : [ 0x0, ['unsigned long']], - 'ProcessorLevel' : [ 0x4, ['unsigned short']], - 'Processor' : [ 0x6, ['unsigned short']], - 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_1969']], -} ], - '__unnamed_1970' : [ 0x28, { - 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], - 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], - 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], - 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], - 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], - 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], - 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], - 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], - 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], - 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], - 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], - 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], - 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], - 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], - 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], - 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], - 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], - 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], - 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], - 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], - 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], - 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], -} ], - '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { - 'ApiNumber' : [ 0x0, ['unsigned long']], - 'ProcessorLevel' : [ 0x4, ['unsigned short']], - 'Processor' : [ 0x6, ['unsigned short']], - 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_1970']], -} ], - '_DBGKD_READ_WRITE_MSR' : [ 0xc, { - 'Msr' : [ 0x0, ['unsigned long']], - 'DataValueLow' : [ 0x4, ['unsigned long']], - 'DataValueHigh' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_BREAKPOINTEX' : [ 0x8, { - 'BreakPointCount' : [ 0x0, ['unsigned long']], - 'ContinueStatus' : [ 0x4, ['long']], -} ], - '_DBGKD_SEARCH_MEMORY' : [ 0x18, { - 'SearchAddress' : [ 0x0, ['unsigned long long']], - 'FoundAddress' : [ 0x0, ['unsigned long long']], - 'SearchLength' : [ 0x8, ['unsigned long long']], - 'PatternLength' : [ 0x10, ['unsigned long']], -} ], - '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { - 'BreakPointHandle' : [ 0x0, ['unsigned long']], -} ], - '_DBGKD_CONTINUE' : [ 0x4, { - 'ContinueStatus' : [ 0x0, ['long']], -} ], - '_DBGKD_CONTINUE2' : [ 0x20, { - 'ContinueStatus' : [ 0x0, ['long']], - 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], - 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], -} ], - '_PEP_ACPI_RESOURCE' : [ 0x48, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], - 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], - 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], - 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], - 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], - 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], - 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], -} ], - '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'Information' : [ 0x4, ['unsigned char']], - 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], - 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], - 'Alignment' : [ 0x18, ['unsigned long']], - 'Length' : [ 0x1c, ['unsigned long']], -} ], - '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x20, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], - 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], - 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], - 'Count' : [ 0x10, ['unsigned char']], - 'Pins' : [ 0x18, ['pointer64', ['unsigned long']]], -} ], - '_PEP_ACPI_GPIO_RESOURCE' : [ 0x48, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], - 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], - 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], - 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], - 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], - 'DriveStrength' : [ 0x18, ['unsigned short']], - 'DebounceTimeout' : [ 0x1a, ['unsigned short']], - 'PinTable' : [ 0x20, ['pointer64', ['unsigned short']]], - 'PinCount' : [ 0x28, ['unsigned short']], - 'ResourceSourceIndex' : [ 0x2a, ['unsigned char']], - 'ResourceSourceName' : [ 0x30, ['pointer64', ['_UNICODE_STRING']]], - 'VendorData' : [ 0x38, ['pointer64', ['unsigned char']]], - 'VendorDataLength' : [ 0x40, ['unsigned short']], -} ], - '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x30, { - 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], - 'ConnectionSpeed' : [ 0x28, ['unsigned long']], - 'SlaveAddress' : [ 0x2c, ['unsigned short']], -} ], - '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x38, { - 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], - 'BaudRate' : [ 0x28, ['unsigned long']], - 'RxBufferSize' : [ 0x2c, ['unsigned short']], - 'TxBufferSize' : [ 0x2e, ['unsigned short']], - 'Parity' : [ 0x30, ['unsigned char']], - 'LinesInUse' : [ 0x31, ['unsigned char']], -} ], - '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x38, { - 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], - 'ConnectionSpeed' : [ 0x28, ['unsigned long']], - 'DataBitLength' : [ 0x2c, ['unsigned char']], - 'Phase' : [ 0x2d, ['unsigned char']], - 'Polarity' : [ 0x2e, ['unsigned char']], - 'DeviceSelection' : [ 0x30, ['unsigned short']], -} ], - '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], - 'ResourceFlags' : [ 0x8, ['unsigned char']], - 'GeneralFlags' : [ 0x9, ['unsigned char']], - 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], - 'RevisionId' : [ 0xb, ['unsigned char']], - 'Reserved' : [ 0xc, ['unsigned char']], - 'Granularity' : [ 0x10, ['unsigned long long']], - 'MinimumAddress' : [ 0x18, ['unsigned long long']], - 'MaximumAddress' : [ 0x20, ['unsigned long long']], - 'TranslationAddress' : [ 0x28, ['unsigned long long']], - 'AddressLength' : [ 0x30, ['unsigned long long']], - 'TypeAttribute' : [ 0x38, ['unsigned long long']], - 'DescriptorName' : [ 0x40, ['pointer64', ['_UNICODE_STRING']]], -} ], - '_PPM_PLATFORM_STATES' : [ 0x1c0, { - 'StateCount' : [ 0x0, ['unsigned long']], - 'InterfaceVersion' : [ 0x4, ['unsigned long']], - 'ProcessorCount' : [ 0x8, ['unsigned long']], - 'CoordinatedInterface' : [ 0xc, ['unsigned char']], - 'IdleTest' : [ 0x10, ['pointer64', ['void']]], - 'IdlePreExecute' : [ 0x18, ['pointer64', ['void']]], - 'IdleComplete' : [ 0x20, ['pointer64', ['void']]], - 'QueryPlatformStateResidency' : [ 0x28, ['pointer64', ['void']]], - 'Accounting' : [ 0x30, ['pointer64', ['_PLATFORM_IDLE_ACCOUNTING']]], - 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], -} ], - '_CPU_INFO' : [ 0x10, { - 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], - 'Eax' : [ 0x0, ['unsigned long']], - 'Ebx' : [ 0x4, ['unsigned long']], - 'Ecx' : [ 0x8, ['unsigned long']], - 'Edx' : [ 0xc, ['unsigned long']], -} ], - '_POP_PPM_PROFILE' : [ 0xb30, { - 'Name' : [ 0x0, ['pointer64', ['unsigned short']]], - 'Id' : [ 0x8, ['unsigned char']], - 'Guid' : [ 0xc, ['_GUID']], - 'Flags' : [ 0x1c, ['unsigned long']], - 'Priority' : [ 0x20, ['unsigned char']], - 'Settings' : [ 0x28, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], - 'StartTime' : [ 0xb08, ['unsigned long long']], - 'Count' : [ 0xb10, ['unsigned long long']], - 'MaxDuration' : [ 0xb18, ['unsigned long long']], - 'MinDuration' : [ 0xb20, ['unsigned long long']], - 'TotalDuration' : [ 0xb28, ['unsigned long long']], -} ], - '_PPM_ENGINE_SETTINGS' : [ 0x570, { - 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], - 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], - 'PerfTimeCheck' : [ 0x14, ['unsigned long']], - 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], - 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], - 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], - 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], - 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], - 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], - 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], - 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], - 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], - 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], - 'PerfBoostMode' : [ 0x30, ['unsigned long']], - 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], - 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], - 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], - 'AutonomousPreference' : [ 0x40, ['unsigned char']], - 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], - 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], - 'DutyCycling' : [ 0x45, ['unsigned char']], - 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], - 'DistributeUtility' : [ 0x48, ['unsigned char']], - 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], - 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], - 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], - 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], - 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], - 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], - 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], - 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], - 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], - 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], - 'AllowScaling' : [ 0x5c, ['unsigned char']], - 'IdleDisabled' : [ 0x5d, ['unsigned char']], - 'IdleTimeCheck' : [ 0x60, ['unsigned long']], - 'IdleDemotePercent' : [ 0x64, ['unsigned char']], - 'IdlePromotePercent' : [ 0x65, ['unsigned char']], - 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], - 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], - 'HeteroDecreaseThreshold' : [ 0x68, ['array', 640, ['unsigned char']]], - 'HeteroIncreaseThreshold' : [ 0x2e8, ['array', 640, ['unsigned char']]], - 'Class0FloorPerformance' : [ 0x568, ['unsigned char']], - 'Class1InitialPerformance' : [ 0x569, ['unsigned char']], -} ], - '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { - 'Value' : [ 0x0, ['long']], - 'Value2' : [ 0x4, ['long']], - 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], - 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], -} ], - '_POP_FX_PERF_FLAGS' : [ 0x4, { - 'Value' : [ 0x0, ['long']], - 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], - 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], - 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], - 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '_POP_FX_DEVICE_STATUS' : [ 0x4, { - 'Value' : [ 0x0, ['long']], - 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], -} ], - '_POP_RW_LOCK' : [ 0x10, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], -} ], - '_VOLUME_CACHE_MAP' : [ 0xd0, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteCode' : [ 0x2, ['short']], - 'UseCount' : [ 0x4, ['unsigned long']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], - 'DirtyPages' : [ 0x20, ['unsigned long long']], - 'LogHandleContext' : [ 0x28, ['_LOG_HANDLE_CONTEXT']], - 'Flags' : [ 0xc0, ['unsigned long']], - 'PagesQueuedToDisk' : [ 0xc4, ['unsigned long']], - 'LoggedPagesQueuedToDisk' : [ 0xc8, ['unsigned long']], -} ], - '_SHARED_CACHE_MAP' : [ 0x210, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteSize' : [ 0x2, ['short']], - 'OpenCount' : [ 0x4, ['unsigned long']], - 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], - 'BcbList' : [ 0x10, ['_LIST_ENTRY']], - 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], - 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], - 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], - 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], - 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], - 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], - 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], - 'DirtyPages' : [ 0x70, ['unsigned long']], - 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], - 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], - 'Flags' : [ 0x98, ['unsigned long']], - 'Status' : [ 0x9c, ['long']], - 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], - 'Section' : [ 0xa8, ['pointer64', ['void']]], - 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], - 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], - 'PagesToWrite' : [ 0xc0, ['unsigned long']], - 'BeyondLastFlush' : [ 0xc8, ['long long']], - 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], - 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], - 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], - 'V1' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V1']], - 'V2' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V2']], - 'LargestLSN' : [ 0x100, ['_LARGE_INTEGER']], - 'DirtyPageThreshold' : [ 0x108, ['unsigned long']], - 'LazyWritePassCount' : [ 0x10c, ['unsigned long']], - 'UninitializeEvent' : [ 0x110, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], - 'BcbLock' : [ 0x118, ['_FAST_MUTEX']], - 'LastUnmapBehindOffset' : [ 0x150, ['_LARGE_INTEGER']], - 'Event' : [ 0x158, ['_KEVENT']], - 'HighWaterMappingOffset' : [ 0x170, ['_LARGE_INTEGER']], - 'PrivateCacheMap' : [ 0x178, ['_PRIVATE_CACHE_MAP']], - 'WriteBehindWorkQueueEntry' : [ 0x1f0, ['pointer64', ['void']]], - 'VolumeCacheMap' : [ 0x1f8, ['pointer64', ['_VOLUME_CACHE_MAP']]], - 'ProcImagePathHash' : [ 0x200, ['unsigned long']], - 'WritesInProgress' : [ 0x204, ['unsigned long']], - 'AsyncReadRequestCount' : [ 0x208, ['unsigned long']], -} ], - '__unnamed_1a53' : [ 0x10, { - 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], - 'ActiveCount' : [ 0x0, ['unsigned short']], - 'Links' : [ 0x0, ['_LIST_ENTRY']], -} ], - '_VACB' : [ 0x28, { - 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], - 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x10, ['__unnamed_1a53']], - 'ArrayHead' : [ 0x20, ['pointer64', ['_VACB_ARRAY_HEADER']]], -} ], - '__unnamed_1a77' : [ 0x8, { - 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], -} ], - '__unnamed_1a79' : [ 0x8, { - 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], -} ], - '__unnamed_1a7b' : [ 0x8, { - 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], -} ], - '__unnamed_1a7d' : [ 0x4, { - 'Reason' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_1a7f' : [ 0x30, { - 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], - 'IoStatus' : [ 0x8, ['pointer64', ['_IO_STATUS_BLOCK']]], - 'CallerWaitEvent' : [ 0x10, ['_KEVENT']], - 'IsLowPriWriteBehind' : [ 0x28, ['unsigned char']], -} ], - '__unnamed_1a83' : [ 0x58, { - 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], - 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], - 'Length' : [ 0x18, ['unsigned long']], - 'PrefetchList' : [ 0x20, ['pointer64', ['_SINGLE_LIST_ENTRY']]], - 'PrefetchPagePriority' : [ 0x28, ['unsigned long']], - 'Mdl' : [ 0x30, ['pointer64', ['_MDL']]], - 'IoStatusBlock' : [ 0x38, ['pointer64', ['_IO_STATUS_BLOCK']]], - 'CallbackContext' : [ 0x40, ['pointer64', ['_CC_ASYNC_READ_CONTEXT']]], - 'OriginatingProcess' : [ 0x48, ['pointer64', ['_EPROCESS']]], - 'RequestorMode' : [ 0x50, ['unsigned char']], - 'NestingLevel' : [ 0x54, ['unsigned long']], -} ], - '__unnamed_1a85' : [ 0x58, { - 'Read' : [ 0x0, ['__unnamed_1a77']], - 'Write' : [ 0x0, ['__unnamed_1a79']], - 'Event' : [ 0x0, ['__unnamed_1a7b']], - 'Notification' : [ 0x0, ['__unnamed_1a7d']], - 'LowPriWrite' : [ 0x0, ['__unnamed_1a7f']], - 'AsyncRead' : [ 0x0, ['__unnamed_1a83']], -} ], - '_WORK_QUEUE_ENTRY' : [ 0x70, { - 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], - 'Parameters' : [ 0x10, ['__unnamed_1a85']], - 'Function' : [ 0x68, ['unsigned char']], -} ], - '_CC_EXTERNAL_CACHE_INFO' : [ 0x30, { - 'Callback' : [ 0x0, ['pointer64', ['void']]], - 'DirtyPageStatistics' : [ 0x8, ['_DIRTY_PAGE_STATISTICS']], - 'Links' : [ 0x20, ['_LIST_ENTRY']], -} ], - '_LOG_HANDLE_CONTEXT' : [ 0x98, { - 'LogHandle' : [ 0x0, ['pointer64', ['void']]], - 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], - 'QueryLogHandleInfoRoutine' : [ 0x10, ['pointer64', ['void']]], - 'DirtyPageStatistics' : [ 0x18, ['_DIRTY_PAGE_STATISTICS']], - 'DirtyPageThresholds' : [ 0x30, ['_DIRTY_PAGE_THRESHOLDS']], - 'AdditionalPagesToWrite' : [ 0x68, ['unsigned long']], - 'CcLWScanDPThreshold' : [ 0x6c, ['unsigned long']], - 'LargestLsnForCurrentLWScan' : [ 0x70, ['_LARGE_INTEGER']], - 'RelatedFileObject' : [ 0x78, ['pointer64', ['_FILE_OBJECT']]], - 'LargestLsnFileObjectKey' : [ 0x80, ['unsigned long long']], - 'LastLWTimeStamp' : [ 0x88, ['_LARGE_INTEGER']], - 'Flags' : [ 0x90, ['unsigned long']], -} ], - '_MBCB' : [ 0xc0, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeIsInZone' : [ 0x2, ['short']], - 'PagesToWrite' : [ 0x4, ['unsigned long']], - 'DirtyPages' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0xc, ['unsigned long']], - 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], - 'ResumeWritePage' : [ 0x20, ['long long']], - 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], - 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], - 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], - 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], -} ], - '_BITMAP_RANGE' : [ 0x30, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'BasePage' : [ 0x10, ['long long']], - 'FirstDirtyPage' : [ 0x18, ['unsigned long']], - 'LastDirtyPage' : [ 0x1c, ['unsigned long']], - 'DirtyPages' : [ 0x20, ['unsigned long']], - 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], -} ], - 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { - 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], - 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], - 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], -} ], - '_VACB_LEVEL_REFERENCE' : [ 0x8, { - 'Reference' : [ 0x0, ['long']], - 'SpecialReference' : [ 0x4, ['long']], -} ], - '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { - 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], - 'Event' : [ 0x8, ['_KEVENT']], -} ], - '_HEAP_LIST_LOOKUP' : [ 0x38, { - 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], - 'ArraySize' : [ 0x8, ['unsigned long']], - 'ExtraItem' : [ 0xc, ['unsigned long']], - 'ItemCount' : [ 0x10, ['unsigned long']], - 'OutOfRangeItems' : [ 0x14, ['unsigned long']], - 'BaseIndex' : [ 0x18, ['unsigned long']], - 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], - 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], - 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], -} ], - '_HEAP' : [ 0x298, { - 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], - 'Entry' : [ 0x0, ['_HEAP_ENTRY']], - 'SegmentSignature' : [ 0x10, ['unsigned long']], - 'SegmentFlags' : [ 0x14, ['unsigned long']], - 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], - 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], - 'NumberOfPages' : [ 0x38, ['unsigned long']], - 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], - 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], - 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], - 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], - 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], - 'Reserved' : [ 0x5a, ['unsigned short']], - 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], - 'Flags' : [ 0x70, ['unsigned long']], - 'ForceFlags' : [ 0x74, ['unsigned long']], - 'CompatibilityFlags' : [ 0x78, ['unsigned long']], - 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], - 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], - 'Interceptor' : [ 0x90, ['unsigned long']], - 'VirtualMemoryThreshold' : [ 0x94, ['unsigned long']], - 'Signature' : [ 0x98, ['unsigned long']], - 'SegmentReserve' : [ 0xa0, ['unsigned long long']], - 'SegmentCommit' : [ 0xa8, ['unsigned long long']], - 'DeCommitFreeBlockThreshold' : [ 0xb0, ['unsigned long long']], - 'DeCommitTotalFreeThreshold' : [ 0xb8, ['unsigned long long']], - 'TotalFreeSize' : [ 0xc0, ['unsigned long long']], - 'MaximumAllocationSize' : [ 0xc8, ['unsigned long long']], - 'ProcessHeapsListIndex' : [ 0xd0, ['unsigned short']], - 'HeaderValidateLength' : [ 0xd2, ['unsigned short']], - 'HeaderValidateCopy' : [ 0xd8, ['pointer64', ['void']]], - 'NextAvailableTagIndex' : [ 0xe0, ['unsigned short']], - 'MaximumTagIndex' : [ 0xe2, ['unsigned short']], - 'TagEntries' : [ 0xe8, ['pointer64', ['_HEAP_TAG_ENTRY']]], - 'UCRList' : [ 0xf0, ['_LIST_ENTRY']], - 'AlignRound' : [ 0x100, ['unsigned long long']], - 'AlignMask' : [ 0x108, ['unsigned long long']], - 'VirtualAllocdBlocks' : [ 0x110, ['_LIST_ENTRY']], - 'SegmentList' : [ 0x120, ['_LIST_ENTRY']], - 'AllocatorBackTraceIndex' : [ 0x130, ['unsigned short']], - 'NonDedicatedListLength' : [ 0x134, ['unsigned long']], - 'BlocksIndex' : [ 0x138, ['pointer64', ['void']]], - 'UCRIndex' : [ 0x140, ['pointer64', ['void']]], - 'PseudoTagEntries' : [ 0x148, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], - 'FreeLists' : [ 0x150, ['_LIST_ENTRY']], - 'LockVariable' : [ 0x160, ['pointer64', ['_HEAP_LOCK']]], - 'CommitRoutine' : [ 0x168, ['pointer64', ['void']]], - 'FrontEndHeap' : [ 0x170, ['pointer64', ['void']]], - 'FrontHeapLockCount' : [ 0x178, ['unsigned short']], - 'FrontEndHeapType' : [ 0x17a, ['unsigned char']], - 'RequestedFrontEndHeapType' : [ 0x17b, ['unsigned char']], - 'FrontEndHeapUsageData' : [ 0x180, ['pointer64', ['unsigned short']]], - 'FrontEndHeapMaximumIndex' : [ 0x188, ['unsigned short']], - 'FrontEndHeapStatusBitmap' : [ 0x18a, ['array', 129, ['unsigned char']]], - 'Counters' : [ 0x210, ['_HEAP_COUNTERS']], - 'TuningParameters' : [ 0x288, ['_HEAP_TUNING_PARAMETERS']], -} ], - '__unnamed_1af3' : [ 0x68, { - 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], - 'Resource' : [ 0x0, ['_ERESOURCE']], -} ], - '_HEAP_LOCK' : [ 0x68, { - 'Lock' : [ 0x0, ['__unnamed_1af3']], -} ], - '_HEAP_ENTRY' : [ 0x10, { - 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], - 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned short']], - 'Flags' : [ 0xa, ['unsigned char']], - 'SmallTagIndex' : [ 0xb, ['unsigned char']], - 'SubSegmentCode' : [ 0x8, ['unsigned long']], - 'PreviousSize' : [ 0xc, ['unsigned short']], - 'SegmentOffset' : [ 0xe, ['unsigned char']], - 'LFHFlags' : [ 0xe, ['unsigned char']], - 'UnusedBytes' : [ 0xf, ['unsigned char']], - 'CompactHeader' : [ 0x8, ['unsigned long long']], - 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], - 'Reserved' : [ 0x0, ['pointer64', ['void']]], - 'FunctionIndex' : [ 0x8, ['unsigned short']], - 'ContextValue' : [ 0xa, ['unsigned short']], - 'InterceptorValue' : [ 0x8, ['unsigned long']], - 'UnusedBytesLength' : [ 0xc, ['unsigned short']], - 'EntryOffset' : [ 0xe, ['unsigned char']], - 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], - 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], - 'Code1' : [ 0x8, ['unsigned long']], - 'Code2' : [ 0xc, ['unsigned short']], - 'Code3' : [ 0xe, ['unsigned char']], - 'Code4' : [ 0xf, ['unsigned char']], - 'Code234' : [ 0xc, ['unsigned long']], - 'AgregateCode' : [ 0x8, ['unsigned long long']], -} ], - '_HEAP_SEGMENT' : [ 0x70, { - 'Entry' : [ 0x0, ['_HEAP_ENTRY']], - 'SegmentSignature' : [ 0x10, ['unsigned long']], - 'SegmentFlags' : [ 0x14, ['unsigned long']], - 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], - 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], - 'NumberOfPages' : [ 0x38, ['unsigned long']], - 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], - 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], - 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], - 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], - 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], - 'Reserved' : [ 0x5a, ['unsigned short']], - 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], -} ], - '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { - 'Entry' : [ 0x0, ['_LIST_ENTRY']], - 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], - 'CommitSize' : [ 0x20, ['unsigned long long']], - 'ReserveSize' : [ 0x28, ['unsigned long long']], - 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], -} ], - '_HEAP_FREE_ENTRY' : [ 0x20, { - 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], - 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], - 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned short']], - 'Flags' : [ 0xa, ['unsigned char']], - 'SmallTagIndex' : [ 0xb, ['unsigned char']], - 'SubSegmentCode' : [ 0x8, ['unsigned long']], - 'PreviousSize' : [ 0xc, ['unsigned short']], - 'SegmentOffset' : [ 0xe, ['unsigned char']], - 'LFHFlags' : [ 0xe, ['unsigned char']], - 'UnusedBytes' : [ 0xf, ['unsigned char']], - 'CompactHeader' : [ 0x8, ['unsigned long long']], - 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], - 'Reserved' : [ 0x0, ['pointer64', ['void']]], - 'FunctionIndex' : [ 0x8, ['unsigned short']], - 'ContextValue' : [ 0xa, ['unsigned short']], - 'InterceptorValue' : [ 0x8, ['unsigned long']], - 'UnusedBytesLength' : [ 0xc, ['unsigned short']], - 'EntryOffset' : [ 0xe, ['unsigned char']], - 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], - 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], - 'Code1' : [ 0x8, ['unsigned long']], - 'Code2' : [ 0xc, ['unsigned short']], - 'Code3' : [ 0xe, ['unsigned char']], - 'Code4' : [ 0xf, ['unsigned char']], - 'Code234' : [ 0xc, ['unsigned long']], - 'AgregateCode' : [ 0x8, ['unsigned long long']], - 'FreeList' : [ 0x10, ['_LIST_ENTRY']], -} ], - '__unnamed_1b46' : [ 0x4, { - 'DataLength' : [ 0x0, ['short']], - 'TotalLength' : [ 0x2, ['short']], -} ], - '__unnamed_1b48' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1b46']], - 'Length' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_1b4a' : [ 0x4, { - 'Type' : [ 0x0, ['short']], - 'DataInfoOffset' : [ 0x2, ['short']], -} ], - '__unnamed_1b4c' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_1b4a']], - 'ZeroInit' : [ 0x0, ['unsigned long']], -} ], - '_PORT_MESSAGE' : [ 0x28, { - 'u1' : [ 0x0, ['__unnamed_1b48']], - 'u2' : [ 0x4, ['__unnamed_1b4c']], - 'ClientId' : [ 0x8, ['_CLIENT_ID']], - 'DoNotUseThisField' : [ 0x8, ['double']], - 'MessageId' : [ 0x18, ['unsigned long']], - 'ClientViewSize' : [ 0x20, ['unsigned long long']], - 'CallbackId' : [ 0x20, ['unsigned long']], -} ], - '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { - 'AllocatedAttributes' : [ 0x0, ['unsigned long']], - 'ValidAttributes' : [ 0x4, ['unsigned long']], -} ], - '_ALPC_HANDLE_ENTRY' : [ 0x8, { - 'Object' : [ 0x0, ['pointer64', ['void']]], -} ], - '_BLOB_TYPE' : [ 0x30, { - 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], - 'PoolTag' : [ 0x4, ['unsigned long']], - 'LookasideIndex' : [ 0x8, ['unsigned long']], - 'Flags' : [ 0xc, ['unsigned long']], - 'Counters' : [ 0x10, ['pointer64', ['_BLOB_COUNTERS']]], - 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], - 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], - 'UsualSize' : [ 0x28, ['unsigned long long']], -} ], - '__unnamed_1b67' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], -} ], - '__unnamed_1b69' : [ 0x1, { - 's1' : [ 0x0, ['__unnamed_1b67']], - 'Flags' : [ 0x0, ['unsigned char']], -} ], - '_BLOB' : [ 0x30, { - 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], - 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], - 'u1' : [ 0x10, ['__unnamed_1b69']], - 'ResourceId' : [ 0x11, ['unsigned char']], - 'CachedReferences' : [ 0x12, ['short']], - 'ReferenceCount' : [ 0x18, ['long long']], - 'Lock' : [ 0x20, ['_EX_PUSH_LOCK']], -} ], - '__unnamed_1b7b' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], -} ], - '__unnamed_1b7d' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1b7b']], -} ], - '_KALPC_SECTION' : [ 0x48, { - 'SectionObject' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned long long']], - 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], - 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], - 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], - 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], - 'u1' : [ 0x30, ['__unnamed_1b7d']], - 'NumberOfRegions' : [ 0x34, ['unsigned long']], - 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], -} ], - '__unnamed_1b86' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], -} ], - '__unnamed_1b88' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1b86']], -} ], - '_KALPC_REGION' : [ 0x58, { - 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], - 'Offset' : [ 0x18, ['unsigned long long']], - 'Size' : [ 0x20, ['unsigned long long']], - 'ViewSize' : [ 0x28, ['unsigned long long']], - 'u1' : [ 0x30, ['__unnamed_1b88']], - 'NumberOfViews' : [ 0x34, ['unsigned long']], - 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], - 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], - 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], -} ], - '__unnamed_1b8e' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], -} ], - '__unnamed_1b90' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1b8e']], -} ], - '_KALPC_VIEW' : [ 0x60, { - 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], - 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], - 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], - 'Address' : [ 0x28, ['pointer64', ['void']]], - 'Size' : [ 0x30, ['unsigned long long']], - 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], - 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], - 'u1' : [ 0x48, ['__unnamed_1b90']], - 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], - 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], -} ], - '_ALPC_COMMUNICATION_INFO' : [ 0x48, { - 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], - 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], - 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], - 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], - 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], - 'CloseMessage' : [ 0x40, ['pointer64', ['_KALPC_MESSAGE']]], -} ], - '__unnamed_1bae' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], -} ], - '__unnamed_1bb0' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1bae']], - 'State' : [ 0x0, ['unsigned long']], -} ], - '_ALPC_PORT' : [ 0x1d8, { - 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], - 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], - 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], - 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], - 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], - 'PortContext' : [ 0x38, ['pointer64', ['void']]], - 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], - 'IncomingQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], - 'MainQueue' : [ 0x90, ['_LIST_ENTRY']], - 'LargeMessageQueue' : [ 0xa0, ['_LIST_ENTRY']], - 'PendingQueueLock' : [ 0xb0, ['_EX_PUSH_LOCK']], - 'PendingQueue' : [ 0xb8, ['_LIST_ENTRY']], - 'DirectQueueLock' : [ 0xc8, ['_EX_PUSH_LOCK']], - 'DirectQueue' : [ 0xd0, ['_LIST_ENTRY']], - 'WaitQueueLock' : [ 0xe0, ['_EX_PUSH_LOCK']], - 'WaitQueue' : [ 0xe8, ['_LIST_ENTRY']], - 'Semaphore' : [ 0xf8, ['pointer64', ['_KSEMAPHORE']]], - 'DummyEvent' : [ 0xf8, ['pointer64', ['_KEVENT']]], - 'PortAttributes' : [ 0x100, ['_ALPC_PORT_ATTRIBUTES']], - 'ResourceListLock' : [ 0x148, ['_EX_PUSH_LOCK']], - 'ResourceListHead' : [ 0x150, ['_LIST_ENTRY']], - 'PortObjectLock' : [ 0x160, ['_EX_PUSH_LOCK']], - 'CompletionList' : [ 0x168, ['pointer64', ['_ALPC_COMPLETION_LIST']]], - 'CallbackObject' : [ 0x170, ['pointer64', ['_CALLBACK_OBJECT']]], - 'CallbackContext' : [ 0x178, ['pointer64', ['void']]], - 'CanceledQueue' : [ 0x180, ['_LIST_ENTRY']], - 'SequenceNo' : [ 0x190, ['long']], - 'ReferenceNo' : [ 0x194, ['long']], - 'ReferenceNoWait' : [ 0x198, ['pointer64', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], - 'u1' : [ 0x1a0, ['__unnamed_1bb0']], - 'TargetQueuePort' : [ 0x1a8, ['pointer64', ['_ALPC_PORT']]], - 'TargetSequencePort' : [ 0x1b0, ['pointer64', ['_ALPC_PORT']]], - 'CachedMessage' : [ 0x1b8, ['pointer64', ['_KALPC_MESSAGE']]], - 'MainQueueLength' : [ 0x1c0, ['unsigned long']], - 'LargeMessageQueueLength' : [ 0x1c4, ['unsigned long']], - 'PendingQueueLength' : [ 0x1c8, ['unsigned long']], - 'DirectQueueLength' : [ 0x1cc, ['unsigned long']], - 'CanceledQueueLength' : [ 0x1d0, ['unsigned long']], - 'WaitQueueLength' : [ 0x1d4, ['unsigned long']], -} ], - '_ALPC_COMPLETION_LIST' : [ 0xa0, { - 'Entry' : [ 0x0, ['_LIST_ENTRY']], - 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'CompletionListLock' : [ 0x18, ['_EX_PUSH_LOCK']], - 'Mdl' : [ 0x20, ['pointer64', ['_MDL']]], - 'UserVa' : [ 0x28, ['pointer64', ['void']]], - 'UserLimit' : [ 0x30, ['pointer64', ['void']]], - 'DataUserVa' : [ 0x38, ['pointer64', ['void']]], - 'SystemVa' : [ 0x40, ['pointer64', ['void']]], - 'TotalSize' : [ 0x48, ['unsigned long long']], - 'Header' : [ 0x50, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], - 'List' : [ 0x58, ['pointer64', ['void']]], - 'ListSize' : [ 0x60, ['unsigned long long']], - 'Bitmap' : [ 0x68, ['pointer64', ['void']]], - 'BitmapSize' : [ 0x70, ['unsigned long long']], - 'Data' : [ 0x78, ['pointer64', ['void']]], - 'DataSize' : [ 0x80, ['unsigned long long']], - 'BitmapLimit' : [ 0x88, ['unsigned long']], - 'BitmapNextHint' : [ 0x8c, ['unsigned long']], - 'ConcurrencyCount' : [ 0x90, ['unsigned long']], - 'AttributeFlags' : [ 0x94, ['unsigned long']], - 'AttributeSize' : [ 0x98, ['unsigned long']], -} ], - '_OBJECT_ATTRIBUTES' : [ 0x30, { - 'Length' : [ 0x0, ['unsigned long']], - 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], - 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], - 'Attributes' : [ 0x18, ['unsigned long']], - 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], - 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], -} ], - '_OBJECT_TYPE' : [ 0xd8, { - 'TypeList' : [ 0x0, ['_LIST_ENTRY']], - 'Name' : [ 0x10, ['_UNICODE_STRING']], - 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], - 'Index' : [ 0x28, ['unsigned char']], - 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], - 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], - 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], - 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], - 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], - 'TypeLock' : [ 0xb8, ['_EX_PUSH_LOCK']], - 'Key' : [ 0xc0, ['unsigned long']], - 'CallbackList' : [ 0xc8, ['_LIST_ENTRY']], -} ], - '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x20, { - 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], - 'DesiredReferenceNo' : [ 0x18, ['long']], -} ], - '_PORT_MESSAGE32' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1b48']], - 'u2' : [ 0x4, ['__unnamed_1b4c']], - 'ClientId' : [ 0x8, ['_CLIENT_ID32']], - 'DoNotUseThisField' : [ 0x8, ['double']], - 'MessageId' : [ 0x10, ['unsigned long']], - 'ClientViewSize' : [ 0x14, ['unsigned long']], - 'CallbackId' : [ 0x14, ['unsigned long']], -} ], - '__unnamed_1bd6' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], -} ], - '__unnamed_1bd8' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1bd6']], - 'State' : [ 0x0, ['unsigned long']], -} ], - '_KALPC_MESSAGE' : [ 0x108, { - 'Entry' : [ 0x0, ['_LIST_ENTRY']], - 'PortQueue' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], - 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], - 'WaitingThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], - 'u1' : [ 0x28, ['__unnamed_1bd8']], - 'SequenceNo' : [ 0x2c, ['long']], - 'QuotaProcess' : [ 0x30, ['pointer64', ['_EPROCESS']]], - 'QuotaBlock' : [ 0x30, ['pointer64', ['void']]], - 'CancelSequencePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], - 'CancelQueuePort' : [ 0x40, ['pointer64', ['_ALPC_PORT']]], - 'CancelSequenceNo' : [ 0x48, ['long']], - 'CancelListEntry' : [ 0x50, ['_LIST_ENTRY']], - 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], - 'MessageAttributes' : [ 0x68, ['_KALPC_MESSAGE_ATTRIBUTES']], - 'DataUserVa' : [ 0xa8, ['pointer64', ['void']]], - 'CommunicationInfo' : [ 0xb0, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], - 'ConnectionPort' : [ 0xb8, ['pointer64', ['_ALPC_PORT']]], - 'ServerThread' : [ 0xc0, ['pointer64', ['_ETHREAD']]], - 'WakeReference' : [ 0xc8, ['pointer64', ['void']]], - 'ExtensionBuffer' : [ 0xd0, ['pointer64', ['void']]], - 'ExtensionBufferSize' : [ 0xd8, ['unsigned long long']], - 'PortMessage' : [ 0xe0, ['_PORT_MESSAGE']], -} ], - '_ALPC_DISPATCH_CONTEXT' : [ 0x40, { - 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], - 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], - 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], - 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], - 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], - 'DirectEvent' : [ 0x28, ['_KALPC_DIRECT_EVENT']], - 'Flags' : [ 0x30, ['unsigned long']], - 'TotalLength' : [ 0x34, ['unsigned short']], - 'Type' : [ 0x36, ['unsigned short']], - 'DataInfoOffset' : [ 0x38, ['unsigned short']], - 'SignalCompletion' : [ 0x3a, ['unsigned char']], - 'PostedToCompletionList' : [ 0x3b, ['unsigned char']], -} ], - '_REMOTE_PORT_VIEW' : [ 0x18, { - 'Length' : [ 0x0, ['unsigned long']], - 'ViewSize' : [ 0x8, ['unsigned long long']], - 'ViewBase' : [ 0x10, ['pointer64', ['void']]], -} ], - '_KALPC_RESERVE' : [ 0x28, { - 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], - 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], - 'Handle' : [ 0x10, ['pointer64', ['void']]], - 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], - 'Active' : [ 0x20, ['long']], -} ], - '_KALPC_HANDLE_DATA' : [ 0x30, { - 'Flags' : [ 0x0, ['unsigned long']], - 'ObjectType' : [ 0x4, ['unsigned long']], - 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], -} ], - '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x40, { - 'ClientContext' : [ 0x0, ['pointer64', ['void']]], - 'ServerContext' : [ 0x8, ['pointer64', ['void']]], - 'PortContext' : [ 0x10, ['pointer64', ['void']]], - 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], - 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], - 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], - 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], - 'DirectEvent' : [ 0x38, ['_KALPC_DIRECT_EVENT']], -} ], - '__unnamed_1c1c' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], -} ], - '__unnamed_1c1e' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1c1c']], -} ], - '_KALPC_SECURITY_DATA' : [ 0x70, { - 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], - 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], - 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], - 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], - 'u1' : [ 0x68, ['__unnamed_1c1e']], -} ], - '_KALPC_DIRECT_EVENT' : [ 0x8, { - 'Event' : [ 0x0, ['unsigned long long']], - 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], -} ], - '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'PacketType' : [ 0x10, ['unsigned long']], - 'KeyContext' : [ 0x18, ['pointer64', ['void']]], - 'ApcContext' : [ 0x20, ['pointer64', ['void']]], - 'IoStatus' : [ 0x28, ['long']], - 'IoStatusInformation' : [ 0x30, ['unsigned long long']], - 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], - 'Context' : [ 0x40, ['pointer64', ['void']]], - 'Allocated' : [ 0x48, ['unsigned char']], -} ], - '_IOP_IRP_EXTENSION' : [ 0x30, { - 'ExtensionFlags' : [ 0x0, ['unsigned short']], - 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], - 'TypesAllocated' : [ 0x2, ['unsigned short']], - 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], - 'VerifierContext' : [ 0x8, ['pointer64', ['void']]], - 'ActivityId' : [ 0x10, ['_GUID']], - 'Timestamp' : [ 0x20, ['_LARGE_INTEGER']], - 'ZeroingOffset' : [ 0x20, ['unsigned long']], - 'FsTrackOffsetBlob' : [ 0x20, ['pointer64', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], - 'FsTrackedOffset' : [ 0x28, ['long long']], -} ], - '_DRIVER_OBJECT' : [ 0x150, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'Flags' : [ 0x10, ['unsigned long']], - 'DriverStart' : [ 0x18, ['pointer64', ['void']]], - 'DriverSize' : [ 0x20, ['unsigned long']], - 'DriverSection' : [ 0x28, ['pointer64', ['void']]], - 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], - 'DriverName' : [ 0x38, ['_UNICODE_STRING']], - 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], - 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], - 'DriverInit' : [ 0x58, ['pointer64', ['void']]], - 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], - 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], - 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], -} ], - '_FILE_SEGMENT_ELEMENT' : [ 0x8, { - 'Buffer' : [ 0x0, ['pointer64', ['void']]], - 'Alignment' : [ 0x0, ['unsigned long long']], -} ], - '_RELATIVE_SYMLINK_INFO' : [ 0x20, { - 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], - 'Flags' : [ 0x2, ['unsigned short']], - 'DeviceNameLength' : [ 0x4, ['unsigned short']], - 'Reserved' : [ 0x6, ['unsigned short']], - 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], - 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], -} ], - '_ECP_LIST' : [ 0x18, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x4, ['unsigned long']], - 'EcpList' : [ 0x8, ['_LIST_ENTRY']], -} ], - '_IOP_FILE_OBJECT_EXTENSION' : [ 0x50, { - 'FoExtFlags' : [ 0x0, ['unsigned long']], - 'FoExtPerTypeExtension' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], - 'FoIoPriorityHint' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], -} ], - '_OPEN_PACKET' : [ 0xc0, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], - 'FinalStatus' : [ 0x10, ['long']], - 'Information' : [ 0x18, ['unsigned long long']], - 'ParseCheck' : [ 0x20, ['unsigned long']], - 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], - 'ReferencedDeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], - 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], - 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], - 'CreateOptions' : [ 0x40, ['unsigned long']], - 'FileAttributes' : [ 0x44, ['unsigned short']], - 'ShareAccess' : [ 0x46, ['unsigned short']], - 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], - 'EaLength' : [ 0x50, ['unsigned long']], - 'Options' : [ 0x54, ['unsigned long']], - 'Disposition' : [ 0x58, ['unsigned long']], - 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], - 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], - 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], - 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], - 'Override' : [ 0x80, ['unsigned char']], - 'QueryOnly' : [ 0x81, ['unsigned char']], - 'DeleteOnly' : [ 0x82, ['unsigned char']], - 'FullAttributes' : [ 0x83, ['unsigned char']], - 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], - 'InternalFlags' : [ 0x90, ['unsigned long']], - 'AccessMode' : [ 0x94, ['unsigned char']], - 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], -} ], - '_ETW_SYSTEMTIME' : [ 0x10, { - 'Year' : [ 0x0, ['unsigned short']], - 'Month' : [ 0x2, ['unsigned short']], - 'DayOfWeek' : [ 0x4, ['unsigned short']], - 'Day' : [ 0x6, ['unsigned short']], - 'Hour' : [ 0x8, ['unsigned short']], - 'Minute' : [ 0xa, ['unsigned short']], - 'Second' : [ 0xc, ['unsigned short']], - 'Milliseconds' : [ 0xe, ['unsigned short']], -} ], - '_TIME_FIELDS' : [ 0x10, { - 'Year' : [ 0x0, ['short']], - 'Month' : [ 0x2, ['short']], - 'Day' : [ 0x4, ['short']], - 'Hour' : [ 0x6, ['short']], - 'Minute' : [ 0x8, ['short']], - 'Second' : [ 0xa, ['short']], - 'Milliseconds' : [ 0xc, ['short']], - 'Weekday' : [ 0xe, ['short']], -} ], - '__unnamed_1ce5' : [ 0x4, { - 'MajorVersion' : [ 0x0, ['unsigned char']], - 'MinorVersion' : [ 0x1, ['unsigned char']], - 'SubVersion' : [ 0x2, ['unsigned char']], - 'SubMinorVersion' : [ 0x3, ['unsigned char']], -} ], - '_TRACE_LOGFILE_HEADER' : [ 0x118, { - 'BufferSize' : [ 0x0, ['unsigned long']], - 'Version' : [ 0x4, ['unsigned long']], - 'VersionDetail' : [ 0x4, ['__unnamed_1ce5']], - 'ProviderVersion' : [ 0x8, ['unsigned long']], - 'NumberOfProcessors' : [ 0xc, ['unsigned long']], - 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], - 'TimerResolution' : [ 0x18, ['unsigned long']], - 'MaximumFileSize' : [ 0x1c, ['unsigned long']], - 'LogFileMode' : [ 0x20, ['unsigned long']], - 'BuffersWritten' : [ 0x24, ['unsigned long']], - 'LogInstanceGuid' : [ 0x28, ['_GUID']], - 'StartBuffers' : [ 0x28, ['unsigned long']], - 'PointerSize' : [ 0x2c, ['unsigned long']], - 'EventsLost' : [ 0x30, ['unsigned long']], - 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], - 'LoggerName' : [ 0x38, ['pointer64', ['unsigned short']]], - 'LogFileName' : [ 0x40, ['pointer64', ['unsigned short']]], - 'TimeZone' : [ 0x48, ['_RTL_TIME_ZONE_INFORMATION']], - 'BootTime' : [ 0xf8, ['_LARGE_INTEGER']], - 'PerfFreq' : [ 0x100, ['_LARGE_INTEGER']], - 'StartTime' : [ 0x108, ['_LARGE_INTEGER']], - 'ReservedFlags' : [ 0x110, ['unsigned long']], - 'BuffersLost' : [ 0x114, ['unsigned long']], -} ], - '_WMI_LOGGER_CONTEXT' : [ 0x390, { - 'LoggerId' : [ 0x0, ['unsigned long']], - 'BufferSize' : [ 0x4, ['unsigned long']], - 'MaximumEventSize' : [ 0x8, ['unsigned long']], - 'LoggerMode' : [ 0xc, ['unsigned long']], - 'AcceptNewEvents' : [ 0x10, ['long']], - 'EventMarker' : [ 0x14, ['array', 2, ['unsigned long']]], - 'ErrorMarker' : [ 0x1c, ['unsigned long']], - 'SizeMask' : [ 0x20, ['unsigned long']], - 'GetCpuClock' : [ 0x28, ['pointer64', ['void']]], - 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], - 'LoggerStatus' : [ 0x38, ['long']], - 'FailureReason' : [ 0x3c, ['unsigned long']], - 'BufferQueue' : [ 0x40, ['_ETW_BUFFER_QUEUE']], - 'OverflowQueue' : [ 0x58, ['_ETW_BUFFER_QUEUE']], - 'GlobalList' : [ 0x70, ['_LIST_ENTRY']], - 'ProviderBinaryList' : [ 0x80, ['_LIST_ENTRY']], - 'BatchedBufferList' : [ 0x90, ['pointer64', ['_WMI_BUFFER_HEADER']]], - 'CurrentBuffer' : [ 0x90, ['_EX_FAST_REF']], - 'LoggerName' : [ 0x98, ['_UNICODE_STRING']], - 'LogFileName' : [ 0xa8, ['_UNICODE_STRING']], - 'LogFilePattern' : [ 0xb8, ['_UNICODE_STRING']], - 'NewLogFileName' : [ 0xc8, ['_UNICODE_STRING']], - 'ClockType' : [ 0xd8, ['unsigned long']], - 'LastFlushedBuffer' : [ 0xdc, ['unsigned long']], - 'FlushTimer' : [ 0xe0, ['unsigned long']], - 'FlushThreshold' : [ 0xe4, ['unsigned long']], - 'ByteOffset' : [ 0xe8, ['_LARGE_INTEGER']], - 'MinimumBuffers' : [ 0xf0, ['unsigned long']], - 'BuffersAvailable' : [ 0xf4, ['long']], - 'NumberOfBuffers' : [ 0xf8, ['long']], - 'MaximumBuffers' : [ 0xfc, ['unsigned long']], - 'EventsLost' : [ 0x100, ['unsigned long']], - 'PeakBuffersCount' : [ 0x104, ['long']], - 'BuffersWritten' : [ 0x108, ['unsigned long']], - 'LogBuffersLost' : [ 0x10c, ['unsigned long']], - 'RealTimeBuffersDelivered' : [ 0x110, ['unsigned long']], - 'RealTimeBuffersLost' : [ 0x114, ['unsigned long']], - 'SequencePtr' : [ 0x118, ['pointer64', ['long']]], - 'LocalSequence' : [ 0x120, ['unsigned long']], - 'InstanceGuid' : [ 0x124, ['_GUID']], - 'MaximumFileSize' : [ 0x134, ['unsigned long']], - 'FileCounter' : [ 0x138, ['long']], - 'PoolType' : [ 0x13c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'ReferenceTime' : [ 0x140, ['_ETW_REF_CLOCK']], - 'CollectionOn' : [ 0x150, ['long']], - 'ProviderInfoSize' : [ 0x154, ['unsigned long']], - 'Consumers' : [ 0x158, ['_LIST_ENTRY']], - 'NumConsumers' : [ 0x168, ['unsigned long']], - 'TransitionConsumer' : [ 0x170, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], - 'RealtimeLogfileHandle' : [ 0x178, ['pointer64', ['void']]], - 'RealtimeLogfileName' : [ 0x180, ['_UNICODE_STRING']], - 'RealtimeWriteOffset' : [ 0x190, ['_LARGE_INTEGER']], - 'RealtimeReadOffset' : [ 0x198, ['_LARGE_INTEGER']], - 'RealtimeLogfileSize' : [ 0x1a0, ['_LARGE_INTEGER']], - 'RealtimeLogfileUsage' : [ 0x1a8, ['unsigned long long']], - 'RealtimeMaximumFileSize' : [ 0x1b0, ['unsigned long long']], - 'RealtimeBuffersSaved' : [ 0x1b8, ['unsigned long']], - 'RealtimeReferenceTime' : [ 0x1c0, ['_ETW_REF_CLOCK']], - 'NewRTEventsLost' : [ 0x1d0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], - 'LoggerEvent' : [ 0x1d8, ['_KEVENT']], - 'FlushEvent' : [ 0x1f0, ['_KEVENT']], - 'FlushTimeOutTimer' : [ 0x208, ['_KTIMER']], - 'LoggerDpc' : [ 0x248, ['_KDPC']], - 'LoggerMutex' : [ 0x288, ['_KMUTANT']], - 'LoggerLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], - 'BufferListSpinLock' : [ 0x2c8, ['unsigned long long']], - 'BufferListPushLock' : [ 0x2c8, ['_EX_PUSH_LOCK']], - 'ClientSecurityContext' : [ 0x2d0, ['_SECURITY_CLIENT_CONTEXT']], - 'TokenAccessInformation' : [ 0x318, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], - 'SecurityDescriptor' : [ 0x320, ['_EX_FAST_REF']], - 'StartTime' : [ 0x328, ['_LARGE_INTEGER']], - 'LogFileHandle' : [ 0x330, ['pointer64', ['void']]], - 'BufferSequenceNumber' : [ 0x338, ['long long']], - 'Flags' : [ 0x340, ['unsigned long']], - 'Persistent' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'AutoLogger' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'FsReady' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'RealTime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Wow' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'KernelTrace' : [ 0x340, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'NoMoreEnable' : [ 0x340, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'StackTracing' : [ 0x340, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'ErrorLogged' : [ 0x340, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'RealtimeLoggerContextFreed' : [ 0x340, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'PebsTracing' : [ 0x340, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'PmcCounters' : [ 0x340, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'PageAlignBuffers' : [ 0x340, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'StackLookasideListAllocated' : [ 0x340, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'SecurityTrace' : [ 0x340, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'SpareFlags1' : [ 0x340, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'SystemLoggerIndex' : [ 0x340, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], - 'StackCaching' : [ 0x340, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'SpareFlags2' : [ 0x340, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], - 'RequestFlag' : [ 0x344, ['unsigned long']], - 'DbgRequestNewFile' : [ 0x344, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DbgRequestUpdateFile' : [ 0x344, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'DbgRequestFlush' : [ 0x344, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'DbgRequestDisableRealtime' : [ 0x344, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'DbgRequestDisconnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'DbgRequestConnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DbgRequestNotifyConsumer' : [ 0x344, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'DbgRequestUpdateHeader' : [ 0x344, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'DbgRequestDeferredFlush' : [ 0x344, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'DbgRequestDeferredFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'DbgRequestFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'DbgRequestUpdateDebugger' : [ 0x344, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'DbgSpareRequestFlags' : [ 0x344, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], - 'HookIdMap' : [ 0x348, ['_RTL_BITMAP']], - 'StackCache' : [ 0x358, ['pointer64', ['_ETW_STACK_CACHE']]], - 'PmcData' : [ 0x360, ['pointer64', ['_ETW_PMC_SUPPORT']]], - 'WinRtProviderBinaryList' : [ 0x368, ['_LIST_ENTRY']], - 'ScratchArray' : [ 0x378, ['pointer64', ['pointer64', ['_WMI_BUFFER_HEADER']]]], - 'DisallowedGuids' : [ 0x380, ['_DISALLOWED_GUIDS']], -} ], - '_ETW_PMC_SUPPORT' : [ 0x28, { - 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], - 'HookIdCount' : [ 0x10, ['unsigned long']], - 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], - 'CountersCount' : [ 0x1c, ['unsigned long']], - 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer64', ['_HAL_PMC_COUNTERS']]]], -} ], - '_ETW_SILODRIVERSTATE' : [ 0x13a8, { - 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], - 'EtwpLoggerRundown' : [ 0x190, ['array', 64, ['pointer64', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], - 'WmipLoggerContext' : [ 0x390, ['array', 64, ['pointer64', ['_WMI_LOGGER_CONTEXT']]]], - 'EtwpGuidHashTable' : [ 0x590, ['array', 64, ['_ETW_HASH_BUCKET']]], - 'EtwpSecurityLoggers' : [ 0x1390, ['array', 8, ['unsigned short']]], - 'EtwpSecurityProviderEnableMask' : [ 0x13a0, ['unsigned char']], - 'EtwpShutdownInProgress' : [ 0x13a1, ['unsigned char']], - 'EtwpSecurityProviderPID' : [ 0x13a4, ['unsigned long']], -} ], - '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x18, { - 'RunRefs' : [ 0x0, ['pointer64', ['_EX_RUNDOWN_REF']]], - 'PoolToFree' : [ 0x8, ['pointer64', ['void']]], - 'RunRefSize' : [ 0x10, ['unsigned long']], - 'Number' : [ 0x14, ['unsigned long']], -} ], - '_ETW_LOGGER_HANDLE' : [ 0x1, { - 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], -} ], - '_LUID_AND_ATTRIBUTES' : [ 0xc, { - 'Luid' : [ 0x0, ['_LUID']], - 'Attributes' : [ 0x8, ['unsigned long']], -} ], - '_TOKEN' : [ 0x480, { - 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], - 'TokenId' : [ 0x10, ['_LUID']], - 'AuthenticationId' : [ 0x18, ['_LUID']], - 'ParentTokenId' : [ 0x20, ['_LUID']], - 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], - 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], - 'ModifiedId' : [ 0x38, ['_LUID']], - 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], - 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], - 'SessionId' : [ 0x78, ['unsigned long']], - 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], - 'RestrictedSidCount' : [ 0x80, ['unsigned long']], - 'VariableLength' : [ 0x84, ['unsigned long']], - 'DynamicCharged' : [ 0x88, ['unsigned long']], - 'DynamicAvailable' : [ 0x8c, ['unsigned long']], - 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], - 'UserAndGroups' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'RestrictedSids' : [ 0xa0, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'PrimaryGroup' : [ 0xa8, ['pointer64', ['void']]], - 'DynamicPart' : [ 0xb0, ['pointer64', ['unsigned long']]], - 'DefaultDacl' : [ 0xb8, ['pointer64', ['_ACL']]], - 'TokenType' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], - 'ImpersonationLevel' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], - 'TokenFlags' : [ 0xc8, ['unsigned long']], - 'TokenInUse' : [ 0xcc, ['unsigned char']], - 'IntegrityLevelIndex' : [ 0xd0, ['unsigned long']], - 'MandatoryPolicy' : [ 0xd4, ['unsigned long']], - 'LogonSession' : [ 0xd8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], - 'OriginatingLogonSession' : [ 0xe0, ['_LUID']], - 'SidHash' : [ 0xe8, ['_SID_AND_ATTRIBUTES_HASH']], - 'RestrictedSidHash' : [ 0x1f8, ['_SID_AND_ATTRIBUTES_HASH']], - 'pSecurityAttributes' : [ 0x308, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], - 'Package' : [ 0x310, ['pointer64', ['void']]], - 'Capabilities' : [ 0x318, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'CapabilityCount' : [ 0x320, ['unsigned long']], - 'CapabilitiesHash' : [ 0x328, ['_SID_AND_ATTRIBUTES_HASH']], - 'LowboxNumberEntry' : [ 0x438, ['pointer64', ['_SEP_LOWBOX_NUMBER_ENTRY']]], - 'LowboxHandlesEntry' : [ 0x440, ['pointer64', ['_SEP_LOWBOX_HANDLES_ENTRY']]], - 'pClaimAttributes' : [ 0x448, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], - 'TrustLevelSid' : [ 0x450, ['pointer64', ['void']]], - 'TrustLinkedToken' : [ 0x458, ['pointer64', ['_TOKEN']]], - 'IntegrityLevelSidValue' : [ 0x460, ['pointer64', ['void']]], - 'TokenSidValues' : [ 0x468, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], - 'IndexEntry' : [ 0x470, ['pointer64', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], - 'VariablePart' : [ 0x478, ['unsigned long long']], -} ], - '_SEP_LOGON_SESSION_REFERENCES' : [ 0xb0, { - 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], - 'LogonId' : [ 0x8, ['_LUID']], - 'BuddyLogonId' : [ 0x10, ['_LUID']], - 'ReferenceCount' : [ 0x18, ['long long']], - 'Flags' : [ 0x20, ['unsigned long']], - 'pDeviceMap' : [ 0x28, ['pointer64', ['_DEVICE_MAP']]], - 'Token' : [ 0x30, ['pointer64', ['void']]], - 'AccountName' : [ 0x38, ['_UNICODE_STRING']], - 'AuthorityName' : [ 0x48, ['_UNICODE_STRING']], - 'LowBoxHandlesTable' : [ 0x58, ['_SEP_LOWBOX_HANDLES_TABLE']], - 'SharedDataLock' : [ 0x68, ['_EX_PUSH_LOCK']], - 'SharedClaimAttributes' : [ 0x70, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], - 'SharedSidValues' : [ 0x78, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], - 'RevocationBlock' : [ 0x80, ['_OB_HANDLE_REVOCATION_BLOCK']], - 'ServerSilo' : [ 0xa0, ['pointer64', ['_EJOB']]], - 'SiblingAuthId' : [ 0xa8, ['_LUID']], -} ], - '_OBJECT_HEADER' : [ 0x38, { - 'PointerCount' : [ 0x0, ['long long']], - 'HandleCount' : [ 0x8, ['long long']], - 'NextToFree' : [ 0x8, ['pointer64', ['void']]], - 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], - 'TypeIndex' : [ 0x18, ['unsigned char']], - 'TraceFlags' : [ 0x19, ['unsigned char']], - 'DbgRefTrace' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'DbgTracePermanent' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'InfoMask' : [ 0x1a, ['unsigned char']], - 'Flags' : [ 0x1b, ['unsigned char']], - 'NewObject' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'KernelObject' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'KernelOnlyAccess' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'ExclusiveObject' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'PermanentObject' : [ 0x1b, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'DefaultSecurityQuota' : [ 0x1b, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'SingleHandleEntry' : [ 0x1b, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'DeletedInline' : [ 0x1b, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Spare' : [ 0x1c, ['unsigned long']], - 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], - 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], - 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], - 'Body' : [ 0x30, ['_QUAD']], -} ], - '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { - 'PagedPoolCharge' : [ 0x0, ['unsigned long']], - 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], - 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], - 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], - 'Reserved' : [ 0x18, ['unsigned long long']], -} ], - '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { - 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'Reserved' : [ 0x8, ['unsigned long long']], -} ], - '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { - 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], - 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], -} ], - '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { - 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], - 'Name' : [ 0x8, ['_UNICODE_STRING']], - 'ReferenceCount' : [ 0x18, ['long']], -} ], - '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { - 'TypeList' : [ 0x0, ['_LIST_ENTRY']], - 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], - 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], - 'Reserved' : [ 0x1a, ['unsigned short']], -} ], - '_OBJECT_HEADER_AUDIT_INFO' : [ 0x10, { - 'SecurityDescriptor' : [ 0x0, ['pointer64', ['void']]], - 'Reserved' : [ 0x8, ['unsigned long long']], -} ], - '_OBJECT_HEADER_HANDLE_REVOCATION_INFO' : [ 0x20, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'RevocationBlock' : [ 0x10, ['pointer64', ['_OB_HANDLE_REVOCATION_BLOCK']]], - 'Padding1' : [ 0x18, ['array', 4, ['unsigned char']]], - 'Padding2' : [ 0x1c, ['array', 4, ['unsigned char']]], -} ], - '_OBP_LOOKUP_CONTEXT' : [ 0x28, { - 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], - 'Object' : [ 0x8, ['pointer64', ['void']]], - 'EntryLink' : [ 0x10, ['pointer64', ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], - 'HashValue' : [ 0x18, ['unsigned long']], - 'HashIndex' : [ 0x1c, ['unsigned short']], - 'DirectoryLocked' : [ 0x1e, ['unsigned char']], - 'LockedExclusive' : [ 0x1f, ['unsigned char']], - 'LockStateSignature' : [ 0x20, ['unsigned long']], -} ], - '_OBJECT_DIRECTORY' : [ 0x158, { - 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], - 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], - 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], - 'ShadowDirectory' : [ 0x138, ['pointer64', ['_OBJECT_DIRECTORY']]], - 'SessionId' : [ 0x140, ['unsigned long']], - 'NamespaceEntry' : [ 0x148, ['pointer64', ['void']]], - 'Flags' : [ 0x150, ['unsigned long']], -} ], - '_OBP_SILODRIVERSTATE' : [ 0x2e0, { - 'SystemDeviceMap' : [ 0x0, ['pointer64', ['_DEVICE_MAP']]], - 'SystemDosDeviceState' : [ 0x8, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], - 'DeviceMapLock' : [ 0x78, ['_EX_PUSH_LOCK']], - 'PrivateNamespaceLookupTable' : [ 0x80, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], -} ], - '_DEVICE_MAP' : [ 0x40, { - 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], - 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], - 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], - 'ReferenceCount' : [ 0x18, ['long']], - 'DriveMap' : [ 0x1c, ['unsigned long']], - 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], -} ], - '_WHEAP_INFO_BLOCK' : [ 0x18, { - 'ErrorSourceCount' : [ 0x0, ['unsigned long']], - 'ErrorSourceTable' : [ 0x8, ['pointer64', ['_WHEAP_ERROR_SOURCE_TABLE']]], - 'WorkQueue' : [ 0x10, ['pointer64', ['_WHEAP_WORK_QUEUE']]], -} ], - '_WHEAP_ERROR_SOURCE' : [ 0x428, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'FailedAllocations' : [ 0x10, ['unsigned long']], - 'PlatformErrorSourceId' : [ 0x14, ['unsigned long']], - 'ErrorCount' : [ 0x18, ['long']], - 'RecordCount' : [ 0x1c, ['unsigned long']], - 'RecordLength' : [ 0x20, ['unsigned long']], - 'PoolTag' : [ 0x24, ['unsigned long']], - 'Type' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], - 'Records' : [ 0x30, ['pointer64', ['_WHEAP_ERROR_RECORD_WRAPPER']]], - 'Context' : [ 0x38, ['pointer64', ['void']]], - 'SectionCount' : [ 0x40, ['unsigned long']], - 'SectionLength' : [ 0x44, ['unsigned long']], - 'TickCountAtLastError' : [ 0x48, ['_LARGE_INTEGER']], - 'AccumulatedErrors' : [ 0x50, ['unsigned long']], - 'TotalErrors' : [ 0x54, ['unsigned long']], - 'Deferred' : [ 0x58, ['unsigned char']], - 'Descriptor' : [ 0x59, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], -} ], - '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xf0, { - 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Length' : [ 0x10, ['unsigned long']], - 'ProcessorNumber' : [ 0x14, ['unsigned long']], - 'Flags' : [ 0x18, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], - 'InUse' : [ 0x1c, ['long']], - 'ErrorSource' : [ 0x20, ['pointer64', ['_WHEAP_ERROR_SOURCE']]], - 'ErrorRecord' : [ 0x28, ['_WHEA_ERROR_RECORD']], -} ], - '_KSECONDARY_IDT_ENTRY' : [ 0x30, { - 'SpinLock' : [ 0x0, ['unsigned long long']], - 'ConnectLock' : [ 0x8, ['_KEVENT']], - 'LineMasked' : [ 0x20, ['unsigned char']], - 'InterruptList' : [ 0x28, ['pointer64', ['_KINTERRUPT']]], -} ], - '_WNF_STATE_NAME' : [ 0x8, { - 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], -} ], - '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { - 'ImpersonationData' : [ 0x0, ['unsigned long long']], - 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], -} ], - '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { - 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], - 'AlphaControlSet' : [ 0x0, ['unsigned long']], - 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], - 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], - 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], - 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], - 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], - 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], -} ], - '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { - 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], -} ], - '_POP_FX_PLUGIN' : [ 0xb8, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Version' : [ 0x10, ['unsigned long']], - 'Flags' : [ 0x18, ['unsigned long long']], - 'WorkQueue' : [ 0x20, ['_KQUEUE']], - 'AcceptDeviceNotification' : [ 0x60, ['pointer64', ['void']]], - 'AcceptProcessorNotification' : [ 0x68, ['pointer64', ['void']]], - 'AcceptAcpiNotification' : [ 0x70, ['pointer64', ['void']]], - 'WorkOrderCount' : [ 0x78, ['unsigned long']], - 'WorkOrders' : [ 0x80, ['array', 1, ['_POP_FX_WORK_ORDER']]], -} ], - '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { - 'Continue' : [ 0x0, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], - 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], -} ], - '_LPCP_MESSAGE' : [ 0x50, { - 'Entry' : [ 0x0, ['_LIST_ENTRY']], - 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Reserved0' : [ 0x8, ['unsigned long']], - 'SenderPort' : [ 0x10, ['pointer64', ['void']]], - 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], - 'PortContext' : [ 0x20, ['pointer64', ['void']]], - 'Request' : [ 0x28, ['_PORT_MESSAGE']], -} ], - '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], -} ], - '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { - 'Flags' : [ 0x0, ['unsigned long']], - 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], - 'MaxMessageLength' : [ 0x10, ['unsigned long long']], - 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], - 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], - 'MaxSectionSize' : [ 0x28, ['unsigned long long']], - 'MaxViewSize' : [ 0x30, ['unsigned long long']], - 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], - 'DupObjectTypes' : [ 0x40, ['unsigned long']], - 'Reserved' : [ 0x44, ['unsigned long']], -} ], - '_MI_PARTITION_SEGMENTS' : [ 0x180, { - 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], - 'UnusedSegmentCleanup' : [ 0x18, ['_KEVENT']], - 'SubsectionDeletePtes' : [ 0x30, ['unsigned long long']], - 'DereferenceSegmentHeader' : [ 0x38, ['_MMDEREFERENCE_SEGMENT_HEADER']], - 'DeleteOnCloseList' : [ 0x68, ['_LIST_ENTRY']], - 'DeleteOnCloseTimer' : [ 0x78, ['_KTIMER']], - 'DeleteOnCloseTimerActive' : [ 0xb8, ['unsigned char']], - 'DeleteOnCloseCount' : [ 0xbc, ['unsigned long']], - 'UnusedSegmentList' : [ 0xc0, ['_LIST_ENTRY']], - 'UnusedSubsectionList' : [ 0xd0, ['_LIST_ENTRY']], - 'DeleteSubsectionList' : [ 0xe0, ['_LIST_ENTRY']], - 'ControlAreaDeleteEvent' : [ 0xf0, ['_KEVENT']], - 'ControlAreaDeleteList' : [ 0x108, ['_SINGLE_LIST_ENTRY']], - 'SegmentListLock' : [ 0x140, ['long']], -} ], - '_KSTACK_COUNT' : [ 0x4, { - 'Value' : [ 0x0, ['long']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], - 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], -} ], - '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { - 'Version' : [ 0x0, ['unsigned char']], - 'DataCount' : [ 0x1, ['unsigned char']], - 'SemanticType' : [ 0x2, ['unsigned char']], - 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], - 'AttributeType' : [ 0x0, ['unsigned long']], -} ], - '_KENTROPY_TIMING_STATE' : [ 0x150, { - 'EntropyCount' : [ 0x0, ['unsigned long']], - 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], - 'Dpc' : [ 0x108, ['_KDPC']], - 'LastDeliveredBuffer' : [ 0x148, ['unsigned long']], -} ], - '_HEAP_UNPACKED_ENTRY' : [ 0x10, { - 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned short']], - 'Flags' : [ 0xa, ['unsigned char']], - 'SmallTagIndex' : [ 0xb, ['unsigned char']], - 'SubSegmentCode' : [ 0x8, ['unsigned long']], - 'PreviousSize' : [ 0xc, ['unsigned short']], - 'SegmentOffset' : [ 0xe, ['unsigned char']], - 'LFHFlags' : [ 0xe, ['unsigned char']], - 'UnusedBytes' : [ 0xf, ['unsigned char']], - 'CompactHeader' : [ 0x8, ['unsigned long long']], -} ], - '_PEP_ACPI_SPB_RESOURCE' : [ 0x28, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], - 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], - 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], - 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], - 'ResourceSourceName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], - 'VendorData' : [ 0x18, ['pointer64', ['unsigned char']]], - 'VendorDataLength' : [ 0x20, ['unsigned short']], -} ], - '_DISPATCHER_HEADER' : [ 0x18, { - 'Lock' : [ 0x0, ['long']], - 'LockNV' : [ 0x0, ['long']], - 'Type' : [ 0x0, ['unsigned char']], - 'Signalling' : [ 0x1, ['unsigned char']], - 'Size' : [ 0x2, ['unsigned char']], - 'Reserved1' : [ 0x3, ['unsigned char']], - 'TimerType' : [ 0x0, ['unsigned char']], - 'TimerControlFlags' : [ 0x1, ['unsigned char']], - 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'Hand' : [ 0x2, ['unsigned char']], - 'TimerMiscFlags' : [ 0x3, ['unsigned char']], - 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], - 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Timer2Type' : [ 0x0, ['unsigned char']], - 'Timer2Flags' : [ 0x1, ['unsigned char']], - 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], - 'Timer2Reserved1' : [ 0x2, ['unsigned char']], - 'Timer2Reserved2' : [ 0x3, ['unsigned char']], - 'QueueType' : [ 0x0, ['unsigned char']], - 'QueueControlFlags' : [ 0x1, ['unsigned char']], - 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'QueueSize' : [ 0x2, ['unsigned char']], - 'QueueReserved' : [ 0x3, ['unsigned char']], - 'ThreadType' : [ 0x0, ['unsigned char']], - 'ThreadReserved' : [ 0x1, ['unsigned char']], - 'ThreadControlFlags' : [ 0x2, ['unsigned char']], - 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], - 'DebugActive' : [ 0x3, ['unsigned char']], - 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Minimal' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Reserved4' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], - 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'MutantType' : [ 0x0, ['unsigned char']], - 'MutantSize' : [ 0x1, ['unsigned char']], - 'DpcActive' : [ 0x2, ['unsigned char']], - 'MutantReserved' : [ 0x3, ['unsigned char']], - 'SignalState' : [ 0x4, ['long']], - 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], -} ], - '_ETW_GUID_ENTRY' : [ 0x190, { - 'GuidList' : [ 0x0, ['_LIST_ENTRY']], - 'RefCount' : [ 0x10, ['long long']], - 'Guid' : [ 0x18, ['_GUID']], - 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], - 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], - 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], - 'MatchId' : [ 0x40, ['unsigned long long']], - 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], - 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], - 'FilterData' : [ 0x170, ['pointer64', ['_ETW_FILTER_HEADER']]], - 'HostSilo' : [ 0x178, ['unsigned char']], - 'Lock' : [ 0x180, ['_EX_PUSH_LOCK']], - 'LockOwner' : [ 0x188, ['pointer64', ['_ETHREAD']]], -} ], - '_VI_POOL_ENTRY' : [ 0x20, { - 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], - 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], - 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], -} ], - '_MM_PAGE_ACCESS_INFO' : [ 0x8, { - 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], - 'FileOffset' : [ 0x0, ['unsigned long long']], - 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], - 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], -} ], - '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { - 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], - 'WaitReason' : [ 0x8, ['unsigned long']], - 'WaitResponse' : [ 0xc, ['unsigned long']], - 'Gate' : [ 0x10, ['_KGATE']], -} ], - '_HEAP_COUNTERS' : [ 0x78, { - 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], - 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], - 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], - 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], - 'TotalSegments' : [ 0x20, ['unsigned long']], - 'TotalUCRs' : [ 0x24, ['unsigned long']], - 'CommittOps' : [ 0x28, ['unsigned long']], - 'DeCommitOps' : [ 0x2c, ['unsigned long']], - 'LockAcquires' : [ 0x30, ['unsigned long']], - 'LockCollisions' : [ 0x34, ['unsigned long']], - 'CommitRate' : [ 0x38, ['unsigned long']], - 'DecommittRate' : [ 0x3c, ['unsigned long']], - 'CommitFailures' : [ 0x40, ['unsigned long']], - 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], - 'PollIntervalCounter' : [ 0x48, ['unsigned long']], - 'DecommitsSinceLastCheck' : [ 0x4c, ['unsigned long']], - 'HeapPollInterval' : [ 0x50, ['unsigned long']], - 'AllocAndFreeOps' : [ 0x54, ['unsigned long']], - 'AllocationIndicesActive' : [ 0x58, ['unsigned long']], - 'InBlockDeccommits' : [ 0x5c, ['unsigned long']], - 'InBlockDeccomitSize' : [ 0x60, ['unsigned long long']], - 'HighWatermarkSize' : [ 0x68, ['unsigned long long']], - 'LastPolledSize' : [ 0x70, ['unsigned long long']], -} ], - '_TraceLoggingMetadata_t' : [ 0x10, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Size' : [ 0x4, ['unsigned short']], - 'Version' : [ 0x6, ['unsigned char']], - 'Flags' : [ 0x7, ['unsigned char']], - 'Magic' : [ 0x8, ['unsigned long long']], -} ], - '_MI_VISIBLE_PARTITION' : [ 0x1100, { - 'LowestPhysicalPage' : [ 0x0, ['unsigned long long']], - 'HighestPhysicalPage' : [ 0x8, ['unsigned long long']], - 'NumberOfPhysicalPages' : [ 0x10, ['unsigned long long']], - 'NumberOfPagingFiles' : [ 0x18, ['unsigned long']], - 'PagingFile' : [ 0x20, ['array', 16, ['pointer64', ['_MMPAGING_FILE']]]], - 'AvailablePages' : [ 0xc0, ['unsigned long long']], - 'ResidentAvailablePages' : [ 0x100, ['unsigned long long']], - 'TotalCommittedPages' : [ 0x108, ['unsigned long long']], - 'ModifiedPageListHead' : [ 0x140, ['_MMPFNLIST']], - 'ModifiedNoWritePageListHead' : [ 0x180, ['_MMPFNLIST']], - 'TotalCommitLimit' : [ 0x1a8, ['unsigned long long']], - 'TotalPagesForPagingFile' : [ 0x1b0, ['unsigned long long']], - 'VadPhysicalPages' : [ 0x1b8, ['unsigned long long']], - 'ProcessLockedFilePages' : [ 0x1c0, ['unsigned long long']], - 'ChargeCommitmentFailures' : [ 0x1c8, ['array', 4, ['unsigned long']]], - 'PageTableBitmapPages' : [ 0x1d8, ['unsigned long long']], - 'PageFileTraceIndex' : [ 0x1e0, ['long']], - 'PageFileTraces' : [ 0x1e8, ['array', 32, ['_MI_PAGEFILE_TRACES']]], -} ], - '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x20, { - 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], - 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], - 'Rundown' : [ 0x18, ['_EX_RUNDOWN_REF']], -} ], - '_SYSPTES_HEADER' : [ 0x118, { - 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], - 'Count' : [ 0x100, ['unsigned long long']], - 'NumberOfEntries' : [ 0x108, ['unsigned long long']], - 'NumberOfEntriesPeak' : [ 0x110, ['unsigned long long']], -} ], - '_EXCEPTION_RECORD' : [ 0x98, { - 'ExceptionCode' : [ 0x0, ['long']], - 'ExceptionFlags' : [ 0x4, ['unsigned long']], - 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], - 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], - 'NumberParameters' : [ 0x18, ['unsigned long']], - 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], -} ], - '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x10, { - 'Flink' : [ 0x0, ['unsigned long long']], - 'Blink' : [ 0x8, ['unsigned long long']], -} ], - '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x70, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], - 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], - 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], - 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], - 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], - 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], - 'Problem' : [ 0x54, ['unsigned long']], - 'ProfileChangingEject' : [ 0x58, ['unsigned char']], - 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], - 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], - 'DequeuePending' : [ 0x68, ['unsigned char']], - 'DeleteType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], -} ], - '_PPM_PLATFORM_STATE' : [ 0x180, { - 'Latency' : [ 0x0, ['unsigned long']], - 'BreakEvenDuration' : [ 0x4, ['unsigned long']], - 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], - 'TransitionDebugger' : [ 0x30, ['unsigned char']], - 'Platform' : [ 0x31, ['unsigned char']], - 'DependencyListCount' : [ 0x34, ['unsigned long']], - 'Processors' : [ 0x38, ['_KAFFINITY_EX']], - 'Name' : [ 0xe0, ['_UNICODE_STRING']], - 'DependencyLists' : [ 0xf0, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], - 'Synchronization' : [ 0xf8, ['_PPM_COORDINATED_SYNCHRONIZATION']], - 'EnterTime' : [ 0x100, ['unsigned long long']], - 'RefCount' : [ 0x140, ['long']], - 'CacheAlign0' : [ 0x140, ['array', 64, ['unsigned char']]], -} ], - '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { - 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], - 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], -} ], - '_TOKEN_ACCESS_INFORMATION' : [ 0x58, { - 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], - 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], - 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], - 'AuthenticationId' : [ 0x18, ['_LUID']], - 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], - 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], - 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], - 'Flags' : [ 0x2c, ['unsigned long']], - 'AppContainerNumber' : [ 0x30, ['unsigned long']], - 'PackageSid' : [ 0x38, ['pointer64', ['void']]], - 'CapabilitiesHash' : [ 0x40, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], - 'TrustLevelSid' : [ 0x48, ['pointer64', ['void']]], - 'SecurityAttributes' : [ 0x50, ['pointer64', ['void']]], -} ], - '_CELL_DATA' : [ 0x50, { - 'u' : [ 0x0, ['_u']], -} ], - '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { - 'PrivilegeCount' : [ 0x0, ['unsigned long']], - 'Control' : [ 0x4, ['unsigned long']], - 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], -} ], - '_HEAP_TUNING_PARAMETERS' : [ 0x10, { - 'CommittThresholdShift' : [ 0x0, ['unsigned long']], - 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], -} ], - '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { - 'Key' : [ 0x0, ['pointer64', ['void']]], - 'Index' : [ 0x8, ['unsigned long long']], -} ], - '_POP_FX_WORK_ORDER' : [ 0x38, { - 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], - 'WorkCount' : [ 0x20, ['long']], - 'Context' : [ 0x28, ['pointer64', ['void']]], - 'WatchdogTimerInfo' : [ 0x30, ['pointer64', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], -} ], - '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], - 'Short0' : [ 0x0, ['unsigned short']], - 'FloppyMedia' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], - 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'UChar1' : [ 0x2, ['unsigned char']], - 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], - 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'UChar2' : [ 0x3, ['unsigned char']], -} ], - '_KAPC' : [ 0x58, { - 'Type' : [ 0x0, ['unsigned char']], - 'SpareByte0' : [ 0x1, ['unsigned char']], - 'Size' : [ 0x2, ['unsigned char']], - 'SpareByte1' : [ 0x3, ['unsigned char']], - 'SpareLong0' : [ 0x4, ['unsigned long']], - 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], - 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], - 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], - 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], - 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], - 'Reserved' : [ 0x20, ['array', 3, ['pointer64', ['void']]]], - 'NormalContext' : [ 0x38, ['pointer64', ['void']]], - 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], - 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], - 'ApcStateIndex' : [ 0x50, ['unsigned char']], - 'ApcMode' : [ 0x51, ['unsigned char']], - 'Inserted' : [ 0x52, ['unsigned char']], -} ], - '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { - 'InterruptTime' : [ 0x0, ['unsigned long long']], - 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], -} ], - '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { - 'Va' : [ 0x0, ['unsigned long long']], - 'Key' : [ 0x8, ['unsigned long']], - 'Pattern' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], - 'PoolType' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], - 'SlushSize' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], - 'NumberOfBytes' : [ 0x10, ['unsigned long long']], -} ], - 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { - 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], - 'ulTargetPlatform' : [ 0x8, ['unsigned long']], - 'ullContextMinimum' : [ 0x10, ['unsigned long long']], - 'guPlatform' : [ 0x18, ['_GUID']], - 'guMinPlatform' : [ 0x28, ['_GUID']], - 'ulContextSource' : [ 0x38, ['unsigned long']], - 'ulElementCount' : [ 0x3c, ['unsigned long']], - 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], -} ], - '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x30, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Count' : [ 0x4, ['long']], - 'Items' : [ 0x8, ['_LIST_ENTRY']], - 'InsertLock' : [ 0x18, ['_KEVENT']], -} ], - '_ETW_HASH_BUCKET' : [ 0x38, { - 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], - 'BucketLock' : [ 0x30, ['_EX_PUSH_LOCK']], -} ], - '_TEB_ACTIVE_FRAME' : [ 0x18, { - 'Flags' : [ 0x0, ['unsigned long']], - 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], - 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], -} ], - '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { - 'NextEntryOffset' : [ 0x0, ['unsigned long']], - 'SidLength' : [ 0x4, ['unsigned long']], - 'Sid' : [ 0x8, ['_SID']], -} ], - '_ACCESS_REASONS' : [ 0x80, { - 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], -} ], - '_CM_KEY_BODY' : [ 0x58, { - 'Type' : [ 0x0, ['unsigned long']], - 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], - 'ProcessID' : [ 0x18, ['pointer64', ['void']]], - 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], - 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], - 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], - 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], - 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], -} ], - '_KWAIT_BLOCK' : [ 0x30, { - 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'WaitType' : [ 0x10, ['unsigned char']], - 'BlockState' : [ 0x11, ['unsigned char']], - 'WaitKey' : [ 0x12, ['unsigned short']], - 'SpareLong' : [ 0x14, ['long']], - 'Thread' : [ 0x18, ['pointer64', ['_KTHREAD']]], - 'NotificationQueue' : [ 0x18, ['pointer64', ['_KQUEUE']]], - 'Object' : [ 0x20, ['pointer64', ['void']]], - 'SparePtr' : [ 0x28, ['pointer64', ['void']]], -} ], - '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { - 'Continue' : [ 0x0, ['unsigned long']], - 'TraceFlag' : [ 0x4, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], - 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], -} ], - '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], - 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], -} ], - '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_THERMAL_INFORMATION_EX' : [ 0x58, { - 'ThermalStamp' : [ 0x0, ['unsigned long']], - 'ThermalConstant1' : [ 0x4, ['unsigned long']], - 'ThermalConstant2' : [ 0x8, ['unsigned long']], - 'SamplingPeriod' : [ 0xc, ['unsigned long']], - 'CurrentTemperature' : [ 0x10, ['unsigned long']], - 'PassiveTripPoint' : [ 0x14, ['unsigned long']], - 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], - 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], - 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], - 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], - 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], - 'MinimumThrottle' : [ 0x50, ['unsigned long']], - 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], -} ], - '__unnamed_1ed8' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], -} ], - '__unnamed_1eda' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], -} ], - '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { - 'File' : [ 0x0, ['__unnamed_1ed8']], - 'Private' : [ 0x0, ['__unnamed_1eda']], -} ], - '_KTIMER2' : [ 0x88, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'RbNodes' : [ 0x18, ['array', 2, ['_RTL_BALANCED_NODE']]], - 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'DueTime' : [ 0x48, ['array', 2, ['unsigned long long']]], - 'Period' : [ 0x58, ['long long']], - 'Callback' : [ 0x60, ['pointer64', ['void']]], - 'CallbackContext' : [ 0x68, ['pointer64', ['void']]], - 'DisableCallback' : [ 0x70, ['pointer64', ['void']]], - 'DisableContext' : [ 0x78, ['pointer64', ['void']]], - 'AbsoluteSystemTime' : [ 0x80, ['unsigned char']], - 'TypeFlags' : [ 0x81, ['unsigned char']], - 'Unused' : [ 0x81, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IdleResilient' : [ 0x81, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'HighResolution' : [ 0x81, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'NoWake' : [ 0x81, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Unused1' : [ 0x81, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'CollectionIndex' : [ 0x82, ['array', 2, ['unsigned char']]], -} ], - '_VI_VERIFIER_ISSUE' : [ 0x20, { - 'IssueType' : [ 0x0, ['unsigned long long']], - 'Address' : [ 0x8, ['pointer64', ['void']]], - 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], -} ], - '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], -} ], - '_EXCEPTION_POINTERS' : [ 0x10, { - 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], - 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], -} ], - '_KMUTANT' : [ 0x38, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], - 'Abandoned' : [ 0x30, ['unsigned char']], - 'ApcDisable' : [ 0x31, ['unsigned char']], -} ], - '_OBJECT_REF_INFO' : [ 0x28, { - 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], - 'NextRef' : [ 0x8, ['pointer64', ['void']]], - 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], - 'NextPos' : [ 0x20, ['unsigned short']], - 'MaxStacks' : [ 0x22, ['unsigned short']], - 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], -} ], - '_HBIN' : [ 0x20, { - 'Signature' : [ 0x0, ['unsigned long']], - 'FileOffset' : [ 0x4, ['unsigned long']], - 'Size' : [ 0x8, ['unsigned long']], - 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], - 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], - 'Spare' : [ 0x1c, ['unsigned long']], -} ], - '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x18, { - 'DynamicRelocations' : [ 0x0, ['pointer64', ['void']]], - 'SecurityContext' : [ 0x8, ['_IMAGE_SECURITY_CONTEXT']], - 'StrongImageReference' : [ 0x10, ['unsigned long long']], -} ], - '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x260, { - 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], - 'pDeviceGroups' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'RestrictedDeviceGroupsCount' : [ 0x10, ['unsigned long']], - 'pRestrictedDeviceGroups' : [ 0x18, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'DeviceGroupsHash' : [ 0x20, ['_SID_AND_ATTRIBUTES_HASH']], - 'RestrictedDeviceGroupsHash' : [ 0x130, ['_SID_AND_ATTRIBUTES_HASH']], - 'pUserSecurityAttributes' : [ 0x240, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], - 'pDeviceSecurityAttributes' : [ 0x248, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], - 'pRestrictedUserSecurityAttributes' : [ 0x250, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], - 'pRestrictedDeviceSecurityAttributes' : [ 0x258, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], -} ], - '_HEAP_TAG_ENTRY' : [ 0x48, { - 'Allocs' : [ 0x0, ['unsigned long']], - 'Frees' : [ 0x4, ['unsigned long']], - 'Size' : [ 0x8, ['unsigned long long']], - 'TagIndex' : [ 0x10, ['unsigned short']], - 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], - 'TagName' : [ 0x14, ['array', 24, ['wchar']]], -} ], - '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { - 'Length' : [ 0x0, ['unsigned long']], - 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], - 'ContextTrackingMode' : [ 0x8, ['unsigned char']], - 'EffectiveOnly' : [ 0x9, ['unsigned char']], -} ], - '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 28, native_type='unsigned long long')]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], -} ], - '_NT_TIB' : [ 0x38, { - 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], - 'StackBase' : [ 0x8, ['pointer64', ['void']]], - 'StackLimit' : [ 0x10, ['pointer64', ['void']]], - 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], - 'FiberData' : [ 0x20, ['pointer64', ['void']]], - 'Version' : [ 0x20, ['unsigned long']], - 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], - 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], -} ], - '_LEARNING_MODE_DATA' : [ 0x8, { - 'Settings' : [ 0x0, ['unsigned long']], - 'Enabled' : [ 0x4, ['unsigned char']], - 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], -} ], - '_WHEA_REVISION' : [ 0x2, { - 'MinorRevision' : [ 0x0, ['unsigned char']], - 'MajorRevision' : [ 0x1, ['unsigned char']], - 'AsUSHORT' : [ 0x0, ['unsigned short']], -} ], - '_PPM_IDLE_STATES' : [ 0x418, { - 'InterfaceVersion' : [ 0x0, ['unsigned char']], - 'ForceIdle' : [ 0x1, ['unsigned char']], - 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], - 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], - 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], - 'UnaccountedTransition' : [ 0x5, ['unsigned char']], - 'IdleDurationLimited' : [ 0x6, ['unsigned char']], - 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], - 'TargetState' : [ 0xc, ['unsigned long']], - 'ActualState' : [ 0x10, ['unsigned long']], - 'OldState' : [ 0x14, ['unsigned long']], - 'OverrideIndex' : [ 0x18, ['unsigned long']], - 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], - 'Type' : [ 0x20, ['unsigned long']], - 'ReasonFlags' : [ 0x24, ['unsigned short']], - 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], - 'PreviousStatus' : [ 0x30, ['long']], - 'PreviousCancelReason' : [ 0x34, ['unsigned long']], - 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], - 'SecondaryProcessorMask' : [ 0xe0, ['_KAFFINITY_EX']], - 'IdlePrepare' : [ 0x188, ['pointer64', ['void']]], - 'IdlePreExecute' : [ 0x190, ['pointer64', ['void']]], - 'IdleExecute' : [ 0x198, ['pointer64', ['void']]], - 'IdlePreselect' : [ 0x1a0, ['pointer64', ['void']]], - 'IdleTest' : [ 0x1a8, ['pointer64', ['void']]], - 'IdleAvailabilityCheck' : [ 0x1b0, ['pointer64', ['void']]], - 'IdleComplete' : [ 0x1b8, ['pointer64', ['void']]], - 'IdleCancel' : [ 0x1c0, ['pointer64', ['void']]], - 'IdleIsHalted' : [ 0x1c8, ['pointer64', ['void']]], - 'IdleInitiateWake' : [ 0x1d0, ['pointer64', ['void']]], - 'PrepareInfo' : [ 0x1d8, ['_PROCESSOR_IDLE_PREPARE_INFO']], - 'DeepIdleSnapshot' : [ 0x230, ['_KAFFINITY_EX']], - 'Tracing' : [ 0x2d8, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], - 'CoordinatedTracing' : [ 0x2e0, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], - 'ProcessorMenu' : [ 0x2e8, ['_PPM_SELECTION_MENU']], - 'CoordinatedMenu' : [ 0x2f8, ['_PPM_SELECTION_MENU']], - 'CoordinatedSelection' : [ 0x308, ['_PPM_COORDINATED_SELECTION']], - 'State' : [ 0x320, ['array', 1, ['_PPM_IDLE_STATE']]], -} ], - '_PPM_VETO_ACCOUNTING' : [ 0x28, { - 'VetoPresent' : [ 0x0, ['long']], - 'VetoListHead' : [ 0x8, ['_LIST_ENTRY']], - 'CsAccountingBlocks' : [ 0x18, ['unsigned char']], - 'BlocksDrips' : [ 0x19, ['unsigned char']], - 'PreallocatedVetoCount' : [ 0x1c, ['unsigned long']], - 'PreallocatedVetoList' : [ 0x20, ['pointer64', ['_PPM_VETO_ENTRY']]], -} ], - '_PEB' : [ 0x7a0, { - 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], - 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], - 'BeingDebugged' : [ 0x2, ['unsigned char']], - 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], - 'Mutant' : [ 0x8, ['pointer64', ['void']]], - 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], - 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], - 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], - 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], - 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], - 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], - 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], - 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], - 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], - 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], - 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], - 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], - 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], - 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], - 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], - 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], - 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], - 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], - 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], - 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], - 'SparePvoid0' : [ 0x90, ['pointer64', ['void']]], - 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], - 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], - 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], - 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], - 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], - 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], - 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], - 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], - 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], - 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], - 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], - 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], - 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], - 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], - 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], - 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], - 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], - 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], - 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], - 'OSMajorVersion' : [ 0x118, ['unsigned long']], - 'OSMinorVersion' : [ 0x11c, ['unsigned long']], - 'OSBuildNumber' : [ 0x120, ['unsigned short']], - 'OSCSDVersion' : [ 0x122, ['unsigned short']], - 'OSPlatformId' : [ 0x124, ['unsigned long']], - 'ImageSubsystem' : [ 0x128, ['unsigned long']], - 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], - 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], - 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], - 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], - 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], - 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], - 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], - 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], - 'SessionId' : [ 0x2c0, ['unsigned long']], - 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], - 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], - 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], - 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], - 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], - 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], - 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], - 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], - 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], - 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], - 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], - 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], - 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], - 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], - 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], - 'FlsHighIndex' : [ 0x350, ['unsigned long']], - 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], - 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], - 'pUnused' : [ 0x368, ['pointer64', ['void']]], - 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], - 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], - 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], - 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], - 'TppWorkerpList' : [ 0x390, ['_LIST_ENTRY']], - 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['pointer64', ['void']]]], -} ], - '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], - 'Address' : [ 0x20, ['pointer64', ['void']]], - 'Size' : [ 0x28, ['unsigned long long']], -} ], - '_ETW_REALTIME_CONSUMER' : [ 0x98, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], - 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], - 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], - 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], - 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], - 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], - 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], - 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], - 'BuffersLost' : [ 0x50, ['unsigned long']], - 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], - 'LoggerId' : [ 0x58, ['unsigned short']], - 'Flags' : [ 0x5a, ['unsigned char']], - 'ShutDownRequested' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'NewBuffersLost' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Disconnected' : [ 0x5a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Notified' : [ 0x5a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Wow' : [ 0x5a, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], - 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], - 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], - 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], - 'UserPagesReused' : [ 0x80, ['unsigned long']], - 'EventsLostCount' : [ 0x88, ['pointer64', ['unsigned long']]], - 'BuffersLostCount' : [ 0x90, ['pointer64', ['unsigned long']]], -} ], - '_POOL_DESCRIPTOR' : [ 0x1140, { - 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'PagedLock' : [ 0x8, ['_FAST_MUTEX']], - 'NonPagedLock' : [ 0x8, ['unsigned long long']], - 'RunningAllocs' : [ 0x40, ['long']], - 'RunningDeAllocs' : [ 0x44, ['long']], - 'TotalBigPages' : [ 0x48, ['long']], - 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], - 'TotalBytes' : [ 0x50, ['unsigned long long']], - 'PoolIndex' : [ 0x80, ['unsigned long']], - 'TotalPages' : [ 0xc0, ['long']], - 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], - 'PendingFreeDepth' : [ 0x108, ['long']], - 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], -} ], - '_TOKEN_MANDATORY_POLICY' : [ 0x4, { - 'Policy' : [ 0x0, ['unsigned long']], -} ], - '_BLOB_COUNTERS' : [ 0x8, { - 'CreatedObjects' : [ 0x0, ['unsigned long']], - 'DeletedObjects' : [ 0x4, ['unsigned long']], -} ], - '_KGATE' : [ 0x18, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], -} ], - '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Revision' : [ 0x4, ['_WHEA_REVISION']], - 'SignatureEnd' : [ 0x6, ['unsigned long']], - 'SectionCount' : [ 0xa, ['unsigned short']], - 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], - 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], - 'Length' : [ 0x14, ['unsigned long']], - 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], - 'PlatformId' : [ 0x20, ['_GUID']], - 'PartitionId' : [ 0x30, ['_GUID']], - 'CreatorId' : [ 0x40, ['_GUID']], - 'NotifyType' : [ 0x50, ['_GUID']], - 'RecordId' : [ 0x60, ['unsigned long long']], - 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], - 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], - 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], -} ], - '_ALPC_PROCESS_CONTEXT' : [ 0x20, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], - 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], -} ], - '_DRIVER_EXTENSION' : [ 0x50, { - 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], - 'AddDevice' : [ 0x8, ['pointer64', ['void']]], - 'Count' : [ 0x10, ['unsigned long']], - 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], - 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], - 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], - 'KseCallbacks' : [ 0x38, ['pointer64', ['void']]], - 'DvCallbacks' : [ 0x40, ['pointer64', ['void']]], - 'VerifierContext' : [ 0x48, ['pointer64', ['void']]], -} ], - '_PRIVILEGE_SET' : [ 0x14, { - 'PrivilegeCount' : [ 0x0, ['unsigned long']], - 'Control' : [ 0x4, ['unsigned long']], - 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], -} ], - '_WHEAP_WORK_QUEUE' : [ 0x88, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'ListLock' : [ 0x10, ['unsigned long long']], - 'ItemCount' : [ 0x18, ['long']], - 'Dpc' : [ 0x20, ['_KDPC']], - 'WorkItem' : [ 0x60, ['_WORK_QUEUE_ITEM']], - 'WorkRoutine' : [ 0x80, ['pointer64', ['void']]], -} ], - '_CM_NOTIFY_BLOCK' : [ 0x58, { - 'HiveList' : [ 0x0, ['_LIST_ENTRY']], - 'PostList' : [ 0x10, ['_LIST_ENTRY']], - 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], -} ], - '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { - 'SizeOfHeaders' : [ 0x0, ['unsigned long']], - 'SizeOfImage' : [ 0x4, ['unsigned long']], -} ], - '_KINTERRUPT' : [ 0x100, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], - 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], - 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], - 'MessageIndex' : [ 0x28, ['unsigned long']], - 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], - 'SpinLock' : [ 0x38, ['unsigned long long']], - 'TickCount' : [ 0x40, ['unsigned long']], - 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], - 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], - 'Vector' : [ 0x58, ['unsigned long']], - 'Irql' : [ 0x5c, ['unsigned char']], - 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], - 'FloatingSave' : [ 0x5e, ['unsigned char']], - 'Connected' : [ 0x5f, ['unsigned char']], - 'Number' : [ 0x60, ['unsigned long']], - 'ShareVector' : [ 0x64, ['unsigned char']], - 'EmulateActiveBoth' : [ 0x65, ['unsigned char']], - 'ActiveCount' : [ 0x66, ['unsigned short']], - 'InternalState' : [ 0x68, ['long']], - 'Mode' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], - 'Polarity' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], - 'ServiceCount' : [ 0x74, ['unsigned long']], - 'DispatchCount' : [ 0x78, ['unsigned long']], - 'PassiveEvent' : [ 0x80, ['pointer64', ['_KEVENT']]], - 'TrapFrame' : [ 0x88, ['pointer64', ['_KTRAP_FRAME']]], - 'DisconnectData' : [ 0x90, ['pointer64', ['void']]], - 'ServiceThread' : [ 0x98, ['pointer64', ['_KTHREAD']]], - 'ConnectionData' : [ 0xa0, ['pointer64', ['_INTERRUPT_CONNECTION_DATA']]], - 'IntTrackEntry' : [ 0xa8, ['pointer64', ['void']]], - 'IsrDpcStats' : [ 0xb0, ['_ISRDPCSTATS']], - 'RedirectObject' : [ 0xf0, ['pointer64', ['void']]], - 'Padding' : [ 0xf8, ['array', 8, ['unsigned char']]], -} ], - '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { - 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], - 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], - 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], - 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], -} ], - '_IMAGE_FILE_HEADER' : [ 0x14, { - 'Machine' : [ 0x0, ['unsigned short']], - 'NumberOfSections' : [ 0x2, ['unsigned short']], - 'TimeDateStamp' : [ 0x4, ['unsigned long']], - 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], - 'NumberOfSymbols' : [ 0xc, ['unsigned long']], - 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], - 'Characteristics' : [ 0x12, ['unsigned short']], -} ], - '_MMEXTEND_INFO' : [ 0x10, { - 'CommittedSize' : [ 0x0, ['unsigned long long']], - 'ReferenceCount' : [ 0x8, ['unsigned long']], -} ], - '_STRING64' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x8, ['unsigned long long']], -} ], - '_HIVE_LIST_ENTRY' : [ 0x98, { - 'FileName' : [ 0x0, ['pointer64', ['unsigned short']]], - 'BaseName' : [ 0x8, ['pointer64', ['unsigned short']]], - 'RegRootName' : [ 0x10, ['pointer64', ['unsigned short']]], - 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], - 'HHiveFlags' : [ 0x20, ['unsigned long']], - 'CmHiveFlags' : [ 0x24, ['unsigned long']], - 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], - 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], - 'HiveMounted' : [ 0x38, ['unsigned char']], - 'ThreadFinished' : [ 0x39, ['unsigned char']], - 'ThreadStarted' : [ 0x3a, ['unsigned char']], - 'Allocate' : [ 0x3b, ['unsigned char']], - 'WinPERequired' : [ 0x3c, ['unsigned char']], - 'StartEvent' : [ 0x40, ['_KEVENT']], - 'FinishedEvent' : [ 0x58, ['_KEVENT']], - 'MountLock' : [ 0x70, ['_KEVENT']], - 'FilePath' : [ 0x88, ['_UNICODE_STRING']], -} ], - '_HMAP_DIRECTORY' : [ 0x2000, { - 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], -} ], - '_CONTEXT' : [ 0x4d0, { - 'P1Home' : [ 0x0, ['unsigned long long']], - 'P2Home' : [ 0x8, ['unsigned long long']], - 'P3Home' : [ 0x10, ['unsigned long long']], - 'P4Home' : [ 0x18, ['unsigned long long']], - 'P5Home' : [ 0x20, ['unsigned long long']], - 'P6Home' : [ 0x28, ['unsigned long long']], - 'ContextFlags' : [ 0x30, ['unsigned long']], - 'MxCsr' : [ 0x34, ['unsigned long']], - 'SegCs' : [ 0x38, ['unsigned short']], - 'SegDs' : [ 0x3a, ['unsigned short']], - 'SegEs' : [ 0x3c, ['unsigned short']], - 'SegFs' : [ 0x3e, ['unsigned short']], - 'SegGs' : [ 0x40, ['unsigned short']], - 'SegSs' : [ 0x42, ['unsigned short']], - 'EFlags' : [ 0x44, ['unsigned long']], - 'Dr0' : [ 0x48, ['unsigned long long']], - 'Dr1' : [ 0x50, ['unsigned long long']], - 'Dr2' : [ 0x58, ['unsigned long long']], - 'Dr3' : [ 0x60, ['unsigned long long']], - 'Dr6' : [ 0x68, ['unsigned long long']], - 'Dr7' : [ 0x70, ['unsigned long long']], - 'Rax' : [ 0x78, ['unsigned long long']], - 'Rcx' : [ 0x80, ['unsigned long long']], - 'Rdx' : [ 0x88, ['unsigned long long']], - 'Rbx' : [ 0x90, ['unsigned long long']], - 'Rsp' : [ 0x98, ['unsigned long long']], - 'Rbp' : [ 0xa0, ['unsigned long long']], - 'Rsi' : [ 0xa8, ['unsigned long long']], - 'Rdi' : [ 0xb0, ['unsigned long long']], - 'R8' : [ 0xb8, ['unsigned long long']], - 'R9' : [ 0xc0, ['unsigned long long']], - 'R10' : [ 0xc8, ['unsigned long long']], - 'R11' : [ 0xd0, ['unsigned long long']], - 'R12' : [ 0xd8, ['unsigned long long']], - 'R13' : [ 0xe0, ['unsigned long long']], - 'R14' : [ 0xe8, ['unsigned long long']], - 'R15' : [ 0xf0, ['unsigned long long']], - 'Rip' : [ 0xf8, ['unsigned long long']], - 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], - 'Header' : [ 0x100, ['array', 2, ['_M128A']]], - 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], - 'Xmm0' : [ 0x1a0, ['_M128A']], - 'Xmm1' : [ 0x1b0, ['_M128A']], - 'Xmm2' : [ 0x1c0, ['_M128A']], - 'Xmm3' : [ 0x1d0, ['_M128A']], - 'Xmm4' : [ 0x1e0, ['_M128A']], - 'Xmm5' : [ 0x1f0, ['_M128A']], - 'Xmm6' : [ 0x200, ['_M128A']], - 'Xmm7' : [ 0x210, ['_M128A']], - 'Xmm8' : [ 0x220, ['_M128A']], - 'Xmm9' : [ 0x230, ['_M128A']], - 'Xmm10' : [ 0x240, ['_M128A']], - 'Xmm11' : [ 0x250, ['_M128A']], - 'Xmm12' : [ 0x260, ['_M128A']], - 'Xmm13' : [ 0x270, ['_M128A']], - 'Xmm14' : [ 0x280, ['_M128A']], - 'Xmm15' : [ 0x290, ['_M128A']], - 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], - 'VectorControl' : [ 0x4a0, ['unsigned long long']], - 'DebugControl' : [ 0x4a8, ['unsigned long long']], - 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], - 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], - 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], - 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], -} ], - '_ALPC_HANDLE_TABLE' : [ 0x18, { - 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], - 'TotalHandles' : [ 0x8, ['unsigned long']], - 'Flags' : [ 0xc, ['unsigned long']], - 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], -} ], - '__unnamed_1fa4' : [ 0x3a4, { - 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], - 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], - 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], - 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], - 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], - 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], - 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], - 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], - 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], - 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], -} ], - '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { - 'Length' : [ 0x0, ['unsigned long']], - 'Version' : [ 0x4, ['unsigned long']], - 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], - 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], - 'MaxRawDataLength' : [ 0x10, ['unsigned long']], - 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], - 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], - 'ErrorSourceId' : [ 0x1c, ['unsigned long']], - 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], - 'Flags' : [ 0x24, ['unsigned long']], - 'Info' : [ 0x28, ['__unnamed_1fa4']], -} ], - '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], -} ], - '_IO_COMPLETION_CONTEXT' : [ 0x10, { - 'Port' : [ 0x0, ['pointer64', ['void']]], - 'Key' : [ 0x8, ['pointer64', ['void']]], -} ], - '_EX_WORK_QUEUE' : [ 0x2d0, { - 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], - 'Node' : [ 0x2b0, ['pointer64', ['_ENODE']]], - 'WorkItemsProcessed' : [ 0x2b8, ['unsigned long']], - 'WorkItemsProcessedLastPass' : [ 0x2bc, ['unsigned long']], - 'ThreadCount' : [ 0x2c0, ['long']], - 'MinThreads' : [ 0x2c4, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], - 'TryFailed' : [ 0x2c4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'MaxThreads' : [ 0x2c8, ['long']], - 'QueueIndex' : [ 0x2cc, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'ExPoolTrusted', 8: 'ExPoolMax'})]], -} ], - '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { - 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], - 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], - 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], -} ], - '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { - 'Flags' : [ 0x0, ['unsigned long']], - 'ActivityId' : [ 0x4, ['unsigned long']], - 'IoTracking' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_SET_CONTEXT' : [ 0x4, { - 'ContextFlags' : [ 0x0, ['unsigned long']], -} ], - '_VI_POOL_ENTRY_INUSE' : [ 0x20, { - 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], - 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], - 'NumberOfBytes' : [ 0x10, ['unsigned long long']], - 'Tag' : [ 0x18, ['unsigned long long']], -} ], - '_MI_FLAGS' : [ 0x4, { - 'EntireFlags' : [ 0x0, ['long']], - 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], - 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'ZeroNonCachedByConverting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'ZeroWriteCombinedByConverting' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], -} ], - '_INTERFACE' : [ 0x20, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x8, ['pointer64', ['void']]], - 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], - 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], -} ], - '_ACL' : [ 0x8, { - 'AclRevision' : [ 0x0, ['unsigned char']], - 'Sbz1' : [ 0x1, ['unsigned char']], - 'AclSize' : [ 0x2, ['unsigned short']], - 'AceCount' : [ 0x4, ['unsigned short']], - 'Sbz2' : [ 0x6, ['unsigned short']], -} ], - '_PS_PROPERTY_SET' : [ 0x18, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Lock' : [ 0x10, ['unsigned long long']], -} ], - '_LAZY_WRITER' : [ 0x88, { - 'ScanDpc' : [ 0x0, ['_KDPC']], - 'ScanTimer' : [ 0x40, ['_KTIMER']], - 'ScanActive' : [ 0x80, ['unsigned char']], - 'OtherWork' : [ 0x81, ['unsigned char']], - 'PendingTeardownScan' : [ 0x82, ['unsigned char']], - 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], - 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], - 'PendingPowerScan' : [ 0x85, ['unsigned char']], - 'PendingCoalescingFlushScan' : [ 0x86, ['unsigned char']], -} ], - '_PI_BUS_EXTENSION' : [ 0x70, { - 'Flags' : [ 0x0, ['unsigned long']], - 'NumberCSNs' : [ 0x4, ['unsigned char']], - 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], - 'DataPortMapped' : [ 0x10, ['unsigned char']], - 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], - 'AddrPortMapped' : [ 0x20, ['unsigned char']], - 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], - 'CmdPortMapped' : [ 0x30, ['unsigned char']], - 'NextSlotNumber' : [ 0x34, ['unsigned long']], - 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], - 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], - 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], - 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], - 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], - 'BusNumber' : [ 0x60, ['unsigned long']], - 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], -} ], - '_DEVICE_DESCRIPTION' : [ 0x40, { - 'Version' : [ 0x0, ['unsigned long']], - 'Master' : [ 0x4, ['unsigned char']], - 'ScatterGather' : [ 0x5, ['unsigned char']], - 'DemandMode' : [ 0x6, ['unsigned char']], - 'AutoInitialize' : [ 0x7, ['unsigned char']], - 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], - 'IgnoreCount' : [ 0x9, ['unsigned char']], - 'Reserved1' : [ 0xa, ['unsigned char']], - 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], - 'BusNumber' : [ 0xc, ['unsigned long']], - 'DmaChannel' : [ 0x10, ['unsigned long']], - 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], - 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], - 'MaximumLength' : [ 0x20, ['unsigned long']], - 'DmaPort' : [ 0x24, ['unsigned long']], - 'DmaAddressWidth' : [ 0x28, ['unsigned long']], - 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], - 'DmaRequestLine' : [ 0x30, ['unsigned long']], - 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], -} ], - '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { - 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'AccessRights' : [ 0x0, ['unsigned char']], -} ], - '_SID_AND_ATTRIBUTES' : [ 0x10, { - 'Sid' : [ 0x0, ['pointer64', ['void']]], - 'Attributes' : [ 0x8, ['unsigned long']], -} ], - '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { - 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], -} ], - '_PROCESS_DISK_COUNTERS' : [ 0x28, { - 'BytesRead' : [ 0x0, ['unsigned long long']], - 'BytesWritten' : [ 0x8, ['unsigned long long']], - 'ReadOperationCount' : [ 0x10, ['unsigned long long']], - 'WriteOperationCount' : [ 0x18, ['unsigned long long']], - 'FlushOperationCount' : [ 0x20, ['unsigned long long']], -} ], - '_IO_WORKITEM' : [ 0x58, { - 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], - 'Routine' : [ 0x20, ['pointer64', ['void']]], - 'IoObject' : [ 0x28, ['pointer64', ['void']]], - 'Context' : [ 0x30, ['pointer64', ['void']]], - 'WorkingOnBehalfClient' : [ 0x38, ['pointer64', ['void']]], - 'Type' : [ 0x40, ['unsigned long']], - 'ActivityId' : [ 0x44, ['_GUID']], -} ], - '_MMVAD_FLAGS' : [ 0x4, { - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], -} ], - '_MMWSLE_HASH' : [ 0x8, { - 'Index' : [ 0x0, ['unsigned long long']], -} ], - '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { - 'HighEdgeFilter' : [ 0x0, ['unsigned long']], - 'LowEdgeFilter' : [ 0x4, ['unsigned long']], -} ], - '_UNEXPECTED_INTERRUPT' : [ 0x8, { - 'PushImm' : [ 0x0, ['unsigned char']], - 'Vector' : [ 0x1, ['unsigned char']], - 'PushRbp' : [ 0x2, ['unsigned char']], - 'JmpOp' : [ 0x3, ['unsigned char']], - 'JmpOffset' : [ 0x4, ['long']], -} ], - '_STRING32' : [ 0x8, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x4, ['unsigned long']], -} ], - '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x88, { - 'Timer' : [ 0x0, ['_KTIMER']], - 'Dpc' : [ 0x40, ['_KDPC']], - 'WorkOrder' : [ 0x80, ['pointer64', ['_POP_FX_WORK_ORDER']]], -} ], - '_MI_VAD_EVENT_BLOCK' : [ 0x40, { - 'Next' : [ 0x0, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], - 'WaitReason' : [ 0x8, ['unsigned long']], - 'Gate' : [ 0x10, ['_KGATE']], - 'SecureInfo' : [ 0x10, ['_MMADDRESS_LIST']], - 'BitMap' : [ 0x10, ['_RTL_BITMAP_EX']], - 'InPageSupport' : [ 0x10, ['pointer64', ['_MMINPAGE_SUPPORT']]], - 'LargePage' : [ 0x10, ['pointer64', ['_MI_LARGEPAGE_MEMORY_INFO']]], - 'CreatingThread' : [ 0x10, ['pointer64', ['_ETHREAD']]], - 'PebTeb' : [ 0x10, ['_MI_SUB64K_FREE_RANGES']], -} ], - '_DBGKD_FILL_MEMORY' : [ 0x10, { - 'Address' : [ 0x0, ['unsigned long long']], - 'Length' : [ 0x8, ['unsigned long']], - 'Flags' : [ 0xc, ['unsigned short']], - 'PatternLength' : [ 0xe, ['unsigned short']], -} ], - '_HEAP_STOP_ON_VALUES' : [ 0x30, { - 'AllocAddress' : [ 0x0, ['unsigned long long']], - 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], - 'ReAllocAddress' : [ 0x10, ['unsigned long long']], - 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], - 'FreeAddress' : [ 0x20, ['unsigned long long']], - 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], -} ], - '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { - 'Allocs' : [ 0x0, ['unsigned long']], - 'Frees' : [ 0x4, ['unsigned long']], - 'Size' : [ 0x8, ['unsigned long long']], -} ], - '_CALL_HASH_ENTRY' : [ 0x28, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], - 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], - 'CallCount' : [ 0x20, ['unsigned long']], -} ], - '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x38, { - 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], - 'ReferenceCount' : [ 0x18, ['long long']], - 'Luid' : [ 0x20, ['unsigned long long']], - 'IndexIntoGlobalSingletonTable' : [ 0x28, ['unsigned long long']], - 'MarkedForDeletion' : [ 0x30, ['unsigned char']], -} ], - '_KTIMER2_COLLECTION' : [ 0x18, { - 'Tree' : [ 0x0, ['_RTL_RB_TREE']], - 'NextDueTime' : [ 0x10, ['unsigned long long']], -} ], - '_MIPFNBLINK' : [ 0x8, { - 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], - 'NodeBlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 56, native_type='unsigned long long')]], - 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 60, native_type='unsigned long long')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 62, native_type='unsigned long long')]], - 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], - 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], - 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], - 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], - 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], - 'EntireField' : [ 0x0, ['unsigned long long']], - 'Lock' : [ 0x0, ['long long']], - 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], - 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], - 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], -} ], - '_VF_TRACKER_STAMP' : [ 0x10, { - 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], -} ], - '_VI_TRACK_IRQL' : [ 0x38, { - 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'OldIrql' : [ 0x8, ['unsigned char']], - 'NewIrql' : [ 0x9, ['unsigned char']], - 'Processor' : [ 0xa, ['unsigned short']], - 'TickCount' : [ 0xc, ['unsigned long']], - 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], -} ], - '_MMCLONE_HEADER' : [ 0x18, { - 'NumberOfPtes' : [ 0x0, ['unsigned long long']], - 'NumberOfProcessReferences' : [ 0x8, ['unsigned long long']], - 'ClonePtes' : [ 0x10, ['pointer64', ['_MMCLONE_BLOCK']]], -} ], - '_SESSION_LOWBOX_MAP' : [ 0x40, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'SessionId' : [ 0x10, ['unsigned long']], - 'LowboxMap' : [ 0x18, ['_SEP_LOWBOX_NUMBER_MAPPING']], -} ], - '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { - 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], -} ], - '_PEB_LDR_DATA' : [ 0x58, { - 'Length' : [ 0x0, ['unsigned long']], - 'Initialized' : [ 0x4, ['unsigned char']], - 'SsHandle' : [ 0x8, ['pointer64', ['void']]], - 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], - 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], - 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], - 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], - 'ShutdownInProgress' : [ 0x48, ['unsigned char']], - 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], -} ], - '_PNP_DEVICE_EVENT_ENTRY' : [ 0xb8, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Argument' : [ 0x10, ['unsigned long']], - 'ArgumentStatus' : [ 0x14, ['long']], - 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], - 'Callback' : [ 0x20, ['pointer64', ['void']]], - 'Context' : [ 0x28, ['pointer64', ['void']]], - 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], - 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], - 'RefCount' : [ 0x40, ['unsigned long']], - 'Lock' : [ 0x44, ['unsigned long']], - 'Cancel' : [ 0x48, ['unsigned char']], - 'Parent' : [ 0x50, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], - 'ActivityId' : [ 0x58, ['_GUID']], - 'Data' : [ 0x68, ['_PLUGPLAY_EVENT_BLOCK']], -} ], - '_HEAP_STOP_ON_TAG' : [ 0x4, { - 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], - 'TagIndex' : [ 0x0, ['unsigned short']], - 'HeapIndex' : [ 0x2, ['unsigned short']], -} ], - '_PS_WAKE_INFORMATION' : [ 0x38, { - 'NotificationChannel' : [ 0x0, ['unsigned long long']], - 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], - 'NoWakeCounter' : [ 0x30, ['unsigned long long']], -} ], - '_RH_OP_CONTEXT' : [ 0x48, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'OplockRequestIrp' : [ 0x10, ['pointer64', ['_IRP']]], - 'OplockRequestFileObject' : [ 0x18, ['pointer64', ['_FILE_OBJECT']]], - 'OplockRequestProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], - 'OplockOwnerThread' : [ 0x28, ['pointer64', ['_ETHREAD']]], - 'Flags' : [ 0x30, ['unsigned long']], - 'AtomicLinks' : [ 0x38, ['_LIST_ENTRY']], -} ], - '_DBGKD_GET_CONTEXT' : [ 0x4, { - 'Unused' : [ 0x0, ['unsigned long']], -} ], - '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { - 'Flags' : [ 0x0, ['unsigned long']], - 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], -} ], - '_KWAIT_CHAIN' : [ 0x8, { - 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], -} ], - '_ISRDPCSTATS' : [ 0x40, { - 'IsrTime' : [ 0x0, ['unsigned long long']], - 'IsrTimeStart' : [ 0x8, ['unsigned long long']], - 'IsrCount' : [ 0x10, ['unsigned long long']], - 'DpcTime' : [ 0x18, ['unsigned long long']], - 'DpcTimeStart' : [ 0x20, ['unsigned long long']], - 'DpcCount' : [ 0x28, ['unsigned long long']], - 'IsrActive' : [ 0x30, ['unsigned char']], - 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], -} ], - '_RTL_BITMAP_EX' : [ 0x10, { - 'SizeOfBitMap' : [ 0x0, ['unsigned long long']], - 'Buffer' : [ 0x8, ['pointer64', ['unsigned long long']]], -} ], - '_MI_PARTITION_PAGE_LISTS' : [ 0xd40, { - 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer64', ['_MMPFNLIST']]]], - 'FreePageSlist' : [ 0x10, ['array', 2, ['pointer64', ['_SLIST_HEADER']]]], - 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], - 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], - 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], - 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], - 'ModifiedPageListNoReservation' : [ 0x240, ['_MMPFNLIST']], - 'ModifiedPageListByReservation' : [ 0x280, ['array', 16, ['_MMPFNLIST']]], - 'MappedPageListHead' : [ 0x500, ['array', 16, ['_MMPFNLIST']]], - 'BadPageListHead' : [ 0x780, ['_MMPFNLIST']], - 'EnclavePageListHead' : [ 0x7c0, ['_MMPFNLIST']], - 'PageLocationList' : [ 0x7e8, ['array', 8, ['pointer64', ['_MMPFNLIST']]]], - 'StandbyRepurposedByPriority' : [ 0x828, ['array', 8, ['unsigned long']]], - 'MappedPageListHeadEvent' : [ 0x848, ['array', 16, ['_KEVENT']]], - 'DecayClusterTimerHeads' : [ 0x9c8, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], - 'DecayHand' : [ 0x9e8, ['unsigned long']], - 'LastDecayHandUpdateTime' : [ 0x9f0, ['unsigned long long']], - 'LastChanceLdwContext' : [ 0x9f8, ['_MI_LDW_WORK_CONTEXT']], - 'AvailableEventsLock' : [ 0xa40, ['unsigned long long']], - 'AvailablePageWaitStates' : [ 0xa48, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], - 'LowMemoryThreshold' : [ 0xaa8, ['unsigned long long']], - 'HighMemoryThreshold' : [ 0xab0, ['unsigned long long']], - 'TransitionPrivatePages' : [ 0xac0, ['unsigned long long']], - 'StandbyListDiscard' : [ 0xac8, ['unsigned long']], - 'FreeListDiscard' : [ 0xacc, ['unsigned char']], - 'RebuildLargePagesInitialized' : [ 0xacd, ['unsigned char']], - 'RebuildLargePagesItem' : [ 0xad0, ['_MI_REBUILD_LARGE_PAGES']], - 'AddMemoryNotifyList' : [ 0xcf8, ['_LIST_ENTRY']], - 'MirrorListLocks' : [ 0xd08, ['pointer64', ['void']]], -} ], - '_XSTATE_CONFIGURATION' : [ 0x330, { - 'EnabledFeatures' : [ 0x0, ['unsigned long long']], - 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], - 'Size' : [ 0x10, ['unsigned long']], - 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], - 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], - 'AlignedFeatures' : [ 0x220, ['unsigned long long']], - 'AllFeatureSize' : [ 0x228, ['unsigned long']], - 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], -} ], - '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { - 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], - 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], - 'ConvKey' : [ 0x10, ['unsigned long']], - 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], - 'KeyHive' : [ 0x20, ['pointer64', ['_HHIVE']]], - 'KeyCell' : [ 0x28, ['unsigned long']], - 'KcbPushlock' : [ 0x30, ['_EX_PUSH_LOCK']], - 'Owner' : [ 0x38, ['pointer64', ['_KTHREAD']]], - 'SharedCount' : [ 0x38, ['long']], - 'SlotHint' : [ 0x40, ['unsigned long']], - 'ParentKcb' : [ 0x48, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'NameBlock' : [ 0x50, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], - 'CachedSecurity' : [ 0x58, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], - 'ValueCache' : [ 0x60, ['_CACHED_CHILD_LIST']], - 'IndexHint' : [ 0x70, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], - 'HashKey' : [ 0x70, ['unsigned long']], - 'SubKeyCount' : [ 0x70, ['unsigned long']], - 'KeyBodyListHead' : [ 0x78, ['_LIST_ENTRY']], - 'FreeListEntry' : [ 0x78, ['_LIST_ENTRY']], - 'KeyBodyArray' : [ 0x88, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], - 'KcbLastWriteTime' : [ 0xa8, ['_LARGE_INTEGER']], - 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], - 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], - 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], - 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], - 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], - 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], - 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], - 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], - 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], - 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], - 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], - 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], - 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], - 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], - 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], - 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], - 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], -} ], - '_KLOCK_ENTRY' : [ 0x60, { - 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'EntryFlags' : [ 0x18, ['unsigned long']], - 'EntryOffset' : [ 0x18, ['unsigned char']], - 'ThreadLocalFlags' : [ 0x19, ['unsigned char']], - 'WaitingBit' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'Spare0' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], - 'AcquiredByte' : [ 0x1a, ['unsigned char']], - 'AcquiredBit' : [ 0x1a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'CrossThreadFlags' : [ 0x1b, ['unsigned char']], - 'HeadNodeBit' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IoPriorityBit' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Spare1' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'StaticState' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], - 'AllFlags' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], - 'SpareFlags' : [ 0x1c, ['unsigned long']], - 'LockState' : [ 0x20, ['_KLOCK_ENTRY_LOCK_STATE']], - 'LockUnsafe' : [ 0x20, ['pointer64', ['void']]], - 'CrossThreadReleasableAndBusyByte' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x21, ['array', 6, ['unsigned char']]], - 'InTreeByte' : [ 0x27, ['unsigned char']], - 'SessionState' : [ 0x28, ['pointer64', ['void']]], - 'SessionId' : [ 0x28, ['unsigned long']], - 'SessionPad' : [ 0x2c, ['unsigned long']], - 'OwnerTree' : [ 0x30, ['_RTL_RB_TREE']], - 'WaiterTree' : [ 0x40, ['_RTL_RB_TREE']], - 'CpuPriorityKey' : [ 0x30, ['unsigned char']], - 'EntryLock' : [ 0x50, ['unsigned long long']], - 'AllBoosts' : [ 0x58, ['unsigned short']], - 'IoBoost' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'CpuBoostsBitmap' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], - 'IoNormalPriorityWaiterCount' : [ 0x5a, ['unsigned short']], - 'SparePad' : [ 0x5c, ['unsigned short']], -} ], - '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { - 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], - 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], -} ], - '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], - 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 24, native_type='unsigned long long')]], - 'LocalPartition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], -} ], - '__unnamed_2080' : [ 0x10, { - 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], -} ], - '_MMMOD_WRITER_MDL_ENTRY' : [ 0x108, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'u' : [ 0x10, ['__unnamed_2080']], - 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], - 'u1' : [ 0x28, ['_MODWRITER_FLAGS']], - 'StoreWriteRefCount' : [ 0x2c, ['unsigned long']], - 'StoreWriteCompletionApc' : [ 0x30, ['_KAPC']], - 'ByteCount' : [ 0x88, ['unsigned long']], - 'ChargedPages' : [ 0x8c, ['unsigned long']], - 'PagingFile' : [ 0x90, ['pointer64', ['_MMPAGING_FILE']]], - 'File' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], - 'ControlArea' : [ 0xa0, ['pointer64', ['_CONTROL_AREA']]], - 'FileResource' : [ 0xa8, ['pointer64', ['_ERESOURCE']]], - 'WriteOffset' : [ 0xb0, ['_LARGE_INTEGER']], - 'IssueTime' : [ 0xb8, ['_LARGE_INTEGER']], - 'Partition' : [ 0xc0, ['pointer64', ['_MI_PARTITION']]], - 'PointerMdl' : [ 0xc8, ['pointer64', ['_MDL']]], - 'Mdl' : [ 0xd0, ['_MDL']], - 'Page' : [ 0x100, ['array', 1, ['unsigned long long']]], -} ], - '_MI_PARTITION_COMMIT' : [ 0x80, { - 'PeakCommitment' : [ 0x0, ['unsigned long long']], - 'TotalCommitLimitMaximum' : [ 0x8, ['unsigned long long']], - 'Popups' : [ 0x10, ['array', 2, ['long']]], - 'LowCommitThreshold' : [ 0x18, ['unsigned long long']], - 'HighCommitThreshold' : [ 0x20, ['unsigned long long']], - 'EventLock' : [ 0x28, ['unsigned long long']], - 'SystemCommitReserve' : [ 0x30, ['unsigned long long']], - 'OverCommit' : [ 0x40, ['unsigned long long']], -} ], - '_NT_TIB32' : [ 0x1c, { - 'ExceptionList' : [ 0x0, ['unsigned long']], - 'StackBase' : [ 0x4, ['unsigned long']], - 'StackLimit' : [ 0x8, ['unsigned long']], - 'SubSystemTib' : [ 0xc, ['unsigned long']], - 'FiberData' : [ 0x10, ['unsigned long']], - 'Version' : [ 0x10, ['unsigned long']], - 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], - 'Self' : [ 0x18, ['unsigned long']], -} ], - '_CM_RESOURCE_LIST' : [ 0x28, { - 'Count' : [ 0x0, ['unsigned long']], - 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], -} ], - '_TOKEN_PRIVILEGES' : [ 0x10, { - 'PrivilegeCount' : [ 0x0, ['unsigned long']], - 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], -} ], - '_POOL_TRACKER_TABLE' : [ 0x28, { - 'Key' : [ 0x0, ['long']], - 'NonPagedAllocs' : [ 0x4, ['unsigned long']], - 'NonPagedFrees' : [ 0x8, ['unsigned long']], - 'NonPagedBytes' : [ 0x10, ['unsigned long long']], - 'PagedAllocs' : [ 0x18, ['unsigned long']], - 'PagedFrees' : [ 0x1c, ['unsigned long']], - 'PagedBytes' : [ 0x20, ['unsigned long long']], -} ], - '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { - 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'BusNumber' : [ 0x4, ['unsigned long']], - 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], -} ], - '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_WMI_BUFFER_HEADER' : [ 0x48, { - 'BufferSize' : [ 0x0, ['unsigned long']], - 'SavedOffset' : [ 0x4, ['unsigned long']], - 'CurrentOffset' : [ 0x8, ['unsigned long']], - 'ReferenceCount' : [ 0xc, ['long']], - 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], - 'SequenceNumber' : [ 0x18, ['long long']], - 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], - 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], - 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], - 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], - 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], - 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], - 'Offset' : [ 0x30, ['unsigned long']], - 'BufferFlag' : [ 0x34, ['unsigned short']], - 'BufferType' : [ 0x36, ['unsigned short']], - 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], - 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], - 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], - 'Pointer0' : [ 0x38, ['pointer64', ['void']]], - 'Pointer1' : [ 0x40, ['pointer64', ['void']]], -} ], - '_NT_TIB64' : [ 0x38, { - 'ExceptionList' : [ 0x0, ['unsigned long long']], - 'StackBase' : [ 0x8, ['unsigned long long']], - 'StackLimit' : [ 0x10, ['unsigned long long']], - 'SubSystemTib' : [ 0x18, ['unsigned long long']], - 'FiberData' : [ 0x20, ['unsigned long long']], - 'Version' : [ 0x20, ['unsigned long']], - 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], - 'Self' : [ 0x30, ['unsigned long long']], -} ], - '_POWER_SEQUENCE' : [ 0xc, { - 'SequenceD1' : [ 0x0, ['unsigned long']], - 'SequenceD2' : [ 0x4, ['unsigned long']], - 'SequenceD3' : [ 0x8, ['unsigned long']], -} ], - '_EPROCESS_VALUES' : [ 0x50, { - 'KernelTime' : [ 0x0, ['unsigned long long']], - 'UserTime' : [ 0x8, ['unsigned long long']], - 'CycleTime' : [ 0x10, ['unsigned long long']], - 'ContextSwitches' : [ 0x18, ['unsigned long long']], - 'ReadOperationCount' : [ 0x20, ['long long']], - 'WriteOperationCount' : [ 0x28, ['long long']], - 'OtherOperationCount' : [ 0x30, ['long long']], - 'ReadTransferCount' : [ 0x38, ['long long']], - 'WriteTransferCount' : [ 0x40, ['long long']], - 'OtherTransferCount' : [ 0x48, ['long long']], -} ], - '_PROCESSOR_POWER_STATE' : [ 0x1d0, { - 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], - 'IdleAccounting' : [ 0x8, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], - 'IdleTimeLast' : [ 0x10, ['unsigned long long']], - 'IdleTimeTotal' : [ 0x18, ['unsigned long long']], - 'IdleTimeEntry' : [ 0x20, ['unsigned long long']], - 'IdleTimeExpiration' : [ 0x28, ['unsigned long long']], - 'NonInterruptibleTransition' : [ 0x30, ['unsigned char']], - 'PepWokenTransition' : [ 0x31, ['unsigned char']], - 'Class' : [ 0x32, ['unsigned char']], - 'TargetIdleState' : [ 0x34, ['unsigned long']], - 'IdlePolicy' : [ 0x38, ['_PROC_IDLE_POLICY']], - 'Synchronization' : [ 0x40, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], - 'PerfFeedback' : [ 0x48, ['_PROC_FEEDBACK']], - 'Hypervisor' : [ 0xd8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], - 'LastSysTime' : [ 0xdc, ['unsigned long']], - 'WmiDispatchPtr' : [ 0xe0, ['unsigned long long']], - 'WmiInterfaceEnabled' : [ 0xe8, ['long']], - 'FFHThrottleStateInfo' : [ 0xf0, ['_PPM_FFH_THROTTLE_STATE_INFO']], - 'PerfActionDpc' : [ 0x110, ['_KDPC']], - 'PerfActionMask' : [ 0x150, ['long']], - 'HvIdleCheck' : [ 0x158, ['_PROC_IDLE_SNAP']], - 'PerfCheck' : [ 0x168, ['pointer64', ['_PROC_PERF_CHECK']]], - 'Domain' : [ 0x170, ['pointer64', ['_PROC_PERF_DOMAIN']]], - 'PerfConstraint' : [ 0x178, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], - 'Concurrency' : [ 0x180, ['pointer64', ['_PPM_CONCURRENCY_ACCOUNTING']]], - 'Load' : [ 0x188, ['pointer64', ['_PROC_PERF_LOAD']]], - 'PerfHistory' : [ 0x190, ['pointer64', ['_PROC_PERF_HISTORY']]], - 'GuaranteedPerformancePercent' : [ 0x198, ['unsigned char']], - 'HvTargetState' : [ 0x199, ['unsigned char']], - 'Parked' : [ 0x19a, ['unsigned char']], - 'LatestPerformancePercent' : [ 0x19c, ['unsigned long']], - 'AveragePerformancePercent' : [ 0x1a0, ['unsigned long']], - 'LatestAffinitizedPercent' : [ 0x1a4, ['unsigned long']], - 'RelativePerformance' : [ 0x1a8, ['unsigned long']], - 'Utility' : [ 0x1ac, ['unsigned long']], - 'AffinitizedUtility' : [ 0x1b0, ['unsigned long']], - 'SnapTimeLast' : [ 0x1b8, ['unsigned long long']], - 'EnergyConsumed' : [ 0x1b8, ['unsigned long long']], - 'ActiveTime' : [ 0x1c0, ['unsigned long long']], - 'TotalTime' : [ 0x1c8, ['unsigned long long']], -} ], - '_OBJECT_REF_STACK_INFO' : [ 0xc, { - 'Sequence' : [ 0x0, ['unsigned long']], - 'Index' : [ 0x4, ['unsigned short']], - 'NumTraces' : [ 0x6, ['unsigned short']], - 'Tag' : [ 0x8, ['unsigned long']], -} ], - '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { - 'Continue' : [ 0x0, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], - 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], -} ], - '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'OnProtectedStandby' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'SystemChargedPage' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], -} ], - '_THREAD_ENERGY_VALUES' : [ 0x40, { - 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], -} ], - '_PCW_CALLBACK_INFORMATION' : [ 0x28, { - 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], - 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], - 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], - 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], -} ], - '_CC_ASYNC_READ_CONTEXT' : [ 0x20, { - 'CompletionRoutine' : [ 0x0, ['pointer64', ['void']]], - 'Context' : [ 0x8, ['pointer64', ['void']]], - 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], - 'RequestorMode' : [ 0x18, ['unsigned char']], - 'NestingLevel' : [ 0x1c, ['unsigned long']], -} ], - '_TOKEN_SOURCE' : [ 0x10, { - 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], - 'SourceIdentifier' : [ 0x8, ['_LUID']], -} ], - '_CMHIVE' : [ 0x17a8, { - 'Hive' : [ 0x0, ['_HHIVE']], - 'FileHandles' : [ 0xa68, ['array', 6, ['pointer64', ['void']]]], - 'NotifyList' : [ 0xa98, ['_LIST_ENTRY']], - 'HiveList' : [ 0xaa8, ['_LIST_ENTRY']], - 'PreloadedHiveList' : [ 0xab8, ['_LIST_ENTRY']], - 'FailedUnloadList' : [ 0xac8, ['_LIST_ENTRY']], - 'HiveRundown' : [ 0xad8, ['_EX_RUNDOWN_REF']], - 'ParseCacheEntries' : [ 0xae0, ['_LIST_ENTRY']], - 'KcbCacheTable' : [ 0xaf0, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], - 'KcbCacheTableSize' : [ 0xaf8, ['unsigned long']], - 'DeletedKcbTable' : [ 0xb00, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], - 'DeletedKcbTableSize' : [ 0xb08, ['unsigned long']], - 'Identity' : [ 0xb0c, ['unsigned long']], - 'HiveLock' : [ 0xb10, ['pointer64', ['_FAST_MUTEX']]], - 'WriterLock' : [ 0xb18, ['pointer64', ['_FAST_MUTEX']]], - 'FlusherLock' : [ 0xb20, ['pointer64', ['_ERESOURCE']]], - 'FlushDirtyVector' : [ 0xb28, ['_RTL_BITMAP']], - 'FlushDirtyVectorSize' : [ 0xb38, ['unsigned long']], - 'FlushLogEntry' : [ 0xb40, ['pointer64', ['unsigned char']]], - 'FlushLogEntrySize' : [ 0xb48, ['unsigned long']], - 'FlushHiveTruncated' : [ 0xb4c, ['unsigned long']], - 'FlushBaseBlockDirty' : [ 0xb50, ['unsigned char']], - 'CapturedUnreconciledVector' : [ 0xb58, ['_RTL_BITMAP']], - 'CapturedUnreconciledVectorSize' : [ 0xb68, ['unsigned long']], - 'UnreconciledOffsetArray' : [ 0xb70, ['pointer64', ['CMP_OFFSET_ARRAY']]], - 'UnreconciledOffsetArrayCount' : [ 0xb78, ['unsigned long']], - 'UnreconciledBaseBlock' : [ 0xb80, ['pointer64', ['_HBASE_BLOCK']]], - 'SecurityLock' : [ 0xb88, ['_EX_PUSH_LOCK']], - 'UseCount' : [ 0xb90, ['unsigned long']], - 'LastShrinkHiveSize' : [ 0xb94, ['unsigned long']], - 'ActualFileSize' : [ 0xb98, ['_LARGE_INTEGER']], - 'LogFileSizes' : [ 0xba0, ['array', 2, ['_LARGE_INTEGER']]], - 'FileFullPath' : [ 0xbb0, ['_UNICODE_STRING']], - 'FileUserName' : [ 0xbc0, ['_UNICODE_STRING']], - 'HiveRootPath' : [ 0xbd0, ['_UNICODE_STRING']], - 'SecurityCount' : [ 0xbe0, ['unsigned long']], - 'SecurityCacheSize' : [ 0xbe4, ['unsigned long']], - 'SecurityHitHint' : [ 0xbe8, ['long']], - 'SecurityCache' : [ 0xbf0, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], - 'SecurityHash' : [ 0xbf8, ['array', 64, ['_LIST_ENTRY']]], - 'UnloadEventCount' : [ 0xff8, ['unsigned long']], - 'UnloadEventArray' : [ 0x1000, ['pointer64', ['pointer64', ['_KEVENT']]]], - 'RootKcb' : [ 0x1008, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'Frozen' : [ 0x1010, ['unsigned char']], - 'UnloadWorkItem' : [ 0x1018, ['pointer64', ['_CM_WORKITEM']]], - 'UnloadWorkItemHolder' : [ 0x1020, ['_CM_WORKITEM']], - 'GrowOnlyMode' : [ 0x1048, ['unsigned char']], - 'GrowOffset' : [ 0x104c, ['unsigned long']], - 'KcbConvertListHead' : [ 0x1050, ['_LIST_ENTRY']], - 'CellRemapArray' : [ 0x1060, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], - 'DirtyVectorLog' : [ 0x1068, ['_CM_DIRTY_VECTOR_LOG']], - 'Flags' : [ 0x14f0, ['unsigned long']], - 'TrustClassEntry' : [ 0x14f8, ['_LIST_ENTRY']], - 'DirtyTime' : [ 0x1508, ['unsigned long long']], - 'UnreconciledTime' : [ 0x1510, ['unsigned long long']], - 'CmRm' : [ 0x1518, ['pointer64', ['_CM_RM']]], - 'CmRmInitFailPoint' : [ 0x1520, ['unsigned long']], - 'CmRmInitFailStatus' : [ 0x1524, ['long']], - 'CreatorOwner' : [ 0x1528, ['pointer64', ['_KTHREAD']]], - 'RundownThread' : [ 0x1530, ['pointer64', ['_KTHREAD']]], - 'LastWriteTime' : [ 0x1538, ['_LARGE_INTEGER']], - 'FlushQueue' : [ 0x1540, ['_HIVE_WRITE_WAIT_QUEUE']], - 'ReconcileQueue' : [ 0x1558, ['_HIVE_WRITE_WAIT_QUEUE']], - 'FlushFlags' : [ 0x1570, ['unsigned long']], - 'FlushActive' : [ 0x1570, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ReconcileActive' : [ 0x1570, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PrimaryFilePurged' : [ 0x1570, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'DiskFileBad' : [ 0x1570, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'PrimaryFileSizeBeforeLastFlush' : [ 0x1574, ['unsigned long']], - 'ReferenceCount' : [ 0x1578, ['long']], - 'UnloadHistoryIndex' : [ 0x157c, ['long']], - 'UnloadHistory' : [ 0x1580, ['array', 128, ['unsigned long']]], - 'BootStart' : [ 0x1780, ['unsigned long']], - 'UnaccessedStart' : [ 0x1784, ['unsigned long']], - 'UnaccessedEnd' : [ 0x1788, ['unsigned long']], - 'LoadedKeyCount' : [ 0x178c, ['unsigned long']], - 'HandleClosePending' : [ 0x1790, ['unsigned long']], - 'HandleClosePendingEvent' : [ 0x1798, ['_EX_PUSH_LOCK']], - 'FinalFlushSucceeded' : [ 0x17a0, ['unsigned char']], - 'FailedUnload' : [ 0x17a1, ['unsigned char']], -} ], - '_DBGKD_QUERY_MEMORY' : [ 0x18, { - 'Address' : [ 0x0, ['unsigned long long']], - 'Reserved' : [ 0x8, ['unsigned long long']], - 'AddressSpace' : [ 0x10, ['unsigned long']], - 'Flags' : [ 0x14, ['unsigned long']], -} ], - '_DIRTY_PAGE_THRESHOLDS' : [ 0x38, { - 'DirtyPageThreshold' : [ 0x0, ['unsigned long long']], - 'DirtyPageThresholdTop' : [ 0x8, ['unsigned long long']], - 'DirtyPageThresholdBottom' : [ 0x10, ['unsigned long long']], - 'DirtyPageTarget' : [ 0x18, ['unsigned long']], - 'AggregateAvailablePages' : [ 0x20, ['unsigned long long']], - 'AggregateDirtyPages' : [ 0x28, ['unsigned long long']], - 'AvailableHistory' : [ 0x30, ['unsigned long']], -} ], - 'DOCK_INTERFACE' : [ 0x30, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x8, ['pointer64', ['void']]], - 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], - 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], - 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], - 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], -} ], - 'CMP_OFFSET_ARRAY' : [ 0x18, { - 'FileOffset' : [ 0x0, ['unsigned long']], - 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], - 'DataLength' : [ 0x10, ['unsigned long']], -} ], - '_MMSUPPORT_FLAGS' : [ 0x4, { - 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], - 'MemoryPriority' : [ 0x2, ['unsigned char']], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], -} ], - '_PPM_VETO_ENTRY' : [ 0x40, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'VetoReason' : [ 0x10, ['unsigned long']], - 'ReferenceCount' : [ 0x14, ['unsigned long']], - 'HitCount' : [ 0x18, ['unsigned long long']], - 'LastActivationTime' : [ 0x20, ['unsigned long long']], - 'TotalActiveTime' : [ 0x28, ['unsigned long long']], - 'CsActivationTime' : [ 0x30, ['unsigned long long']], - 'CsActiveTime' : [ 0x38, ['unsigned long long']], -} ], - '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { - 'Magic' : [ 0x0, ['unsigned short']], - 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], - 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], - 'SizeOfCode' : [ 0x4, ['unsigned long']], - 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], - 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], - 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], - 'BaseOfCode' : [ 0x14, ['unsigned long']], - 'ImageBase' : [ 0x18, ['unsigned long long']], - 'SectionAlignment' : [ 0x20, ['unsigned long']], - 'FileAlignment' : [ 0x24, ['unsigned long']], - 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], - 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], - 'MajorImageVersion' : [ 0x2c, ['unsigned short']], - 'MinorImageVersion' : [ 0x2e, ['unsigned short']], - 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], - 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], - 'Win32VersionValue' : [ 0x34, ['unsigned long']], - 'SizeOfImage' : [ 0x38, ['unsigned long']], - 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], - 'CheckSum' : [ 0x40, ['unsigned long']], - 'Subsystem' : [ 0x44, ['unsigned short']], - 'DllCharacteristics' : [ 0x46, ['unsigned short']], - 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], - 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], - 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], - 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], - 'LoaderFlags' : [ 0x68, ['unsigned long']], - 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], - 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], -} ], - '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'Size' : [ 0x8, ['unsigned long']], - 'ActiveCount' : [ 0xc, ['unsigned long']], - 'PendingNullCount' : [ 0x10, ['unsigned long']], - 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], - 'PendingDelete' : [ 0x18, ['unsigned long']], - 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], - 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], - 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], - 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], -} ], - '_TERMINATION_PORT' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], - 'Port' : [ 0x8, ['pointer64', ['void']]], -} ], - '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderMaximum'})]], - 'BasePage' : [ 0x18, ['unsigned long long']], - 'PageCount' : [ 0x20, ['unsigned long long']], -} ], - '_CM_INTENT_LOCK' : [ 0x10, { - 'OwnerCount' : [ 0x0, ['unsigned long']], - 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], -} ], - '_PROC_IDLE_ACCOUNTING' : [ 0x408, { - 'StateCount' : [ 0x0, ['unsigned long']], - 'TotalTransitions' : [ 0x4, ['unsigned long']], - 'ResetCount' : [ 0x8, ['unsigned long']], - 'AbortCount' : [ 0xc, ['unsigned long']], - 'StartTime' : [ 0x10, ['unsigned long long']], - 'PriorIdleTime' : [ 0x18, ['unsigned long long']], - 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], - 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], -} ], - '_THERMAL_INFORMATION' : [ 0x58, { - 'ThermalStamp' : [ 0x0, ['unsigned long']], - 'ThermalConstant1' : [ 0x4, ['unsigned long']], - 'ThermalConstant2' : [ 0x8, ['unsigned long']], - 'Processors' : [ 0x10, ['unsigned long long']], - 'SamplingPeriod' : [ 0x18, ['unsigned long']], - 'CurrentTemperature' : [ 0x1c, ['unsigned long']], - 'PassiveTripPoint' : [ 0x20, ['unsigned long']], - 'CriticalTripPoint' : [ 0x24, ['unsigned long']], - 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], - 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], -} ], - '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x28, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'Bitmap' : [ 0x8, ['_RTL_BITMAP']], - 'HashTable' : [ 0x18, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], - 'Active' : [ 0x20, ['unsigned char']], -} ], - '_MAPPED_FILE_SEGMENT' : [ 0x30, { - 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], - 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], - 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], - 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], - 'SizeOfSegment' : [ 0x18, ['unsigned long long']], - 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], - 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], - 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], -} ], - '_GDI_TEB_BATCH' : [ 0x4e8, { - 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'HDC' : [ 0x8, ['unsigned long long']], - 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], -} ], - '_MM_DRIVER_VERIFIER_DATA' : [ 0xa8, { - 'Level' : [ 0x0, ['unsigned long']], - 'RaiseIrqls' : [ 0x4, ['unsigned long']], - 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], - 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], - 'AllocationsAttempted' : [ 0x10, ['unsigned long']], - 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], - 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], - 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], - 'TrimRequests' : [ 0x20, ['unsigned long']], - 'Trims' : [ 0x24, ['unsigned long']], - 'AllocationsFailed' : [ 0x28, ['unsigned long']], - 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], - 'Loads' : [ 0x30, ['unsigned long']], - 'Unloads' : [ 0x34, ['unsigned long']], - 'UnTrackedPool' : [ 0x38, ['unsigned long']], - 'UserTrims' : [ 0x3c, ['unsigned long']], - 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], - 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], - 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], - 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], - 'PagedBytes' : [ 0x50, ['unsigned long long']], - 'NonPagedBytes' : [ 0x58, ['unsigned long long']], - 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], - 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], - 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], - 'SessionTrims' : [ 0x74, ['unsigned long']], - 'OptionChanges' : [ 0x78, ['unsigned long']], - 'VerifyMode' : [ 0x7c, ['unsigned long']], - 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], - 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], - 'ExecutePageProtections' : [ 0x94, ['unsigned long']], - 'ExecutePageMappings' : [ 0x98, ['unsigned long']], - 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], - 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], -} ], - '_INVERTED_FUNCTION_TABLE' : [ 0x1810, { - 'CurrentSize' : [ 0x0, ['unsigned long']], - 'MaximumSize' : [ 0x4, ['unsigned long']], - 'Epoch' : [ 0x8, ['unsigned long']], - 'Overflow' : [ 0xc, ['unsigned char']], - 'TableEntry' : [ 0x10, ['array', 256, ['_INVERTED_FUNCTION_TABLE_ENTRY']]], -} ], - '_VF_DRIVER_IO_CALLBACKS' : [ 0x100, { - 'DriverInit' : [ 0x0, ['pointer64', ['void']]], - 'DriverStartIo' : [ 0x8, ['pointer64', ['void']]], - 'DriverUnload' : [ 0x10, ['pointer64', ['void']]], - 'AddDevice' : [ 0x18, ['pointer64', ['void']]], - 'MajorFunction' : [ 0x20, ['array', 28, ['pointer64', ['void']]]], -} ], - '_HIVE_WRITE_WAIT_QUEUE' : [ 0x18, { - 'ActiveThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], - 'WaitList' : [ 0x8, ['pointer64', ['_HIVE_WAIT_PACKET']]], - 'OwnerBoosted' : [ 0x10, ['unsigned long']], -} ], - '_VI_FAULT_TRACE' : [ 0x48, { - 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], - 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], -} ], - '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x10, { - 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], -} ], - '_GENERIC_MAPPING' : [ 0x10, { - 'GenericRead' : [ 0x0, ['unsigned long']], - 'GenericWrite' : [ 0x4, ['unsigned long']], - 'GenericExecute' : [ 0x8, ['unsigned long']], - 'GenericAll' : [ 0xc, ['unsigned long']], -} ], - '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { - 'CountEntries' : [ 0x0, ['unsigned long']], - 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], -} ], - '_UMS_CONTROL_BLOCK' : [ 0x90, { - 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], - 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], - 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], - 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], - 'UmsQueue' : [ 0x20, ['_KQUEUE']], - 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], - 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], - 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], - 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], - 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], - 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], - 'UmsWaitEvent' : [ 0x30, ['_KEVENT']], - 'StagingArea' : [ 0x48, ['pointer64', ['void']]], - 'UmsPrimaryDeliveredContext' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'UmsAssociatedQueueUsed' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'UmsThreadParked' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'UmsFlags' : [ 0x50, ['unsigned long']], - 'TebSelector' : [ 0x88, ['unsigned short']], -} ], - '_OWNER_ENTRY' : [ 0x10, { - 'OwnerThread' : [ 0x0, ['unsigned long long']], - 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], - 'TableSize' : [ 0x8, ['unsigned long']], -} ], - '_KSYSTEM_TIME' : [ 0xc, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'High1Time' : [ 0x4, ['long']], - 'High2Time' : [ 0x8, ['long']], -} ], - '_ETIMER' : [ 0x138, { - 'KeTimer' : [ 0x0, ['_KTIMER']], - 'Lock' : [ 0x40, ['unsigned long long']], - 'TimerApc' : [ 0x48, ['_KAPC']], - 'TimerDpc' : [ 0xa0, ['_KDPC']], - 'ActiveTimerListEntry' : [ 0xe0, ['_LIST_ENTRY']], - 'Period' : [ 0xf0, ['unsigned long']], - 'TimerFlags' : [ 0xf4, ['unsigned char']], - 'ApcAssociated' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'FlushDpcs' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Paused' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Spare1' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], - 'DueTimeType' : [ 0xf5, ['unsigned char']], - 'Spare2' : [ 0xf6, ['unsigned short']], - 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], - 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], - 'VirtualizedTimerCookie' : [ 0x110, ['pointer64', ['void']]], - 'VirtualizedTimerLinks' : [ 0x118, ['_LIST_ENTRY']], - 'DueTime' : [ 0x128, ['unsigned long long']], - 'CoalescingWindow' : [ 0x130, ['unsigned long']], -} ], - '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { - 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], - 'Object' : [ 0x8, ['pointer64', ['void']]], - 'HashValue' : [ 0x10, ['unsigned long']], -} ], - '_LOCK_TRACKER' : [ 0x90, { - 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], - 'StartVa' : [ 0x20, ['pointer64', ['void']]], - 'Count' : [ 0x28, ['unsigned long long']], - 'Offset' : [ 0x30, ['unsigned long']], - 'Length' : [ 0x34, ['unsigned long']], - 'Page' : [ 0x38, ['unsigned long long']], - 'StackTrace' : [ 0x40, ['array', 8, ['pointer64', ['void']]]], - 'Who' : [ 0x80, ['unsigned long']], - 'Process' : [ 0x88, ['pointer64', ['_EPROCESS']]], -} ], - '_MI_CACHED_PTES' : [ 0x48, { - 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], - 'CachedPteCount' : [ 0x40, ['long']], -} ], - '_EXHANDLE' : [ 0x8, { - 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], - 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], - 'GenericHandleOverlay' : [ 0x0, ['pointer64', ['void']]], - 'Value' : [ 0x0, ['unsigned long long']], -} ], - '__unnamed_2155' : [ 0x8, { - 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], - 'FlagsLong' : [ 0x0, ['unsigned long']], - 'StartVa' : [ 0x0, ['pointer64', ['void']]], -} ], - '_MMADDRESS_LIST' : [ 0x10, { - 'u1' : [ 0x0, ['__unnamed_2155']], - 'EndVa' : [ 0x8, ['pointer64', ['void']]], -} ], - '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { - 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'Value' : [ 0x0, ['unsigned long']], -} ], - '_XSTATE_FEATURE' : [ 0x8, { - 'Offset' : [ 0x0, ['unsigned long']], - 'Size' : [ 0x4, ['unsigned long']], -} ], - '_DBGKD_CONTEXT_EX' : [ 0xc, { - 'Offset' : [ 0x0, ['unsigned long']], - 'ByteCount' : [ 0x4, ['unsigned long']], - 'BytesCopied' : [ 0x8, ['unsigned long']], -} ], - '_CM_DIRTY_VECTOR_LOG' : [ 0x488, { - 'Next' : [ 0x0, ['unsigned long']], - 'Size' : [ 0x4, ['unsigned long']], - 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], -} ], - '_ARBITER_INSTANCE' : [ 0x150, { - 'Signature' : [ 0x0, ['unsigned long']], - 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], - 'Name' : [ 0x10, ['pointer64', ['unsigned short']]], - 'OrderingName' : [ 0x18, ['pointer64', ['unsigned short']]], - 'ResourceType' : [ 0x20, ['long']], - 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], - 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], - 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], - 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], - 'ReferenceCount' : [ 0x58, ['long']], - 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], - 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], - 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], - 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], - 'PackResource' : [ 0x80, ['pointer64', ['void']]], - 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], - 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], - 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], - 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], - 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], - 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], - 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], - 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], - 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], - 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], - 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], - 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], - 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], - 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], - 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], - 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], - 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], - 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], - 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], - 'TransactionInProgress' : [ 0x120, ['unsigned char']], - 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], - 'Extension' : [ 0x130, ['pointer64', ['void']]], - 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], - 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], - 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], -} ], - '_MMVAD_FLAGS1' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '_MI_SYSTEM_INFORMATION' : [ 0x1bc0, { - 'Pools' : [ 0x0, ['_MI_POOL_STATE']], - 'Sections' : [ 0x100, ['_MI_SECTION_STATE']], - 'SystemImages' : [ 0x380, ['_MI_SYSTEM_IMAGE_STATE']], - 'Sessions' : [ 0x440, ['_MI_SESSION_STATE']], - 'Processes' : [ 0x4d0, ['_MI_PROCESS_STATE']], - 'Hardware' : [ 0x530, ['_MI_HARDWARE_STATE']], - 'SystemVa' : [ 0x600, ['_MI_SYSTEM_VA_STATE']], - 'PageCombines' : [ 0x8c0, ['_MI_COMBINE_STATE']], - 'Partitions' : [ 0xa60, ['_MI_PARTITION_STATE']], - 'Shutdowns' : [ 0xac0, ['_MI_SHUTDOWN_STATE']], - 'Errors' : [ 0xb40, ['_MI_ERROR_STATE']], - 'AccessLog' : [ 0xc00, ['_MI_ACCESS_LOG_STATE']], - 'Debugger' : [ 0xc80, ['_MI_DEBUGGER_STATE']], - 'Standby' : [ 0xdc0, ['_MI_STANDBY_STATE']], - 'SystemPtes' : [ 0xe80, ['_MI_SYSTEM_PTE_STATE']], - 'IoPages' : [ 0x1000, ['_MI_IO_PAGE_STATE']], - 'PagingIo' : [ 0x1060, ['_MI_PAGING_IO_STATE']], - 'CommonPages' : [ 0x10b0, ['_MI_COMMON_PAGE_STATE']], - 'Trims' : [ 0x1180, ['_MI_SYSTEM_TRIM_STATE']], - 'ResTrack' : [ 0x11c0, ['_MI_RESAVAIL_TRACKER']], - 'Cookie' : [ 0x1540, ['unsigned long long']], - 'ZeroingDisabled' : [ 0x1548, ['long']], - 'BootRegistryRuns' : [ 0x1550, ['pointer64', ['pointer64', ['void']]]], - 'FullyInitialized' : [ 0x1558, ['unsigned char']], - 'SafeBooted' : [ 0x1559, ['unsigned char']], - 'LargePfnBitMap' : [ 0x1560, ['_RTL_BITMAP_EX']], - 'TraceLogging' : [ 0x1570, ['pointer64', ['_TlgProvider_t']]], - 'Vs' : [ 0x1580, ['_MI_VISIBLE_STATE']], -} ], - '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { - 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'SortKey' : [ 0x10, ['unsigned long']], - 'Inserted' : [ 0x14, ['unsigned char']], -} ], - '_PPM_SELECTION_DEPENDENCY' : [ 0x18, { - 'Processor' : [ 0x0, ['unsigned long']], - 'Menu' : [ 0x8, ['_PPM_SELECTION_MENU']], -} ], - '__unnamed_21cf' : [ 0x4, { - 'UserData' : [ 0x0, ['unsigned long']], - 'Next' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_21d1' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_21cf']], -} ], - '__unnamed_21d3' : [ 0x4, { - 'NewCell' : [ 0x0, ['__unnamed_21d1']], -} ], - '_HCELL' : [ 0x8, { - 'Size' : [ 0x0, ['long']], - 'u' : [ 0x4, ['__unnamed_21d3']], -} ], - '_MI_VISIBLE_STATE' : [ 0x640, { - 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], - 'SessionWsList' : [ 0x50, ['_LIST_ENTRY']], - 'SessionIdBitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], - 'PagedPoolInfo' : [ 0x68, ['_MM_PAGED_POOL_INFO']], - 'MaximumNonPagedPoolInPages' : [ 0xa0, ['unsigned long long']], - 'SizeOfPagedPoolInPages' : [ 0xa8, ['unsigned long long']], - 'SystemPteInfo' : [ 0xb0, ['_MI_SYSTEM_PTE_TYPE']], - 'NonPagedPoolCommit' : [ 0x110, ['unsigned long long']], - 'BootCommit' : [ 0x118, ['unsigned long long']], - 'MdlPagesAllocated' : [ 0x120, ['unsigned long long']], - 'SystemPageTableCommit' : [ 0x128, ['unsigned long long']], - 'SpecialPagesInUse' : [ 0x130, ['unsigned long long']], - 'WsOverheadPages' : [ 0x138, ['unsigned long long']], - 'VadBitmapPages' : [ 0x140, ['unsigned long long']], - 'ProcessCommit' : [ 0x148, ['unsigned long long']], - 'SharedCommit' : [ 0x150, ['unsigned long long']], - 'DriverCommit' : [ 0x158, ['long']], - 'SystemWs' : [ 0x180, ['array', 3, ['_MMSUPPORT']]], - 'MapCacheFailures' : [ 0x468, ['unsigned long']], - 'PagefileHashPages' : [ 0x470, ['unsigned long long']], - 'PteHeader' : [ 0x478, ['_SYSPTES_HEADER']], - 'SessionSpecialPool' : [ 0x590, ['pointer64', ['_MI_SPECIAL_POOL']]], - 'SystemVaTypeCount' : [ 0x598, ['array', 14, ['unsigned long long']]], -} ], - '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { - 'Type' : [ 0x0, ['unsigned short']], - 'Reserved' : [ 0x2, ['unsigned char']], - 'Enabled' : [ 0x3, ['unsigned char']], - 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], - 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], - 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], - 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], - 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], - 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], - 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], - 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], -} ], - '_HMAP_TABLE' : [ 0x5000, { - 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], -} ], - '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x38, { - 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], - 'ReferenceCount' : [ 0x18, ['long long']], - 'PackageSid' : [ 0x20, ['pointer64', ['void']]], - 'HandleCount' : [ 0x28, ['unsigned long']], - 'Handles' : [ 0x30, ['pointer64', ['pointer64', ['void']]]], -} ], - '_PROC_PERF_CONSTRAINT' : [ 0x58, { - 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], - 'PerfContext' : [ 0x8, ['unsigned long long']], - 'ProcCap' : [ 0x10, ['unsigned long']], - 'ProcFloor' : [ 0x14, ['unsigned long']], - 'PlatformCap' : [ 0x18, ['unsigned long']], - 'ThermalCap' : [ 0x1c, ['unsigned long']], - 'LimitReasons' : [ 0x20, ['unsigned long']], - 'PlatformCapStartTime' : [ 0x28, ['unsigned long long']], - 'TargetPercent' : [ 0x30, ['unsigned long']], - 'SelectedPercent' : [ 0x34, ['unsigned long']], - 'SelectedFrequency' : [ 0x38, ['unsigned long']], - 'PreviousFrequency' : [ 0x3c, ['unsigned long']], - 'PreviousPercent' : [ 0x40, ['unsigned long']], - 'LatestFrequencyPercent' : [ 0x44, ['unsigned long']], - 'SelectedState' : [ 0x48, ['unsigned long long']], - 'Force' : [ 0x50, ['unsigned char']], -} ], - '__unnamed_21ef' : [ 0x20, { - 'CallerCompletion' : [ 0x0, ['pointer64', ['void']]], - 'CallerContext' : [ 0x8, ['pointer64', ['void']]], - 'CallerDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], - 'SystemWake' : [ 0x18, ['unsigned char']], -} ], - '__unnamed_21f2' : [ 0x10, { - 'NotifyDevice' : [ 0x0, ['pointer64', ['_PO_DEVICE_NOTIFY']]], - 'FxDeviceActivated' : [ 0x8, ['unsigned char']], -} ], - '_POP_IRP_DATA' : [ 0xf8, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], - 'TargetDevice' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], - 'CurrentDevice' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], - 'WatchdogStart' : [ 0x30, ['unsigned long long']], - 'WatchdogTimer' : [ 0x38, ['_KTIMER']], - 'WatchdogDpc' : [ 0x78, ['_KDPC']], - 'MinorFunction' : [ 0xb8, ['unsigned char']], - 'PowerStateType' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], - 'PowerState' : [ 0xc0, ['_POWER_STATE']], - 'WatchdogEnabled' : [ 0xc4, ['unsigned char']], - 'FxDevice' : [ 0xc8, ['pointer64', ['_POP_FX_DEVICE']]], - 'SystemTransition' : [ 0xd0, ['unsigned char']], - 'NotifyPEP' : [ 0xd1, ['unsigned char']], - 'Device' : [ 0xd8, ['__unnamed_21ef']], - 'System' : [ 0xd8, ['__unnamed_21f2']], -} ], - '_MI_ERROR_STATE' : [ 0xb8, { - 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], - 'ProbeRaises' : [ 0x38, ['_MI_PROBE_RAISE_TRACKER']], - 'ForcedCommits' : [ 0x78, ['_MI_FORCED_COMMITS']], - 'WsleFailures' : [ 0x80, ['array', 2, ['unsigned long']]], - 'WsLinear' : [ 0x88, ['unsigned long']], - 'PageHashErrors' : [ 0x8c, ['unsigned long']], - 'CheckZeroCount' : [ 0x90, ['unsigned long']], - 'ZeroedPageSingleBitErrorsDetected' : [ 0x94, ['long']], - 'BadPagesDetected' : [ 0x98, ['long']], - 'ScrubPasses' : [ 0x9c, ['long']], - 'ScrubBadPagesFound' : [ 0xa0, ['long']], - 'UserViewFailures' : [ 0xa4, ['unsigned long']], - 'UserViewCollisionFailures' : [ 0xa8, ['unsigned long']], - 'ResavailFailures' : [ 0xac, ['_MI_RESAVAIL_FAILURES']], - 'PendingBadPages' : [ 0xb4, ['unsigned char']], - 'InitFailure' : [ 0xb5, ['unsigned char']], - 'StopBadMaps' : [ 0xb6, ['unsigned char']], -} ], - '_IMAGE_DATA_DIRECTORY' : [ 0x8, { - 'VirtualAddress' : [ 0x0, ['unsigned long']], - 'Size' : [ 0x4, ['unsigned long']], -} ], - '_DEVICE_CAPABILITIES' : [ 0x40, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], - 'Address' : [ 0x8, ['unsigned long']], - 'UINumber' : [ 0xc, ['unsigned long']], - 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], - 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], - 'D1Latency' : [ 0x34, ['unsigned long']], - 'D2Latency' : [ 0x38, ['unsigned long']], - 'D3Latency' : [ 0x3c, ['unsigned long']], -} ], - '_MI_USER_VA_INFO' : [ 0x158, { - 'NumberOfCommittedPageTables' : [ 0x0, ['unsigned long']], - 'HighestTopDownAllocationAddress' : [ 0x8, ['pointer64', ['void']]], - 'VadCell' : [ 0x10, ['array', 2, ['_MI_VAD_ALLOCATION_CELL']]], - 'VadBitMapCommitment' : [ 0x60, ['unsigned long']], - 'MaximumLastVadBit' : [ 0x64, ['unsigned long']], - 'VadsBeingDeleted' : [ 0x68, ['long']], - 'NumberOfDebugEnclaves' : [ 0x6c, ['long']], - 'PhysicalMappingCount' : [ 0x70, ['unsigned long long']], - 'LastVadDeletionEvent' : [ 0x78, ['pointer64', ['_KEVENT']]], - 'SubVadRanges' : [ 0x80, ['array', 3, ['_LIST_ENTRY']]], - 'NumaAware' : [ 0xb0, ['unsigned char']], - 'CloneNestingLevel' : [ 0xb8, ['unsigned long long']], - 'PrivateFixupVadCount' : [ 0xc0, ['unsigned long long']], - 'CfgBitMap' : [ 0xc8, ['array', 2, ['_MI_CFG_BITMAP_INFO']]], - 'CommittedPageTableBufferForTopLevel' : [ 0xf8, ['array', 8, ['unsigned long']]], - 'CommittedPageTableBitmaps' : [ 0x118, ['array', 3, ['_RTL_BITMAP']]], - 'PageTableBitmapPages' : [ 0x148, ['array', 3, ['unsigned long']]], -} ], - '_PROC_FEEDBACK' : [ 0x90, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'CyclesLast' : [ 0x8, ['unsigned long long']], - 'CyclesActive' : [ 0x10, ['unsigned long long']], - 'Counters' : [ 0x18, ['array', 2, ['pointer64', ['_PROC_FEEDBACK_COUNTER']]]], - 'LastUpdateTime' : [ 0x28, ['unsigned long long']], - 'UnscaledTime' : [ 0x30, ['unsigned long long']], - 'UnaccountedTime' : [ 0x38, ['long long']], - 'ScaledTime' : [ 0x40, ['array', 2, ['unsigned long long']]], - 'UnaccountedKernelTime' : [ 0x50, ['unsigned long long']], - 'PerformanceScaledKernelTime' : [ 0x58, ['unsigned long long']], - 'UserTimeLast' : [ 0x60, ['unsigned long']], - 'KernelTimeLast' : [ 0x64, ['unsigned long']], - 'IdleGenerationNumberLast' : [ 0x68, ['unsigned long long']], - 'HvActiveTimeLast' : [ 0x70, ['unsigned long long']], - 'StallCyclesLast' : [ 0x78, ['unsigned long long']], - 'StallTime' : [ 0x80, ['unsigned long long']], - 'KernelTimesIndex' : [ 0x88, ['unsigned char']], -} ], - '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x38, { - 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'LocationTreeNode' : [ 0x18, ['_RTL_BALANCED_NODE']], - 'StartingIndex' : [ 0x30, ['unsigned long']], - 'Length' : [ 0x34, ['unsigned long']], -} ], - '__unnamed_220f' : [ 0x18, { - 'Length' : [ 0x0, ['unsigned long']], - 'Alignment' : [ 0x4, ['unsigned long']], - 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], - 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_2213' : [ 0x18, { - 'MinimumVector' : [ 0x0, ['unsigned long']], - 'MaximumVector' : [ 0x4, ['unsigned long']], - 'AffinityPolicy' : [ 0x8, ['unsigned short']], - 'Group' : [ 0xa, ['unsigned short']], - 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], - 'TargetedProcessors' : [ 0x10, ['unsigned long long']], -} ], - '__unnamed_2215' : [ 0x8, { - 'MinimumChannel' : [ 0x0, ['unsigned long']], - 'MaximumChannel' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_2217' : [ 0x10, { - 'RequestLine' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'Channel' : [ 0x8, ['unsigned long']], - 'TransferWidth' : [ 0xc, ['unsigned long']], -} ], - '__unnamed_2219' : [ 0xc, { - 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], -} ], - '__unnamed_221b' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned long']], - 'MinBusNumber' : [ 0x4, ['unsigned long']], - 'MaxBusNumber' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0xc, ['unsigned long']], -} ], - '__unnamed_221d' : [ 0xc, { - 'Priority' : [ 0x0, ['unsigned long']], - 'Reserved1' : [ 0x4, ['unsigned long']], - 'Reserved2' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_221f' : [ 0x18, { - 'Length40' : [ 0x0, ['unsigned long']], - 'Alignment40' : [ 0x4, ['unsigned long']], - 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], - 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_2221' : [ 0x18, { - 'Length48' : [ 0x0, ['unsigned long']], - 'Alignment48' : [ 0x4, ['unsigned long']], - 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], - 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_2223' : [ 0x18, { - 'Length64' : [ 0x0, ['unsigned long']], - 'Alignment64' : [ 0x4, ['unsigned long']], - 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], - 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], -} ], - '__unnamed_2225' : [ 0xc, { - 'Class' : [ 0x0, ['unsigned char']], - 'Type' : [ 0x1, ['unsigned char']], - 'Reserved1' : [ 0x2, ['unsigned char']], - 'Reserved2' : [ 0x3, ['unsigned char']], - 'IdLowPart' : [ 0x4, ['unsigned long']], - 'IdHighPart' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2227' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_220f']], - 'Memory' : [ 0x0, ['__unnamed_220f']], - 'Interrupt' : [ 0x0, ['__unnamed_2213']], - 'Dma' : [ 0x0, ['__unnamed_2215']], - 'DmaV3' : [ 0x0, ['__unnamed_2217']], - 'Generic' : [ 0x0, ['__unnamed_220f']], - 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], - 'BusNumber' : [ 0x0, ['__unnamed_221b']], - 'ConfigData' : [ 0x0, ['__unnamed_221d']], - 'Memory40' : [ 0x0, ['__unnamed_221f']], - 'Memory48' : [ 0x0, ['__unnamed_2221']], - 'Memory64' : [ 0x0, ['__unnamed_2223']], - 'Connection' : [ 0x0, ['__unnamed_2225']], -} ], - '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { - 'Option' : [ 0x0, ['unsigned char']], - 'Type' : [ 0x1, ['unsigned char']], - 'ShareDisposition' : [ 0x2, ['unsigned char']], - 'Spare1' : [ 0x3, ['unsigned char']], - 'Flags' : [ 0x4, ['unsigned short']], - 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_2227']], -} ], - '_POP_THERMAL_ZONE' : [ 0x348, { - 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], - 'Notification' : [ 0x18, ['pointer64', ['void']]], - 'Name' : [ 0x20, ['_UNICODE_STRING']], - 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], - 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], - 'State' : [ 0x40, ['unsigned char']], - 'Flags' : [ 0x41, ['unsigned char']], - 'Removing' : [ 0x42, ['unsigned char']], - 'Mode' : [ 0x43, ['unsigned char']], - 'PendingMode' : [ 0x44, ['unsigned char']], - 'ActivePoint' : [ 0x45, ['unsigned char']], - 'PendingActivePoint' : [ 0x46, ['unsigned char']], - 'Critical' : [ 0x47, ['unsigned char']], - 'ThermalStandby' : [ 0x48, ['unsigned char']], - 'OverThrottled' : [ 0x49, ['unsigned char']], - 'HighPrecisionThrottle' : [ 0x4c, ['long']], - 'Throttle' : [ 0x50, ['long']], - 'PendingThrottle' : [ 0x54, ['long']], - 'ThrottleReasons' : [ 0x58, ['unsigned long']], - 'LastTime' : [ 0x60, ['unsigned long long']], - 'SampleRate' : [ 0x68, ['unsigned long']], - 'LastTemp' : [ 0x6c, ['unsigned long']], - 'PassiveTimer' : [ 0x70, ['_KTIMER']], - 'PassiveDpc' : [ 0xb0, ['_KDPC']], - 'Info' : [ 0xf0, ['_THERMAL_INFORMATION_EX']], - 'InfoLastUpdateTime' : [ 0x148, ['_LARGE_INTEGER']], - 'Policy' : [ 0x150, ['_THERMAL_POLICY']], - 'PolicyDriver' : [ 0x168, ['unsigned char']], - 'LastActiveStartTime' : [ 0x170, ['unsigned long long']], - 'LastPassiveStartTime' : [ 0x178, ['unsigned long long']], - 'WorkItem' : [ 0x180, ['_WORK_QUEUE_ITEM']], - 'Lock' : [ 0x1a0, ['_POP_RW_LOCK']], - 'ZoneStopped' : [ 0x1b0, ['_KEVENT']], - 'TemperatureUpdated' : [ 0x1c8, ['_KEVENT']], - 'InstanceId' : [ 0x1e0, ['unsigned long']], - 'TelemetryTracker' : [ 0x1e8, ['_POP_THERMAL_TELEMETRY_TRACKER']], - 'Description' : [ 0x338, ['_UNICODE_STRING']], -} ], - '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 28, native_type='unsigned long long')]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], -} ], - '_VI_POOL_PAGE_HEADER' : [ 0x18, { - 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], - 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], - 'Signature' : [ 0x10, ['unsigned long long']], -} ], - '_MI_REBUILD_LARGE_PAGES' : [ 0x228, { - 'Active' : [ 0x0, ['long']], - 'Timer' : [ 0x4, ['array', 64, ['array', 4, ['_MI_REBUILD_LARGE_PAGE_COUNTDOWN']]]], - 'WorkItem' : [ 0x208, ['_WORK_QUEUE_ITEM']], -} ], - '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { - 'RefCount' : [ 0x0, ['long']], - 'TableSize' : [ 0x4, ['unsigned long']], - 'BitMaskFlags' : [ 0x8, ['unsigned long']], - 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], - 'CurrentStackIndex' : [ 0x48, ['unsigned long']], - 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], -} ], - '_HHIVE' : [ 0xa68, { - 'Signature' : [ 0x0, ['unsigned long']], - 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], - 'ReleaseCellRoutine' : [ 0x10, ['pointer64', ['void']]], - 'Allocate' : [ 0x18, ['pointer64', ['void']]], - 'Free' : [ 0x20, ['pointer64', ['void']]], - 'FileWrite' : [ 0x28, ['pointer64', ['void']]], - 'FileRead' : [ 0x30, ['pointer64', ['void']]], - 'HiveLoadFailure' : [ 0x38, ['pointer64', ['void']]], - 'BaseBlock' : [ 0x40, ['pointer64', ['_HBASE_BLOCK']]], - 'DirtyVector' : [ 0x48, ['_RTL_BITMAP']], - 'DirtyCount' : [ 0x58, ['unsigned long']], - 'DirtyAlloc' : [ 0x5c, ['unsigned long']], - 'UnreconciledVector' : [ 0x60, ['_RTL_BITMAP']], - 'UnreconciledCount' : [ 0x70, ['unsigned long']], - 'BaseBlockAlloc' : [ 0x74, ['unsigned long']], - 'Cluster' : [ 0x78, ['unsigned long']], - 'Flat' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'ReadOnly' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'SystemCacheBacked' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], - 'DirtyFlag' : [ 0x7d, ['unsigned char']], - 'HvBinHeadersUse' : [ 0x80, ['unsigned long']], - 'HvFreeCellsUse' : [ 0x84, ['unsigned long']], - 'HvUsedCellsUse' : [ 0x88, ['unsigned long']], - 'CmUsedCellsUse' : [ 0x8c, ['unsigned long']], - 'HiveFlags' : [ 0x90, ['unsigned long']], - 'CurrentLog' : [ 0x94, ['unsigned long']], - 'CurrentLogSequence' : [ 0x98, ['unsigned long']], - 'CurrentLogMinimumSequence' : [ 0x9c, ['unsigned long']], - 'CurrentLogOffset' : [ 0xa0, ['unsigned long']], - 'MinimumLogSequence' : [ 0xa4, ['unsigned long']], - 'LogFileSizeCap' : [ 0xa8, ['unsigned long']], - 'LogDataPresent' : [ 0xac, ['array', 2, ['unsigned char']]], - 'PrimaryFileValid' : [ 0xae, ['unsigned char']], - 'BaseBlockDirty' : [ 0xaf, ['unsigned char']], - 'LastLogSwapTime' : [ 0xb0, ['_LARGE_INTEGER']], - 'FirstLogFile' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], - 'SecondLogFile' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], - 'HeaderRecovered' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'LegacyRecoveryIndicated' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], - 'RecoveryInformationReserved' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], - 'RecoveryInformation' : [ 0xb8, ['unsigned short']], - 'LogEntriesRecovered' : [ 0xba, ['array', 2, ['unsigned char']]], - 'RefreshCount' : [ 0xbc, ['unsigned long']], - 'StorageTypeCount' : [ 0xc0, ['unsigned long']], - 'Version' : [ 0xc4, ['unsigned long']], - 'ViewMap' : [ 0xc8, ['_HVIEW_MAP']], - 'Storage' : [ 0x578, ['array', 2, ['_DUAL']]], -} ], - '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], -} ], - '_ETW_FILTER_HEADER' : [ 0x48, { - 'FilterFlags' : [ 0x0, ['long']], - 'PidFilter' : [ 0x8, ['pointer64', ['_ETW_FILTER_PID']]], - 'ExeFilter' : [ 0x10, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], - 'PkgIdFilter' : [ 0x18, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], - 'PkgAppIdFilter' : [ 0x20, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], - 'StackWalkFilter' : [ 0x28, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], - 'EventIdFilter' : [ 0x30, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], - 'PayloadFilter' : [ 0x38, ['pointer64', ['_ETW_PAYLOAD_FILTER']]], - 'ProviderSideFilter' : [ 0x40, ['pointer64', ['_EVENT_FILTER_HEADER']]], -} ], - '_CM_WORKITEM' : [ 0x28, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Private' : [ 0x10, ['unsigned long']], - 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], - 'Parameter' : [ 0x20, ['pointer64', ['void']]], -} ], - '_ETW_PAYLOAD_FILTER' : [ 0x58, { - 'RefCount' : [ 0x0, ['long']], - 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], -} ], - '_CM_TRANS' : [ 0xa8, { - 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], - 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], - 'KtmTrans' : [ 0x30, ['pointer64', ['void']]], - 'CmRm' : [ 0x38, ['pointer64', ['_CM_RM']]], - 'KtmEnlistmentObject' : [ 0x40, ['pointer64', ['_KENLISTMENT']]], - 'KtmEnlistmentHandle' : [ 0x48, ['pointer64', ['void']]], - 'KtmUow' : [ 0x50, ['_GUID']], - 'StartLsn' : [ 0x60, ['unsigned long long']], - 'TransState' : [ 0x68, ['unsigned long']], - 'HiveCount' : [ 0x6c, ['unsigned long']], - 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], -} ], - '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { - 'Version' : [ 0x0, ['unsigned short']], - 'Revision' : [ 0x2, ['unsigned short']], - 'Count' : [ 0x4, ['unsigned long']], - 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], -} ], - '_RTL_RANGE_LIST' : [ 0x20, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Flags' : [ 0x10, ['unsigned long']], - 'Count' : [ 0x14, ['unsigned long']], - 'Stamp' : [ 0x18, ['unsigned long']], -} ], - '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { - 'Bias' : [ 0x0, ['long']], - 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], - 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], - 'StandardBias' : [ 0x54, ['long']], - 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], - 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], - 'DaylightBias' : [ 0xa8, ['long']], -} ], - '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x150, { - 'AccountingDisabled' : [ 0x0, ['unsigned char']], - 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], - 'TotalPassiveTime' : [ 0x10, ['array', 20, ['unsigned long long']]], - 'PassiveTimeSnap' : [ 0xb0, ['array', 20, ['unsigned long long']]], -} ], - '_OBJECT_CREATE_INFORMATION' : [ 0x40, { - 'Attributes' : [ 0x0, ['unsigned long']], - 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], - 'ProbeMode' : [ 0x10, ['unsigned char']], - 'PagedPoolCharge' : [ 0x14, ['unsigned long']], - 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], - 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], - 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], - 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], - 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], -} ], - '_HVIEW_MAP' : [ 0x4b0, { - 'MappedLength' : [ 0x0, ['unsigned long']], - 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], - 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], - 'Directory' : [ 0x18, ['pointer64', ['_HVIEW_MAP_DIRECTORY']]], - 'PagesCharged' : [ 0x20, ['unsigned long']], - 'PinLog' : [ 0x28, ['_HVIEW_MAP_PIN_LOG']], -} ], - '_TRACE_ENABLE_INFO' : [ 0x20, { - 'IsEnabled' : [ 0x0, ['unsigned long']], - 'Level' : [ 0x4, ['unsigned char']], - 'Reserved1' : [ 0x5, ['unsigned char']], - 'LoggerId' : [ 0x6, ['unsigned short']], - 'EnableProperty' : [ 0x8, ['unsigned long']], - 'Reserved2' : [ 0xc, ['unsigned long']], - 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], - 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], -} ], - '_DISALLOWED_GUIDS' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned short']], - 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], -} ], - '_HVIEW_MAP_DIRECTORY' : [ 0x400, { - 'Tables' : [ 0x0, ['array', 128, ['pointer64', ['_HVIEW_MAP_TABLE']]]], -} ], - '_PO_DIAG_STACK_RECORD' : [ 0x10, { - 'StackDepth' : [ 0x0, ['unsigned long']], - 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], -} ], - '_SECTION_OBJECT_POINTERS' : [ 0x18, { - 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], - 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], - 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], -} ], - '_SEP_AUDIT_POLICY' : [ 0x1f, { - 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], - 'PolicySetStatus' : [ 0x1e, ['unsigned char']], -} ], - '__unnamed_229f' : [ 0x4, { - 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_22a1' : [ 0x20, { - 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], - 'Flags' : [ 0x0, ['__unnamed_229f']], -} ], - '_VF_TARGET_DRIVER' : [ 0x38, { - 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], - 'u1' : [ 0x10, ['__unnamed_22a1']], - 'VerifiedData' : [ 0x30, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], -} ], - '__unnamed_22aa' : [ 0x14, { - 'ClassGuid' : [ 0x0, ['_GUID']], - 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], -} ], - '__unnamed_22ac' : [ 0x2, { - 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], -} ], - '__unnamed_22ae' : [ 0x10, { - 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], - 'DeviceId' : [ 0x8, ['array', 1, ['wchar']]], -} ], - '__unnamed_22b0' : [ 0x8, { - 'Notification' : [ 0x0, ['pointer64', ['void']]], -} ], - '__unnamed_22b2' : [ 0x8, { - 'NotificationCode' : [ 0x0, ['unsigned long']], - 'NotificationData' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_22b4' : [ 0x8, { - 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], - 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], -} ], - '__unnamed_22b6' : [ 0x10, { - 'BlockedDriverGuid' : [ 0x0, ['_GUID']], -} ], - '__unnamed_22b8' : [ 0x2, { - 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], -} ], - '__unnamed_22ba' : [ 0x20, { - 'PowerSettingGuid' : [ 0x0, ['_GUID']], - 'Flags' : [ 0x10, ['unsigned long']], - 'SessionId' : [ 0x14, ['unsigned long']], - 'DataLength' : [ 0x18, ['unsigned long']], - 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], -} ], - '__unnamed_22bc' : [ 0x20, { - 'DeviceClass' : [ 0x0, ['__unnamed_22aa']], - 'TargetDevice' : [ 0x0, ['__unnamed_22ac']], - 'InstallDevice' : [ 0x0, ['__unnamed_22ac']], - 'CustomNotification' : [ 0x0, ['__unnamed_22ae']], - 'ProfileNotification' : [ 0x0, ['__unnamed_22b0']], - 'PowerNotification' : [ 0x0, ['__unnamed_22b2']], - 'VetoNotification' : [ 0x0, ['__unnamed_22b4']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_22b6']], - 'InvalidIDNotification' : [ 0x0, ['__unnamed_22b8']], - 'PowerSettingNotification' : [ 0x0, ['__unnamed_22ba']], - 'PropertyChangeNotification' : [ 0x0, ['__unnamed_22ac']], - 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_22ac']], -} ], - '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { - 'EventGuid' : [ 0x0, ['_GUID']], - 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], - 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], - 'Flags' : [ 0x20, ['unsigned long']], - 'TotalSize' : [ 0x24, ['unsigned long']], - 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], - 'u' : [ 0x30, ['__unnamed_22bc']], -} ], - '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'Loads' : [ 0x10, ['unsigned long']], - 'Unloads' : [ 0x14, ['unsigned long']], - 'BaseName' : [ 0x18, ['_UNICODE_STRING']], -} ], - '_MMPTE_TIMESTAMP' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], -} ], - '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { - 'SidCount' : [ 0x0, ['unsigned long']], - 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], - 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], -} ], - '_XSTATE_CONTEXT' : [ 0x20, { - 'Mask' : [ 0x0, ['unsigned long long']], - 'Length' : [ 0x8, ['unsigned long']], - 'Reserved1' : [ 0xc, ['unsigned long']], - 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], - 'Buffer' : [ 0x18, ['pointer64', ['void']]], -} ], - '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x58, { - 'Context' : [ 0x0, ['pointer64', ['void']]], - 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], - 'DependencyCount' : [ 0x38, ['unsigned long']], - 'DependencyUsed' : [ 0x3c, ['unsigned long']], - 'DependencyArray' : [ 0x40, ['pointer64', ['_PROCESSOR_IDLE_DEPENDENCY']]], - 'PlatformIdleStateIndex' : [ 0x48, ['unsigned long']], - 'ProcessorIdleStateIndex' : [ 0x4c, ['unsigned long']], - 'IdleSelectFailureMask' : [ 0x50, ['unsigned long']], -} ], - '_XSAVE_FORMAT' : [ 0x200, { - 'ControlWord' : [ 0x0, ['unsigned short']], - 'StatusWord' : [ 0x2, ['unsigned short']], - 'TagWord' : [ 0x4, ['unsigned char']], - 'Reserved1' : [ 0x5, ['unsigned char']], - 'ErrorOpcode' : [ 0x6, ['unsigned short']], - 'ErrorOffset' : [ 0x8, ['unsigned long']], - 'ErrorSelector' : [ 0xc, ['unsigned short']], - 'Reserved2' : [ 0xe, ['unsigned short']], - 'DataOffset' : [ 0x10, ['unsigned long']], - 'DataSelector' : [ 0x14, ['unsigned short']], - 'Reserved3' : [ 0x16, ['unsigned short']], - 'MxCsr' : [ 0x18, ['unsigned long']], - 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], - 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], - 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], - 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], -} ], - '__unnamed_22d8' : [ 0x1, { - 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], -} ], - 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { - 'Revision' : [ 0x0, ['unsigned long']], - 'MaxThrottle' : [ 0x4, ['unsigned char']], - 'MinThrottle' : [ 0x5, ['unsigned char']], - 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], - 'Spare' : [ 0x7, ['unsigned char']], - 'Flags' : [ 0x7, ['__unnamed_22d8']], - 'TimeCheck' : [ 0x8, ['unsigned long']], - 'IncreaseTime' : [ 0xc, ['unsigned long']], - 'DecreaseTime' : [ 0x10, ['unsigned long']], - 'IncreasePercent' : [ 0x14, ['unsigned long']], - 'DecreasePercent' : [ 0x18, ['unsigned long']], -} ], - '_BUS_EXTENSION_LIST' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['void']]], - 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], -} ], - '_CACHED_CHILD_LIST' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned long']], - 'ValueList' : [ 0x8, ['unsigned long long']], - 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], -} ], - '_KDEVICE_QUEUE' : [ 0x28, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], - 'Lock' : [ 0x18, ['unsigned long long']], - 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], -} ], - '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], - 'ContextAsUlong' : [ 0x0, ['unsigned long']], -} ], - '_MI_HARDWARE_STATE' : [ 0xa8, { - 'NodeMask' : [ 0x0, ['unsigned long']], - 'NodeGraph' : [ 0x8, ['pointer64', ['unsigned short']]], - 'SystemNodeInformation' : [ 0x10, ['pointer64', ['_MI_SYSTEM_NODE_INFORMATION']]], - 'NumaLastRangeIndex' : [ 0x18, ['unsigned long']], - 'NumaMemoryRanges' : [ 0x20, ['pointer64', ['_HAL_NODE_RANGE']]], - 'NumaTableCaptured' : [ 0x28, ['unsigned char']], - 'NodeShift' : [ 0x29, ['unsigned char']], - 'ChannelMemoryRanges' : [ 0x30, ['pointer64', ['_HAL_CHANNEL_MEMORY_RANGES']]], - 'ChannelShift' : [ 0x38, ['unsigned char']], - 'SecondLevelCacheSize' : [ 0x3c, ['unsigned long']], - 'FirstLevelCacheSize' : [ 0x40, ['unsigned long']], - 'PhysicalAddressBits' : [ 0x44, ['unsigned long']], - 'AllMainMemoryMustBeCached' : [ 0x48, ['unsigned char']], - 'TotalPagesAllowed' : [ 0x50, ['unsigned long long']], - 'SecondaryColorMask' : [ 0x58, ['unsigned long']], - 'SecondaryColors' : [ 0x5c, ['unsigned long']], - 'FlushTbForAttributeChange' : [ 0x60, ['unsigned long']], - 'FlushCacheForAttributeChange' : [ 0x64, ['unsigned long']], - 'FlushCacheForPageAttributeChange' : [ 0x68, ['unsigned long']], - 'CacheFlushPromoteThreshold' : [ 0x6c, ['unsigned long']], - 'FlushTbThreshold' : [ 0x70, ['unsigned long long']], - 'ZeroCostCounts' : [ 0x78, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], - 'PrimaryPfns' : [ 0x98, ['unsigned long long']], - 'HighestPossiblePhysicalPage' : [ 0xa0, ['unsigned long long']], -} ], - '_PEBS_DS_SAVE_AREA' : [ 0x60, { - 'BtsBufferBase' : [ 0x0, ['unsigned long long']], - 'BtsIndex' : [ 0x8, ['unsigned long long']], - 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], - 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], - 'PebsBufferBase' : [ 0x20, ['unsigned long long']], - 'PebsIndex' : [ 0x28, ['unsigned long long']], - 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], - 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], - 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], - 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], - 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], - 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], -} ], - '_OBJECT_TYPE_INITIALIZER' : [ 0x78, { - 'Length' : [ 0x0, ['unsigned short']], - 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'ObjectTypeCode' : [ 0x4, ['unsigned long']], - 'InvalidAttributes' : [ 0x8, ['unsigned long']], - 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], - 'ValidAccessMask' : [ 0x1c, ['unsigned long']], - 'RetainAccess' : [ 0x20, ['unsigned long']], - 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], - 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], - 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], - 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], - 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], - 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], - 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], - 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], - 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], - 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], - 'WaitObjectFlagMask' : [ 0x70, ['unsigned long']], - 'WaitObjectFlagOffset' : [ 0x74, ['unsigned short']], - 'WaitObjectPointerOffset' : [ 0x76, ['unsigned short']], -} ], - '__unnamed_231c' : [ 0x8, { - 'Long' : [ 0x0, ['unsigned long long']], - 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], -} ], - '_MI_DECAY_TIMER_LINK' : [ 0x8, { - 'u1' : [ 0x0, ['__unnamed_231c']], -} ], - '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x18, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'DeviceNode' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], -} ], - '_KPROCESSOR_STATE' : [ 0x5b0, { - 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], - 'ContextFrame' : [ 0xe0, ['_CONTEXT']], -} ], - 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { - 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], - 'fAllowContextUpdate' : [ 0x8, ['long']], - 'fEnableTrace' : [ 0xc, ['long']], - 'EtwHandle' : [ 0x10, ['unsigned long long']], -} ], - '_IO_CLIENT_EXTENSION' : [ 0x10, { - 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], - 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], -} ], - '_ETW_BUFFER_CONTEXT' : [ 0x4, { - 'ProcessorNumber' : [ 0x0, ['unsigned char']], - 'Alignment' : [ 0x1, ['unsigned char']], - 'ProcessorIndex' : [ 0x0, ['unsigned short']], - 'LoggerId' : [ 0x2, ['unsigned short']], -} ], - '_HEAP_EXTENDED_ENTRY' : [ 0x10, { - 'Reserved' : [ 0x0, ['pointer64', ['void']]], - 'FunctionIndex' : [ 0x8, ['unsigned short']], - 'ContextValue' : [ 0xa, ['unsigned short']], - 'InterceptorValue' : [ 0x8, ['unsigned long']], - 'UnusedBytesLength' : [ 0xc, ['unsigned short']], - 'EntryOffset' : [ 0xe, ['unsigned char']], - 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], -} ], - '_MI_SYSTEM_VA_STATE' : [ 0x2c0, { - 'SystemTablesLock' : [ 0x0, ['unsigned long long']], - 'AvailableSystemCacheVa' : [ 0x8, ['unsigned long long']], - 'DynamicBitMapSystemPtes' : [ 0x10, ['_MI_DYNAMIC_BITMAP']], - 'DynamicBitMapDriverImages' : [ 0x60, ['array', 2, ['_MI_DYNAMIC_BITMAP']]], - 'DynamicBitMapPagedPool' : [ 0x100, ['_MI_DYNAMIC_BITMAP']], - 'DynamicBitMapSpecialPool' : [ 0x150, ['_MI_DYNAMIC_BITMAP']], - 'DynamicBitMapSystemCache' : [ 0x1a0, ['_MI_DYNAMIC_BITMAP']], - 'WorkingSetListHashStart' : [ 0x1f0, ['pointer64', ['_MMWSLE_HASH']]], - 'WorkingSetListHashEnd' : [ 0x1f8, ['pointer64', ['_MMWSLE_HASH']]], - 'WorkingSetListIndirectHashStart' : [ 0x200, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], - 'FreeSystemCacheVa' : [ 0x208, ['_KEVENT']], - 'SystemVaLock' : [ 0x220, ['unsigned long long']], - 'DeleteKvaLock' : [ 0x228, ['long']], - 'FreeSystemCache' : [ 0x230, ['_MI_PTE_CHAIN_HEAD']], - 'SystemCacheViewLock' : [ 0x248, ['unsigned long long']], - 'UnusableWsles' : [ 0x250, ['array', 5, ['unsigned long long']]], - 'PossibleWsles' : [ 0x278, ['array', 5, ['unsigned long long']]], -} ], - '_DIRTY_PAGE_STATISTICS' : [ 0x18, { - 'DirtyPages' : [ 0x0, ['unsigned long long']], - 'DirtyPagesLastScan' : [ 0x8, ['unsigned long long']], - 'DirtyPagesScheduledLastScan' : [ 0x10, ['unsigned long']], -} ], - '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { - 'BreakPointAddress' : [ 0x0, ['unsigned long long']], - 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], - 'BreakPointHandle' : [ 0x10, ['unsigned long']], - 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], - 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], -} ], - '_PROC_IDLE_SNAP' : [ 0x10, { - 'Time' : [ 0x0, ['unsigned long long']], - 'Idle' : [ 0x8, ['unsigned long long']], -} ], - '_KERNEL_STACK_SEGMENT' : [ 0x20, { - 'StackBase' : [ 0x0, ['unsigned long long']], - 'StackLimit' : [ 0x8, ['unsigned long long']], - 'KernelStack' : [ 0x10, ['unsigned long long']], - 'InitialStack' : [ 0x18, ['unsigned long long']], -} ], - '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'ExecuteOptions' : [ 0x0, ['unsigned char']], - 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], -} ], - '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { - 'Present' : [ 0x0, ['unsigned long long']], - 'Enabled' : [ 0x8, ['unsigned long long']], - 'EnabledByDefault' : [ 0x10, ['unsigned long long']], -} ], - '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'NumberOfBanks' : [ 0x3, ['unsigned char']], - 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], - 'MCG_Capability' : [ 0x8, ['unsigned long long']], - 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], - 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], -} ], - '_MI_DEBUGGER_STATE' : [ 0x118, { - 'TransientWrite' : [ 0x0, ['unsigned char']], - 'CodePageEdited' : [ 0x1, ['unsigned char']], - 'DebugPte' : [ 0x8, ['pointer64', ['_MMPTE']]], - 'PoisonedTb' : [ 0x10, ['unsigned long']], - 'InDebugger' : [ 0x14, ['long']], - 'Pfns' : [ 0x18, ['array', 32, ['pointer64', ['void']]]], -} ], - '_MI_PROCESS_STATE' : [ 0x60, { - 'ColorSeed' : [ 0x0, ['unsigned long']], - 'CloneDereferenceEvent' : [ 0x8, ['_KEVENT']], - 'CloneProtosSListHead' : [ 0x20, ['_SLIST_HEADER']], - 'SystemDllBase' : [ 0x30, ['pointer64', ['void']]], - 'RotatingUniprocessorNumber' : [ 0x38, ['long']], - 'CriticalSectionTimeout' : [ 0x40, ['_LARGE_INTEGER']], - 'ProcessList' : [ 0x48, ['_LIST_ENTRY']], - 'SharedUserDataPte' : [ 0x58, ['pointer64', ['_MMPTE']]], -} ], - '_ARBITER_ALLOCATION_STATE' : [ 0x50, { - 'Start' : [ 0x0, ['unsigned long long']], - 'End' : [ 0x8, ['unsigned long long']], - 'CurrentMinimum' : [ 0x10, ['unsigned long long']], - 'CurrentMaximum' : [ 0x18, ['unsigned long long']], - 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], - 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], - 'AlternativeCount' : [ 0x30, ['unsigned long']], - 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], - 'Flags' : [ 0x40, ['unsigned short']], - 'RangeAttributes' : [ 0x42, ['unsigned char']], - 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], - 'WorkSpace' : [ 0x48, ['unsigned long long']], -} ], - '_VACB_ARRAY_HEADER' : [ 0x10, { - 'VacbArrayIndex' : [ 0x0, ['unsigned long']], - 'MappingCount' : [ 0x4, ['unsigned long']], - 'HighestMappedIndex' : [ 0x8, ['unsigned long']], - 'Reserved' : [ 0xc, ['unsigned long']], -} ], - '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], - 'HighActiveFlink' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], - 'HighActiveBlink' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 56, native_type='unsigned long long')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], -} ], - 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { - 'PowerButtonPresent' : [ 0x0, ['unsigned char']], - 'SleepButtonPresent' : [ 0x1, ['unsigned char']], - 'LidPresent' : [ 0x2, ['unsigned char']], - 'SystemS1' : [ 0x3, ['unsigned char']], - 'SystemS2' : [ 0x4, ['unsigned char']], - 'SystemS3' : [ 0x5, ['unsigned char']], - 'SystemS4' : [ 0x6, ['unsigned char']], - 'SystemS5' : [ 0x7, ['unsigned char']], - 'HiberFilePresent' : [ 0x8, ['unsigned char']], - 'FullWake' : [ 0x9, ['unsigned char']], - 'VideoDimPresent' : [ 0xa, ['unsigned char']], - 'ApmPresent' : [ 0xb, ['unsigned char']], - 'UpsPresent' : [ 0xc, ['unsigned char']], - 'ThermalControl' : [ 0xd, ['unsigned char']], - 'ProcessorThrottle' : [ 0xe, ['unsigned char']], - 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], - 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], - 'FastSystemS4' : [ 0x11, ['unsigned char']], - 'Hiberboot' : [ 0x12, ['unsigned char']], - 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], - 'AoAc' : [ 0x14, ['unsigned char']], - 'DiskSpinDown' : [ 0x15, ['unsigned char']], - 'HiberFileType' : [ 0x16, ['unsigned char']], - 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], - 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], - 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], - 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], - 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], - 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], -} ], - '_MI_REBUILD_LARGE_PAGE_COUNTDOWN' : [ 0x2, { - 'SecondsLeft' : [ 0x0, ['unsigned char']], - 'SecondsAssigned' : [ 0x1, ['unsigned char']], -} ], - '_DBGKD_SWITCH_PARTITION' : [ 0x4, { - 'Partition' : [ 0x0, ['unsigned long']], -} ], - '_REQUEST_MAILBOX' : [ 0x40, { - 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], - 'RequestSummary' : [ 0x8, ['unsigned long long']], - 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], - 'NodeTargetCountAddr' : [ 0x30, ['pointer64', ['long']]], - 'NodeTargetCount' : [ 0x38, ['long']], -} ], - '_DBGKD_GET_VERSION32' : [ 0x28, { - 'MajorVersion' : [ 0x0, ['unsigned short']], - 'MinorVersion' : [ 0x2, ['unsigned short']], - 'ProtocolVersion' : [ 0x4, ['unsigned short']], - 'Flags' : [ 0x6, ['unsigned short']], - 'KernBase' : [ 0x8, ['unsigned long']], - 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], - 'MachineType' : [ 0x10, ['unsigned short']], - 'ThCallbackStack' : [ 0x12, ['unsigned short']], - 'NextCallback' : [ 0x14, ['unsigned short']], - 'FramePointer' : [ 0x16, ['unsigned short']], - 'KiCallUserMode' : [ 0x18, ['unsigned long']], - 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], - 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], - 'DebuggerDataList' : [ 0x24, ['unsigned long']], -} ], - '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'NumberOfBanks' : [ 0x3, ['unsigned char']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], - 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], -} ], - '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], - 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], - 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], -} ], - '_PEB32' : [ 0x460, { - 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], - 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], - 'BeingDebugged' : [ 0x2, ['unsigned char']], - 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Mutant' : [ 0x4, ['unsigned long']], - 'ImageBaseAddress' : [ 0x8, ['unsigned long']], - 'Ldr' : [ 0xc, ['unsigned long']], - 'ProcessParameters' : [ 0x10, ['unsigned long']], - 'SubSystemData' : [ 0x14, ['unsigned long']], - 'ProcessHeap' : [ 0x18, ['unsigned long']], - 'FastPebLock' : [ 0x1c, ['unsigned long']], - 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], - 'IFEOKey' : [ 0x24, ['unsigned long']], - 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], - 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], - 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], - 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], - 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], - 'ApiSetMap' : [ 0x38, ['unsigned long']], - 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], - 'TlsBitmap' : [ 0x40, ['unsigned long']], - 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], - 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], - 'SparePvoid0' : [ 0x50, ['unsigned long']], - 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], - 'AnsiCodePageData' : [ 0x58, ['unsigned long']], - 'OemCodePageData' : [ 0x5c, ['unsigned long']], - 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], - 'NumberOfProcessors' : [ 0x64, ['unsigned long']], - 'NtGlobalFlag' : [ 0x68, ['unsigned long']], - 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], - 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], - 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], - 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], - 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], - 'NumberOfHeaps' : [ 0x88, ['unsigned long']], - 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], - 'ProcessHeaps' : [ 0x90, ['unsigned long']], - 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], - 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], - 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], - 'LoaderLock' : [ 0xa0, ['unsigned long']], - 'OSMajorVersion' : [ 0xa4, ['unsigned long']], - 'OSMinorVersion' : [ 0xa8, ['unsigned long']], - 'OSBuildNumber' : [ 0xac, ['unsigned short']], - 'OSCSDVersion' : [ 0xae, ['unsigned short']], - 'OSPlatformId' : [ 0xb0, ['unsigned long']], - 'ImageSubsystem' : [ 0xb4, ['unsigned long']], - 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], - 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], - 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], - 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], - 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], - 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], - 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], - 'SessionId' : [ 0x1d4, ['unsigned long']], - 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], - 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], - 'pShimData' : [ 0x1e8, ['unsigned long']], - 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], - 'CSDVersion' : [ 0x1f0, ['_STRING32']], - 'ActivationContextData' : [ 0x1f8, ['unsigned long']], - 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], - 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], - 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], - 'MinimumStackCommit' : [ 0x208, ['unsigned long']], - 'FlsCallback' : [ 0x20c, ['unsigned long']], - 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], - 'FlsBitmap' : [ 0x218, ['unsigned long']], - 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], - 'FlsHighIndex' : [ 0x22c, ['unsigned long']], - 'WerRegistrationData' : [ 0x230, ['unsigned long']], - 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], - 'pUnused' : [ 0x238, ['unsigned long']], - 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], - 'TracingFlags' : [ 0x240, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], - 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], - 'TppWorkerpList' : [ 0x254, ['LIST_ENTRY32']], - 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['unsigned long']]], -} ], - '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x10, { - 'Validation' : [ 0x0, ['unsigned short']], - 'Flags' : [ 0x2, ['unsigned short']], - 'TrackedOffsetCallback' : [ 0x8, ['pointer64', ['void']]], -} ], - '_VPB' : [ 0x60, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'Flags' : [ 0x4, ['unsigned short']], - 'VolumeLabelLength' : [ 0x6, ['unsigned short']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], - 'SerialNumber' : [ 0x18, ['unsigned long']], - 'ReferenceCount' : [ 0x1c, ['unsigned long']], - 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], -} ], - '_MI_SESSION_STATE' : [ 0x88, { - 'SystemSession' : [ 0x0, ['_MMSESSION']], - 'CodePageEdited' : [ 0x20, ['unsigned char']], - 'DynamicVaBitBuffer' : [ 0x28, ['pointer64', ['unsigned long']]], - 'DynamicVaBitBufferPages' : [ 0x30, ['unsigned long long']], - 'DynamicPoolBitBuffer' : [ 0x38, ['pointer64', ['unsigned long']]], - 'DynamicVaStart' : [ 0x40, ['pointer64', ['void']]], - 'DynamicPtesBitBuffer' : [ 0x48, ['pointer64', ['unsigned long']]], - 'IdLock' : [ 0x50, ['_EX_PUSH_LOCK']], - 'DetachTimeStamp' : [ 0x58, ['unsigned long']], - 'LeaderProcess' : [ 0x60, ['pointer64', ['_EPROCESS']]], - 'InitializeLock' : [ 0x68, ['_EX_PUSH_LOCK']], - 'WorkingSetList' : [ 0x70, ['pointer64', ['_MMWSL']]], - 'WsHashStart' : [ 0x78, ['pointer64', ['_MMWSLE_HASH']]], - 'WsHashEnd' : [ 0x80, ['pointer64', ['_MMWSLE_HASH']]], -} ], - '_CACHE_DESCRIPTOR' : [ 0xc, { - 'Level' : [ 0x0, ['unsigned char']], - 'Associativity' : [ 0x1, ['unsigned char']], - 'LineSize' : [ 0x2, ['unsigned short']], - 'Size' : [ 0x4, ['unsigned long']], - 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], -} ], - '_MMSESSION' : [ 0x20, { - 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'SystemSpaceViewLockPointer' : [ 0x8, ['pointer64', ['_EX_PUSH_LOCK']]], - 'ViewRoot' : [ 0x10, ['_RTL_AVL_TREE']], - 'ViewCount' : [ 0x18, ['unsigned long']], - 'BitmapFailures' : [ 0x1c, ['unsigned long']], -} ], - '_IOP_IRP_STACK_PROFILER' : [ 0x54, { - 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], - 'TotalIrps' : [ 0x50, ['unsigned long']], -} ], - '_FILE_BASIC_INFORMATION' : [ 0x28, { - 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], - 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], - 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], - 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], - 'FileAttributes' : [ 0x20, ['unsigned long']], -} ], - '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x260, { - 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], - 'Lock' : [ 0x250, ['_EX_PUSH_LOCK']], - 'NumberOfPrivateSpaces' : [ 0x258, ['unsigned long']], -} ], - '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { - 'ClientToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], - 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], - 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], -} ], - '_MI_DECAY_TIMER_LINKAGE' : [ 0x8, { - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], - 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], -} ], - '_EVENT_HEADER' : [ 0x50, { - 'Size' : [ 0x0, ['unsigned short']], - 'HeaderType' : [ 0x2, ['unsigned short']], - 'Flags' : [ 0x4, ['unsigned short']], - 'EventProperty' : [ 0x6, ['unsigned short']], - 'ThreadId' : [ 0x8, ['unsigned long']], - 'ProcessId' : [ 0xc, ['unsigned long']], - 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], - 'ProviderId' : [ 0x18, ['_GUID']], - 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], - 'KernelTime' : [ 0x38, ['unsigned long']], - 'UserTime' : [ 0x3c, ['unsigned long']], - 'ProcessorTime' : [ 0x38, ['unsigned long long']], - 'ActivityId' : [ 0x40, ['_GUID']], -} ], - '_PF_KERNEL_GLOBALS' : [ 0x60, { - 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], - 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], - 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], - 'AccessBufferMax' : [ 0x28, ['unsigned long']], - 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], - 'StreamSequenceNumber' : [ 0x50, ['long']], - 'Flags' : [ 0x54, ['unsigned long']], - 'ScenarioPrefetchCount' : [ 0x58, ['long']], -} ], - '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], - 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], -} ], - '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { - 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], -} ], - '__unnamed_23a3' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], -} ], - '_MI_PARTITION_CORE' : [ 0x158, { - 'PartitionId' : [ 0x0, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_23a3']], - 'ReferenceCount' : [ 0x8, ['unsigned long long']], - 'ParentPartition' : [ 0x10, ['pointer64', ['_MI_PARTITION']]], - 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'NodeInformation' : [ 0x28, ['pointer64', ['_MI_NODE_INFORMATION']]], - 'MdlPhysicalMemoryBlock' : [ 0x30, ['pointer64', ['_MDL']]], - 'MemoryNodeRuns' : [ 0x38, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], - 'MemoryBlockReferences' : [ 0x40, ['unsigned long long']], - 'PfnUnmapWorkItem' : [ 0x48, ['_WORK_QUEUE_ITEM']], - 'PfnUnmapActive' : [ 0x68, ['unsigned char']], - 'PfnUnmapCount' : [ 0x70, ['unsigned long long']], - 'PfnUnmapWaitList' : [ 0x78, ['pointer64', ['void']]], - 'MemoryRuns' : [ 0x80, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], - 'ExitEvent' : [ 0x88, ['_KEVENT']], - 'SystemThreadHandles' : [ 0xa0, ['array', 5, ['pointer64', ['void']]]], - 'PartitionObject' : [ 0xc8, ['pointer64', ['void']]], - 'PartitionObjectHandle' : [ 0xd0, ['pointer64', ['void']]], - 'DynamicMemoryPushLock' : [ 0xd8, ['_EX_PUSH_LOCK']], - 'DynamicMemoryLock' : [ 0xe0, ['long']], - 'TemporaryMemoryEvent' : [ 0xe8, ['_KEVENT']], - 'MemoryEvents' : [ 0x100, ['array', 11, ['pointer64', ['_KEVENT']]]], -} ], - '_MI_PARTITION_MODWRITES' : [ 0x2d0, { - 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], - 'PageFileContract' : [ 0x60, ['_MMPAGE_FILE_EXPANSION']], - 'NumberOfMappedMdls' : [ 0xc0, ['unsigned long long']], - 'NumberOfMappedMdlsInUse' : [ 0xc8, ['long']], - 'NumberOfMappedMdlsInUsePeak' : [ 0xcc, ['unsigned long']], - 'MappedFileHeader' : [ 0xd0, ['_MMMOD_WRITER_LISTHEAD']], - 'NeedMappedMdl' : [ 0xf8, ['unsigned char']], - 'NeedPageFileMdl' : [ 0xf9, ['unsigned char']], - 'TransitionInserted' : [ 0xfa, ['unsigned char']], - 'LastModifiedWriteError' : [ 0xfc, ['long']], - 'LastMappedWriteError' : [ 0x100, ['long']], - 'MappedFileWriteSucceeded' : [ 0x104, ['unsigned long']], - 'MappedWriteBurstCount' : [ 0x108, ['unsigned long']], - 'LowPriorityModWritesOutstanding' : [ 0x10c, ['unsigned long']], - 'BoostModWriteIoPriorityEvent' : [ 0x110, ['_KEVENT']], - 'ModifiedWriterThreadPriority' : [ 0x128, ['long']], - 'ModifiedPagesLowPriorityGoal' : [ 0x130, ['unsigned long long']], - 'ModifiedPageWriterEvent' : [ 0x138, ['_KEVENT']], - 'ModifiedWriterExitedEvent' : [ 0x150, ['_KEVENT']], - 'WriteAllPagefilePages' : [ 0x168, ['long']], - 'WriteAllMappedPages' : [ 0x16c, ['long']], - 'MappedPageWriterEvent' : [ 0x170, ['_KEVENT']], - 'ModWriteData' : [ 0x188, ['_MI_MODWRITE_DATA']], - 'RescanPageFilesEvent' : [ 0x1c8, ['_KEVENT']], - 'PagingFileHeader' : [ 0x1e0, ['_MMMOD_WRITER_LISTHEAD']], - 'ModifiedPageWriterThread' : [ 0x208, ['pointer64', ['_ETHREAD']]], - 'ModifiedPageWriterRundown' : [ 0x210, ['_EX_RUNDOWN_REF']], - 'PagefileScanWorkItem' : [ 0x218, ['_WORK_QUEUE_ITEM']], - 'PagefileScanCount' : [ 0x238, ['unsigned long']], - 'ClusterWritesDisabled' : [ 0x23c, ['array', 2, ['long']]], - 'NotifyStoreMemoryConditions' : [ 0x248, ['_KEVENT']], - 'DelayMappedWrite' : [ 0x260, ['unsigned char']], - 'PagefileReservationsEnabled' : [ 0x264, ['unsigned long']], - 'PageFileCreationLock' : [ 0x268, ['_EX_PUSH_LOCK']], - 'TrimPagefileWorkItem' : [ 0x270, ['_WORK_QUEUE_ITEM']], - 'LastTrimPagefileTime' : [ 0x290, ['unsigned long long']], - 'WsSwapPagefileContractWorkItem' : [ 0x298, ['_WORK_QUEUE_ITEM']], - 'WsSwapPageFileContractionInProgress' : [ 0x2b8, ['long']], - 'WorkingSetSwapLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], - 'WorkingSetInswapLock' : [ 0x2c8, ['long']], -} ], - '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { - 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], -} ], - '_KPRIQUEUE' : [ 0x2b0, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'EntryListHead' : [ 0x18, ['array', 32, ['_LIST_ENTRY']]], - 'CurrentCount' : [ 0x218, ['array', 32, ['long']]], - 'MaximumCount' : [ 0x298, ['unsigned long']], - 'ThreadListHead' : [ 0x2a0, ['_LIST_ENTRY']], -} ], - '__unnamed_23c0' : [ 0x4, { - 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], -} ], - '_MI_NODE_INFORMATION' : [ 0x538, { - 'LargePageFreeCount' : [ 0x0, ['array', 2, ['unsigned long long']]], - 'LargePages' : [ 0x10, ['array', 2, ['array', 2, ['array', 4, ['_LIST_ENTRY']]]]], - 'LargePagesCount' : [ 0x110, ['array', 2, ['array', 2, ['array', 4, ['unsigned long long']]]]], - 'StandbyPageList' : [ 0x190, ['array', 4, ['array', 8, ['_MMPFNLIST_SHORT']]]], - 'FreeCount' : [ 0x490, ['array', 2, ['unsigned long long']]], - 'TotalPages' : [ 0x4a0, ['array', 4, ['unsigned long long']]], - 'TotalPagesEntireNode' : [ 0x4c0, ['unsigned long long']], - 'MmShiftedColor' : [ 0x4c8, ['unsigned long']], - 'Color' : [ 0x4cc, ['unsigned long']], - 'ChannelFreeCount' : [ 0x4d0, ['array', 4, ['array', 2, ['unsigned long long']]]], - 'Flags' : [ 0x510, ['__unnamed_23c0']], - 'NodeLock' : [ 0x518, ['_EX_PUSH_LOCK']], - 'ChannelStatus' : [ 0x520, ['unsigned char']], - 'ChannelOrdering' : [ 0x521, ['array', 4, ['unsigned char']]], - 'LockedChannelOrdering' : [ 0x525, ['array', 4, ['unsigned char']]], - 'PowerAttribute' : [ 0x529, ['array', 4, ['unsigned char']]], - 'LargePageLock' : [ 0x530, ['unsigned long long']], -} ], - '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], - 'Handler' : [ 0x8, ['pointer64', ['void']]], -} ], - '_WAITING_IRP' : [ 0x38, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'CompletionRoutine' : [ 0x18, ['pointer64', ['void']]], - 'Context' : [ 0x20, ['pointer64', ['void']]], - 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], - 'Information' : [ 0x30, ['unsigned long']], - 'BreakAllRH' : [ 0x34, ['unsigned char']], -} ], - '_ETW_FILTER_PID' : [ 0x24, { - 'Count' : [ 0x0, ['unsigned long']], - 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], -} ], - '_PPM_SELECTION_MENU' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned long']], - 'Entries' : [ 0x8, ['pointer64', ['_PPM_SELECTION_MENU_ENTRY']]], -} ], - '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x20, { - 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], - 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], - 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], - 'XdvSharedExportThunks' : [ 0x18, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], -} ], - '_KSCHEDULING_GROUP' : [ 0x240, { - 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], - 'RelativeWeight' : [ 0x8, ['unsigned long']], - 'ChildMinRate' : [ 0xc, ['unsigned long']], - 'ChildMinWeight' : [ 0x10, ['unsigned long']], - 'ChildTotalWeight' : [ 0x14, ['unsigned long']], - 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], - 'NotificationCycles' : [ 0x20, ['long long']], - 'SchedulingGroupList' : [ 0x28, ['_LIST_ENTRY']], - 'Sibling' : [ 0x28, ['_LIST_ENTRY']], - 'NotificationDpc' : [ 0x38, ['pointer64', ['_KDPC']]], - 'ChildList' : [ 0x40, ['_LIST_ENTRY']], - 'Parent' : [ 0x50, ['pointer64', ['_KSCHEDULING_GROUP']]], - 'PerProcessor' : [ 0x80, ['array', 1, ['_KSCB']]], -} ], - '_ETW_REF_CLOCK' : [ 0x10, { - 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], - 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], -} ], - '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { - 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], - 'Object' : [ 0x10, ['pointer64', ['void']]], - 'TargetAccess' : [ 0x18, ['unsigned long']], - 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], - 'HandleAttributes' : [ 0x20, ['unsigned long']], -} ], - '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 15, native_type='unsigned long long')]], - 'ExecutePrivilege' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long long')]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], -} ], - '_POWER_STATE' : [ 0x4, { - 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], -} ], - '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x10, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], -} ], - '_POP_IRP_WORKER_ENTRY' : [ 0x30, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], - 'Irp' : [ 0x18, ['pointer64', ['_IRP']]], - 'Device' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], - 'Static' : [ 0x28, ['unsigned char']], -} ], - '_POP_POLICY_DEVICE' : [ 0x40, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], - 'Notification' : [ 0x18, ['pointer64', ['void']]], - 'Name' : [ 0x20, ['_UNICODE_STRING']], - 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], - 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], -} ], - '__unnamed_23f3' : [ 0x8, { - 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], - 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], - 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], -} ], - '_SECTION' : [ 0x40, { - 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'StartingVpn' : [ 0x18, ['unsigned long long']], - 'EndingVpn' : [ 0x20, ['unsigned long long']], - 'u1' : [ 0x28, ['__unnamed_23f3']], - 'SizeOfSection' : [ 0x30, ['unsigned long long']], - 'u' : [ 0x38, ['__unnamed_16ec']], - 'InitialPageProtection' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], - 'SessionId' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], - 'NoValidationNeeded' : [ 0x3c, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '_MI_SECTION_STATE' : [ 0x280, { - 'SectionObjectPointersLock' : [ 0x0, ['long']], - 'SectionExtendLock' : [ 0x8, ['_EX_PUSH_LOCK']], - 'SectionExtendSetLock' : [ 0x10, ['_EX_PUSH_LOCK']], - 'SectionBasedRoot' : [ 0x18, ['_RTL_AVL_TREE']], - 'SectionBasedLock' : [ 0x20, ['_EX_PUSH_LOCK']], - 'UnusedSubsectionPagedPool' : [ 0x28, ['unsigned long long']], - 'UnusedSegmentForceFree' : [ 0x30, ['unsigned long']], - 'DataSectionProtectionMask' : [ 0x34, ['unsigned long']], - 'HighSectionBase' : [ 0x38, ['pointer64', ['void']]], - 'PhysicalSubsection' : [ 0x40, ['_MSUBSECTION']], - 'PhysicalControlArea' : [ 0xb0, ['_CONTROL_AREA']], - 'DanglingExtentsPages' : [ 0x128, ['pointer64', ['_MMPFN']]], - 'DanglingExtentsLock' : [ 0x130, ['long']], - 'DanglingExtentsWorkItem' : [ 0x138, ['_WORK_QUEUE_ITEM']], - 'DanglingExtentsWorkerActive' : [ 0x158, ['unsigned char']], - 'PageFileSectionHead' : [ 0x160, ['_RTL_AVL_TREE']], - 'PageFileSectionListSpinLock' : [ 0x168, ['long']], - 'SharedSegmentCharges' : [ 0x170, ['_MI_CROSS_PARTITION_CHARGES']], - 'SharedPageCombineCharges' : [ 0x198, ['_MI_CROSS_PARTITION_CHARGES']], - 'ImageBias' : [ 0x1c0, ['unsigned long']], - 'RelocateBitmapsLock' : [ 0x1c8, ['_EX_PUSH_LOCK']], - 'ImageBitMap' : [ 0x1d0, ['_RTL_BITMAP']], - 'ImageBias64Low' : [ 0x1e0, ['unsigned long']], - 'ImageBias64High' : [ 0x1e4, ['unsigned long']], - 'ImageBitMap64Low' : [ 0x1e8, ['_RTL_BITMAP']], - 'ImageBitMap64High' : [ 0x1f8, ['_RTL_BITMAP']], - 'ImageBitMapWow64Dll' : [ 0x208, ['_RTL_BITMAP']], - 'ApiSetSection' : [ 0x218, ['pointer64', ['void']]], - 'ApiSetSchema' : [ 0x220, ['pointer64', ['void']]], - 'ApiSetSchemaSize' : [ 0x228, ['unsigned long long']], - 'LostDataFiles' : [ 0x230, ['unsigned long']], - 'LostDataPages' : [ 0x234, ['unsigned long']], - 'ImageFailureReason' : [ 0x238, ['unsigned long']], - 'CfgBitMapSection32' : [ 0x240, ['pointer64', ['_SECTION']]], - 'CfgBitMapControlArea32' : [ 0x248, ['pointer64', ['_CONTROL_AREA']]], - 'CfgBitMapSection64' : [ 0x250, ['pointer64', ['_SECTION']]], - 'CfgBitMapControlArea64' : [ 0x258, ['pointer64', ['_CONTROL_AREA']]], - 'ImageCfgFailure' : [ 0x260, ['unsigned long']], - 'ImageValidationFailed' : [ 0x264, ['long']], -} ], - '_MI_PARTITION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], -} ], - '__unnamed_2400' : [ 0xc, { - 'Start' : [ 0x0, ['_LARGE_INTEGER']], - 'Length' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2402' : [ 0x10, { - 'Level' : [ 0x0, ['unsigned short']], - 'Group' : [ 0x2, ['unsigned short']], - 'Vector' : [ 0x4, ['unsigned long']], - 'Affinity' : [ 0x8, ['unsigned long long']], -} ], - '__unnamed_2404' : [ 0x10, { - 'Group' : [ 0x0, ['unsigned short']], - 'MessageCount' : [ 0x2, ['unsigned short']], - 'Vector' : [ 0x4, ['unsigned long']], - 'Affinity' : [ 0x8, ['unsigned long long']], -} ], - '__unnamed_2406' : [ 0x10, { - 'Raw' : [ 0x0, ['__unnamed_2404']], - 'Translated' : [ 0x0, ['__unnamed_2402']], -} ], - '__unnamed_2408' : [ 0xc, { - 'Channel' : [ 0x0, ['unsigned long']], - 'Port' : [ 0x4, ['unsigned long']], - 'Reserved1' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_240a' : [ 0xc, { - 'Channel' : [ 0x0, ['unsigned long']], - 'RequestLine' : [ 0x4, ['unsigned long']], - 'TransferWidth' : [ 0x8, ['unsigned char']], - 'Reserved1' : [ 0x9, ['unsigned char']], - 'Reserved2' : [ 0xa, ['unsigned char']], - 'Reserved3' : [ 0xb, ['unsigned char']], -} ], - '__unnamed_240c' : [ 0xc, { - 'Start' : [ 0x0, ['unsigned long']], - 'Length' : [ 0x4, ['unsigned long']], - 'Reserved' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_240e' : [ 0xc, { - 'DataSize' : [ 0x0, ['unsigned long']], - 'Reserved1' : [ 0x4, ['unsigned long']], - 'Reserved2' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2410' : [ 0xc, { - 'Start' : [ 0x0, ['_LARGE_INTEGER']], - 'Length40' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2412' : [ 0xc, { - 'Start' : [ 0x0, ['_LARGE_INTEGER']], - 'Length48' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2414' : [ 0xc, { - 'Start' : [ 0x0, ['_LARGE_INTEGER']], - 'Length64' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_2416' : [ 0x10, { - 'Generic' : [ 0x0, ['__unnamed_2400']], - 'Port' : [ 0x0, ['__unnamed_2400']], - 'Interrupt' : [ 0x0, ['__unnamed_2402']], - 'MessageInterrupt' : [ 0x0, ['__unnamed_2406']], - 'Memory' : [ 0x0, ['__unnamed_2400']], - 'Dma' : [ 0x0, ['__unnamed_2408']], - 'DmaV3' : [ 0x0, ['__unnamed_240a']], - 'DevicePrivate' : [ 0x0, ['__unnamed_2219']], - 'BusNumber' : [ 0x0, ['__unnamed_240c']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_240e']], - 'Memory40' : [ 0x0, ['__unnamed_2410']], - 'Memory48' : [ 0x0, ['__unnamed_2412']], - 'Memory64' : [ 0x0, ['__unnamed_2414']], - 'Connection' : [ 0x0, ['__unnamed_2225']], -} ], - '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { - 'Type' : [ 0x0, ['unsigned char']], - 'ShareDisposition' : [ 0x1, ['unsigned char']], - 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_2416']], -} ], - '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { - 'PaddingAmount' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_241e' : [ 0x4, { - 'PhysicalAddress' : [ 0x0, ['unsigned long']], - 'VirtualSize' : [ 0x0, ['unsigned long']], -} ], - '_IMAGE_SECTION_HEADER' : [ 0x28, { - 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_241e']], - 'VirtualAddress' : [ 0xc, ['unsigned long']], - 'SizeOfRawData' : [ 0x10, ['unsigned long']], - 'PointerToRawData' : [ 0x14, ['unsigned long']], - 'PointerToRelocations' : [ 0x18, ['unsigned long']], - 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], - 'NumberOfRelocations' : [ 0x20, ['unsigned short']], - 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], - 'Characteristics' : [ 0x24, ['unsigned long']], -} ], - '_INVERTED_FUNCTION_TABLE_ENTRY' : [ 0x18, { - 'FunctionTable' : [ 0x0, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], - 'DynamicTable' : [ 0x0, ['pointer64', ['_DYNAMIC_FUNCTION_TABLE']]], - 'ImageBase' : [ 0x8, ['pointer64', ['void']]], - 'SizeOfImage' : [ 0x10, ['unsigned long']], - 'SizeOfTable' : [ 0x14, ['unsigned long']], -} ], - '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { - 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], -} ], - '_MM_PAGED_POOL_INFO' : [ 0x38, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'PagedPoolAllocationMap' : [ 0x8, ['_RTL_BITMAP_EX']], - 'FirstPteForPagedPool' : [ 0x18, ['pointer64', ['_MMPTE']]], - 'MaximumSize' : [ 0x20, ['unsigned long long']], - 'PagedPoolHint' : [ 0x28, ['unsigned long long']], - 'AllocatedPagedPool' : [ 0x30, ['unsigned long long']], -} ], - '__unnamed_2430' : [ 0x50, { - 'CellData' : [ 0x0, ['_CELL_DATA']], - 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], -} ], - '_CM_CACHED_VALUE_INDEX' : [ 0x58, { - 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x8, ['__unnamed_2430']], -} ], - '_PPM_COORDINATED_SELECTION' : [ 0x18, { - 'MaximumStates' : [ 0x0, ['unsigned long']], - 'SelectedStates' : [ 0x4, ['unsigned long']], - 'DefaultSelection' : [ 0x8, ['unsigned long']], - 'Selection' : [ 0x10, ['pointer64', ['unsigned long']]], -} ], - '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { - 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], -} ], - '_MI_PAGE_COMBINING_SUPPORT' : [ 0x188, { - 'Partition' : [ 0x0, ['pointer64', ['_MI_PARTITION']]], - 'ArbitraryPfnMapList' : [ 0x8, ['_LIST_ENTRY']], - 'FreeCombinePoolItem' : [ 0x18, ['_MI_COMBINE_WORKITEM']], - 'CombiningThreadCount' : [ 0x40, ['unsigned long']], - 'CombinePageFreeList' : [ 0x48, ['_LIST_ENTRY']], - 'CombineFreeListLock' : [ 0x58, ['unsigned long long']], - 'CombinePageListHeads' : [ 0x60, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], - 'PageCombineStats' : [ 0x160, ['_MI_PAGE_COMBINE_STATISTICS']], -} ], - '_VF_AVL_TREE_NODE' : [ 0x10, { - 'p' : [ 0x0, ['pointer64', ['void']]], - 'RangeSize' : [ 0x8, ['unsigned long long']], -} ], - '_POP_FX_DEVICE' : [ 0x278, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'IrpData' : [ 0x18, ['pointer64', ['_POP_IRP_DATA']]], - 'Status' : [ 0x20, ['_POP_FX_DEVICE_STATUS']], - 'PowerReqCall' : [ 0x24, ['long']], - 'PowerNotReqCall' : [ 0x28, ['long']], - 'DevNode' : [ 0x30, ['pointer64', ['_DEVICE_NODE']]], - 'DpmContext' : [ 0x38, ['pointer64', ['PEPHANDLE__']]], - 'Plugin' : [ 0x40, ['pointer64', ['_POP_FX_PLUGIN']]], - 'PluginHandle' : [ 0x48, ['pointer64', ['PEPHANDLE__']]], - 'AcpiPlugin' : [ 0x50, ['pointer64', ['_POP_FX_PLUGIN']]], - 'AcpiPluginHandle' : [ 0x58, ['pointer64', ['PEPHANDLE__']]], - 'DeviceObject' : [ 0x60, ['pointer64', ['_DEVICE_OBJECT']]], - 'TargetDevice' : [ 0x68, ['pointer64', ['_DEVICE_OBJECT']]], - 'Callbacks' : [ 0x70, ['_POP_FX_DRIVER_CALLBACKS']], - 'DriverContext' : [ 0xa8, ['pointer64', ['void']]], - 'AcpiLink' : [ 0xb0, ['_LIST_ENTRY']], - 'DeviceId' : [ 0xc0, ['_UNICODE_STRING']], - 'RemoveLock' : [ 0xd0, ['_IO_REMOVE_LOCK']], - 'AcpiRemoveLock' : [ 0xf0, ['_IO_REMOVE_LOCK']], - 'WorkOrder' : [ 0x110, ['_POP_FX_WORK_ORDER']], - 'IdleLock' : [ 0x148, ['unsigned long long']], - 'IdleTimer' : [ 0x150, ['_KTIMER']], - 'IdleDpc' : [ 0x190, ['_KDPC']], - 'IdleTimeout' : [ 0x1d0, ['unsigned long long']], - 'IdleStamp' : [ 0x1d8, ['unsigned long long']], - 'NextIrpDeviceObject' : [ 0x1e0, ['array', 2, ['pointer64', ['_DEVICE_OBJECT']]]], - 'NextIrpPowerState' : [ 0x1f0, ['array', 2, ['_POWER_STATE']]], - 'NextIrpCallerCompletion' : [ 0x1f8, ['array', 2, ['pointer64', ['void']]]], - 'NextIrpCallerContext' : [ 0x208, ['array', 2, ['pointer64', ['void']]]], - 'IrpCompleteEvent' : [ 0x218, ['_KEVENT']], - 'PowerOnDumpDeviceCallback' : [ 0x230, ['pointer64', ['void']]], - 'Accounting' : [ 0x238, ['_POP_FX_ACCOUNTING']], - 'Flags' : [ 0x268, ['unsigned long']], - 'ComponentCount' : [ 0x26c, ['unsigned long']], - 'Components' : [ 0x270, ['pointer64', ['pointer64', ['_POP_FX_COMPONENT']]]], -} ], - '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { - 'AsULong' : [ 0x0, ['unsigned long']], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_2458' : [ 0x8, { - 'IdleTime' : [ 0x0, ['unsigned long']], - 'NonIdleTime' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_245a' : [ 0x8, { - 'Disk' : [ 0x0, ['__unnamed_2458']], -} ], - '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x60, { - 'IdleCount' : [ 0x0, ['unsigned long']], - 'BusyCount' : [ 0x4, ['unsigned long']], - 'BusyReference' : [ 0x8, ['unsigned long']], - 'TotalBusyCount' : [ 0xc, ['unsigned long']], - 'ConservationIdleTime' : [ 0x10, ['unsigned long']], - 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], - 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], - 'IdleList' : [ 0x20, ['_LIST_ENTRY']], - 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], - 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], - 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], - 'CoolingExtension' : [ 0x40, ['pointer64', ['_POP_COOLING_EXTENSION']]], - 'Volume' : [ 0x48, ['_LIST_ENTRY']], - 'Specific' : [ 0x58, ['__unnamed_245a']], -} ], - '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { - 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], - 'AllocateFromCount' : [ 0x8, ['unsigned long']], - 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], -} ], - '_PROCESSOR_NUMBER' : [ 0x4, { - 'Group' : [ 0x0, ['unsigned short']], - 'Number' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], -} ], - '_MI_COMBINE_STATE' : [ 0x1a0, { - 'ActiveSpinLock' : [ 0x0, ['long']], - 'CombiningThreadCount' : [ 0x4, ['unsigned long']], - 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], - 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], - 'CrossPartition' : [ 0x18, ['_MI_PAGE_COMBINING_SUPPORT']], -} ], - '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x30, { - 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], - 'ListHead' : [ 0x20, ['_LIST_ENTRY']], -} ], - '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { - 'BadPageCount' : [ 0x0, ['unsigned long long']], - 'BadPagesDetected' : [ 0x8, ['long']], - 'ZeroedPageSingleBitErrorsDetected' : [ 0xc, ['long']], - 'ScrubPasses' : [ 0x10, ['long']], - 'ScrubBadPagesFound' : [ 0x14, ['long']], - 'PageHashErrors' : [ 0x18, ['unsigned long']], - 'FeatureBits' : [ 0x20, ['unsigned long long']], - 'TimeZoneId' : [ 0x28, ['unsigned long']], - 'Flags' : [ 0x2c, ['_MI_FLAGS']], - 'VsmConnection' : [ 0x30, ['pointer64', ['void']]], -} ], - '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'AsUCHAR' : [ 0x0, ['unsigned char']], -} ], - '_FS_FILTER_CALLBACKS' : [ 0x68, { - 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], - 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], - 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], - 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], - 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], - 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], - 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], - 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], - 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], - 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], - 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], - 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], -} ], - '_KENLISTMENT' : [ 0x1e0, { - 'cookie' : [ 0x0, ['unsigned long']], - 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], - 'EnlistmentId' : [ 0x30, ['_GUID']], - 'Mutex' : [ 0x40, ['_KMUTANT']], - 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], - 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], - 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], - 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], - 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], - 'Flags' : [ 0xac, ['unsigned long']], - 'NotificationMask' : [ 0xb0, ['unsigned long']], - 'Key' : [ 0xb8, ['pointer64', ['void']]], - 'KeyRefCount' : [ 0xc0, ['unsigned long']], - 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], - 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], - 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], - 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], - 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], - 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], - 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], - 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], - 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], - 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], - 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], - 'NextHistory' : [ 0x138, ['unsigned long']], - 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], -} ], - '_ARBITER_INTERFACE' : [ 0x30, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x8, ['pointer64', ['void']]], - 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], - 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], - 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], - 'Flags' : [ 0x28, ['unsigned long']], -} ], - '_DELAY_ACK_FO' : [ 0x18, { - 'Links' : [ 0x0, ['_LIST_ENTRY']], - 'OriginalFileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], -} ], - '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { - 'Continue' : [ 0x0, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], - 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], -} ], - '_DEVICE_RELATIONS' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned long']], - 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], -} ], - '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { - 'Magic' : [ 0x0, ['unsigned short']], - 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], - 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], - 'SizeOfCode' : [ 0x4, ['unsigned long']], - 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], - 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], - 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], - 'BaseOfCode' : [ 0x14, ['unsigned long']], - 'BaseOfData' : [ 0x18, ['unsigned long']], - 'BaseOfBss' : [ 0x1c, ['unsigned long']], - 'GprMask' : [ 0x20, ['unsigned long']], - 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], - 'GpValue' : [ 0x34, ['unsigned long']], -} ], - '_MI_CROSS_PARTITION_CHARGES' : [ 0x28, { - 'CurrentCharges' : [ 0x0, ['unsigned long long']], - 'ChargeFailures' : [ 0x8, ['unsigned long long']], - 'ChargePeak' : [ 0x10, ['unsigned long long']], - 'ChargeMinimum' : [ 0x18, ['unsigned long long']], - 'ChargeMaximum' : [ 0x20, ['unsigned long long']], -} ], - '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x38, { - 'BugCheckCode' : [ 0x0, ['unsigned long']], - 'Active' : [ 0x4, ['long']], - 'Data' : [ 0x8, ['unsigned long']], - 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], - 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], -} ], - '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { - 'StartMagic' : [ 0x0, ['unsigned long long']], - 'TotalSize' : [ 0x8, ['unsigned long']], - 'ListOffset' : [ 0xc, ['unsigned long']], - 'ListSize' : [ 0x10, ['unsigned long']], - 'BitmapOffset' : [ 0x14, ['unsigned long']], - 'BitmapSize' : [ 0x18, ['unsigned long']], - 'DataOffset' : [ 0x1c, ['unsigned long']], - 'DataSize' : [ 0x20, ['unsigned long']], - 'AttributeFlags' : [ 0x24, ['unsigned long']], - 'AttributeSize' : [ 0x28, ['unsigned long']], - 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], - 'LastMessageId' : [ 0x48, ['unsigned long']], - 'LastCallbackId' : [ 0x4c, ['unsigned long']], - 'PostCount' : [ 0x80, ['unsigned long']], - 'ReturnCount' : [ 0xc0, ['unsigned long']], - 'LogSequenceNumber' : [ 0x100, ['unsigned long']], - 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], - 'EndMagic' : [ 0x148, ['unsigned long long']], -} ], - '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { - 'Characteristics' : [ 0x0, ['unsigned long']], - 'TimeDateStamp' : [ 0x4, ['unsigned long']], - 'MajorVersion' : [ 0x8, ['unsigned short']], - 'MinorVersion' : [ 0xa, ['unsigned short']], - 'Type' : [ 0xc, ['unsigned long']], - 'SizeOfData' : [ 0x10, ['unsigned long']], - 'AddressOfRawData' : [ 0x14, ['unsigned long']], - 'PointerToRawData' : [ 0x18, ['unsigned long']], -} ], - '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], - 'BusNumber' : [ 0x4, ['unsigned long']], - 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], - 'DeviceControl' : [ 0xc, ['unsigned short']], - 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], - 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], - 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], - 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], - 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], -} ], - '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { - 'ExpansionLock' : [ 0x0, ['unsigned long long']], - 'TrimInProgressCount' : [ 0x8, ['long']], - 'PeriodicWorkingSetEvent' : [ 0x10, ['_KEVENT']], - 'TrimAllPageFaultCount' : [ 0x28, ['array', 3, ['unsigned long']]], -} ], - '_ETW_WMITRACE_WORK' : [ 0xf0, { - 'LoggerId' : [ 0x0, ['unsigned long']], - 'SpareUlong' : [ 0x4, ['unsigned long']], - 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], - 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], - 'MaximumFileSize' : [ 0xcc, ['unsigned long']], - 'MinBuffers' : [ 0xd0, ['unsigned long']], - 'MaxBuffers' : [ 0xd4, ['unsigned long']], - 'BufferSize' : [ 0xd8, ['unsigned long']], - 'Mode' : [ 0xdc, ['unsigned long']], - 'FlushTimer' : [ 0xe0, ['unsigned long']], - 'MatchAny' : [ 0x8, ['unsigned long long']], - 'MatchAll' : [ 0x10, ['unsigned long long']], - 'EnableProperty' : [ 0x18, ['unsigned long']], - 'Guid' : [ 0x1c, ['_GUID']], - 'Level' : [ 0x2c, ['unsigned char']], - 'Status' : [ 0xe8, ['long']], -} ], - '_MI_ZERO_COST_COUNTS' : [ 0x10, { - 'NativeSum' : [ 0x0, ['unsigned long long']], - 'CachedSum' : [ 0x8, ['unsigned long long']], -} ], - '_CHILD_LIST' : [ 0x8, { - 'Count' : [ 0x0, ['unsigned long']], - 'List' : [ 0x4, ['unsigned long']], -} ], - '_IO_RESOURCE_LIST' : [ 0x28, { - 'Version' : [ 0x0, ['unsigned short']], - 'Revision' : [ 0x2, ['unsigned short']], - 'Count' : [ 0x4, ['unsigned long']], - 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], -} ], - '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { - 'Continue' : [ 0x0, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], - 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], -} ], - '_MI_RESAVAIL_TRACKER' : [ 0x380, { - 'AllocateKernelStack' : [ 0x0, ['unsigned long long']], - 'AllocateGrowKernelStack' : [ 0x8, ['unsigned long long']], - 'FreeKernelStack' : [ 0x10, ['unsigned long long']], - 'FreeKernelStackError' : [ 0x18, ['unsigned long long']], - 'FreeGrowKernelStackError' : [ 0x20, ['unsigned long long']], - 'AllocateCreateProcess' : [ 0x28, ['unsigned long long']], - 'FreeCreateProcessError' : [ 0x30, ['unsigned long long']], - 'FreeDeleteProcess' : [ 0x38, ['unsigned long long']], - 'FreeCleanProcess' : [ 0x40, ['unsigned long long']], - 'FreeCleanProcessError' : [ 0x48, ['unsigned long long']], - 'AllocateAddProcessWsMetaPage' : [ 0x50, ['unsigned long long']], - 'AllocateWsIncrease' : [ 0x58, ['unsigned long long']], - 'FreeWsIncreaseError' : [ 0x60, ['unsigned long long']], - 'FreeWsIncreaseErrorMax' : [ 0x68, ['unsigned long long']], - 'FreeWsDecrease' : [ 0x70, ['unsigned long long']], - 'AllocateWorkingSetPage' : [ 0x78, ['unsigned long long']], - 'FreeWorkingSetPageError' : [ 0x80, ['unsigned long long']], - 'FreeDeletePteRange' : [ 0x88, ['unsigned long long']], - 'AllocatePageTablesForProcessMetadata' : [ 0x90, ['unsigned long long']], - 'FreePageTablesForProcessMetadataError2' : [ 0x98, ['unsigned long long']], - 'AllocatePageTablesForSystem' : [ 0xa0, ['unsigned long long']], - 'FreePageTablesExcess' : [ 0xa8, ['unsigned long long']], - 'FreeSystemVaPageTables' : [ 0xb0, ['unsigned long long']], - 'FreeSessionVaPageTables' : [ 0xb8, ['unsigned long long']], - 'AllocateCreateSession' : [ 0xc0, ['unsigned long long']], - 'FreeSessionWsDereference' : [ 0xc8, ['unsigned long long']], - 'FreeSessionDereference' : [ 0xd0, ['unsigned long long']], - 'AllocateLockedSessionImage' : [ 0xd8, ['unsigned long long']], - 'FreeLockedSessionImage' : [ 0xe0, ['unsigned long long']], - 'FreeSessionImageConversion' : [ 0xe8, ['unsigned long long']], - 'AllocateWsAdjustPageTable' : [ 0xf0, ['unsigned long long']], - 'FreeWsAdjustPageTable' : [ 0xf8, ['unsigned long long']], - 'FreeWsAdjustPageTableError' : [ 0x100, ['unsigned long long']], - 'AllocateNoLowMemory' : [ 0x108, ['unsigned long long']], - 'AllocatePagedPoolLockedDown' : [ 0x110, ['unsigned long long']], - 'FreePagedPoolLockedDown' : [ 0x118, ['unsigned long long']], - 'AllocateSystemBitmaps' : [ 0x120, ['unsigned long long']], - 'FreeSystemBitmapsError' : [ 0x128, ['unsigned long long']], - 'AllocateForMdl' : [ 0x130, ['unsigned long long']], - 'FreeFromMdl' : [ 0x138, ['unsigned long long']], - 'AllocateForMdlPartition' : [ 0x140, ['unsigned long long']], - 'FreeFromMdlPartition' : [ 0x148, ['unsigned long long']], - 'FreeMdlExcess' : [ 0x150, ['unsigned long long']], - 'AllocateExpansionNonPagedPool' : [ 0x158, ['unsigned long long']], - 'FreeExpansionNonPagedPool' : [ 0x160, ['unsigned long long']], - 'AllocateVad' : [ 0x168, ['unsigned long long']], - 'RemoveVad' : [ 0x170, ['unsigned long long']], - 'FreeVad' : [ 0x178, ['unsigned long long']], - 'AllocateContiguous' : [ 0x180, ['unsigned long long']], - 'FreeContiguousPages' : [ 0x188, ['unsigned long long']], - 'FreeContiguousError' : [ 0x190, ['unsigned long long']], - 'FreeLargePageMemory' : [ 0x198, ['unsigned long long']], - 'AllocateSystemWsles' : [ 0x1a0, ['unsigned long long']], - 'FreeSystemWsles' : [ 0x1a8, ['unsigned long long']], - 'AllocateSystemInitWs' : [ 0x1b0, ['unsigned long long']], - 'AllocateSessionInitWs' : [ 0x1b8, ['unsigned long long']], - 'FreeSessionInitWsError' : [ 0x1c0, ['unsigned long long']], - 'AllocateSystemImage' : [ 0x1c8, ['unsigned long long']], - 'AllocateSystemImageLoad' : [ 0x1d0, ['unsigned long long']], - 'AllocateSessionSharedImage' : [ 0x1d8, ['unsigned long long']], - 'FreeSystemImageInitCode' : [ 0x1e0, ['unsigned long long']], - 'FreeSystemImageLargePageConversion' : [ 0x1e8, ['unsigned long long']], - 'FreeSystemImageError' : [ 0x1f0, ['unsigned long long']], - 'FreeSystemImageLoadExcess' : [ 0x1f8, ['unsigned long long']], - 'FreeUnloadSystemImage' : [ 0x200, ['unsigned long long']], - 'FreeReloadBootImageLarge' : [ 0x208, ['unsigned long long']], - 'FreeIndependent' : [ 0x210, ['unsigned long long']], - 'AllocateHotRemove' : [ 0x218, ['unsigned long long']], - 'FreeHotAdd' : [ 0x220, ['unsigned long long']], - 'AllocateBoot' : [ 0x228, ['unsigned long long']], - 'FreeLoaderBlock' : [ 0x230, ['unsigned long long']], - 'AllocateNonPagedSpecialPool' : [ 0x238, ['unsigned long long']], - 'FreeNonPagedSpecialPoolError' : [ 0x240, ['unsigned long long']], - 'FreeNonPagedSpecialPool' : [ 0x248, ['unsigned long long']], - 'AllocateSharedSegmentPage' : [ 0x250, ['unsigned long long']], - 'FreeSharedSegmentPage' : [ 0x258, ['unsigned long long']], - 'AllocateZeroPage' : [ 0x260, ['unsigned long long']], - 'FreeZeroPage' : [ 0x268, ['unsigned long long']], - 'AllocateForPo' : [ 0x270, ['unsigned long long']], - 'AllocateForPoForce' : [ 0x278, ['unsigned long long']], - 'FreeForPo' : [ 0x280, ['unsigned long long']], - 'AllocateThreadHardFaultBehavior' : [ 0x288, ['unsigned long long']], - 'FreeThreadHardFaultBehavior' : [ 0x290, ['unsigned long long']], - 'ObtainFaultCharges' : [ 0x298, ['unsigned long long']], - 'FreeFaultCharges' : [ 0x2a0, ['unsigned long long']], - 'AllocateStoreCharges' : [ 0x2a8, ['unsigned long long']], - 'FreeStoreCharges' : [ 0x2b0, ['unsigned long long']], - 'ObtainLockedPageCharge' : [ 0x2c0, ['unsigned long long']], - 'FreeLockedPageCharge' : [ 0x300, ['unsigned long long']], - 'AllocateStore' : [ 0x308, ['unsigned long long']], - 'FreeStore' : [ 0x310, ['unsigned long long']], - 'AllocateSystemImageProtos' : [ 0x318, ['unsigned long long']], - 'FreeSystemImageProtos' : [ 0x320, ['unsigned long long']], - 'AllocateModWriterCharge' : [ 0x328, ['unsigned long long']], - 'FreeModWriterCharge' : [ 0x330, ['unsigned long long']], - 'AllocateMappedWriterCharge' : [ 0x338, ['unsigned long long']], - 'FreeMappedWriterCharge' : [ 0x340, ['unsigned long long']], - 'AllocateRegistryCharges' : [ 0x348, ['unsigned long long']], - 'FreeRegistryCharges' : [ 0x350, ['unsigned long long']], -} ], - '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_XSAVE_AREA_HEADER' : [ 0x40, { - 'Mask' : [ 0x0, ['unsigned long long']], - 'CompactionMask' : [ 0x8, ['unsigned long long']], - 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], -} ], - '_RTL_CRITICAL_SECTION' : [ 0x28, { - 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], - 'LockCount' : [ 0x8, ['long']], - 'RecursionCount' : [ 0xc, ['long']], - 'OwningThread' : [ 0x10, ['pointer64', ['void']]], - 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], - 'SpinCount' : [ 0x20, ['unsigned long long']], -} ], - '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x40, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], - 'Context' : [ 0x18, ['pointer64', ['void']]], - 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], - 'IrpPended' : [ 0x24, ['unsigned long']], - 'Status' : [ 0x28, ['long']], - 'Information' : [ 0x30, ['pointer64', ['void']]], - 'ReferenceCount' : [ 0x38, ['long']], -} ], - '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x10, { - 'Table' : [ 0x0, ['_RTL_AVL_TREE']], - 'Lock' : [ 0x8, ['long']], -} ], - '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { - 'NumberOfRuns' : [ 0x0, ['unsigned long']], - 'NumberOfPages' : [ 0x8, ['unsigned long long']], - 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], -} ], - '_KTSS64' : [ 0x68, { - 'Reserved0' : [ 0x0, ['unsigned long']], - 'Rsp0' : [ 0x4, ['unsigned long long']], - 'Rsp1' : [ 0xc, ['unsigned long long']], - 'Rsp2' : [ 0x14, ['unsigned long long']], - 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], - 'Reserved1' : [ 0x5c, ['unsigned long long']], - 'Reserved2' : [ 0x64, ['unsigned short']], - 'IoMapBase' : [ 0x66, ['unsigned short']], -} ], - '__unnamed_24ce' : [ 0x8, { - 'Start' : [ 0x0, ['unsigned long']], - 'Length' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_24d0' : [ 0x8, { - 'RangeCount' : [ 0x0, ['unsigned long']], - 'SetBitCount' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_24d2' : [ 0x8, { - 'Context1' : [ 0x0, ['unsigned long']], - 'Context2' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_24d4' : [ 0x8, { - 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_24ce']], - 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_24d0']], - 'Raw' : [ 0x0, ['__unnamed_24d2']], -} ], - '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x48, { - 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], - 'Operation' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], - 'Data' : [ 0xc, ['__unnamed_24d4']], - 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], -} ], - '_MI_SYSTEM_NODE_INFORMATION' : [ 0x1a0, { - 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], - 'NonPagedPoolSListHead' : [ 0x10, ['array', 3, ['_SLIST_HEADER']]], - 'NonPagedPoolSListHeadNx' : [ 0x40, ['array', 3, ['_SLIST_HEADER']]], - 'CachedKernelStacks' : [ 0x70, ['array', 2, ['_CACHED_KSTACK_LIST']]], - 'NonPagedBitMapMaximum' : [ 0xb0, ['unsigned long long']], - 'DynamicBitMapNonPagedPool' : [ 0xb8, ['_MI_DYNAMIC_BITMAP']], - 'NonPagedPoolLowestPage' : [ 0x108, ['unsigned long long']], - 'NonPagedPoolHighestPage' : [ 0x110, ['unsigned long long']], - 'AllocatedNonPagedPool' : [ 0x118, ['unsigned long long']], - 'PartialLargePoolRegions' : [ 0x120, ['unsigned long long']], - 'PagesInPartialLargePoolRegions' : [ 0x128, ['unsigned long long']], - 'CachedNonPagedPoolCount' : [ 0x130, ['unsigned long long']], - 'NonPagedPoolSpinLock' : [ 0x138, ['unsigned long long']], - 'CachedNonPagedPool' : [ 0x140, ['pointer64', ['_MMPFN']]], - 'NonPagedPoolFirstVa' : [ 0x148, ['pointer64', ['void']]], - 'NonPagedPoolLastVa' : [ 0x150, ['pointer64', ['void']]], - 'NonPagedBitMap' : [ 0x158, ['array', 3, ['_RTL_BITMAP_EX']]], - 'NonPagedHint' : [ 0x188, ['array', 2, ['unsigned long long']]], -} ], - '_KLOCK_ENTRY_LOCK_STATE' : [ 0x10, { - 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 63, native_type='unsigned long long')]], - 'InTree' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], - 'LockState' : [ 0x0, ['pointer64', ['void']]], - 'SessionState' : [ 0x8, ['pointer64', ['void']]], - 'SessionId' : [ 0x8, ['unsigned long']], - 'SessionPad' : [ 0xc, ['unsigned long']], -} ], - '__unnamed_24e4' : [ 0x4, { - 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], - 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], - 'Long' : [ 0x0, ['long']], -} ], - '_MI_PARTITION_STORES' : [ 0x80, { - 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_24e4']], - 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], - 'Registered' : [ 0x8, ['unsigned long']], - 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], - 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], - 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], - 'WriteIssueFailures' : [ 0x18, ['unsigned long']], - 'EvictionThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], - 'EvictEvent' : [ 0x28, ['_KEVENT']], - 'EvictFlushCompleteEvent' : [ 0x40, ['_KEVENT']], - 'WriteSupportSListHead' : [ 0x60, ['_SLIST_HEADER']], - 'EvictFlushLock' : [ 0x70, ['long']], - 'ModifiedWriteFailedBitmap' : [ 0x78, ['pointer64', ['_RTL_BITMAP']]], -} ], - '_EVENT_FILTER_HEADER' : [ 0x18, { - 'Id' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], - 'InstanceId' : [ 0x8, ['unsigned long long']], - 'Size' : [ 0x10, ['unsigned long']], - 'NextOffset' : [ 0x14, ['unsigned long']], -} ], - '_WAIT_CONTEXT_BLOCK' : [ 0x48, { - 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], - 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], - 'NumberOfChannels' : [ 0x10, ['unsigned long']], - 'SyncCallback' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DmaContext' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Reserved' : [ 0x14, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], - 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], - 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], - 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], - 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], - 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], - 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], -} ], - '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { - 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], - 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], - 'ConvKey' : [ 0x8, ['unsigned long']], - 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], - 'NameLength' : [ 0x18, ['unsigned short']], - 'Name' : [ 0x1a, ['array', 1, ['wchar']]], -} ], - '_u' : [ 0x50, { - 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], - 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], - 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], - 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], - 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], - 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], - 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], -} ], - '_HBASE_BLOCK' : [ 0x1000, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Sequence1' : [ 0x4, ['unsigned long']], - 'Sequence2' : [ 0x8, ['unsigned long']], - 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], - 'Major' : [ 0x14, ['unsigned long']], - 'Minor' : [ 0x18, ['unsigned long']], - 'Type' : [ 0x1c, ['unsigned long']], - 'Format' : [ 0x20, ['unsigned long']], - 'RootCell' : [ 0x24, ['unsigned long']], - 'Length' : [ 0x28, ['unsigned long']], - 'Cluster' : [ 0x2c, ['unsigned long']], - 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], - 'RmId' : [ 0x70, ['_GUID']], - 'LogId' : [ 0x80, ['_GUID']], - 'Flags' : [ 0x90, ['unsigned long']], - 'TmId' : [ 0x94, ['_GUID']], - 'GuidSignature' : [ 0xa4, ['unsigned long']], - 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], - 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], - 'CheckSum' : [ 0x1fc, ['unsigned long']], - 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], - 'ThawTmId' : [ 0xfc8, ['_GUID']], - 'ThawRmId' : [ 0xfd8, ['_GUID']], - 'ThawLogId' : [ 0xfe8, ['_GUID']], - 'BootType' : [ 0xff8, ['unsigned long']], - 'BootRecover' : [ 0xffc, ['unsigned long']], -} ], - '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Depth' : [ 0x10, ['unsigned short']], - 'MaximumDepth' : [ 0x12, ['unsigned short']], - 'TotalAllocates' : [ 0x14, ['unsigned long']], - 'AllocateMisses' : [ 0x18, ['unsigned long']], - 'AllocateHits' : [ 0x18, ['unsigned long']], - 'TotalFrees' : [ 0x1c, ['unsigned long']], - 'FreeMisses' : [ 0x20, ['unsigned long']], - 'FreeHits' : [ 0x20, ['unsigned long']], - 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'Tag' : [ 0x28, ['unsigned long']], - 'Size' : [ 0x2c, ['unsigned long']], - 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], - 'Allocate' : [ 0x30, ['pointer64', ['void']]], - 'FreeEx' : [ 0x38, ['pointer64', ['void']]], - 'Free' : [ 0x38, ['pointer64', ['void']]], - 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], - 'LastTotalAllocates' : [ 0x50, ['unsigned long']], - 'LastAllocateMisses' : [ 0x54, ['unsigned long']], - 'LastAllocateHits' : [ 0x54, ['unsigned long']], - 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], -} ], - '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { - 'Linkage' : [ 0x0, ['_LIST_ENTRY']], - 'Signature' : [ 0x10, ['unsigned long long']], -} ], - '_MI_SUB64K_FREE_RANGES' : [ 0x30, { - 'BitMap' : [ 0x0, ['_RTL_BITMAP_EX']], - 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], - 'Vad' : [ 0x20, ['pointer64', ['_MMVAD_SHORT']]], - 'SubListIndex' : [ 0x28, ['unsigned short']], - 'Hint' : [ 0x2a, ['unsigned short']], - 'SetBits' : [ 0x2c, ['unsigned long']], -} ], - '_ETW_LAST_ENABLE_INFO' : [ 0x10, { - 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], - 'LoggerId' : [ 0x8, ['unsigned short']], - 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], -} ], - '_M128A' : [ 0x10, { - 'Low' : [ 0x0, ['unsigned long long']], - 'High' : [ 0x8, ['long long']], -} ], - '_HEAP_LOOKASIDE' : [ 0x40, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'Depth' : [ 0x10, ['unsigned short']], - 'MaximumDepth' : [ 0x12, ['unsigned short']], - 'TotalAllocates' : [ 0x14, ['unsigned long']], - 'AllocateMisses' : [ 0x18, ['unsigned long']], - 'TotalFrees' : [ 0x1c, ['unsigned long']], - 'FreeMisses' : [ 0x20, ['unsigned long']], - 'LastTotalAllocates' : [ 0x24, ['unsigned long']], - 'LastAllocateMisses' : [ 0x28, ['unsigned long']], - 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], -} ], - '_KTIMER' : [ 0x40, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], - 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], - 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], - 'Processor' : [ 0x38, ['unsigned long']], - 'Period' : [ 0x3c, ['unsigned long']], -} ], - '_RTL_ATOM_TABLE' : [ 0x28, { - 'Signature' : [ 0x0, ['unsigned long']], - 'ReferenceCount' : [ 0x4, ['long']], - 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], - 'ExHandleTable' : [ 0x10, ['pointer64', ['_HANDLE_TABLE']]], - 'Flags' : [ 0x18, ['unsigned long']], - 'NumberOfBuckets' : [ 0x1c, ['unsigned long']], - 'Buckets' : [ 0x20, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], -} ], - '__unnamed_2522' : [ 0x18, { - 'RequestedTime' : [ 0x0, ['unsigned long long']], - 'ProgrammedTime' : [ 0x8, ['unsigned long long']], - 'TimerInfo' : [ 0x10, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], -} ], - '_POP_POWER_ACTION' : [ 0x110, { - 'Updates' : [ 0x0, ['unsigned char']], - 'State' : [ 0x1, ['unsigned char']], - 'Shutdown' : [ 0x2, ['unsigned char']], - 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], - 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'Flags' : [ 0xc, ['unsigned long']], - 'Status' : [ 0x10, ['long']], - 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], - 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], - 'IrpMinor' : [ 0x1c, ['unsigned char']], - 'Waking' : [ 0x1d, ['unsigned char']], - 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], - 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], - 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], - 'WakeTime' : [ 0x48, ['unsigned long long']], - 'SleepTime' : [ 0x50, ['unsigned long long']], - 'WakeFirstUnattendedTime' : [ 0x58, ['unsigned long long']], - 'WakeAlarmSignaled' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], - 'WakeAlarm' : [ 0x68, ['array', 3, ['__unnamed_2522']]], - 'WakeAlarmPaused' : [ 0xb0, ['unsigned char']], - 'WakeAlarmLastTime' : [ 0xb8, ['unsigned long long']], - 'FilteredCapabilities' : [ 0xc0, ['SYSTEM_POWER_CAPABILITIES']], -} ], - '_CM_KEY_VALUE' : [ 0x18, { - 'Signature' : [ 0x0, ['unsigned short']], - 'NameLength' : [ 0x2, ['unsigned short']], - 'DataLength' : [ 0x4, ['unsigned long']], - 'Data' : [ 0x8, ['unsigned long']], - 'Type' : [ 0xc, ['unsigned long']], - 'Flags' : [ 0x10, ['unsigned short']], - 'Spare' : [ 0x12, ['unsigned short']], - 'Name' : [ 0x14, ['array', 1, ['wchar']]], -} ], - '_CM_KEY_HASH' : [ 0x20, { - 'ConvKey' : [ 0x0, ['unsigned long']], - 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], - 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], - 'KeyCell' : [ 0x18, ['unsigned long']], -} ], - '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], -} ], - '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { - 'ProcessorIndex' : [ 0x0, ['unsigned long']], - 'ExpectedState' : [ 0x4, ['unsigned char']], - 'AllowDeeperStates' : [ 0x5, ['unsigned char']], - 'LooseDependency' : [ 0x6, ['unsigned char']], -} ], - '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { - 'TraceFlag' : [ 0x0, ['unsigned long']], - 'Dr7' : [ 0x4, ['unsigned long long']], - 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], - 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], -} ], - '_KAPC_STATE' : [ 0x30, { - 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], - 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], - 'InProgressFlags' : [ 0x28, ['unsigned char']], - 'KernelApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'SpecialApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'KernelApcPending' : [ 0x29, ['unsigned char']], - 'UserApcPending' : [ 0x2a, ['unsigned char']], -} ], - '_PO_DEVICE_NOTIFY' : [ 0x68, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], - 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], - 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], - 'OrderLevel' : [ 0x38, ['unsigned char']], - 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], - 'DeviceName' : [ 0x48, ['pointer64', ['unsigned short']]], - 'DriverName' : [ 0x50, ['pointer64', ['unsigned short']]], - 'ChildCount' : [ 0x58, ['unsigned long']], - 'ActiveChild' : [ 0x5c, ['unsigned long']], - 'ParentCount' : [ 0x60, ['unsigned long']], - 'ActiveParent' : [ 0x64, ['unsigned long']], -} ], - '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { - 'Cell' : [ 0x0, ['unsigned long']], - 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], -} ], - '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { - 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], - 'Operation' : [ 0x4, ['unsigned char']], - 'Reserved' : [ 0x5, ['unsigned char']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], - 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], -} ], - '_GDI_TEB_BATCH32' : [ 0x4e0, { - 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'HDC' : [ 0x4, ['unsigned long']], - 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], -} ], - '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], - 'BusNumber' : [ 0x4, ['unsigned long']], - 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], - 'DeviceControl' : [ 0xc, ['unsigned short']], - 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], - 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], - 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], - 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], - 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], - 'RootErrorCommand' : [ 0x20, ['unsigned long']], -} ], - '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { - 'TotalTime' : [ 0x0, ['unsigned long long']], - 'CancelCount' : [ 0x8, ['unsigned long']], - 'FailureCount' : [ 0xc, ['unsigned long']], - 'SuccessCount' : [ 0x10, ['unsigned long']], - 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], - 'MinTime' : [ 0x18, ['unsigned long long']], - 'MaxTime' : [ 0x20, ['unsigned long long']], - 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], - 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], -} ], - '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { - 'PageHashes' : [ 0x0, ['pointer64', ['void']]], - 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], -} ], - '_KENLISTMENT_HISTORY' : [ 0x8, { - 'Notification' : [ 0x0, ['unsigned long']], - 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], -} ], - '_FAST_IO_DISPATCH' : [ 0xe0, { - 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], - 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], - 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], - 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], - 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], - 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], - 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], - 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], - 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], - 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], - 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], - 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], - 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], - 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], - 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], - 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], - 'MdlRead' : [ 0x80, ['pointer64', ['void']]], - 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], - 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], - 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], - 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], - 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], - 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], - 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], - 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], - 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], - 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], - 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], -} ], - '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { - 'SelectedState' : [ 0x0, ['unsigned long']], - 'VetoedStates' : [ 0x4, ['unsigned long']], - 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], -} ], - '_KIDTENTRY64' : [ 0x10, { - 'OffsetLow' : [ 0x0, ['unsigned short']], - 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], - 'OffsetMiddle' : [ 0x6, ['unsigned short']], - 'OffsetHigh' : [ 0x8, ['unsigned long']], - 'Reserved1' : [ 0xc, ['unsigned long']], - 'Alignment' : [ 0x0, ['unsigned long long']], -} ], - '_CM_CELL_REMAP_BLOCK' : [ 0x8, { - 'OldCell' : [ 0x0, ['unsigned long']], - 'NewCell' : [ 0x4, ['unsigned long']], -} ], - '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { - 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], - 'ResourceType' : [ 0x10, ['unsigned char']], - 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], - 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], - 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], - 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], - 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], - 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], - 'State' : [ 0x68, ['unsigned char']], - 'ResourcesChanged' : [ 0x69, ['unsigned char']], -} ], - '_SECURITY_DESCRIPTOR' : [ 0x28, { - 'Revision' : [ 0x0, ['unsigned char']], - 'Sbz1' : [ 0x1, ['unsigned char']], - 'Control' : [ 0x2, ['unsigned short']], - 'Owner' : [ 0x8, ['pointer64', ['void']]], - 'Group' : [ 0x10, ['pointer64', ['void']]], - 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], - 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], -} ], - '_MODWRITER_FLAGS' : [ 0x4, { - 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], - 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], -} ], - '_MI_PTE_CHAIN_HEAD' : [ 0x18, { - 'Flink' : [ 0x0, ['_MMPTE']], - 'Blink' : [ 0x8, ['_MMPTE']], - 'PteBase' : [ 0x10, ['pointer64', ['_MMPTE']]], -} ], - '_PPM_SELECTION_MENU_ENTRY' : [ 0x18, { - 'StrictDependency' : [ 0x0, ['unsigned char']], - 'InitiatingState' : [ 0x1, ['unsigned char']], - 'DependentState' : [ 0x2, ['unsigned char']], - 'StateIndex' : [ 0x4, ['unsigned long']], - 'Dependencies' : [ 0x8, ['unsigned long']], - 'DependencyList' : [ 0x10, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], -} ], - '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x28, { - 'RefCount' : [ 0x0, ['unsigned long']], - 'Anchor' : [ 0x0, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], - 'AllocationBitmap' : [ 0x8, ['_RTL_BITMAP']], - 'ReservationBitmap' : [ 0x18, ['_RTL_BITMAP']], - 'EvictedBitmap' : [ 0x18, ['_RTL_BITMAP']], -} ], - '_KQUEUE' : [ 0x40, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], - 'CurrentCount' : [ 0x28, ['unsigned long']], - 'MaximumCount' : [ 0x2c, ['unsigned long']], - 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], -} ], - '_MI_COMBINE_WORKITEM' : [ 0x28, { - 'NextEntry' : [ 0x0, ['pointer64', ['void']]], - 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], -} ], - '_RTL_USER_PROCESS_PARAMETERS' : [ 0x410, { - 'MaximumLength' : [ 0x0, ['unsigned long']], - 'Length' : [ 0x4, ['unsigned long']], - 'Flags' : [ 0x8, ['unsigned long']], - 'DebugFlags' : [ 0xc, ['unsigned long']], - 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], - 'ConsoleFlags' : [ 0x18, ['unsigned long']], - 'StandardInput' : [ 0x20, ['pointer64', ['void']]], - 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], - 'StandardError' : [ 0x30, ['pointer64', ['void']]], - 'CurrentDirectory' : [ 0x38, ['_CURDIR']], - 'DllPath' : [ 0x50, ['_UNICODE_STRING']], - 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], - 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], - 'Environment' : [ 0x80, ['pointer64', ['void']]], - 'StartingX' : [ 0x88, ['unsigned long']], - 'StartingY' : [ 0x8c, ['unsigned long']], - 'CountX' : [ 0x90, ['unsigned long']], - 'CountY' : [ 0x94, ['unsigned long']], - 'CountCharsX' : [ 0x98, ['unsigned long']], - 'CountCharsY' : [ 0x9c, ['unsigned long']], - 'FillAttribute' : [ 0xa0, ['unsigned long']], - 'WindowFlags' : [ 0xa4, ['unsigned long']], - 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], - 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], - 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], - 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], - 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], - 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], - 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], - 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], - 'PackageDependencyData' : [ 0x400, ['pointer64', ['void']]], - 'ProcessGroupId' : [ 0x408, ['unsigned long']], - 'LoaderThreads' : [ 0x40c, ['unsigned long']], -} ], - '_PHYSICAL_MEMORY_RUN' : [ 0x10, { - 'BasePage' : [ 0x0, ['unsigned long long']], - 'PageCount' : [ 0x8, ['unsigned long long']], -} ], - '_RTL_SRWLOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], - 'Value' : [ 0x0, ['unsigned long long']], - 'Ptr' : [ 0x0, ['pointer64', ['void']]], -} ], - '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { - 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], - 'Expired' : [ 0x20, ['unsigned char']], -} ], - '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { - 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], - 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], - 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], - 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], -} ], - '_PROC_PERF_LOAD' : [ 0x2, { - 'BusyPercentage' : [ 0x0, ['unsigned char']], - 'FrequencyPercentage' : [ 0x1, ['unsigned char']], -} ], - '_RTL_RANGE' : [ 0x28, { - 'Start' : [ 0x0, ['unsigned long long']], - 'End' : [ 0x8, ['unsigned long long']], - 'UserData' : [ 0x10, ['pointer64', ['void']]], - 'Owner' : [ 0x18, ['pointer64', ['void']]], - 'Attributes' : [ 0x20, ['unsigned char']], - 'Flags' : [ 0x21, ['unsigned char']], -} ], - '_LOCK_HEADER' : [ 0x20, { - 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], - 'Count' : [ 0x8, ['unsigned long long']], - 'Lock' : [ 0x10, ['unsigned long long']], - 'Valid' : [ 0x18, ['unsigned long']], -} ], - '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], -} ], - '_MMSECTION_FLAGS2' : [ 0x4, { - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], - 'NumberOfChildViews' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], -} ], - '_KSPECIAL_REGISTERS' : [ 0xe0, { - 'Cr0' : [ 0x0, ['unsigned long long']], - 'Cr2' : [ 0x8, ['unsigned long long']], - 'Cr3' : [ 0x10, ['unsigned long long']], - 'Cr4' : [ 0x18, ['unsigned long long']], - 'KernelDr0' : [ 0x20, ['unsigned long long']], - 'KernelDr1' : [ 0x28, ['unsigned long long']], - 'KernelDr2' : [ 0x30, ['unsigned long long']], - 'KernelDr3' : [ 0x38, ['unsigned long long']], - 'KernelDr6' : [ 0x40, ['unsigned long long']], - 'KernelDr7' : [ 0x48, ['unsigned long long']], - 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], - 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], - 'Tr' : [ 0x70, ['unsigned short']], - 'Ldtr' : [ 0x72, ['unsigned short']], - 'MxCsr' : [ 0x74, ['unsigned long']], - 'DebugControl' : [ 0x78, ['unsigned long long']], - 'LastBranchToRip' : [ 0x80, ['unsigned long long']], - 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], - 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], - 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], - 'Cr8' : [ 0xa0, ['unsigned long long']], - 'MsrGsBase' : [ 0xa8, ['unsigned long long']], - 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], - 'MsrStar' : [ 0xb8, ['unsigned long long']], - 'MsrLStar' : [ 0xc0, ['unsigned long long']], - 'MsrCStar' : [ 0xc8, ['unsigned long long']], - 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], - 'Xcr0' : [ 0xd8, ['unsigned long long']], -} ], - '_SYSTEM_POWER_POLICY' : [ 0xe8, { - 'Revision' : [ 0x0, ['unsigned long']], - 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], - 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], - 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], - 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'Reserved' : [ 0x2c, ['unsigned long']], - 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], - 'IdleTimeout' : [ 0x3c, ['unsigned long']], - 'IdleSensitivity' : [ 0x40, ['unsigned char']], - 'DynamicThrottle' : [ 0x41, ['unsigned char']], - 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], - 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'WinLogonFlags' : [ 0x50, ['unsigned long']], - 'Spare3' : [ 0x54, ['unsigned long']], - 'DozeS4Timeout' : [ 0x58, ['unsigned long']], - 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], - 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], - 'VideoTimeout' : [ 0xc0, ['unsigned long']], - 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], - 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], - 'SpindownTimeout' : [ 0xd4, ['unsigned long']], - 'OptimizeForPower' : [ 0xd8, ['unsigned char']], - 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], - 'ForcedThrottle' : [ 0xda, ['unsigned char']], - 'MinThrottle' : [ 0xdb, ['unsigned char']], - 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], -} ], - '_PEB64' : [ 0x7a0, { - 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], - 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], - 'BeingDebugged' : [ 0x2, ['unsigned char']], - 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], - 'Mutant' : [ 0x8, ['unsigned long long']], - 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], - 'Ldr' : [ 0x18, ['unsigned long long']], - 'ProcessParameters' : [ 0x20, ['unsigned long long']], - 'SubSystemData' : [ 0x28, ['unsigned long long']], - 'ProcessHeap' : [ 0x30, ['unsigned long long']], - 'FastPebLock' : [ 0x38, ['unsigned long long']], - 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], - 'IFEOKey' : [ 0x48, ['unsigned long long']], - 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], - 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], - 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], - 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], - 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], - 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], - 'ApiSetMap' : [ 0x68, ['unsigned long long']], - 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], - 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], - 'TlsBitmap' : [ 0x78, ['unsigned long long']], - 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], - 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], - 'SparePvoid0' : [ 0x90, ['unsigned long long']], - 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], - 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], - 'OemCodePageData' : [ 0xa8, ['unsigned long long']], - 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], - 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], - 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], - 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], - 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], - 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], - 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], - 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], - 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], - 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], - 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], - 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], - 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], - 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], - 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], - 'LoaderLock' : [ 0x110, ['unsigned long long']], - 'OSMajorVersion' : [ 0x118, ['unsigned long']], - 'OSMinorVersion' : [ 0x11c, ['unsigned long']], - 'OSBuildNumber' : [ 0x120, ['unsigned short']], - 'OSCSDVersion' : [ 0x122, ['unsigned short']], - 'OSPlatformId' : [ 0x124, ['unsigned long']], - 'ImageSubsystem' : [ 0x128, ['unsigned long']], - 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], - 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], - 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], - 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], - 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], - 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], - 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], - 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], - 'SessionId' : [ 0x2c0, ['unsigned long']], - 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], - 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], - 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], - 'pShimData' : [ 0x2d8, ['unsigned long long']], - 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], - 'CSDVersion' : [ 0x2e8, ['_STRING64']], - 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], - 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], - 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], - 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], - 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], - 'FlsCallback' : [ 0x320, ['unsigned long long']], - 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], - 'FlsBitmap' : [ 0x338, ['unsigned long long']], - 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], - 'FlsHighIndex' : [ 0x350, ['unsigned long']], - 'WerRegistrationData' : [ 0x358, ['unsigned long long']], - 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], - 'pUnused' : [ 0x368, ['unsigned long long']], - 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], - 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], - 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], - 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], - 'TppWorkerpList' : [ 0x390, ['LIST_ENTRY64']], - 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['unsigned long long']]], -} ], - '_PS_PROTECTION' : [ 0x1, { - 'Level' : [ 0x0, ['unsigned char']], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], -} ], - '_MSUBSECTION' : [ 0x70, { - 'Core' : [ 0x0, ['_SUBSECTION']], - 'SubsectionNode' : [ 0x38, ['_RTL_BALANCED_NODE']], - 'DereferenceList' : [ 0x50, ['_LIST_ENTRY']], - 'NumberOfMappedViews' : [ 0x60, ['unsigned long long']], - 'NumberOfPfnReferences' : [ 0x68, ['unsigned long']], -} ], - '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { - 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], -} ], - '_HEAP_ENTRY_EXTRA' : [ 0x10, { - 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], - 'TagIndex' : [ 0x2, ['unsigned short']], - 'Settable' : [ 0x8, ['unsigned long long']], - 'ZeroInit' : [ 0x0, ['unsigned long long']], - 'ZeroInit1' : [ 0x8, ['unsigned long long']], -} ], - '_VF_POOL_TRACE' : [ 0x80, { - 'Address' : [ 0x0, ['pointer64', ['void']]], - 'Size' : [ 0x8, ['unsigned long long']], - 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], - 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], -} ], - '__unnamed_25ee' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], -} ], - '_MM_SESSION_SPACE' : [ 0x1f40, { - 'ReferenceCount' : [ 0x0, ['long']], - 'u' : [ 0x4, ['__unnamed_25ee']], - 'SessionId' : [ 0x8, ['unsigned long']], - 'ProcessReferenceToSession' : [ 0xc, ['long']], - 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], - 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long long']], - 'NonPagablePages' : [ 0x28, ['unsigned long long']], - 'CommittedPages' : [ 0x30, ['unsigned long long']], - 'PagedPoolStart' : [ 0x38, ['pointer64', ['void']]], - 'PagedPoolEnd' : [ 0x40, ['pointer64', ['void']]], - 'SessionObject' : [ 0x48, ['pointer64', ['void']]], - 'SessionObjectHandle' : [ 0x50, ['pointer64', ['void']]], - 'SessionPoolAllocationFailures' : [ 0x58, ['array', 4, ['unsigned long']]], - 'ImageTree' : [ 0x68, ['_RTL_AVL_TREE']], - 'LocaleId' : [ 0x70, ['unsigned long']], - 'AttachCount' : [ 0x74, ['unsigned long']], - 'AttachGate' : [ 0x78, ['_KGATE']], - 'WsListEntry' : [ 0x90, ['_LIST_ENTRY']], - 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], - 'Session' : [ 0xb40, ['_MMSESSION']], - 'PagedPoolInfo' : [ 0xb60, ['_MM_PAGED_POOL_INFO']], - 'Vm' : [ 0xb98, ['_MMSUPPORT']], - 'Wsle' : [ 0xc90, ['pointer64', ['_MMWSLE']]], - 'DriverUnload' : [ 0xc98, ['_MI_SESSION_DRIVER_UNLOAD']], - 'PagedPool' : [ 0xcc0, ['_POOL_DESCRIPTOR']], - 'PageDirectory' : [ 0x1e00, ['_MMPTE']], - 'SessionVaLock' : [ 0x1e08, ['_EX_PUSH_LOCK']], - 'DynamicVaBitMap' : [ 0x1e10, ['_RTL_BITMAP']], - 'DynamicVaHint' : [ 0x1e20, ['unsigned long']], - 'SpecialPool' : [ 0x1e28, ['_MI_SPECIAL_POOL']], - 'SessionPteLock' : [ 0x1e78, ['_EX_PUSH_LOCK']], - 'PoolBigEntriesInUse' : [ 0x1e80, ['long']], - 'PagedPoolPdeCount' : [ 0x1e84, ['unsigned long']], - 'SpecialPoolPdeCount' : [ 0x1e88, ['unsigned long']], - 'DynamicSessionPdeCount' : [ 0x1e8c, ['unsigned long']], - 'SystemPteInfo' : [ 0x1e90, ['_MI_SYSTEM_PTE_TYPE']], - 'PoolTrackTableExpansion' : [ 0x1ef0, ['pointer64', ['void']]], - 'PoolTrackTableExpansionSize' : [ 0x1ef8, ['unsigned long long']], - 'PoolTrackBigPages' : [ 0x1f00, ['pointer64', ['void']]], - 'PoolTrackBigPagesSize' : [ 0x1f08, ['unsigned long long']], - 'IoState' : [ 0x1f10, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], - 'IoStateSequence' : [ 0x1f14, ['unsigned long']], - 'IoNotificationEvent' : [ 0x1f18, ['_KEVENT']], - 'ServerSilo' : [ 0x1f30, ['pointer64', ['_EJOB']]], - 'CreateTime' : [ 0x1f38, ['unsigned long long']], -} ], - '_MMPAGE_FILE_EXPANSION' : [ 0x60, { - 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], - 'DereferenceList' : [ 0x8, ['_LIST_ENTRY']], - 'Partition' : [ 0x18, ['pointer64', ['_MI_PARTITION']]], - 'RequestedExpansionSize' : [ 0x20, ['unsigned long long']], - 'ActualExpansion' : [ 0x28, ['unsigned long long']], - 'Event' : [ 0x30, ['_KEVENT']], - 'InProgress' : [ 0x48, ['long']], - 'u' : [ 0x4c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], - 'ActiveEntry' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], - 'AttemptForCantExtend' : [ 0x58, ['unsigned char']], - 'PageFileContract' : [ 0x59, ['unsigned char']], -} ], - '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { - 'BankNumber' : [ 0x0, ['unsigned char']], - 'ClearOnInitialization' : [ 0x1, ['unsigned char']], - 'StatusDataFormat' : [ 0x2, ['unsigned char']], - 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], - 'ControlMsr' : [ 0x4, ['unsigned long']], - 'StatusMsr' : [ 0x8, ['unsigned long']], - 'AddressMsr' : [ 0xc, ['unsigned long']], - 'MiscMsr' : [ 0x10, ['unsigned long']], - 'ControlData' : [ 0x14, ['unsigned long long']], -} ], - '__unnamed_25ff' : [ 0x4, { - 'LongFlags2' : [ 0x0, ['unsigned long']], - 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], -} ], - '__unnamed_2603' : [ 0x8, { - 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], - 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], -} ], - '_MMVAD' : [ 0x88, { - 'Core' : [ 0x0, ['_MMVAD_SHORT']], - 'u2' : [ 0x40, ['__unnamed_25ff']], - 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], - 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], - 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], - 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], - 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], - 'u4' : [ 0x78, ['__unnamed_2603']], - 'FileObject' : [ 0x80, ['pointer64', ['_FILE_OBJECT']]], -} ], - '_SEP_SID_VALUES_BLOCK' : [ 0x20, { - 'BlockLength' : [ 0x0, ['unsigned long']], - 'ReferenceCount' : [ 0x8, ['long long']], - 'SidCount' : [ 0x10, ['unsigned long']], - 'SidValuesStart' : [ 0x18, ['unsigned long long']], -} ], - '_MI_PARTITION_STATE' : [ 0x60, { - 'PartitionLock' : [ 0x0, ['unsigned long long']], - 'PartitionIdLock' : [ 0x8, ['_EX_PUSH_LOCK']], - 'InitialPartitionIdBits' : [ 0x10, ['unsigned long long']], - 'PartitionList' : [ 0x18, ['_LIST_ENTRY']], - 'PartitionIdBitmap' : [ 0x28, ['pointer64', ['_RTL_BITMAP']]], - 'InitialPartitionIdBitmap' : [ 0x30, ['_RTL_BITMAP']], - 'TempPartitionPointers' : [ 0x40, ['array', 1, ['pointer64', ['_MI_PARTITION']]]], - 'Partition' : [ 0x48, ['pointer64', ['pointer64', ['_MI_PARTITION']]]], - 'TotalPagesInChildPartitions' : [ 0x50, ['unsigned long long']], - 'CrossPartitionDenials' : [ 0x58, ['unsigned long']], -} ], - '_MMMOD_WRITER_LISTHEAD' : [ 0x28, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Gate' : [ 0x10, ['_KGATE']], - 'Event' : [ 0x10, ['_KEVENT']], -} ], - '_CM_RM' : [ 0x88, { - 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], - 'TmHandle' : [ 0x20, ['pointer64', ['void']]], - 'Tm' : [ 0x28, ['pointer64', ['void']]], - 'RmHandle' : [ 0x30, ['pointer64', ['void']]], - 'KtmRm' : [ 0x38, ['pointer64', ['void']]], - 'RefCount' : [ 0x40, ['unsigned long']], - 'ContainerNum' : [ 0x44, ['unsigned long']], - 'ContainerSize' : [ 0x48, ['unsigned long long']], - 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], - 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], - 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], - 'RmFlags' : [ 0x68, ['unsigned long']], - 'LogStartStatus1' : [ 0x6c, ['long']], - 'LogStartStatus2' : [ 0x70, ['long']], - 'BaseLsn' : [ 0x78, ['unsigned long long']], - 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], -} ], - '_NONOPAQUE_OPLOCK' : [ 0xa0, { - 'IrpExclusiveOplock' : [ 0x0, ['pointer64', ['_IRP']]], - 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], - 'ExclusiveOplockOwner' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'ExclusiveOplockOwnerThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], - 'WaiterPriority' : [ 0x20, ['unsigned char']], - 'IrpOplocksR' : [ 0x28, ['_LIST_ENTRY']], - 'IrpOplocksRH' : [ 0x38, ['_LIST_ENTRY']], - 'RHBreakQueue' : [ 0x48, ['_LIST_ENTRY']], - 'WaitingIrps' : [ 0x58, ['_LIST_ENTRY']], - 'DelayAckFileObjectQueue' : [ 0x68, ['_LIST_ENTRY']], - 'AtomicQueue' : [ 0x78, ['_LIST_ENTRY']], - 'DeleterParentKey' : [ 0x88, ['pointer64', ['_GUID']]], - 'OplockState' : [ 0x90, ['unsigned long']], - 'FastMutex' : [ 0x98, ['pointer64', ['_FAST_MUTEX']]], -} ], - '_MI_LARGEPAGE_MEMORY_INFO' : [ 0x28, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'ColoredPageInfoBase' : [ 0x10, ['pointer64', ['_COLORED_PAGE_INFO']]], - 'PagesNeedZeroing' : [ 0x18, ['unsigned long']], - 'LargeImageBias' : [ 0x1c, ['unsigned char']], - 'Spare' : [ 0x1d, ['array', 3, ['unsigned char']]], - 'ActualImageViewSize' : [ 0x20, ['unsigned long long']], -} ], - '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { - 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], -} ], - '_PROCESS_ENERGY_VALUES' : [ 0x90, { - 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], - 'DiskEnergy' : [ 0x40, ['unsigned long long']], - 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], - 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], - 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], - 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], - 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'WindowInformation' : [ 0x68, ['unsigned long']], - 'PixelArea' : [ 0x6c, ['unsigned long']], - 'PixelReportTimestamp' : [ 0x70, ['long long']], - 'PixelTime' : [ 0x78, ['unsigned long long']], - 'ForegroundReportTimestamp' : [ 0x80, ['long long']], - 'ForegroundTime' : [ 0x88, ['unsigned long long']], -} ], - '_CLIENT_ID' : [ 0x10, { - 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], - 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], -} ], - '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { - 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], - 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], - 'PhysicalAddress' : [ 0x10, ['unsigned long long']], - 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], - 'Node' : [ 0x20, ['unsigned short']], - 'Card' : [ 0x22, ['unsigned short']], - 'Module' : [ 0x24, ['unsigned short']], - 'Bank' : [ 0x26, ['unsigned short']], - 'Device' : [ 0x28, ['unsigned short']], - 'Row' : [ 0x2a, ['unsigned short']], - 'Column' : [ 0x2c, ['unsigned short']], - 'BitPosition' : [ 0x2e, ['unsigned short']], - 'RequesterId' : [ 0x30, ['unsigned long long']], - 'ResponderId' : [ 0x38, ['unsigned long long']], - 'TargetId' : [ 0x40, ['unsigned long long']], - 'ErrorType' : [ 0x48, ['unsigned char']], -} ], - '_MI_COMMON_PAGE_STATE' : [ 0x98, { - 'PageOfOnesPfn' : [ 0x0, ['pointer64', ['_MMPFN']]], - 'PageOfOnes' : [ 0x8, ['unsigned long long']], - 'DummyPagePfn' : [ 0x10, ['pointer64', ['_MMPFN']]], - 'DummyPage' : [ 0x18, ['unsigned long long']], - 'PageOfZeroes' : [ 0x20, ['unsigned long long']], - 'ZeroMapping' : [ 0x28, ['pointer64', ['void']]], - 'OnesMapping' : [ 0x30, ['pointer64', ['void']]], - 'BitmapGapFrames' : [ 0x38, ['array', 4, ['unsigned long long']]], - 'PfnGapFrames' : [ 0x58, ['array', 4, ['unsigned long long']]], - 'PageTableOfZeroes' : [ 0x78, ['unsigned long long']], - 'PdeOfZeroes' : [ 0x80, ['_MMPTE']], - 'PageTableOfOnes' : [ 0x88, ['unsigned long long']], - 'PdeOfOnes' : [ 0x90, ['_MMPTE']], -} ], - '_KWAIT_STATUS_REGISTER' : [ 0x1, { - 'Flags' : [ 0x0, ['unsigned char']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], -} ], - '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], - 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], - 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], - 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], - 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], - 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], - 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], - 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], - 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], -} ], - '_MMPFNLIST_SHORT' : [ 0x18, { - 'Total' : [ 0x0, ['unsigned long long']], - 'Flink' : [ 0x8, ['unsigned long long']], - 'Blink' : [ 0x10, ['unsigned long long']], -} ], - '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { - 'BusDataType' : [ 0x0, ['unsigned long']], - 'BusNumber' : [ 0x4, ['unsigned long']], - 'SlotNumber' : [ 0x8, ['unsigned long']], - 'Offset' : [ 0xc, ['unsigned long']], - 'Length' : [ 0x10, ['unsigned long']], -} ], - '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], - 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], - 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { - 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], - 'ClientToken' : [ 0x10, ['pointer64', ['void']]], - 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], - 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], - 'ServerIsRemote' : [ 0x1a, ['unsigned char']], - 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], -} ], - '_MI_VAD_ALLOCATION_CELL' : [ 0x28, { - 'AllocationBitMap' : [ 0x0, ['_RTL_BITMAP']], - 'BitMapHint' : [ 0x10, ['unsigned long']], - 'LastAllocationSize' : [ 0x14, ['unsigned long']], - 'LastAllocationSizeHint' : [ 0x18, ['unsigned long']], - 'LowestBottomUpVadBit' : [ 0x1c, ['unsigned long']], - 'LowestBottomUpAllocationAddress' : [ 0x20, ['pointer64', ['void']]], -} ], - '_MI_REVERSE_VIEW_MAP' : [ 0x28, { - 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], - 'SystemCacheVa' : [ 0x10, ['pointer64', ['void']]], - 'SessionViewVa' : [ 0x10, ['pointer64', ['void']]], - 'VadsProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], - 'Type' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], - 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], - 'SubsectionType' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'SectionOffset' : [ 0x20, ['unsigned long long']], -} ], - '_IO_SECURITY_CONTEXT' : [ 0x18, { - 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], - 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], - 'DesiredAccess' : [ 0x10, ['unsigned long']], - 'FullCreateOptions' : [ 0x14, ['unsigned long']], -} ], - '__unnamed_2647' : [ 0x38, { - 'Mdl' : [ 0x0, ['_MDL']], - 'Page' : [ 0x30, ['array', 1, ['unsigned long long']]], -} ], - '_MI_PAGEFILE_TRACES' : [ 0x78, { - 'Status' : [ 0x0, ['long']], - 'PartitionId' : [ 0x4, ['unsigned short']], - 'Priority' : [ 0x6, ['unsigned char']], - 'IrpPriority' : [ 0x7, ['unsigned char']], - 'ReservationWrite' : [ 0x8, ['unsigned char']], - 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], - 'AvailablePages' : [ 0x18, ['unsigned long long']], - 'ModifiedPagesTotal' : [ 0x20, ['unsigned long long']], - 'ModifiedPagefilePages' : [ 0x28, ['unsigned long long']], - 'ModifiedNoWritePages' : [ 0x30, ['unsigned long long']], - 'ModifiedPagefileNoReservationPages' : [ 0x38, ['unsigned long long']], - 'MdlHack' : [ 0x40, ['__unnamed_2647']], -} ], - '_PROC_PERF_DOMAIN' : [ 0x190, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], - 'Members' : [ 0x18, ['_KAFFINITY_EX']], - 'ProcessorCount' : [ 0xc0, ['unsigned long']], - 'Class' : [ 0xc4, ['unsigned char']], - 'Spare' : [ 0xc5, ['array', 3, ['unsigned char']]], - 'Processors' : [ 0xc8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], - 'GetFFHThrottleState' : [ 0xd0, ['pointer64', ['void']]], - 'TimeWindowHandler' : [ 0xd8, ['pointer64', ['void']]], - 'BoostPolicyHandler' : [ 0xe0, ['pointer64', ['void']]], - 'BoostModeHandler' : [ 0xe8, ['pointer64', ['void']]], - 'EnergyPerfPreferenceHandler' : [ 0xf0, ['pointer64', ['void']]], - 'AutonomousActivityWindowHandler' : [ 0xf8, ['pointer64', ['void']]], - 'AutonomousModeHandler' : [ 0x100, ['pointer64', ['void']]], - 'ReinitializeHandler' : [ 0x108, ['pointer64', ['void']]], - 'PerfSelectionHandler' : [ 0x110, ['pointer64', ['void']]], - 'PerfControlHandler' : [ 0x118, ['pointer64', ['void']]], - 'MaxFrequency' : [ 0x120, ['unsigned long']], - 'NominalFrequency' : [ 0x124, ['unsigned long']], - 'MaxPercent' : [ 0x128, ['unsigned long']], - 'MinPerfPercent' : [ 0x12c, ['unsigned long']], - 'MinThrottlePercent' : [ 0x130, ['unsigned long']], - 'MinimumRelativePerformance' : [ 0x138, ['unsigned long long']], - 'NominalRelativePerformance' : [ 0x140, ['unsigned long long']], - 'Coordination' : [ 0x148, ['unsigned char']], - 'HardPlatformCap' : [ 0x149, ['unsigned char']], - 'AffinitizeControl' : [ 0x14a, ['unsigned char']], - 'EfficientThrottle' : [ 0x14b, ['unsigned char']], - 'AutonomousMode' : [ 0x14c, ['unsigned char']], - 'SelectedPercent' : [ 0x150, ['unsigned long']], - 'SelectedFrequency' : [ 0x154, ['unsigned long']], - 'DesiredPercent' : [ 0x158, ['unsigned long']], - 'MaxPolicyPercent' : [ 0x15c, ['unsigned long']], - 'MinPolicyPercent' : [ 0x160, ['unsigned long']], - 'ConstrainedMaxPercent' : [ 0x164, ['unsigned long']], - 'ConstrainedMinPercent' : [ 0x168, ['unsigned long']], - 'GuaranteedPercent' : [ 0x16c, ['unsigned long']], - 'TolerancePercent' : [ 0x170, ['unsigned long']], - 'SelectedState' : [ 0x178, ['unsigned long long']], - 'PerfChangeTime' : [ 0x180, ['unsigned long long']], - 'PerfChangeIntervalCount' : [ 0x188, ['unsigned long']], - 'Force' : [ 0x18c, ['unsigned char']], - 'ProvideGuidance' : [ 0x18d, ['unsigned char']], -} ], - '_X86_DBGKD_CONTROL_SET' : [ 0x10, { - 'TraceFlag' : [ 0x0, ['unsigned long']], - 'Dr7' : [ 0x4, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], - 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], -} ], - '_HVIEW_MAP_TABLE' : [ 0x800, { - 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], -} ], - '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { - 'ClientId' : [ 0x0, ['_CLIENT_ID']], - 'Handle' : [ 0x10, ['pointer64', ['void']]], - 'Type' : [ 0x18, ['unsigned long']], - 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], -} ], - '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], -} ], - '_DUMMY_FILE_OBJECT' : [ 0x110, { - 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], - 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], -} ], - '_TRIAGE_9F_PNP' : [ 0x18, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Revision' : [ 0x2, ['unsigned short']], - 'CompletionQueue' : [ 0x8, ['pointer64', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], - 'DelayedWorkQueue' : [ 0x10, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], -} ], - '_RELATION_LIST' : [ 0x10, { - 'DeviceObjectList' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT_LIST']]], - 'Sorted' : [ 0x8, ['unsigned char']], -} ], - '_IO_TIMER' : [ 0x30, { - 'Type' : [ 0x0, ['short']], - 'TimerFlag' : [ 0x2, ['short']], - 'TimerList' : [ 0x8, ['_LIST_ENTRY']], - 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], - 'Context' : [ 0x20, ['pointer64', ['void']]], - 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], -} ], - '_MI_STANDBY_STATE' : [ 0xc0, { - 'TransitionSharedPages' : [ 0x0, ['unsigned long long']], - 'TransitionSharedPagesPeak' : [ 0x8, ['array', 3, ['unsigned long long']]], - 'FirstDecayPage' : [ 0x20, ['unsigned long long']], - 'PfnDecayFreeSList' : [ 0x30, ['_SLIST_HEADER']], - 'PfnRepurposeLog' : [ 0x40, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], - 'AllocatePfnRepurposeDpc' : [ 0x48, ['_KDPC']], -} ], - '_MI_ACCESS_LOG_STATE' : [ 0x80, { - 'CcAccessLog' : [ 0x0, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], - 'Enabled' : [ 0x8, ['unsigned long']], - 'DisableAccessLogging' : [ 0x10, ['_WORK_QUEUE_ITEM']], - 'MinLoggingPriority' : [ 0x30, ['unsigned long']], - 'AccessLoggingLock' : [ 0x40, ['unsigned long long']], -} ], - '_ETW_BUFFER_QUEUE' : [ 0x18, { - 'QueueHead' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], - 'QueueTail' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], - 'QueueEntry' : [ 0x10, ['_SINGLE_LIST_ENTRY']], -} ], - '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { - 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], - 'AllocateFromCount' : [ 0x8, ['unsigned long']], - 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], -} ], - '_MI_SPECIAL_POOL' : [ 0x50, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], - 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], - 'PagesInUse' : [ 0x38, ['unsigned long long']], - 'SpecialPoolPdes' : [ 0x40, ['_RTL_BITMAP']], -} ], - '_LOGGED_STREAM_CALLBACK_V2' : [ 0x8, { - 'LogHandleContext' : [ 0x0, ['pointer64', ['_LOG_HANDLE_CONTEXT']]], -} ], - '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { - 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], - 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], - 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], - 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], -} ], - '_POP_CURRENT_BROADCAST' : [ 0x18, { - 'InProgress' : [ 0x0, ['unsigned char']], - 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], - 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], - 'DeviceState' : [ 0x10, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], -} ], - 'PEPHANDLE__' : [ 0x4, { - 'unused' : [ 0x0, ['long']], -} ], - '__unnamed_2691' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['unsigned char']], - 'Flags1' : [ 0x1, ['unsigned char']], - 'Flags2' : [ 0x2, ['unsigned char']], - 'BaseHigh' : [ 0x3, ['unsigned char']], -} ], - '__unnamed_2695' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], -} ], - '_KGDTENTRY64' : [ 0x10, { - 'LimitLow' : [ 0x0, ['unsigned short']], - 'BaseLow' : [ 0x2, ['unsigned short']], - 'Bytes' : [ 0x4, ['__unnamed_2691']], - 'Bits' : [ 0x4, ['__unnamed_2695']], - 'BaseUpper' : [ 0x8, ['unsigned long']], - 'MustBeZero' : [ 0xc, ['unsigned long']], - 'DataLow' : [ 0x0, ['long long']], - 'DataHigh' : [ 0x8, ['long long']], -} ], - '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { - 'Status' : [ 0x0, ['long']], - 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], - 'Lock' : [ 0x40, ['_FAST_MUTEX']], - 'List' : [ 0x78, ['_LIST_ENTRY']], -} ], - '_IOV_IRP_TRACE' : [ 0x80, { - 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], - 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], - 'KernelApcDisable' : [ 0x10, ['short']], - 'SpecialApcDisable' : [ 0x12, ['short']], - 'CombinedApcDisable' : [ 0x10, ['unsigned long']], - 'Irql' : [ 0x14, ['unsigned char']], - 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], -} ], - '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { - 'MailslotQuota' : [ 0x0, ['unsigned long']], - 'MaximumMessageSize' : [ 0x4, ['unsigned long']], - 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], - 'TimeoutSpecified' : [ 0x10, ['unsigned char']], -} ], - '_PO_IRP_MANAGER' : [ 0x20, { - 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], - 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], -} ], - '_DYNAMIC_FUNCTION_TABLE' : [ 0x58, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'FunctionTable' : [ 0x10, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], - 'TimeStamp' : [ 0x18, ['_LARGE_INTEGER']], - 'MinimumAddress' : [ 0x20, ['unsigned long long']], - 'MaximumAddress' : [ 0x28, ['unsigned long long']], - 'BaseAddress' : [ 0x30, ['unsigned long long']], - 'Callback' : [ 0x38, ['pointer64', ['void']]], - 'Context' : [ 0x40, ['pointer64', ['void']]], - 'OutOfProcessCallbackDll' : [ 0x48, ['pointer64', ['unsigned short']]], - 'Type' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'RF_SORTED', 1: 'RF_UNSORTED', 2: 'RF_CALLBACK', 3: 'RF_KERNEL_DYNAMIC'})]], - 'EntryCount' : [ 0x54, ['unsigned long']], -} ], - '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x10, { - 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'HashTable' : [ 0x8, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], -} ], - '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { - 'EnableLogging' : [ 0x0, ['unsigned char']], - 'MismatchCount' : [ 0x4, ['unsigned long']], - 'Initialized' : [ 0x8, ['unsigned char']], - 'LastValue' : [ 0x10, ['unsigned long long']], - 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], -} ], - '_PROC_IDLE_POLICY' : [ 0x6, { - 'PromotePercent' : [ 0x0, ['unsigned char']], - 'DemotePercent' : [ 0x1, ['unsigned char']], - 'PromotePercentBase' : [ 0x2, ['unsigned char']], - 'DemotePercentBase' : [ 0x3, ['unsigned char']], - 'AllowScaling' : [ 0x4, ['unsigned char']], - 'ForceLightIdle' : [ 0x5, ['unsigned char']], -} ], - '_CLIENT_ID64' : [ 0x10, { - 'UniqueProcess' : [ 0x0, ['unsigned long long']], - 'UniqueThread' : [ 0x8, ['unsigned long long']], -} ], - '__unnamed_26b7' : [ 0x4, { - 'PercentLevel' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_26b9' : [ 0x4, { - 'Type' : [ 0x0, ['unsigned long']], -} ], - '_POP_ACTION_TRIGGER' : [ 0x18, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyDeviceMax'})]], - 'Flags' : [ 0x4, ['unsigned long']], - 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], - 'Battery' : [ 0x10, ['__unnamed_26b7']], - 'Button' : [ 0x10, ['__unnamed_26b9']], -} ], - '_KDPC_DATA' : [ 0x28, { - 'DpcList' : [ 0x0, ['_KDPC_LIST']], - 'DpcLock' : [ 0x10, ['unsigned long long']], - 'DpcQueueDepth' : [ 0x18, ['long']], - 'DpcCount' : [ 0x1c, ['unsigned long']], - 'ActiveDpc' : [ 0x20, ['pointer64', ['_KDPC']]], -} ], - '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { - 'NamedPipeType' : [ 0x0, ['unsigned long']], - 'ReadMode' : [ 0x4, ['unsigned long']], - 'CompletionMode' : [ 0x8, ['unsigned long']], - 'MaximumInstances' : [ 0xc, ['unsigned long']], - 'InboundQuota' : [ 0x10, ['unsigned long']], - 'OutboundQuota' : [ 0x14, ['unsigned long']], - 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], - 'TimeoutSpecified' : [ 0x20, ['unsigned char']], -} ], - '_CM_BIG_DATA' : [ 0x8, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Count' : [ 0x2, ['unsigned short']], - 'List' : [ 0x4, ['unsigned long']], -} ], - '_KSCB' : [ 0x198, { - 'GenerationCycles' : [ 0x0, ['unsigned long long']], - 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], - 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], - 'RankCycleTarget' : [ 0x18, ['unsigned long long']], - 'LongTermCycles' : [ 0x20, ['unsigned long long']], - 'LastReportedCycles' : [ 0x28, ['unsigned long long']], - 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], - 'ReadyTime' : [ 0x38, ['unsigned long long']], - 'InsertTime' : [ 0x40, ['unsigned long long']], - 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], - 'QueueNode' : [ 0x58, ['_RTL_BALANCED_NODE']], - 'Inserted' : [ 0x70, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'MaxOverQuota' : [ 0x70, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'MinOverQuota' : [ 0x70, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'RankBias' : [ 0x70, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'SoftCap' : [ 0x70, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'Spare1' : [ 0x70, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], - 'Depth' : [ 0x71, ['unsigned char']], - 'ReadySummary' : [ 0x72, ['unsigned short']], - 'Rank' : [ 0x74, ['unsigned long']], - 'ReadyListHead' : [ 0x78, ['array', 16, ['_LIST_ENTRY']]], - 'ChildScbQueue' : [ 0x178, ['_RTL_RB_TREE']], - 'Parent' : [ 0x188, ['pointer64', ['_KSCB']]], - 'Root' : [ 0x190, ['pointer64', ['_KSCB']]], -} ], - '__unnamed_26c8' : [ 0x10, { - 'UserData' : [ 0x0, ['pointer64', ['void']]], - 'Owner' : [ 0x8, ['pointer64', ['void']]], -} ], - '__unnamed_26c9' : [ 0x10, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], -} ], - '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { - 'Start' : [ 0x0, ['unsigned long long']], - 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_26c8']], - 'Merged' : [ 0x10, ['__unnamed_26c9']], - 'Attributes' : [ 0x20, ['unsigned char']], - 'PublicFlags' : [ 0x21, ['unsigned char']], - 'PrivateFlags' : [ 0x22, ['unsigned short']], - 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], -} ], - '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { - 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], - 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], -} ], - '_PROC_PERF_HISTORY' : [ 0x24, { - 'Count' : [ 0x0, ['unsigned long']], - 'Slot' : [ 0x4, ['unsigned long']], - 'UtilityTotal' : [ 0x8, ['unsigned long']], - 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], - 'FrequencyTotal' : [ 0x10, ['unsigned long']], - 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], - 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], -} ], - '_MI_PARTITION_ZEROING' : [ 0x68, { - 'PageEvent' : [ 0x0, ['_KEVENT']], - 'ThreadActive' : [ 0x18, ['unsigned char']], - 'ZeroFreePageSlistMinimum' : [ 0x1c, ['long']], - 'FirstReservedZeroingPte' : [ 0x20, ['pointer64', ['_MMPTE']]], - 'RebalanceZeroFreeWorkItem' : [ 0x28, ['_WORK_QUEUE_ITEM']], - 'ThreadCount' : [ 0x48, ['long']], - 'Gate' : [ 0x50, ['_KGATE']], -} ], - '_IMAGE_RUNTIME_FUNCTION_ENTRY' : [ 0xc, { - 'BeginAddress' : [ 0x0, ['unsigned long']], - 'EndAddress' : [ 0x4, ['unsigned long']], - 'UnwindInfoAddress' : [ 0x8, ['unsigned long']], - 'UnwindData' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_26d8' : [ 0x2, { - 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], -} ], - 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { - 'Revision' : [ 0x0, ['unsigned short']], - 'Flags' : [ 0x2, ['__unnamed_26d8']], - 'PolicyCount' : [ 0x4, ['unsigned long']], - 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], -} ], - '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { - 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], - 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], - 'Flags' : [ 0x18, ['unsigned long']], - 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], - 'StackId' : [ 0x20, ['unsigned long']], -} ], - '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { - 'Flags' : [ 0x0, ['unsigned short']], - 'Length' : [ 0x2, ['unsigned short']], - 'TimeStamp' : [ 0x4, ['unsigned long']], - 'DosPath' : [ 0x8, ['_STRING']], -} ], - '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { - 'AsLong' : [ 0x0, ['long']], - 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], - 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], -} ], - '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'Processors' : [ 0x8, ['unsigned long']], - 'ActiveProcessors' : [ 0xc, ['unsigned long']], - 'LastUpdateTime' : [ 0x10, ['unsigned long long']], - 'TotalTime' : [ 0x18, ['unsigned long long']], - 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], -} ], - '_DIAGNOSTIC_CONTEXT' : [ 0x20, { - 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], - 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], - 'ServiceTag' : [ 0x10, ['unsigned long']], - 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], - 'ReasonSize' : [ 0x18, ['unsigned long long']], -} ], - '__unnamed_26f0' : [ 0x4, { - 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_26f2' : [ 0x4, { - 'Flags' : [ 0x0, ['__unnamed_26f0']], - 'Whole' : [ 0x0, ['unsigned long']], -} ], - '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x110, { - 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], - 'WMICallback' : [ 0x8, ['pointer64', ['void']]], - 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], - 'u1' : [ 0x20, ['__unnamed_26f2']], - 'Signature' : [ 0x28, ['unsigned long long']], - 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], - 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], - 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], - 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], - 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], - 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], - 'PagedBytes' : [ 0x60, ['unsigned long long']], - 'NonPagedBytes' : [ 0x68, ['unsigned long long']], - 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], - 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], - 'RaiseIrqls' : [ 0x80, ['unsigned long']], - 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], - 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], - 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], - 'AllocationsFailed' : [ 0x90, ['unsigned long']], - 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], - 'LockedBytes' : [ 0x98, ['unsigned long long']], - 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], - 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], - 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], - 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], - 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], - 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], - 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], - 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], - 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], - 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], - 'ExecutePoolTypes' : [ 0xf8, ['unsigned long']], - 'ExecutePageProtections' : [ 0xfc, ['unsigned long']], - 'ExecutePageMappings' : [ 0x100, ['unsigned long']], - 'ExecuteWriteSections' : [ 0x104, ['unsigned long']], - 'SectionAlignmentFailures' : [ 0x108, ['unsigned long']], -} ], - '_TRIAGE_DEVICE_NODE' : [ 0x58, { - 'Sibling' : [ 0x0, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], - 'Child' : [ 0x8, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], - 'Parent' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], - 'LastChild' : [ 0x18, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], - 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], - 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], - 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], - 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], - 'FxDevice' : [ 0x50, ['pointer64', ['_TRIAGE_POP_FX_DEVICE']]], -} ], - '_PRIVATE_CACHE_MAP' : [ 0x78, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], - 'ReadAheadMask' : [ 0x4, ['unsigned long']], - 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], - 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], - 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], - 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], - 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], - 'SequentialReadCount' : [ 0x30, ['unsigned long']], - 'ReadAheadLength' : [ 0x34, ['unsigned long']], - 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], - 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], - 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], - 'ReadAheadSpinLock' : [ 0x50, ['unsigned long long']], - 'PipelinedReadAheadRequestSize' : [ 0x58, ['unsigned long']], - 'ReadAheadGrowth' : [ 0x5c, ['unsigned long']], - 'PrivateLinks' : [ 0x60, ['_LIST_ENTRY']], - 'ReadAheadWorkItem' : [ 0x70, ['pointer64', ['void']]], -} ], - '_CM_KEY_NODE' : [ 0x50, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Flags' : [ 0x2, ['unsigned short']], - 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], - 'AccessBits' : [ 0xc, ['unsigned long']], - 'Parent' : [ 0x10, ['unsigned long']], - 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], - 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], - 'ValueList' : [ 0x24, ['_CHILD_LIST']], - 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], - 'Security' : [ 0x2c, ['unsigned long']], - 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], - 'MaxClassLen' : [ 0x38, ['unsigned long']], - 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], - 'MaxValueDataLen' : [ 0x40, ['unsigned long']], - 'WorkVar' : [ 0x44, ['unsigned long']], - 'NameLength' : [ 0x48, ['unsigned short']], - 'ClassLength' : [ 0x4a, ['unsigned short']], - 'Name' : [ 0x4c, ['array', 1, ['wchar']]], -} ], - '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { - 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], - 'AsUSHORT' : [ 0x0, ['unsigned short']], -} ], - '_MI_SYSTEM_IMAGE_STATE' : [ 0xc0, { - 'FixupLock' : [ 0x0, ['long']], - 'FixupList' : [ 0x8, ['_LIST_ENTRY']], - 'LoadLock' : [ 0x18, ['_KMUTANT']], - 'FirstLoadEver' : [ 0x50, ['unsigned char']], - 'LargePageAll' : [ 0x51, ['unsigned char']], - 'LastPage' : [ 0x58, ['unsigned long long']], - 'LargePageList' : [ 0x60, ['_LIST_ENTRY']], - 'BeingDeleted' : [ 0x70, ['pointer64', ['_KLDR_DATA_TABLE_ENTRY']]], - 'MappingRangesPushLock' : [ 0x78, ['_EX_PUSH_LOCK']], - 'MappingRanges' : [ 0x80, ['array', 2, ['pointer64', ['_MI_DRIVER_VA']]]], - 'PageCount' : [ 0x90, ['unsigned long long']], - 'PageCounts' : [ 0x98, ['_MM_SYSTEM_PAGE_COUNTS']], - 'CollidedLock' : [ 0xa8, ['_EX_PUSH_LOCK']], - 'ErrataPte' : [ 0xb0, ['pointer64', ['_MMPTE']]], - 'ErrataPteMapped' : [ 0xb8, ['unsigned long']], -} ], - '_PTE_TRACKER' : [ 0x80, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], - 'Count' : [ 0x18, ['unsigned long long']], - 'SystemVa' : [ 0x20, ['pointer64', ['void']]], - 'StartVa' : [ 0x28, ['pointer64', ['void']]], - 'Offset' : [ 0x30, ['unsigned long']], - 'Length' : [ 0x34, ['unsigned long']], - 'Page' : [ 0x38, ['unsigned long long']], - 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], - 'GuardPte' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'Spare' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], - 'StackTrace' : [ 0x48, ['array', 7, ['pointer64', ['void']]]], -} ], - '_HV_GET_CELL_CONTEXT' : [ 0x4, { - 'Cell' : [ 0x0, ['unsigned long']], - 'IsInTempBin' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], -} ], - '_KTHREAD_COUNTERS' : [ 0x1a8, { - 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], - 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], - 'Flags' : [ 0x10, ['unsigned long']], - 'ContextSwitches' : [ 0x14, ['unsigned long']], - 'CycleTimeBias' : [ 0x18, ['unsigned long long']], - 'HardwareCounters' : [ 0x20, ['unsigned long long']], - 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], -} ], - '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { - 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], - 'Flags' : [ 0x10, ['unsigned long']], -} ], - '__unnamed_2724' : [ 0x2, { - 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], - 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], - 'EntireField' : [ 0x0, ['unsigned short']], -} ], - '_KLDR_DATA_TABLE_ENTRY' : [ 0xa0, { - 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], - 'ExceptionTable' : [ 0x10, ['pointer64', ['void']]], - 'ExceptionTableSize' : [ 0x18, ['unsigned long']], - 'GpValue' : [ 0x20, ['pointer64', ['void']]], - 'NonPagedDebugInfo' : [ 0x28, ['pointer64', ['_NON_PAGED_DEBUG_INFO']]], - 'DllBase' : [ 0x30, ['pointer64', ['void']]], - 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], - 'SizeOfImage' : [ 0x40, ['unsigned long']], - 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], - 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], - 'Flags' : [ 0x68, ['unsigned long']], - 'LoadCount' : [ 0x6c, ['unsigned short']], - 'u1' : [ 0x6e, ['__unnamed_2724']], - 'SectionPointer' : [ 0x70, ['pointer64', ['void']]], - 'CheckSum' : [ 0x78, ['unsigned long']], - 'CoverageSectionSize' : [ 0x7c, ['unsigned long']], - 'CoverageSection' : [ 0x80, ['pointer64', ['void']]], - 'LoadedImports' : [ 0x88, ['pointer64', ['void']]], - 'Spare' : [ 0x90, ['pointer64', ['void']]], - 'SizeOfImageNotRounded' : [ 0x98, ['unsigned long']], - 'TimeDateStamp' : [ 0x9c, ['unsigned long']], -} ], - '_DBGKD_GET_VERSION64' : [ 0x28, { - 'MajorVersion' : [ 0x0, ['unsigned short']], - 'MinorVersion' : [ 0x2, ['unsigned short']], - 'ProtocolVersion' : [ 0x4, ['unsigned char']], - 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], - 'Flags' : [ 0x6, ['unsigned short']], - 'MachineType' : [ 0x8, ['unsigned short']], - 'MaxPacketType' : [ 0xa, ['unsigned char']], - 'MaxStateChange' : [ 0xb, ['unsigned char']], - 'MaxManipulate' : [ 0xc, ['unsigned char']], - 'Simulation' : [ 0xd, ['unsigned char']], - 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], - 'KernBase' : [ 0x10, ['unsigned long long']], - 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], - 'DebuggerDataList' : [ 0x20, ['unsigned long long']], -} ], - '_PROC_FEEDBACK_COUNTER' : [ 0x30, { - 'InstantaneousRead' : [ 0x0, ['pointer64', ['void']]], - 'DifferentialRead' : [ 0x0, ['pointer64', ['void']]], - 'LastActualCount' : [ 0x8, ['unsigned long long']], - 'LastReferenceCount' : [ 0x10, ['unsigned long long']], - 'CachedValue' : [ 0x18, ['unsigned long']], - 'Affinitized' : [ 0x20, ['unsigned char']], - 'Differential' : [ 0x21, ['unsigned char']], - 'Scaling' : [ 0x22, ['unsigned char']], - 'Context' : [ 0x28, ['unsigned long long']], -} ], - '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { - 'AsLong' : [ 0x0, ['long']], - 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], - 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], - 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], -} ], - '_MI_PAGING_IO_STATE' : [ 0x50, { - 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], - 'PageFileHeadSpinLock' : [ 0x8, ['long']], - 'PrefetchSeekThreshold' : [ 0xc, ['long']], - 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], - 'InPageSupportSListMinimum' : [ 0x30, ['array', 2, ['unsigned char']]], - 'InPageSinglePages' : [ 0x34, ['unsigned long']], - 'DelayPageFaults' : [ 0x38, ['long']], - 'FileCompressionBoundary' : [ 0x3c, ['unsigned long']], - 'MdlsAdjusted' : [ 0x40, ['unsigned char']], -} ], - '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { - 'Count' : [ 0x0, ['unsigned long']], - 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], -} ], - '_MI_FORCED_COMMITS' : [ 0x8, { - 'Regular' : [ 0x0, ['unsigned long']], - 'Wrap' : [ 0x4, ['unsigned long']], -} ], - '_HMAP_ENTRY' : [ 0x28, { - 'BlockOffset' : [ 0x0, ['unsigned long long']], - 'PermanentBinAddress' : [ 0x8, ['unsigned long long']], - 'TemporaryBinAddress' : [ 0x10, ['unsigned long long']], - 'TemporaryBinRundown' : [ 0x18, ['_EX_RUNDOWN_REF']], - 'MemAlloc' : [ 0x20, ['unsigned long']], -} ], - '_RTL_ATOM_TABLE_ENTRY' : [ 0x30, { - 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], - 'HandleIndex' : [ 0x8, ['unsigned short']], - 'Atom' : [ 0xa, ['unsigned short']], - 'Reference' : [ 0x10, ['_RTL_ATOM_TABLE_REFERENCE']], - 'NameLength' : [ 0x28, ['unsigned char']], - 'Name' : [ 0x2a, ['array', 1, ['wchar']]], -} ], - '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { - 'ResetCount' : [ 0x0, ['unsigned long']], - 'StateCount' : [ 0x4, ['unsigned long']], - 'DeepSleepCount' : [ 0x8, ['unsigned long']], - 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], - 'StartTime' : [ 0x10, ['unsigned long long']], - 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], -} ], - '_TXN_PARAMETER_BLOCK' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'TxFsContext' : [ 0x2, ['unsigned short']], - 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], -} ], - '_DUAL' : [ 0x278, { - 'Length' : [ 0x0, ['unsigned long']], - 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], - 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], - 'Guard' : [ 0x18, ['unsigned long']], - 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], - 'FreeBins' : [ 0x260, ['_LIST_ENTRY']], - 'FreeSummary' : [ 0x270, ['unsigned long']], -} ], - '_MI_VAD_SEQUENTIAL_INFO' : [ 0x8, { - 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long long')]], - 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], -} ], - '__unnamed_2753' : [ 0x4, { - 'ImagePteOffset' : [ 0x0, ['unsigned long']], - 'TossPage' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_2756' : [ 0x4, { - 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], - 'LongFlags' : [ 0x0, ['unsigned long']], -} ], - '_MMINPAGE_SUPPORT' : [ 0x1b0, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'ListHead' : [ 0x10, ['_LIST_ENTRY']], - 'Event' : [ 0x20, ['_KEVENT']], - 'CollidedEvent' : [ 0x38, ['_KEVENT']], - 'IoStatus' : [ 0x50, ['_IO_STATUS_BLOCK']], - 'ReadOffset' : [ 0x60, ['_LARGE_INTEGER']], - 'ApcState' : [ 0x68, ['_KAPC_STATE']], - 'Thread' : [ 0x98, ['pointer64', ['_ETHREAD']]], - 'LockedProtoPfn' : [ 0xa0, ['pointer64', ['_MMPFN']]], - 'PteContents' : [ 0xa8, ['_MMPTE']], - 'WaitCount' : [ 0xb0, ['long']], - 'ByteCount' : [ 0xb4, ['unsigned long']], - 'u3' : [ 0xb8, ['__unnamed_2753']], - 'u1' : [ 0xbc, ['__unnamed_2756']], - 'FilePointer' : [ 0xc0, ['pointer64', ['_FILE_OBJECT']]], - 'ControlArea' : [ 0xc8, ['pointer64', ['_CONTROL_AREA']]], - 'Subsection' : [ 0xc8, ['pointer64', ['_SUBSECTION']]], - 'Autoboost' : [ 0xd0, ['pointer64', ['void']]], - 'FaultingAddress' : [ 0xd8, ['pointer64', ['void']]], - 'PointerPte' : [ 0xe0, ['pointer64', ['_MMPTE']]], - 'BasePte' : [ 0xe8, ['pointer64', ['_MMPTE']]], - 'Pfn' : [ 0xf0, ['pointer64', ['_MMPFN']]], - 'PrefetchMdl' : [ 0xf8, ['pointer64', ['_MDL']]], - 'Mdl' : [ 0x100, ['_MDL']], - 'Page' : [ 0x130, ['array', 16, ['unsigned long long']]], - 'FlowThrough' : [ 0x130, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], -} ], - '_HAL_NODE_RANGE' : [ 0x10, { - 'PageFrameIndex' : [ 0x0, ['unsigned long long']], - 'Node' : [ 0x8, ['unsigned long']], -} ], - '_MMCLONE_BLOCK' : [ 0x20, { - 'ProtoPte' : [ 0x0, ['_MMPTE']], - 'PaddingFor16ByteAlignment' : [ 0x8, ['unsigned long long']], - 'CloneCommitCount' : [ 0x10, ['unsigned long long']], - 'u1' : [ 0x10, ['_MI_CLONE_BLOCK_FLAGS']], - 'CloneRefCount' : [ 0x18, ['unsigned long long']], -} ], - '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { - 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], -} ], - '_PNP_DEVICE_ACTION_ENTRY' : [ 0x48, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], - 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], - 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], - 'RequestArgument' : [ 0x20, ['unsigned long long']], - 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], - 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], - 'ActivityId' : [ 0x38, ['_GUID']], -} ], - '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x38, { - 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], - 'ReferenceCount' : [ 0x18, ['long long']], - 'PackageSid' : [ 0x20, ['pointer64', ['void']]], - 'LowboxNumber' : [ 0x28, ['unsigned long']], - 'AtomTable' : [ 0x30, ['pointer64', ['void']]], -} ], - '_MI_LDW_WORK_CONTEXT' : [ 0x38, { - 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], - 'FileObject' : [ 0x20, ['pointer64', ['_FILE_OBJECT']]], - 'ErrorStatus' : [ 0x28, ['long']], - 'Active' : [ 0x2c, ['long']], - 'FreeWhenDone' : [ 0x30, ['unsigned char']], -} ], - '_MI_CFG_BITMAP_INFO' : [ 0x18, { - 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], - 'RegionSize' : [ 0x8, ['unsigned long long']], - 'BitmapVad' : [ 0x10, ['pointer64', ['_MMVAD']]], -} ], - '_COUNTER_READING' : [ 0x18, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], - 'Index' : [ 0x4, ['unsigned long']], - 'Start' : [ 0x8, ['unsigned long long']], - 'Total' : [ 0x10, ['unsigned long long']], -} ], - '_MI_SHUTDOWN_STATE' : [ 0x80, { - 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], - 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], - 'SystemShutdown' : [ 0x4, ['unsigned long']], - 'ShutdownFlushInProgress' : [ 0x8, ['long']], - 'ResumeItem' : [ 0x10, ['_MI_RESUME_WORKITEM']], - 'MirrorHoldsPfn' : [ 0x48, ['pointer64', ['_ETHREAD']]], - 'MirroringActive' : [ 0x50, ['unsigned long']], - 'MirrorBitMaps' : [ 0x58, ['array', 2, ['_RTL_BITMAP_EX']]], - 'CrashDumpPte' : [ 0x78, ['pointer64', ['_MMPTE']]], -} ], - '_SECTION_IMAGE_INFORMATION' : [ 0x40, { - 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], - 'ZeroBits' : [ 0x8, ['unsigned long']], - 'MaximumStackSize' : [ 0x10, ['unsigned long long']], - 'CommittedStackSize' : [ 0x18, ['unsigned long long']], - 'SubSystemType' : [ 0x20, ['unsigned long']], - 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], - 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], - 'SubSystemVersion' : [ 0x24, ['unsigned long']], - 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], - 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], - 'OperatingSystemVersion' : [ 0x28, ['unsigned long']], - 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], - 'DllCharacteristics' : [ 0x2e, ['unsigned short']], - 'Machine' : [ 0x30, ['unsigned short']], - 'ImageContainsCode' : [ 0x32, ['unsigned char']], - 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'BaseBelow4gb' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'ComPlusPrefer32bit' : [ 0x33, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], - 'LoaderFlags' : [ 0x34, ['unsigned long']], - 'ImageFileSize' : [ 0x38, ['unsigned long']], - 'CheckSum' : [ 0x3c, ['unsigned long']], -} ], - '_ETW_REG_ENTRY' : [ 0x70, { - 'RegList' : [ 0x0, ['_LIST_ENTRY']], - 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], - 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], - 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], - 'ReplyQueue' : [ 0x30, ['pointer64', ['_ETW_REPLY_QUEUE']]], - 'ReplySlot' : [ 0x30, ['array', 4, ['pointer64', ['_ETW_QUEUE_ENTRY']]]], - 'Caller' : [ 0x30, ['pointer64', ['void']]], - 'SessionId' : [ 0x38, ['unsigned long']], - 'Process' : [ 0x50, ['pointer64', ['_EPROCESS']]], - 'CallbackContext' : [ 0x50, ['pointer64', ['void']]], - 'Callback' : [ 0x58, ['pointer64', ['void']]], - 'Index' : [ 0x60, ['unsigned short']], - 'Flags' : [ 0x62, ['unsigned char']], - 'DbgKernelRegistration' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'DbgUserRegistration' : [ 0x62, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'DbgReplyRegistration' : [ 0x62, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'DbgClassicRegistration' : [ 0x62, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'DbgSessionSpaceRegistration' : [ 0x62, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'DbgModernRegistration' : [ 0x62, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'DbgClosed' : [ 0x62, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'DbgInserted' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'EnableMask' : [ 0x63, ['unsigned char']], - 'GroupEnableMask' : [ 0x64, ['unsigned char']], - 'UseDescriptorType' : [ 0x65, ['unsigned char']], - 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], -} ], - '_LPCP_PORT_OBJECT' : [ 0x100, { - 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], - 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], - 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], - 'Creator' : [ 0x30, ['_CLIENT_ID']], - 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], - 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], - 'PortContext' : [ 0x50, ['pointer64', ['void']]], - 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], - 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], - 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], - 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], - 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], - 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], - 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], - 'MaxMessageLength' : [ 0xe0, ['unsigned short']], - 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], - 'Flags' : [ 0xe4, ['unsigned long']], - 'WaitEvent' : [ 0xe8, ['_KEVENT']], -} ], - '_HVIEW_MAP_PIN_LOG' : [ 0x488, { - 'Next' : [ 0x0, ['unsigned long']], - 'Size' : [ 0x4, ['unsigned long']], - 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], -} ], - '_ARBITER_LIST_ENTRY' : [ 0x60, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'AlternativeCount' : [ 0x10, ['unsigned long']], - 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], - 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], - 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], - 'Flags' : [ 0x2c, ['unsigned long']], - 'WorkSpace' : [ 0x30, ['long long']], - 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'SlotNumber' : [ 0x3c, ['unsigned long']], - 'BusNumber' : [ 0x40, ['unsigned long']], - 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], - 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], - 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], -} ], - '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { - 'UserRangeInKernel' : [ 0x0, ['unsigned long']], - 'FaultFailed' : [ 0x4, ['unsigned long']], - 'WriteFaultFailed' : [ 0x8, ['unsigned long']], - 'LargePageFailed' : [ 0xc, ['unsigned long']], - 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], - 'BadPageLocation' : [ 0x14, ['unsigned long']], - 'InsufficientCharge' : [ 0x18, ['unsigned long']], - 'PageTableCharge' : [ 0x1c, ['unsigned long']], - 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], - 'NoIoReference' : [ 0x24, ['unsigned long']], - 'ProbeFailed' : [ 0x28, ['unsigned long']], - 'PteIsZero' : [ 0x2c, ['unsigned long']], - 'StrongCodeWrite' : [ 0x30, ['unsigned long']], - 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], - 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], - 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], -} ], - '_ETW_PROVIDER_TRAITS' : [ 0x20, { - 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'ReferenceCount' : [ 0x18, ['unsigned long']], - 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], -} ], - '_INTERRUPT_CONNECTION_DATA' : [ 0x60, { - 'Count' : [ 0x0, ['unsigned long']], - 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], -} ], - '_MI_CLONE_BLOCK_FLAGS' : [ 0x8, { - 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 59, native_type='unsigned long long')]], - 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], -} ], - '_LDR_DATA_TABLE_ENTRY' : [ 0x118, { - 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], - 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], - 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], - 'DllBase' : [ 0x30, ['pointer64', ['void']]], - 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], - 'SizeOfImage' : [ 0x40, ['unsigned long']], - 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], - 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], - 'FlagGroup' : [ 0x68, ['array', 4, ['unsigned char']]], - 'Flags' : [ 0x68, ['unsigned long']], - 'PackagedBinary' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'MarkedForRemoval' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ImageDll' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'LoadNotificationsSent' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'TelemetryEntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'ProcessStaticImport' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'InLegacyLists' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'InIndexes' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'ShimDll' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'InExceptionTable' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'ReservedFlags1' : [ 0x68, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], - 'LoadInProgress' : [ 0x68, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'LoadConfigProcessed' : [ 0x68, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'EntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'ProtectDelayLoad' : [ 0x68, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'ReservedFlags3' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], - 'DontCallForThreads' : [ 0x68, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'ProcessAttachCalled' : [ 0x68, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'ProcessAttachFailed' : [ 0x68, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'CorDeferredValidate' : [ 0x68, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'CorImage' : [ 0x68, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], - 'DontRelocate' : [ 0x68, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], - 'CorILOnly' : [ 0x68, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'ReservedFlags5' : [ 0x68, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], - 'Redirected' : [ 0x68, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'ReservedFlags6' : [ 0x68, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], - 'CompatDatabaseProcessed' : [ 0x68, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'ObsoleteLoadCount' : [ 0x6c, ['unsigned short']], - 'TlsIndex' : [ 0x6e, ['unsigned short']], - 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], - 'TimeDateStamp' : [ 0x80, ['unsigned long']], - 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], - 'Lock' : [ 0x90, ['pointer64', ['void']]], - 'DdagNode' : [ 0x98, ['pointer64', ['_LDR_DDAG_NODE']]], - 'NodeModuleLink' : [ 0xa0, ['_LIST_ENTRY']], - 'LoadContext' : [ 0xb0, ['pointer64', ['_LDRP_LOAD_CONTEXT']]], - 'ParentDllBase' : [ 0xb8, ['pointer64', ['void']]], - 'SwitchBackContext' : [ 0xc0, ['pointer64', ['void']]], - 'BaseAddressIndexNode' : [ 0xc8, ['_RTL_BALANCED_NODE']], - 'MappingInfoIndexNode' : [ 0xe0, ['_RTL_BALANCED_NODE']], - 'OriginalBase' : [ 0xf8, ['unsigned long long']], - 'LoadTime' : [ 0x100, ['_LARGE_INTEGER']], - 'BaseNameHashValue' : [ 0x108, ['unsigned long']], - 'LoadReason' : [ 0x10c, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], - 'ImplicitPathOptions' : [ 0x110, ['unsigned long']], - 'ReferenceCount' : [ 0x114, ['unsigned long']], -} ], - '_CACHED_KSTACK_LIST' : [ 0x20, { - 'SListHead' : [ 0x0, ['_SLIST_HEADER']], - 'MinimumFree' : [ 0x10, ['long']], - 'Misses' : [ 0x14, ['unsigned long']], - 'MissesLast' : [ 0x18, ['unsigned long']], - 'AllStacksInUse' : [ 0x1c, ['unsigned long']], -} ], - '_MMINPAGE_FLAGS' : [ 0x4, { - 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], - 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], - 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], - 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], - 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], - 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], - 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], - 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], -} ], - '_MI_DRIVER_VA' : [ 0x28, { - 'Next' : [ 0x0, ['pointer64', ['_MI_DRIVER_VA']]], - 'PointerPte' : [ 0x8, ['pointer64', ['_MMPTE']]], - 'BitMap' : [ 0x10, ['_RTL_BITMAP']], - 'Hint' : [ 0x20, ['unsigned long']], -} ], - '_LDR_DDAG_NODE' : [ 0x50, { - 'Modules' : [ 0x0, ['_LIST_ENTRY']], - 'ServiceTagList' : [ 0x10, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], - 'LoadCount' : [ 0x18, ['unsigned long']], - 'LoadWhileUnloadingCount' : [ 0x1c, ['unsigned long']], - 'LowestLink' : [ 0x20, ['unsigned long']], - 'Dependencies' : [ 0x28, ['_LDRP_CSLIST']], - 'IncomingDependencies' : [ 0x30, ['_LDRP_CSLIST']], - 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], - 'CondenseLink' : [ 0x40, ['_SINGLE_LIST_ENTRY']], - 'PreorderNumber' : [ 0x48, ['unsigned long']], -} ], - '_POP_DEVICE_SYS_STATE' : [ 0x1d0, { - 'IrpMinor' : [ 0x0, ['unsigned char']], - 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'SpinLock' : [ 0x8, ['unsigned long long']], - 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], - 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], - 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], - 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], - 'Order' : [ 0x30, ['_PO_DEVICE_NOTIFY_ORDER']], - 'Pending' : [ 0x1a8, ['_LIST_ENTRY']], - 'Status' : [ 0x1b8, ['long']], - 'FailedDevice' : [ 0x1c0, ['pointer64', ['_DEVICE_OBJECT']]], - 'Waking' : [ 0x1c8, ['unsigned char']], - 'Cancelled' : [ 0x1c9, ['unsigned char']], - 'IgnoreErrors' : [ 0x1ca, ['unsigned char']], - 'IgnoreNotImplemented' : [ 0x1cb, ['unsigned char']], - 'TimeRefreshLockAcquired' : [ 0x1cc, ['unsigned char']], -} ], - '_KHETERO_PROCESSOR_SET' : [ 0x10, { - 'PreferredMask' : [ 0x0, ['unsigned long long']], - 'AvailableMask' : [ 0x8, ['unsigned long long']], -} ], - '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { - 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], - 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], -} ], - '_LOGGED_STREAM_CALLBACK_V1' : [ 0x10, { - 'LogHandle' : [ 0x0, ['pointer64', ['void']]], - 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], -} ], - '_DIAGNOSTIC_BUFFER' : [ 0x28, { - 'Size' : [ 0x0, ['unsigned long long']], - 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], - 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], - 'ProcessId' : [ 0x18, ['unsigned long']], - 'ServiceTag' : [ 0x1c, ['unsigned long']], - 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], - 'DevicePathOffset' : [ 0x18, ['unsigned long long']], - 'ReasonOffset' : [ 0x20, ['unsigned long long']], -} ], - '_KWAIT_CHAIN_ENTRY' : [ 0x20, { - 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Event' : [ 0x8, ['_KEVENT']], -} ], - '__unnamed_27d1' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], -} ], - '__unnamed_27d3' : [ 0x4, { - 'NumberOfChildViews' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_27d5' : [ 0x4, { - 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '_SUBSECTION' : [ 0x38, { - 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], - 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], - 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], - 'GlobalPerSessionHead' : [ 0x18, ['_RTL_AVL_TREE']], - 'CreationWaitList' : [ 0x18, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], - 'SessionDriverProtos' : [ 0x18, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], - 'u' : [ 0x20, ['__unnamed_27d1']], - 'StartingSector' : [ 0x24, ['unsigned long']], - 'NumberOfFullSectors' : [ 0x28, ['unsigned long']], - 'PtesInSubsection' : [ 0x2c, ['unsigned long']], - 'u1' : [ 0x30, ['__unnamed_27d3']], - 'UnusedPtes' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'DirtyPages' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'u2' : [ 0x34, ['__unnamed_27d5']], -} ], - '_CLIENT_ID32' : [ 0x8, { - 'UniqueProcess' : [ 0x0, ['unsigned long']], - 'UniqueThread' : [ 0x4, ['unsigned long']], -} ], - '_CM_KEY_INDEX' : [ 0x8, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Count' : [ 0x2, ['unsigned short']], - 'List' : [ 0x4, ['array', 1, ['unsigned long']]], -} ], - '_VI_DEADLOCK_THREAD' : [ 0x38, { - 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], - 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], - 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], - 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], - 'NodeCount' : [ 0x28, ['unsigned long']], - 'PagingCount' : [ 0x2c, ['unsigned long']], - 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], -} ], - '_PPM_IDLE_STATE' : [ 0xf8, { - 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], - 'Name' : [ 0xa8, ['_UNICODE_STRING']], - 'Latency' : [ 0xb8, ['unsigned long']], - 'BreakEvenDuration' : [ 0xbc, ['unsigned long']], - 'Power' : [ 0xc0, ['unsigned long']], - 'StateFlags' : [ 0xc4, ['unsigned long']], - 'VetoAccounting' : [ 0xc8, ['_PPM_VETO_ACCOUNTING']], - 'StateType' : [ 0xf0, ['unsigned char']], - 'InterruptsEnabled' : [ 0xf1, ['unsigned char']], - 'Interruptible' : [ 0xf2, ['unsigned char']], - 'ContextRetained' : [ 0xf3, ['unsigned char']], - 'CacheCoherent' : [ 0xf4, ['unsigned char']], - 'WakesSpuriously' : [ 0xf5, ['unsigned char']], - 'PlatformOnly' : [ 0xf6, ['unsigned char']], - 'NoCState' : [ 0xf7, ['unsigned char']], -} ], - '_KRESOURCEMANAGER' : [ 0x250, { - 'NotificationAvailable' : [ 0x0, ['_KEVENT']], - 'cookie' : [ 0x18, ['unsigned long']], - 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], - 'Flags' : [ 0x20, ['unsigned long']], - 'Mutex' : [ 0x28, ['_KMUTANT']], - 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], - 'RmId' : [ 0x88, ['_GUID']], - 'NotificationQueue' : [ 0x98, ['_KQUEUE']], - 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], - 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], - 'EnlistmentCount' : [ 0x120, ['unsigned long']], - 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], - 'Key' : [ 0x130, ['pointer64', ['void']]], - 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], - 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], - 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], - 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], - 'Description' : [ 0x170, ['_UNICODE_STRING']], - 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], - 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], -} ], - '_MI_SYSTEM_PTE_STATE' : [ 0x180, { - 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], - 'PteTrackerLock' : [ 0x10, ['unsigned long long']], - 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], - 'PteTrackingBitmap' : [ 0xc0, ['_RTL_BITMAP_EX']], - 'CachedPteHeads' : [ 0xd0, ['pointer64', ['_MI_CACHED_PTES']]], - 'SystemViewPteInfo' : [ 0xd8, ['_MI_SYSTEM_PTE_TYPE']], - 'KernelStackPages' : [ 0x138, ['unsigned char']], - 'QueuedStacks' : [ 0x140, ['_SLIST_HEADER']], - 'StackGrowthFailures' : [ 0x150, ['unsigned long']], - 'TrackPtesAborted' : [ 0x154, ['unsigned char']], - 'AdjustCounter' : [ 0x155, ['unsigned char']], - 'QueuedStacksWorkItem' : [ 0x158, ['_MI_QUEUED_DEADSTACK_WORKITEM']], -} ], - '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { - 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], - 'FirstFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], - 'LastFreeHandleEntry' : [ 0x10, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], - 'HandleCount' : [ 0x18, ['long']], - 'HighWaterMark' : [ 0x1c, ['unsigned long']], - 'Reserved' : [ 0x20, ['array', 8, ['unsigned long']]], -} ], - '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { - 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { - 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], - 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], - 'Size' : [ 0x2, ['unsigned short']], - 'PredicateCount' : [ 0x4, ['unsigned short']], - 'Reserved' : [ 0x6, ['unsigned short']], - 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], - 'ProviderGuid' : [ 0x10, ['_GUID']], - 'EachEventTableOffset' : [ 0x20, ['unsigned short']], - 'EachEventTableLength' : [ 0x22, ['unsigned short']], - 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], - 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], - 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], - 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], - 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], - 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], - 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], - 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], - 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], -} ], - '_GDI_TEB_BATCH64' : [ 0x4e8, { - 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], - 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'HDC' : [ 0x8, ['unsigned long long']], - 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], -} ], - '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { - 'Value' : [ 0x0, ['unsigned long long']], - 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], - 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], - 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], - 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], - 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], - 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], - 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], - 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], - 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], - 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], - 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], - 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], - 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], - 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], - 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], - 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_2805' : [ 0x4, { - 'NodeSize' : [ 0x0, ['unsigned long']], - 'UseLookaside' : [ 0x0, ['unsigned long']], -} ], - '_VF_AVL_TREE' : [ 0x20, { - 'NodeRangeSize' : [ 0x0, ['unsigned long long']], - 'NodeCount' : [ 0x8, ['unsigned long long']], - 'Tables' : [ 0x10, ['pointer64', ['_VF_AVL_TABLE']]], - 'TablesNo' : [ 0x18, ['unsigned long']], - 'u1' : [ 0x1c, ['__unnamed_2805']], -} ], - '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { - 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], - 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], - 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], - 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], - 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], - 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], - 'FileAttributes' : [ 0x30, ['unsigned long']], -} ], - '_POP_FX_ACCOUNTING' : [ 0x30, { - 'Lock' : [ 0x0, ['unsigned long long']], - 'Active' : [ 0x8, ['unsigned char']], - 'DripsRequiredState' : [ 0xc, ['unsigned long']], - 'Level' : [ 0x10, ['long']], - 'ActiveStamp' : [ 0x18, ['long long']], - 'CsActiveTime' : [ 0x20, ['unsigned long long']], - 'CriticalActiveTime' : [ 0x28, ['long long']], -} ], - '_MI_RESUME_WORKITEM' : [ 0x38, { - 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], - 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], -} ], - '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], - 'ValidBits' : [ 0x0, ['unsigned long long']], -} ], - '_POP_TRIGGER_WAIT' : [ 0x38, { - 'Event' : [ 0x0, ['_KEVENT']], - 'Status' : [ 0x18, ['long']], - 'Link' : [ 0x20, ['_LIST_ENTRY']], - 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], -} ], - '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { - 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], - 'AsUSHORT' : [ 0x0, ['unsigned short']], -} ], - '_ISR_THUNK' : [ 0x8, { - 'PushImm' : [ 0x0, ['unsigned char']], - 'Vector' : [ 0x1, ['unsigned char']], - 'PushRbp' : [ 0x2, ['unsigned char']], - 'JmpOp' : [ 0x3, ['unsigned char']], - 'JmpOffset' : [ 0x4, ['long']], -} ], - '_TRIAGE_EX_WORK_QUEUE' : [ 0x2b0, { - 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], -} ], - '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { - 'TagIndex' : [ 0x0, ['unsigned short']], - 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], -} ], - '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { - 'Utility' : [ 0x0, ['unsigned short']], - 'AffinitizedUtility' : [ 0x2, ['unsigned short']], - 'Frequency' : [ 0x4, ['unsigned char']], - 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], -} ], - '_POP_FX_COMPONENT' : [ 0x100, { - 'Id' : [ 0x0, ['_GUID']], - 'Index' : [ 0x10, ['unsigned long']], - 'WorkOrder' : [ 0x18, ['_POP_FX_WORK_ORDER']], - 'Device' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], - 'Flags' : [ 0x58, ['_POP_FX_COMPONENT_FLAGS']], - 'Resident' : [ 0x60, ['long']], - 'ActiveEvent' : [ 0x68, ['_KEVENT']], - 'IdleLock' : [ 0x80, ['unsigned long long']], - 'IdleConditionComplete' : [ 0x88, ['long']], - 'IdleStateComplete' : [ 0x8c, ['long']], - 'IdleStamp' : [ 0x90, ['unsigned long long']], - 'CurrentIdleState' : [ 0x98, ['unsigned long']], - 'IdleStateCount' : [ 0x9c, ['unsigned long']], - 'IdleStates' : [ 0xa0, ['pointer64', ['_POP_FX_IDLE_STATE']]], - 'DeepestWakeableIdleState' : [ 0xa8, ['unsigned long']], - 'ProviderCount' : [ 0xac, ['unsigned long']], - 'Providers' : [ 0xb0, ['pointer64', ['_POP_FX_PROVIDER']]], - 'IdleProviderCount' : [ 0xb8, ['unsigned long']], - 'DependentCount' : [ 0xbc, ['unsigned long']], - 'Dependents' : [ 0xc0, ['pointer64', ['_POP_FX_DEPENDENT']]], - 'Accounting' : [ 0xc8, ['_POP_FX_ACCOUNTING']], - 'Performance' : [ 0xf8, ['pointer64', ['_POP_FX_PERF_INFO']]], -} ], - '_PEP_CRASHDUMP_INFORMATION' : [ 0x10, { - 'DeviceHandle' : [ 0x0, ['pointer64', ['PEPHANDLE__']]], - 'DeviceContext' : [ 0x8, ['pointer64', ['void']]], -} ], - '_POP_FX_DRIVER_CALLBACKS' : [ 0x38, { - 'ComponentActive' : [ 0x0, ['pointer64', ['void']]], - 'ComponentIdle' : [ 0x8, ['pointer64', ['void']]], - 'ComponentIdleState' : [ 0x10, ['pointer64', ['void']]], - 'DevicePowerRequired' : [ 0x18, ['pointer64', ['void']]], - 'DevicePowerNotRequired' : [ 0x20, ['pointer64', ['void']]], - 'PowerControl' : [ 0x28, ['pointer64', ['void']]], - 'ComponentCriticalTransition' : [ 0x30, ['pointer64', ['void']]], -} ], - '_PROVIDER_BINARY_ENTRY' : [ 0x38, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'ConsumersNotified' : [ 0x10, ['unsigned char']], - 'Spare' : [ 0x11, ['array', 3, ['unsigned char']]], - 'DebugIdSize' : [ 0x14, ['unsigned long']], - 'DebugId' : [ 0x18, ['_CVDD']], -} ], - '_VI_DEADLOCK_GLOBALS' : [ 0x8180, { - 'TimeAcquire' : [ 0x0, ['long long']], - 'TimeRelease' : [ 0x8, ['long long']], - 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], - 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], - 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], - 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], - 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], - 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], - 'AllocationFailures' : [ 0x8010, ['unsigned long']], - 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], - 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], - 'NodesSearched' : [ 0x801c, ['unsigned long']], - 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], - 'SequenceNumber' : [ 0x8024, ['unsigned long']], - 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], - 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], - 'DepthLimitHits' : [ 0x8030, ['unsigned long']], - 'SearchLimitHits' : [ 0x8034, ['unsigned long']], - 'StackLimitHits' : [ 0x8038, ['unsigned long']], - 'ABC_ACB_Skipped' : [ 0x803c, ['unsigned long']], - 'OutOfOrderReleases' : [ 0x8040, ['unsigned long']], - 'NodesReleasedOutOfOrder' : [ 0x8044, ['unsigned long']], - 'TotalReleases' : [ 0x8048, ['unsigned long']], - 'RootNodesDeleted' : [ 0x804c, ['unsigned long']], - 'ForgetHistoryCounter' : [ 0x8050, ['unsigned long']], - 'Instigator' : [ 0x8058, ['pointer64', ['void']]], - 'NumberOfParticipants' : [ 0x8060, ['unsigned long']], - 'Participant' : [ 0x8068, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], - 'ChildrenCountWatermark' : [ 0x8168, ['long']], - 'StackType' : [ 0x816c, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], - 'StackLowLimit' : [ 0x8170, ['unsigned long long']], - 'StackHighLimit' : [ 0x8178, ['unsigned long long']], -} ], - '_KTM' : [ 0x3c0, { - 'cookie' : [ 0x0, ['unsigned long']], - 'Mutex' : [ 0x8, ['_KMUTANT']], - 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], - 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], - 'TmIdentity' : [ 0x70, ['_GUID']], - 'Flags' : [ 0x80, ['unsigned long']], - 'VolatileFlags' : [ 0x84, ['unsigned long']], - 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], - 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], - 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], - 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], - 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], - 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], - 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], - 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], - 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], - 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], - 'BaseLsn' : [ 0x288, ['_CLS_LSN']], - 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], - 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], - 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], - 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], - 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], - 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], - 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], - 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], - 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], - 'LogFlags' : [ 0x378, ['unsigned long']], - 'LogFullStatus' : [ 0x37c, ['long']], - 'RecoveryStatus' : [ 0x380, ['long']], - 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], - 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], - 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], -} ], - '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { - 'SystemCodePage' : [ 0x0, ['unsigned long']], - 'SystemDriverPage' : [ 0x4, ['unsigned long']], - 'TotalSystemCodePages' : [ 0x8, ['long']], - 'TotalSystemDriverPages' : [ 0xc, ['long']], -} ], - '_MI_MODWRITE_DATA' : [ 0x40, { - 'PagesLoad' : [ 0x0, ['long long']], - 'PagesAverage' : [ 0x8, ['unsigned long long']], - 'AverageAvailablePages' : [ 0x10, ['unsigned long long']], - 'PagesWritten' : [ 0x18, ['unsigned long long']], - 'WritesIssued' : [ 0x20, ['unsigned long']], - 'IgnoredReservationsCount' : [ 0x24, ['unsigned long']], - 'FreedReservationsCount' : [ 0x28, ['unsigned long']], - 'WriteBurstCount' : [ 0x2c, ['unsigned long']], - 'IgnoreReservationsStartTime' : [ 0x30, ['unsigned long long']], - 'ReservationClusterInfo' : [ 0x38, ['_MI_RESERVATION_CLUSTER_INFO']], - 'IgnoreReservations' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'Spare' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], - 'Spare1' : [ 0x3e, ['unsigned short']], -} ], - '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { - 'CancelCount' : [ 0x0, ['unsigned long']], - 'FailureCount' : [ 0x4, ['unsigned long']], - 'SuccessCount' : [ 0x8, ['unsigned long']], - 'MaxTime' : [ 0x10, ['unsigned long long']], - 'MinTime' : [ 0x18, ['unsigned long long']], - 'TotalTime' : [ 0x20, ['unsigned long long']], - 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], - 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], - 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], -} ], - '_KTRANSACTION' : [ 0x2d8, { - 'OutcomeEvent' : [ 0x0, ['_KEVENT']], - 'cookie' : [ 0x18, ['unsigned long']], - 'Mutex' : [ 0x20, ['_KMUTANT']], - 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], - 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], - 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], - 'UOW' : [ 0xb0, ['_GUID']], - 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], - 'Flags' : [ 0xc4, ['unsigned long']], - 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], - 'EnlistmentCount' : [ 0xd8, ['unsigned long']], - 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], - 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], - 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], - 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], - 'PendingResponses' : [ 0xec, ['unsigned long']], - 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], - 'LastLsn' : [ 0xf8, ['_CLS_LSN']], - 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], - 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], - 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], - 'IsolationLevel' : [ 0x120, ['unsigned long']], - 'IsolationFlags' : [ 0x124, ['unsigned long']], - 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], - 'Description' : [ 0x130, ['_UNICODE_STRING']], - 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], - 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], - 'RollbackDpc' : [ 0x168, ['_KDPC']], - 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], - 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], - 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], - 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], - 'CommitReservation' : [ 0x208, ['long long']], - 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], - 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], - 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], - 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], - 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], - 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], - 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], - 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], -} ], - '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], - 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], -} ], - '_CM_KCB_UOW' : [ 0x60, { - 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], - 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], - 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], - 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], - 'UoWState' : [ 0x40, ['unsigned long']], - 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], - 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], - 'ChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'VolatileKeyCell' : [ 0x50, ['unsigned long']], - 'OldValueCell' : [ 0x50, ['unsigned long']], - 'NewValueCell' : [ 0x54, ['unsigned long']], - 'UserFlags' : [ 0x50, ['unsigned long']], - 'LastWriteTime' : [ 0x50, ['_LARGE_INTEGER']], - 'TxSecurityCell' : [ 0x50, ['unsigned long']], - 'OldChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'NewChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'OtherChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], - 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], -} ], - '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], -} ], - '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { - 'TotalTime' : [ 0x0, ['unsigned long long']], - 'IdleTime' : [ 0x8, ['unsigned long long']], - 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], - 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], - 'OverrideState' : [ 0x20, ['unsigned long']], - 'TimeCheck' : [ 0x24, ['unsigned long']], - 'PromotePercent' : [ 0x28, ['unsigned char']], - 'DemotePercent' : [ 0x29, ['unsigned char']], - 'Parked' : [ 0x2a, ['unsigned char']], - 'Interruptible' : [ 0x2b, ['unsigned char']], - 'PlatformIdle' : [ 0x2c, ['unsigned char']], - 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], -} ], - '_KREQUEST_PACKET' : [ 0x20, { - 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], - 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], -} ], - '_VF_WATCHDOG_IRP' : [ 0x20, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'DueTickCount' : [ 0x18, ['unsigned long']], - 'Inserted' : [ 0x1c, ['unsigned char']], - 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], - 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], -} ], - '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], - 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], - 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], - 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], - 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], -} ], - '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], - 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], -} ], - '__unnamed_2880' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], -} ], - '__unnamed_2882' : [ 0x8, { - 's1' : [ 0x0, ['__unnamed_2880']], - 'Value' : [ 0x0, ['long long']], -} ], - '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { - 'u1' : [ 0x0, ['__unnamed_2882']], -} ], - '_CM_KEY_SECURITY_CACHE' : [ 0x38, { - 'Cell' : [ 0x0, ['unsigned long']], - 'ConvKey' : [ 0x4, ['unsigned long']], - 'List' : [ 0x8, ['_LIST_ENTRY']], - 'DescriptorLength' : [ 0x18, ['unsigned long']], - 'RealRefCount' : [ 0x1c, ['unsigned long']], - 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], -} ], - '_CM_NAME_HASH' : [ 0x18, { - 'ConvKey' : [ 0x0, ['unsigned long']], - 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], - 'NameLength' : [ 0x10, ['unsigned short']], - 'Name' : [ 0x12, ['array', 1, ['wchar']]], -} ], - '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { - 'TotalTime' : [ 0x0, ['unsigned long long']], - 'MinTime' : [ 0x8, ['unsigned long long']], - 'MaxTime' : [ 0x10, ['unsigned long long']], - 'Count' : [ 0x18, ['unsigned long']], -} ], - '_PO_IRP_QUEUE' : [ 0x10, { - 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], - 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], -} ], - '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], -} ], - '__unnamed_2897' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], - 'Whole' : [ 0x0, ['unsigned long']], -} ], - '_VI_DEADLOCK_NODE' : [ 0xd0, { - 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], - 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], - 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], - 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], - 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], - 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], - 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], - 'u1' : [ 0x48, ['__unnamed_2897']], - 'ChildrenCount' : [ 0x4c, ['long']], - 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], - 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], -} ], - 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { - 'TimeCheck' : [ 0x0, ['unsigned long']], - 'DemotePercent' : [ 0x4, ['unsigned char']], - 'PromotePercent' : [ 0x5, ['unsigned char']], - 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], -} ], - '_KTMOBJECT_NAMESPACE' : [ 0xa8, { - 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], - 'Mutex' : [ 0x68, ['_KMUTANT']], - 'LinksOffset' : [ 0xa0, ['unsigned short']], - 'GuidOffset' : [ 0xa2, ['unsigned short']], - 'Expired' : [ 0xa4, ['unsigned char']], -} ], - '_LPCP_PORT_QUEUE' : [ 0x20, { - 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], - 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], - 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], -} ], - '_CM_KEY_REFERENCE' : [ 0x10, { - 'KeyCell' : [ 0x0, ['unsigned long']], - 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], -} ], - 'SYSTEM_POWER_LEVEL' : [ 0x18, { - 'Enable' : [ 0x0, ['unsigned char']], - 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], - 'BatteryLevel' : [ 0x4, ['unsigned long']], - 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], - 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], -} ], - '_HVIEW_MAP_ENTRY' : [ 0x20, { - 'ViewStart' : [ 0x0, ['pointer64', ['void']]], - 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Bcb' : [ 0x8, ['pointer64', ['void']]], - 'PinnedPages' : [ 0x10, ['unsigned long long']], - 'Size' : [ 0x18, ['unsigned long']], -} ], - '_OBJECT_DUMP_CONTROL' : [ 0x10, { - 'Stream' : [ 0x0, ['pointer64', ['void']]], - 'Detail' : [ 0x8, ['unsigned long']], -} ], - '_POP_COOLING_EXTENSION' : [ 0x90, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'RequestListHead' : [ 0x10, ['_LIST_ENTRY']], - 'Lock' : [ 0x20, ['_POP_RW_LOCK']], - 'DeviceObject' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], - 'NotificationEntry' : [ 0x38, ['pointer64', ['void']]], - 'Enabled' : [ 0x40, ['unsigned char']], - 'ActiveEngaged' : [ 0x41, ['unsigned char']], - 'ThrottleLimit' : [ 0x42, ['unsigned char']], - 'UpdatingToCurrent' : [ 0x43, ['unsigned char']], - 'RemovalFlushEvent' : [ 0x48, ['pointer64', ['_KEVENT']]], - 'PnpFlushEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], - 'Interface' : [ 0x58, ['_THERMAL_COOLING_INTERFACE']], -} ], - '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { - 'FieldIndex' : [ 0x0, ['unsigned short']], - 'CompareOp' : [ 0x2, ['unsigned short']], - 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], -} ], - '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { - 'Reserved1' : [ 0x0, ['unsigned short']], - 'ExtType' : [ 0x2, ['unsigned short']], - 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], - 'DataSize' : [ 0x6, ['unsigned short']], - 'DataPtr' : [ 0x8, ['unsigned long long']], -} ], - '_CM_INDEX' : [ 0x8, { - 'Cell' : [ 0x0, ['unsigned long']], - 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], - 'HashKey' : [ 0x4, ['unsigned long']], -} ], - '_VF_ADDRESS_RANGE' : [ 0x10, { - 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], - 'End' : [ 0x8, ['pointer64', ['unsigned char']]], -} ], - '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { - 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], - 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], - 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], - 'Flags' : [ 0x1c, ['unsigned long']], -} ], - '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { - 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], - 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], -} ], - '_THERMAL_POLICY' : [ 0x18, { - 'Version' : [ 0x0, ['unsigned long']], - 'WaitForUpdate' : [ 0x4, ['unsigned char']], - 'Hibernate' : [ 0x5, ['unsigned char']], - 'Critical' : [ 0x6, ['unsigned char']], - 'ThermalStandby' : [ 0x7, ['unsigned char']], - 'ActivationReasons' : [ 0x8, ['unsigned long']], - 'PassiveLimit' : [ 0xc, ['unsigned long']], - 'ActiveLevel' : [ 0x10, ['unsigned long']], - 'OverThrottled' : [ 0x14, ['unsigned char']], -} ], - '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { - 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Port' : [ 0x10, ['pointer64', ['void']]], - 'Key' : [ 0x18, ['unsigned long long']], - 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], -} ], - '_VF_TRACKER' : [ 0x10, { - 'TrackerFlags' : [ 0x0, ['unsigned long']], - 'TrackerSize' : [ 0x4, ['unsigned long']], - 'TrackerIndex' : [ 0x8, ['unsigned long']], - 'TraceDepth' : [ 0xc, ['unsigned long']], -} ], - '_CALL_PERFORMANCE_DATA' : [ 0x408, { - 'SpinLock' : [ 0x0, ['unsigned long long']], - 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], -} ], - '_RTL_UMS_CONTEXT' : [ 0x520, { - 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Context' : [ 0x10, ['_CONTEXT']], - 'Teb' : [ 0x4e0, ['pointer64', ['void']]], - 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], - 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'Flags' : [ 0x4f0, ['long']], - 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], - 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], - 'ContextLock' : [ 0x4f8, ['unsigned long long']], - 'PrimaryUmsContext' : [ 0x500, ['pointer64', ['_RTL_UMS_CONTEXT']]], - 'SwitchCount' : [ 0x508, ['unsigned long']], - 'KernelYieldCount' : [ 0x50c, ['unsigned long']], - 'MixedYieldCount' : [ 0x510, ['unsigned long']], - 'YieldCount' : [ 0x514, ['unsigned long']], -} ], - '_ARBITER_ALTERNATIVE' : [ 0x40, { - 'Minimum' : [ 0x0, ['unsigned long long']], - 'Maximum' : [ 0x8, ['unsigned long long']], - 'Length' : [ 0x10, ['unsigned long long']], - 'Alignment' : [ 0x18, ['unsigned long long']], - 'Priority' : [ 0x20, ['long']], - 'Flags' : [ 0x24, ['unsigned long']], - 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], - 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], -} ], - '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x20, { - 'Event' : [ 0x0, ['_KEVENT']], - 'EventSets' : [ 0x18, ['unsigned long']], -} ], - '_WHEA_ERROR_STATUS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], -} ], - '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], - 'AsULONGLONG' : [ 0x0, ['unsigned long long']], -} ], - '_COLORED_PAGE_INFO' : [ 0x18, { - 'BeingZeroed' : [ 0x0, ['long']], - 'Processor' : [ 0x4, ['unsigned long']], - 'PagesQueued' : [ 0x8, ['unsigned long long']], - 'PfnAllocation' : [ 0x10, ['pointer64', ['_MMPFN']]], -} ], - '_TRIAGE_9F_POWER' : [ 0x20, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Revision' : [ 0x2, ['unsigned short']], - 'IrpList' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], - 'ThreadList' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], - 'DelayedWorkQueue' : [ 0x18, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], -} ], - '_MI_POOL_STATE' : [ 0xf8, { - 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long long']], - 'NonPagedPoolSListMaximum' : [ 0x8, ['array', 3, ['unsigned long']]], - 'AllocatedNonPagedPool' : [ 0x18, ['unsigned long long']], - 'BadPoolHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], - 'HighEventSets' : [ 0x28, ['unsigned long']], - 'HighEventSetsValid' : [ 0x2c, ['unsigned char']], - 'PoolFailures' : [ 0x30, ['array', 3, ['array', 3, ['unsigned long']]]], - 'PoolFailureReasons' : [ 0x54, ['_MI_POOL_FAILURE_REASONS']], - 'LowPagedPoolThreshold' : [ 0x80, ['unsigned long long']], - 'HighPagedPoolThreshold' : [ 0x88, ['unsigned long long']], - 'PagedPoolSListMaximum' : [ 0x90, ['unsigned long']], - 'PreemptiveTrims' : [ 0x94, ['array', 4, ['unsigned long']]], - 'SpecialPagesInUsePeak' : [ 0xa8, ['unsigned long long']], - 'SpecialPoolRejected' : [ 0xb0, ['array', 9, ['unsigned long']]], - 'SpecialPagesNonPaged' : [ 0xd8, ['unsigned long long']], - 'SpecialPoolPdes' : [ 0xe0, ['long']], - 'SessionSpecialPoolPdesMax' : [ 0xe4, ['unsigned long']], - 'TotalPagedPoolQuota' : [ 0xe8, ['unsigned long long']], - 'TotalNonPagedPoolQuota' : [ 0xf0, ['unsigned long long']], -} ], - '_STACK_TABLE' : [ 0x8088, { - 'NumStackTraces' : [ 0x0, ['unsigned short']], - 'TraceCapacity' : [ 0x2, ['unsigned short']], - 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], - 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], -} ], - '_POP_POWER_SETTING_VALUES' : [ 0x13c, { - 'StructureSize' : [ 0x0, ['unsigned long']], - 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], - 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], - 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], - 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], - 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], - 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], - 'AwayModeIgnoreAction' : [ 0xf8, ['long']], - 'DisableFastS4' : [ 0xfc, ['unsigned char']], - 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], - 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], - 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], - 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], - 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], - 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], - 'VideoDimBrightness' : [ 0x114, ['unsigned long']], - 'AlsOffset' : [ 0x118, ['unsigned long']], - 'AlsEnabled' : [ 0x11c, ['unsigned long']], - 'EsBrightness' : [ 0x120, ['unsigned long']], - 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], - 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], - 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], - 'OffloadedAudio' : [ 0x12d, ['unsigned char']], - 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], - 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], - 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], - 'EsUserAwaySetting' : [ 0x134, ['unsigned char']], - 'WiFiInStandby' : [ 0x138, ['unsigned long']], -} ], - '_CM_INDEX_HINT_BLOCK' : [ 0x8, { - 'Count' : [ 0x0, ['unsigned long']], - 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], -} ], - '_TOKEN_CONTROL' : [ 0x28, { - 'TokenId' : [ 0x0, ['_LUID']], - 'AuthenticationId' : [ 0x8, ['_LUID']], - 'ModifiedId' : [ 0x10, ['_LUID']], - 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], -} ], - '_KUMS_CONTEXT_HEADER' : [ 0x70, { - 'P1Home' : [ 0x0, ['unsigned long long']], - 'P2Home' : [ 0x8, ['unsigned long long']], - 'P3Home' : [ 0x10, ['unsigned long long']], - 'P4Home' : [ 0x18, ['unsigned long long']], - 'StackTop' : [ 0x20, ['pointer64', ['void']]], - 'StackSize' : [ 0x28, ['unsigned long long']], - 'RspOffset' : [ 0x30, ['unsigned long long']], - 'Rip' : [ 0x38, ['unsigned long long']], - 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], - 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], - 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], - 'Flags' : [ 0x48, ['unsigned long long']], - 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], - 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], - 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], - 'Return' : [ 0x68, ['unsigned long long']], -} ], - '_DEFERRED_WRITE' : [ 0x48, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteSize' : [ 0x2, ['short']], - 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], - 'BytesToWrite' : [ 0x10, ['unsigned long']], - 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], - 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], - 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], - 'Context1' : [ 0x38, ['pointer64', ['void']]], - 'Context2' : [ 0x40, ['pointer64', ['void']]], -} ], - '__unnamed_2911' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_2913' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_2911']], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_2913']], -} ], - '_MI_RESAVAIL_FAILURES' : [ 0x8, { - 'Wrap' : [ 0x0, ['unsigned long']], - 'NoCharge' : [ 0x4, ['unsigned long']], -} ], - '_MI_IO_PAGE_STATE' : [ 0x58, { - 'IoPfnLock' : [ 0x0, ['unsigned long long']], - 'IoPfnRoot' : [ 0x8, ['array', 3, ['_RTL_AVL_TREE']]], - 'UnusedCachedMaps' : [ 0x20, ['_LIST_ENTRY']], - 'OldestCacheFlushTimeStamp' : [ 0x30, ['unsigned long']], - 'IoCacheStats' : [ 0x38, ['_MI_IO_CACHE_STATS']], -} ], - '_ARBITER_ORDERING_LIST' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned short']], - 'Maximum' : [ 0x2, ['unsigned short']], - 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], -} ], - '_VF_AVL_TABLE' : [ 0xc0, { - 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], - 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], - 'NodeToFree' : [ 0x70, ['pointer64', ['void']]], - 'Lock' : [ 0x80, ['long']], -} ], - '_XPF_MC_BANK_FLAGS' : [ 0x1, { - 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], - 'AsUCHAR' : [ 0x0, ['unsigned char']], -} ], - '_TOKEN_AUDIT_POLICY' : [ 0x1e, { - 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], -} ], - '_TRIAGE_POP_FX_DEVICE' : [ 0x38, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'IrpData' : [ 0x18, ['pointer64', ['_TRIAGE_POP_IRP_DATA']]], - 'Status' : [ 0x20, ['long']], - 'PowerReqCall' : [ 0x24, ['long']], - 'PowerNotReqCall' : [ 0x28, ['long']], - 'DeviceNode' : [ 0x30, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], -} ], - '__unnamed_292f' : [ 0x10, { - 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], - 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], -} ], - '__unnamed_2931' : [ 0x8, { - 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], -} ], - '__unnamed_2937' : [ 0x10, { - 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], - 'PageProtection' : [ 0x4, ['unsigned long']], - 'OutputInformation' : [ 0x8, ['pointer64', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], -} ], - '__unnamed_293b' : [ 0x10, { - 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], - 'SafeToRecurse' : [ 0x8, ['unsigned char']], -} ], - '__unnamed_293d' : [ 0x28, { - 'Argument1' : [ 0x0, ['pointer64', ['void']]], - 'Argument2' : [ 0x8, ['pointer64', ['void']]], - 'Argument3' : [ 0x10, ['pointer64', ['void']]], - 'Argument4' : [ 0x18, ['pointer64', ['void']]], - 'Argument5' : [ 0x20, ['pointer64', ['void']]], -} ], - '_FS_FILTER_PARAMETERS' : [ 0x28, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_292f']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2931']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2937']], - 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_293b']], - 'Others' : [ 0x0, ['__unnamed_293d']], -} ], - '_MI_SESSION_DRIVER_UNLOAD' : [ 0x8, { - 'Function' : [ 0x0, ['pointer64', ['void']]], - 'FunctionValue' : [ 0x0, ['unsigned long long']], -} ], - '_PPM_SELECTION_STATISTICS' : [ 0x78, { - 'SelectedCount' : [ 0x0, ['unsigned long long']], - 'VetoCount' : [ 0x8, ['unsigned long long']], - 'PreVetoCount' : [ 0x10, ['unsigned long long']], - 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], - 'LatencyCount' : [ 0x20, ['unsigned long long']], - 'IdleDurationCount' : [ 0x28, ['unsigned long long']], - 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], - 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], - 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], - 'InterruptibleCount' : [ 0x48, ['unsigned long long']], - 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], - 'CstateCheckCount' : [ 0x58, ['unsigned long long']], - 'NoCStateCount' : [ 0x60, ['unsigned long long']], - 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], - 'PreVetoAccounting' : [ 0x70, ['pointer64', ['_PPM_VETO_ACCOUNTING']]], -} ], - '_LDR_SERVICE_TAG_RECORD' : [ 0x10, { - 'Next' : [ 0x0, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], - 'ServiceTag' : [ 0x8, ['unsigned long']], -} ], - '_COMPRESSED_DATA_INFO' : [ 0xc, { - 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], - 'CompressionUnitShift' : [ 0x2, ['unsigned char']], - 'ChunkShift' : [ 0x3, ['unsigned char']], - 'ClusterShift' : [ 0x4, ['unsigned char']], - 'Reserved' : [ 0x5, ['unsigned char']], - 'NumberOfChunks' : [ 0x6, ['unsigned short']], - 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], -} ], - '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { - 'PagesScannedActive' : [ 0x0, ['unsigned long long']], - 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], - 'PagesCombined' : [ 0x10, ['unsigned long long']], - 'CombineScanCount' : [ 0x18, ['unsigned long']], - 'CombinedBlocksInUse' : [ 0x1c, ['long']], - 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], -} ], - '_THERMAL_COOLING_INTERFACE' : [ 0x38, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x8, ['pointer64', ['void']]], - 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], - 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], - 'Flags' : [ 0x20, ['unsigned long']], - 'ActiveCooling' : [ 0x28, ['pointer64', ['void']]], - 'PassiveCooling' : [ 0x30, ['pointer64', ['void']]], -} ], - '_HIVE_WAIT_PACKET' : [ 0x28, { - 'WakeEvent' : [ 0x0, ['_KEVENT']], - 'Status' : [ 0x18, ['long']], - 'Next' : [ 0x20, ['pointer64', ['_HIVE_WAIT_PACKET']]], -} ], - '_PROC_PERF_CHECK' : [ 0xc0, { - 'LastActive' : [ 0x0, ['unsigned long long']], - 'LastTime' : [ 0x8, ['unsigned long long']], - 'LastStall' : [ 0x10, ['unsigned long long']], - 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], - 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], - 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], - 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], - 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], -} ], - '__unnamed_2956' : [ 0x4, { - 'PollInterval' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_2958' : [ 0x18, { - 'PollInterval' : [ 0x0, ['unsigned long']], - 'Vector' : [ 0x4, ['unsigned long']], - 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], - 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], - 'ErrorThreshold' : [ 0x10, ['unsigned long']], - 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], -} ], - '__unnamed_295a' : [ 0x18, { - 'Polled' : [ 0x0, ['__unnamed_2956']], - 'Interrupt' : [ 0x0, ['__unnamed_2958']], - 'LocalInterrupt' : [ 0x0, ['__unnamed_2958']], - 'Sci' : [ 0x0, ['__unnamed_2958']], - 'Nmi' : [ 0x0, ['__unnamed_2958']], -} ], - '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { - 'Type' : [ 0x0, ['unsigned char']], - 'Length' : [ 0x1, ['unsigned char']], - 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], - 'u' : [ 0x4, ['__unnamed_295a']], -} ], - '_POP_HIBER_CONTEXT' : [ 0x1d0, { - 'Reset' : [ 0x0, ['unsigned char']], - 'HiberFlags' : [ 0x1, ['unsigned char']], - 'WroteHiberFile' : [ 0x2, ['unsigned char']], - 'VerifyKernelPhaseOnResume' : [ 0x3, ['unsigned char']], - 'KernelPhaseVerificationActive' : [ 0x4, ['unsigned char']], - 'InitializationFinished' : [ 0x5, ['unsigned char']], - 'NextTableLockHeld' : [ 0x8, ['long']], - 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], - 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], - 'HvCaptureReadyBarrier' : [ 0x14, ['long']], - 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], - 'MapFrozen' : [ 0x1c, ['unsigned char']], - 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], - 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], - 'BootPhaseMap' : [ 0x30, ['_RTL_BITMAP']], - 'ClonedRanges' : [ 0x40, ['_LIST_ENTRY']], - 'ClonedRangeCount' : [ 0x50, ['unsigned long']], - 'ClonedPageCount' : [ 0x58, ['unsigned long long']], - 'CurrentMap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], - 'NextCloneRange' : [ 0x68, ['pointer64', ['_LIST_ENTRY']]], - 'NextPreserve' : [ 0x70, ['unsigned long long']], - 'LoaderMdl' : [ 0x78, ['pointer64', ['_MDL']]], - 'AllocatedMdl' : [ 0x80, ['pointer64', ['_MDL']]], - 'PagesOut' : [ 0x88, ['unsigned long long']], - 'IoPages' : [ 0x90, ['pointer64', ['void']]], - 'IoPagesCount' : [ 0x98, ['unsigned long']], - 'CurrentMcb' : [ 0xa0, ['pointer64', ['void']]], - 'DumpStack' : [ 0xa8, ['pointer64', ['_DUMP_STACK_CONTEXT']]], - 'WakeState' : [ 0xb0, ['pointer64', ['_KPROCESSOR_STATE']]], - 'IoProgress' : [ 0xb8, ['unsigned long']], - 'Status' : [ 0xbc, ['long']], - 'GraphicsProc' : [ 0xc0, ['unsigned long']], - 'MemoryImage' : [ 0xc8, ['pointer64', ['PO_MEMORY_IMAGE']]], - 'PerformanceStats' : [ 0xd0, ['pointer64', ['unsigned long']]], - 'BootLoaderLogMdl' : [ 0xd8, ['pointer64', ['_MDL']]], - 'SiLogOffset' : [ 0xe0, ['unsigned long']], - 'FirmwareRuntimeInformationMdl' : [ 0xe8, ['pointer64', ['_MDL']]], - 'FirmwareRuntimeInformationVa' : [ 0xf0, ['pointer64', ['void']]], - 'ResumeContext' : [ 0xf8, ['pointer64', ['void']]], - 'ResumeContextPages' : [ 0x100, ['unsigned long']], - 'SecurePages' : [ 0x104, ['unsigned long']], - 'ProcessorCount' : [ 0x108, ['unsigned long']], - 'ProcessorContext' : [ 0x110, ['pointer64', ['_POP_PER_PROCESSOR_CONTEXT']]], - 'ProdConsBuffer' : [ 0x118, ['pointer64', ['unsigned char']]], - 'ProdConsSize' : [ 0x120, ['unsigned long']], - 'MaxDataPages' : [ 0x124, ['unsigned long']], - 'ExtraBuffer' : [ 0x128, ['pointer64', ['void']]], - 'ExtraBufferSize' : [ 0x130, ['unsigned long long']], - 'ExtraMapVa' : [ 0x138, ['pointer64', ['void']]], - 'BitlockerKeyPFN' : [ 0x140, ['unsigned long long']], - 'IoInfo' : [ 0x148, ['_POP_IO_INFO']], - 'IoChecksums' : [ 0x1b8, ['pointer64', ['unsigned short']]], - 'IoChecksumsSize' : [ 0x1c0, ['unsigned long long']], - 'HardwareConfigurationSignature' : [ 0x1c8, ['unsigned long']], - 'IumEnabled' : [ 0x1cc, ['unsigned char']], -} ], - '_OBJECT_REF_TRACE' : [ 0x80, { - 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], -} ], - '_CVDD' : [ 0x1c, { - 'Signature' : [ 0x0, ['unsigned long']], - 'NB10' : [ 0x0, ['_NB10']], - 'RsDs' : [ 0x0, ['_RSDS']], -} ], - '_OBJECT_NAME_INFORMATION' : [ 0x10, { - 'Name' : [ 0x0, ['_UNICODE_STRING']], -} ], - '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { - 'Type' : [ 0x0, ['unsigned short']], - 'Enabled' : [ 0x2, ['unsigned char']], - 'Reserved' : [ 0x3, ['unsigned char']], - 'BusNumber' : [ 0x4, ['unsigned long']], - 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], - 'DeviceControl' : [ 0xc, ['unsigned short']], - 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], - 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], - 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], - 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], - 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], - 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], - 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], - 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], -} ], - '_POP_FX_PERF_INFO' : [ 0xa0, { - 'Component' : [ 0x0, ['pointer64', ['_POP_FX_COMPONENT']]], - 'CompletedEvent' : [ 0x8, ['_KEVENT']], - 'ComponentPerfState' : [ 0x20, ['pointer64', ['void']]], - 'Flags' : [ 0x28, ['_POP_FX_PERF_FLAGS']], - 'LastChange' : [ 0x30, ['pointer64', ['_PO_FX_PERF_STATE_CHANGE']]], - 'LastChangeCount' : [ 0x38, ['unsigned long']], - 'LastChangeStamp' : [ 0x40, ['unsigned long long']], - 'LastChangeNominal' : [ 0x48, ['unsigned char']], - 'PepRegistered' : [ 0x49, ['unsigned char']], - 'QueryOnIdleStates' : [ 0x4a, ['unsigned char']], - 'RequestDriverContext' : [ 0x50, ['pointer64', ['void']]], - 'WorkOrder' : [ 0x58, ['_POP_FX_WORK_ORDER']], - 'SetsCount' : [ 0x90, ['unsigned long']], - 'Sets' : [ 0x98, ['pointer64', ['_POP_FX_PERF_SET']]], -} ], - '_KDESCRIPTOR' : [ 0x10, { - 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], - 'Limit' : [ 0x6, ['unsigned short']], - 'Base' : [ 0x8, ['pointer64', ['void']]], -} ], - '_HAL_CHANNEL_MEMORY_RANGES' : [ 0x10, { - 'PageFrameIndex' : [ 0x0, ['unsigned long long']], - 'MpnId' : [ 0x8, ['unsigned short']], - 'Node' : [ 0xa, ['unsigned short']], - 'Channel' : [ 0xc, ['unsigned short']], - 'IsPowerManageable' : [ 0xe, ['unsigned char']], - 'DeepPowerState' : [ 0xf, ['unsigned char']], -} ], - '_PCW_COUNTER_INFORMATION' : [ 0x10, { - 'CounterMask' : [ 0x0, ['unsigned long long']], - 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], -} ], - '_DUMP_STACK_CONTEXT' : [ 0x178, { - 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], - 'PartitionOffset' : [ 0x108, ['_LARGE_INTEGER']], - 'DumpPointers' : [ 0x110, ['pointer64', ['void']]], - 'PointersLength' : [ 0x118, ['unsigned long']], - 'ModulePrefix' : [ 0x120, ['pointer64', ['unsigned short']]], - 'DriverList' : [ 0x128, ['_LIST_ENTRY']], - 'InitMsg' : [ 0x138, ['_STRING']], - 'ProgMsg' : [ 0x148, ['_STRING']], - 'DoneMsg' : [ 0x158, ['_STRING']], - 'FileObject' : [ 0x168, ['pointer64', ['void']]], - 'UsageType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], -} ], - '_FILE_STANDARD_INFORMATION' : [ 0x18, { - 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], - 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], - 'NumberOfLinks' : [ 0x10, ['unsigned long']], - 'DeletePending' : [ 0x14, ['unsigned char']], - 'Directory' : [ 0x15, ['unsigned char']], -} ], - '_ETW_FILTER_STRING_TOKEN' : [ 0x18, { - 'Count' : [ 0x0, ['unsigned short']], - 'Tokens' : [ 0x8, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], -} ], - '_POP_SHUTDOWN_BUG_CHECK' : [ 0x48, { - 'InitiatingThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], - 'InitiatingProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], - 'ThreadId' : [ 0x10, ['pointer64', ['void']]], - 'ProcessId' : [ 0x18, ['pointer64', ['void']]], - 'Code' : [ 0x20, ['unsigned long']], - 'Parameter1' : [ 0x28, ['unsigned long long']], - 'Parameter2' : [ 0x30, ['unsigned long long']], - 'Parameter3' : [ 0x38, ['unsigned long long']], - 'Parameter4' : [ 0x40, ['unsigned long long']], -} ], - '_NB10' : [ 0x14, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Offset' : [ 0x4, ['unsigned long']], - 'TimeStamp' : [ 0x8, ['unsigned long']], - 'Age' : [ 0xc, ['unsigned long']], - 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], -} ], - '_PCW_MASK_INFORMATION' : [ 0x28, { - 'CounterMask' : [ 0x0, ['unsigned long long']], - 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], - 'InstanceId' : [ 0x10, ['unsigned long']], - 'CollectMultiple' : [ 0x14, ['unsigned char']], - 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], - 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], -} ], - '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { - 'Revision' : [ 0x0, ['unsigned char']], - 'Sbz1' : [ 0x1, ['unsigned char']], - 'Control' : [ 0x2, ['unsigned short']], - 'Owner' : [ 0x4, ['unsigned long']], - 'Group' : [ 0x8, ['unsigned long']], - 'Sacl' : [ 0xc, ['unsigned long']], - 'Dacl' : [ 0x10, ['unsigned long']], -} ], - '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { - 'StructureSize' : [ 0x0, ['unsigned long']], - 'SizeReturned' : [ 0x4, ['unsigned long']], - 'Flags' : [ 0x8, ['unsigned long']], - 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], -} ], - '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x48, { - 'ViewOffset' : [ 0x0, ['unsigned long']], - 'Pinned' : [ 0x4, ['unsigned char']], - 'PinMask' : [ 0x8, ['unsigned long long']], - 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], - 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], -} ], - '__unnamed_299a' : [ 0x20, { - 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], - 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], - 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], - 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], - 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], - 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], - 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], -} ], - '_ARBITER_PARAMETERS' : [ 0x20, { - 'Parameters' : [ 0x0, ['__unnamed_299a']], -} ], - '__unnamed_299e' : [ 0x8, { - 'idxRecord' : [ 0x0, ['unsigned long']], - 'cidContainer' : [ 0x4, ['unsigned long']], -} ], - '_CLS_LSN' : [ 0x8, { - 'offset' : [ 0x0, ['__unnamed_299e']], - 'ullOffset' : [ 0x0, ['unsigned long long']], -} ], - '_MI_SUBSECTION_WAIT_BLOCK' : [ 0x20, { - 'Next' : [ 0x0, ['pointer64', ['_MI_SUBSECTION_WAIT_BLOCK']]], - 'Gate' : [ 0x8, ['_KGATE']], -} ], - 'POWER_ACTION_POLICY' : [ 0xc, { - 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], - 'Flags' : [ 0x4, ['unsigned long']], - 'EventCode' : [ 0x8, ['unsigned long']], -} ], - '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { - 'Value' : [ 0x0, ['unsigned long']], - 'Weight' : [ 0x0, ['unsigned short']], - 'MinRate' : [ 0x0, ['unsigned short']], - 'MaxRate' : [ 0x2, ['unsigned short']], - 'AllFlags' : [ 0x4, ['unsigned long']], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], -} ], - '_RSDS' : [ 0x1c, { - 'Signature' : [ 0x0, ['unsigned long']], - 'Guid' : [ 0x4, ['_GUID']], - 'Age' : [ 0x14, ['unsigned long']], - 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], -} ], - 'PO_MEMORY_IMAGE' : [ 0x3b0, { - 'Signature' : [ 0x0, ['unsigned long']], - 'ImageType' : [ 0x4, ['unsigned long']], - 'CheckSum' : [ 0x8, ['unsigned long']], - 'LengthSelf' : [ 0xc, ['unsigned long']], - 'PageSelf' : [ 0x10, ['unsigned long long']], - 'PageSize' : [ 0x18, ['unsigned long']], - 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], - 'InterruptTime' : [ 0x28, ['unsigned long long']], - 'FeatureFlags' : [ 0x30, ['unsigned long long']], - 'HiberFlags' : [ 0x38, ['unsigned char']], - 'spare' : [ 0x39, ['array', 3, ['unsigned char']]], - 'NoHiberPtes' : [ 0x3c, ['unsigned long']], - 'HiberVa' : [ 0x40, ['unsigned long long']], - 'NoFreePages' : [ 0x48, ['unsigned long']], - 'FreeMapCheck' : [ 0x4c, ['unsigned long']], - 'WakeCheck' : [ 0x50, ['unsigned long']], - 'NumPagesForLoader' : [ 0x58, ['unsigned long long']], - 'FirstSecureRestorePage' : [ 0x60, ['unsigned long long']], - 'FirstBootRestorePage' : [ 0x68, ['unsigned long long']], - 'FirstKernelRestorePage' : [ 0x70, ['unsigned long long']], - 'FirstChecksumRestorePage' : [ 0x78, ['unsigned long long']], - 'NoChecksumEntries' : [ 0x80, ['unsigned long long']], - 'PerfInfo' : [ 0x88, ['_PO_HIBER_PERF']], - 'FirmwareRuntimeInformationPages' : [ 0x268, ['unsigned long']], - 'FirmwareRuntimeInformation' : [ 0x270, ['array', 1, ['unsigned long long']]], - 'SiLogOffset' : [ 0x278, ['unsigned long']], - 'NoBootLoaderLogPages' : [ 0x27c, ['unsigned long']], - 'BootLoaderLogPages' : [ 0x280, ['array', 24, ['unsigned long long']]], - 'NotUsed' : [ 0x340, ['unsigned long']], - 'ResumeContextCheck' : [ 0x344, ['unsigned long']], - 'ResumeContextPages' : [ 0x348, ['unsigned long']], - 'Hiberboot' : [ 0x34c, ['unsigned char']], - 'HvCr3' : [ 0x350, ['unsigned long long']], - 'HvEntryPoint' : [ 0x358, ['unsigned long long']], - 'HvReservedTransitionAddress' : [ 0x360, ['unsigned long long']], - 'HvReservedTransitionAddressSize' : [ 0x368, ['unsigned long long']], - 'BootFlags' : [ 0x370, ['unsigned long long']], - 'HalEntryPointPhysical' : [ 0x378, ['unsigned long long']], - 'HighestPhysicalPage' : [ 0x380, ['unsigned long long']], - 'BitlockerKeyPfns' : [ 0x388, ['array', 4, ['unsigned long long']]], - 'HardwareSignature' : [ 0x3a8, ['unsigned long']], -} ], - 'BATTERY_REPORTING_SCALE' : [ 0x8, { - 'Granularity' : [ 0x0, ['unsigned long']], - 'Capacity' : [ 0x4, ['unsigned long']], -} ], - '_RTL_ATOM_TABLE_REFERENCE' : [ 0x18, { - 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], - 'LowBoxID' : [ 0x10, ['unsigned long']], - 'ReferenceCount' : [ 0x14, ['unsigned short']], - 'Flags' : [ 0x16, ['unsigned short']], -} ], - '_CURDIR' : [ 0x18, { - 'DosPath' : [ 0x0, ['_UNICODE_STRING']], - 'Handle' : [ 0x10, ['pointer64', ['void']]], -} ], - '_PO_HIBER_PERF' : [ 0x1e0, { - 'HiberIoTicks' : [ 0x0, ['unsigned long long']], - 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], - 'HiberInitTicks' : [ 0x10, ['unsigned long long']], - 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], - 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], - 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], - 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], - 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], - 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], - 'POSTTime' : [ 0x48, ['unsigned long']], - 'ResumeBootMgrTime' : [ 0x4c, ['unsigned long']], - 'BootmgrUserInputTime' : [ 0x50, ['unsigned long']], - 'ResumeAppTicks' : [ 0x58, ['unsigned long long']], - 'ResumeAppStartTimestamp' : [ 0x60, ['unsigned long long']], - 'ResumeLibraryInitTicks' : [ 0x68, ['unsigned long long']], - 'ResumeInitTicks' : [ 0x70, ['unsigned long long']], - 'ResumeRestoreImageStartTimestamp' : [ 0x78, ['unsigned long long']], - 'ResumeHiberFileTicks' : [ 0x80, ['unsigned long long']], - 'ResumeIoTicks' : [ 0x88, ['unsigned long long']], - 'ResumeDecompressTicks' : [ 0x90, ['unsigned long long']], - 'ResumeAllocateTicks' : [ 0x98, ['unsigned long long']], - 'ResumeUserInOutTicks' : [ 0xa0, ['unsigned long long']], - 'ResumeMapTicks' : [ 0xa8, ['unsigned long long']], - 'ResumeUnmapTicks' : [ 0xb0, ['unsigned long long']], - 'ResumeChecksumTicks' : [ 0xb8, ['unsigned long long']], - 'ResumeChecksumIoTicks' : [ 0xc0, ['unsigned long long']], - 'ResumeKernelSwitchTimestamp' : [ 0xc8, ['unsigned long long']], - 'WriteLogDataTimestamp' : [ 0xd0, ['unsigned long long']], - 'KernelReturnFromHandler' : [ 0xd8, ['unsigned long long']], - 'TimeStampCounterAtSwitchTime' : [ 0xe0, ['unsigned long long']], - 'HalTscOffset' : [ 0xe8, ['unsigned long long']], - 'HvlTscOffset' : [ 0xf0, ['unsigned long long']], - 'SleeperThreadEnd' : [ 0xf8, ['unsigned long long']], - 'KernelReturnSystemPowerStateTimestamp' : [ 0x100, ['unsigned long long']], - 'IoBoundedness' : [ 0x108, ['unsigned long long']], - 'KernelDecompressTicks' : [ 0x110, ['unsigned long long']], - 'KernelIoTicks' : [ 0x118, ['unsigned long long']], - 'KernelCopyTicks' : [ 0x120, ['unsigned long long']], - 'ReadCheckCount' : [ 0x128, ['unsigned long long']], - 'KernelInitTicks' : [ 0x130, ['unsigned long long']], - 'KernelResumeHiberFileTicks' : [ 0x138, ['unsigned long long']], - 'KernelIoCpuTicks' : [ 0x140, ['unsigned long long']], - 'KernelSharedBufferTicks' : [ 0x148, ['unsigned long long']], - 'KernelAnimationTicks' : [ 0x150, ['unsigned long long']], - 'KernelChecksumTicks' : [ 0x158, ['unsigned long long']], - 'KernelChecksumIoTicks' : [ 0x160, ['unsigned long long']], - 'AnimationStart' : [ 0x168, ['_LARGE_INTEGER']], - 'AnimationStop' : [ 0x170, ['_LARGE_INTEGER']], - 'DeviceResumeTime' : [ 0x178, ['unsigned long']], - 'SecurePagesProcessed' : [ 0x180, ['unsigned long long']], - 'BootPagesProcessed' : [ 0x188, ['unsigned long long']], - 'KernelPagesProcessed' : [ 0x190, ['unsigned long long']], - 'BootBytesWritten' : [ 0x198, ['unsigned long long']], - 'KernelBytesWritten' : [ 0x1a0, ['unsigned long long']], - 'BootPagesWritten' : [ 0x1a8, ['unsigned long long']], - 'KernelPagesWritten' : [ 0x1b0, ['unsigned long long']], - 'BytesWritten' : [ 0x1b8, ['unsigned long long']], - 'PagesWritten' : [ 0x1c0, ['unsigned long']], - 'FileRuns' : [ 0x1c4, ['unsigned long']], - 'NoMultiStageResumeReason' : [ 0x1c8, ['unsigned long']], - 'MaxHuffRatio' : [ 0x1cc, ['unsigned long']], - 'AdjustedTotalResumeTime' : [ 0x1d0, ['unsigned long long']], - 'ResumeCompleteTimestamp' : [ 0x1d8, ['unsigned long long']], -} ], - '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x28, { - 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], - 'Active' : [ 0x20, ['long']], -} ], - '_POP_FX_PROVIDER' : [ 0x8, { - 'Index' : [ 0x0, ['unsigned long']], - 'Activating' : [ 0x4, ['unsigned char']], -} ], - '_RTL_BALANCED_LINKS' : [ 0x20, { - 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], - 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], - 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], - 'Balance' : [ 0x18, ['unsigned char']], - 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], -} ], - '_FREE_DISPLAY' : [ 0x18, { - 'RealVectorSize' : [ 0x0, ['unsigned long']], - 'Hint' : [ 0x4, ['unsigned long']], - 'Display' : [ 0x8, ['_RTL_BITMAP']], -} ], - '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x38, { - 'Page' : [ 0x0, ['array', 1, ['unsigned long long']]], - 'InitialInPageSupport' : [ 0x8, ['pointer64', ['_MMINPAGE_SUPPORT']]], - 'PagingFile' : [ 0x10, ['pointer64', ['_MMPAGING_FILE']]], - 'PageFileOffset' : [ 0x18, ['unsigned long long']], - 'Node' : [ 0x20, ['_RTL_BALANCED_NODE']], -} ], - '_POP_PER_PROCESSOR_CONTEXT' : [ 0x80, { - 'UncompressedData' : [ 0x0, ['pointer64', ['unsigned char']]], - 'MappingVa' : [ 0x8, ['pointer64', ['void']]], - 'XpressEncodeWorkspace' : [ 0x10, ['pointer64', ['void']]], - 'CompressedDataBuffer' : [ 0x18, ['pointer64', ['unsigned char']]], - 'CopyTicks' : [ 0x20, ['unsigned long long']], - 'CompressTicks' : [ 0x28, ['unsigned long long']], - 'BytesCopied' : [ 0x30, ['unsigned long long']], - 'PagesProcessed' : [ 0x38, ['unsigned long long']], - 'DecompressTicks' : [ 0x40, ['unsigned long long']], - 'ResumeCopyTicks' : [ 0x48, ['unsigned long long']], - 'SharedBufferTicks' : [ 0x50, ['unsigned long long']], - 'DecompressTicksByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], - 'DecompressSizeByMethod' : [ 0x68, ['array', 2, ['unsigned long long']]], - 'CompressCount' : [ 0x78, ['unsigned long']], - 'HuffCompressCount' : [ 0x7c, ['unsigned long']], -} ], - '_IO_REMOVE_LOCK' : [ 0x20, { - 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], -} ], - '_MI_DYNAMIC_BITMAP' : [ 0x50, { - 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], - 'MaximumSize' : [ 0x10, ['unsigned long long']], - 'Hint' : [ 0x18, ['unsigned long long']], - 'BaseVa' : [ 0x20, ['pointer64', ['void']]], - 'SizeTopDown' : [ 0x28, ['unsigned long long']], - 'HintTopDown' : [ 0x30, ['unsigned long long']], - 'BaseVaTopDown' : [ 0x38, ['pointer64', ['void']]], - 'SpinLock' : [ 0x40, ['unsigned long long']], - 'Vm' : [ 0x48, ['pointer64', ['_MMSUPPORT']]], -} ], - '_POP_IO_INFO' : [ 0x70, { - 'DumpMdl' : [ 0x0, ['pointer64', ['_MDL']]], - 'IoStatus' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], - 'IoStartCount' : [ 0x10, ['unsigned long long']], - 'IoBytesCompleted' : [ 0x18, ['unsigned long long']], - 'IoBytesInProgress' : [ 0x20, ['unsigned long long']], - 'RequestSize' : [ 0x28, ['unsigned long long']], - 'IoLocation' : [ 0x30, ['_LARGE_INTEGER']], - 'FileOffset' : [ 0x38, ['unsigned long long']], - 'Buffer' : [ 0x40, ['pointer64', ['void']]], - 'AsyncCapable' : [ 0x48, ['unsigned char']], - 'BytesToRead' : [ 0x50, ['unsigned long long']], - 'Pages' : [ 0x58, ['unsigned long']], - 'HighestChecksumIndex' : [ 0x60, ['unsigned long long']], - 'PreviousChecksum' : [ 0x68, ['unsigned short']], -} ], - '_LDRP_CSLIST' : [ 0x8, { - 'Tail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], -} ], - '_NON_PAGED_DEBUG_INFO' : [ 0x20, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Flags' : [ 0x2, ['unsigned short']], - 'Size' : [ 0x4, ['unsigned long']], - 'Machine' : [ 0x8, ['unsigned short']], - 'Characteristics' : [ 0xa, ['unsigned short']], - 'TimeDateStamp' : [ 0xc, ['unsigned long']], - 'CheckSum' : [ 0x10, ['unsigned long']], - 'SizeOfImage' : [ 0x14, ['unsigned long']], - 'ImageBase' : [ 0x18, ['unsigned long long']], -} ], - '_POP_FX_PERF_SET' : [ 0x20, { - 'PerfSet' : [ 0x0, ['pointer64', ['_PO_FX_COMPONENT_PERF_SET']]], - 'CurrentPerf' : [ 0x8, ['unsigned long long']], - 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], - 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], -} ], - '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { - 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], - 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], - 'AsUSHORT' : [ 0x0, ['unsigned short']], -} ], - '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], -} ], - '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { - 'Type' : [ 0x0, ['unsigned short']], - 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], - 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], - 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], - 'EntryCount' : [ 0x20, ['unsigned long']], - 'ContentionCount' : [ 0x24, ['unsigned long']], - 'Flags' : [ 0x28, ['unsigned long']], - 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], - 'SpareUSHORT' : [ 0x2e, ['unsigned short']], -} ], - '__unnamed_29dd' : [ 0x8, { - 'Gsiv' : [ 0x0, ['unsigned long']], - 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_29df' : [ 0x10, { - 'Address' : [ 0x0, ['_LARGE_INTEGER']], - 'DataPayload' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_29e2' : [ 0x8, { - 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], -} ], - '__unnamed_29e6' : [ 0x4, { - 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], -} ], - '_INTERRUPT_VECTOR_DATA' : [ 0x58, { - 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], - 'Vector' : [ 0x4, ['unsigned long']], - 'Irql' : [ 0x8, ['unsigned char']], - 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], - 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], - 'TargetProcessors' : [ 0x18, ['_GROUP_AFFINITY']], - 'IntRemapInfo' : [ 0x28, ['_INTERRUPT_REMAPPING_INFO']], - 'ControllerInput' : [ 0x38, ['__unnamed_29dd']], - 'HvDeviceId' : [ 0x40, ['unsigned long long']], - 'XapicMessage' : [ 0x48, ['__unnamed_29df']], - 'Hypertransport' : [ 0x48, ['__unnamed_29e2']], - 'GenericMessage' : [ 0x48, ['__unnamed_29df']], - 'MessageRequest' : [ 0x48, ['__unnamed_29e6']], -} ], - '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { - 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], - 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], - 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], - 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], -} ], - '_POP_FX_DEPENDENT' : [ 0x8, { - 'Index' : [ 0x0, ['unsigned long']], - 'ProviderIndex' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_29f4' : [ 0x10, { - 'Count' : [ 0x0, ['unsigned long']], - 'States' : [ 0x8, ['pointer64', ['_PO_FX_PERF_STATE']]], -} ], - '__unnamed_29f6' : [ 0x10, { - 'Minimum' : [ 0x0, ['unsigned long long']], - 'Maximum' : [ 0x8, ['unsigned long long']], -} ], - '_PO_FX_COMPONENT_PERF_SET' : [ 0x30, { - 'Name' : [ 0x0, ['_UNICODE_STRING']], - 'Flags' : [ 0x10, ['unsigned long long']], - 'Unit' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], - 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], - 'Discrete' : [ 0x20, ['__unnamed_29f4']], - 'Range' : [ 0x20, ['__unnamed_29f6']], -} ], - '_XPF_MCE_FLAGS' : [ 0x4, { - 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_2a07' : [ 0x8, { - 'Signature' : [ 0x0, ['unsigned long']], - 'CheckSum' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_2a09' : [ 0x10, { - 'DiskId' : [ 0x0, ['_GUID']], -} ], - '__unnamed_2a0b' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_2a07']], - 'Gpt' : [ 0x0, ['__unnamed_2a09']], -} ], - '_DUMP_INITIALIZATION_CONTEXT' : [ 0x108, { - 'Length' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], - 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], - 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], - 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], - 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], - 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], - 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], - 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], - 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], - 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], - 'CrashDump' : [ 0x68, ['unsigned char']], - 'MarkMemoryOnly' : [ 0x69, ['unsigned char']], - 'HiberResume' : [ 0x6a, ['unsigned char']], - 'Reserved1' : [ 0x6b, ['unsigned char']], - 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], - 'CommonBufferSize' : [ 0x70, ['unsigned long']], - 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], - 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], - 'PartitionStyle' : [ 0x88, ['unsigned long']], - 'DiskInfo' : [ 0x8c, ['__unnamed_2a0b']], - 'ReadRoutine' : [ 0xa0, ['pointer64', ['void']]], - 'GetDriveTelemetryRoutine' : [ 0xa8, ['pointer64', ['void']]], - 'LogSectionTruncateSize' : [ 0xb0, ['unsigned long']], - 'Parameters' : [ 0xb4, ['array', 16, ['unsigned long']]], - 'GetTransferSizesRoutine' : [ 0xf8, ['pointer64', ['void']]], - 'DumpNotifyRoutine' : [ 0x100, ['pointer64', ['void']]], -} ], - '_MI_IO_CACHE_STATS' : [ 0x20, { - 'UnusedBlocks' : [ 0x0, ['unsigned long long']], - 'ActiveCacheMatch' : [ 0x8, ['unsigned long']], - 'ActiveCacheOverride' : [ 0xc, ['unsigned long']], - 'UnmappedCacheFlush' : [ 0x10, ['unsigned long']], - 'UnmappedCacheMatch' : [ 0x14, ['unsigned long']], - 'UnmappedCacheConflict' : [ 0x18, ['unsigned long']], -} ], - '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { - 'Residency' : [ 0x0, ['unsigned long long']], - 'TransitionCount' : [ 0x8, ['unsigned long long']], -} ], - '_ETW_QUEUE_ENTRY' : [ 0x38, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'DataBlock' : [ 0x10, ['pointer64', ['_ETWP_NOTIFICATION_HEADER']]], - 'RegEntry' : [ 0x18, ['pointer64', ['_ETW_REG_ENTRY']]], - 'ReplyObject' : [ 0x20, ['pointer64', ['_ETW_REG_ENTRY']]], - 'WakeReference' : [ 0x28, ['pointer64', ['void']]], - 'RegIndex' : [ 0x30, ['unsigned short']], - 'ReplyIndex' : [ 0x32, ['unsigned short']], - 'Flags' : [ 0x34, ['unsigned long']], -} ], - '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { - 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], - 'EntireInfo' : [ 0x0, ['long']], -} ], - '_TRIAGE_POP_IRP_DATA' : [ 0x20, { - 'Link' : [ 0x0, ['_LIST_ENTRY']], - 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], - 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], -} ], - '_KDPC_LIST' : [ 0x10, { - 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'LastEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], -} ], - '_CM_KEY_SECURITY' : [ 0x28, { - 'Signature' : [ 0x0, ['unsigned short']], - 'Reserved' : [ 0x2, ['unsigned short']], - 'Flink' : [ 0x4, ['unsigned long']], - 'Blink' : [ 0x8, ['unsigned long']], - 'ReferenceCount' : [ 0xc, ['unsigned long']], - 'DescriptorLength' : [ 0x10, ['unsigned long']], - 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], -} ], - '_PO_DEVICE_NOTIFY_ORDER' : [ 0x178, { - 'Locked' : [ 0x0, ['unsigned char']], - 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], - 'OrderLevel' : [ 0x10, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], -} ], - '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { - 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], - 'PriorityTooLow' : [ 0x4, ['unsigned long']], - 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], - 'PagedNoPtes' : [ 0xc, ['unsigned long']], - 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], - 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], - 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], - 'PagedNoCommit' : [ 0x1c, ['unsigned long']], - 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], - 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], - 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], -} ], - '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x20, { - 'Removed' : [ 0x0, ['unsigned char']], - 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], - 'IoCount' : [ 0x4, ['long']], - 'RemoveEvent' : [ 0x8, ['_KEVENT']], -} ], - '_POP_FX_IDLE_STATE' : [ 0x18, { - 'TransitionLatency' : [ 0x0, ['unsigned long long']], - 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], - 'NominalPower' : [ 0x10, ['unsigned long']], -} ], - '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { - 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], - 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], - 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], - 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], - 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], - 'AsUSHORT' : [ 0x0, ['unsigned short']], -} ], - '_ARBITER_CONFLICT_INFO' : [ 0x18, { - 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], - 'Start' : [ 0x8, ['unsigned long long']], - 'End' : [ 0x10, ['unsigned long long']], -} ], - '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { - 'DeviceCount' : [ 0x0, ['unsigned long']], - 'ActiveCount' : [ 0x4, ['unsigned long']], - 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], - 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], - 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], - 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], -} ], - '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { - 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], - 'NotificationSize' : [ 0x4, ['unsigned long']], - 'RefCount' : [ 0x8, ['long']], - 'ReplyRequested' : [ 0xc, ['unsigned char']], - 'ReplyIndex' : [ 0x10, ['unsigned long']], - 'Timeout' : [ 0x10, ['unsigned long']], - 'ReplyCount' : [ 0x14, ['unsigned long']], - 'NotifyeeCount' : [ 0x14, ['unsigned long']], - 'ReplyHandle' : [ 0x18, ['unsigned long long']], - 'ReplyObject' : [ 0x18, ['pointer64', ['void']]], - 'RegIndex' : [ 0x18, ['unsigned long']], - 'TargetPID' : [ 0x20, ['unsigned long']], - 'SourcePID' : [ 0x24, ['unsigned long']], - 'DestinationGuid' : [ 0x28, ['_GUID']], - 'SourceGuid' : [ 0x38, ['_GUID']], -} ], - '__unnamed_2a42' : [ 0x4, { - 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], - 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], - 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], - 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], - 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], - 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], - 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], - 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], - 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_2a44' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_2a42']], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '__unnamed_2a47' : [ 0x4, { - 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], - 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], -} ], - '__unnamed_2a49' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_2a47']], - 'AsULONG' : [ 0x0, ['unsigned long']], -} ], - '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { - 'LowPart' : [ 0x0, ['__unnamed_2a44']], - 'HighPart' : [ 0x4, ['__unnamed_2a49']], -} ], - '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], - 'ContextSwitches' : [ 0x8, ['unsigned long']], - 'HwCountersCount' : [ 0xc, ['unsigned long']], - 'UpdateCount' : [ 0x10, ['unsigned long long']], - 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], - 'HardwareCounters' : [ 0x20, ['unsigned long long']], - 'CycleTime' : [ 0x28, ['_COUNTER_READING']], - 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], -} ], - '_ETW_REPLY_QUEUE' : [ 0x48, { - 'Queue' : [ 0x0, ['_KQUEUE']], - 'EventsLost' : [ 0x40, ['long']], -} ], - '_PROC_PERF_CHECK_SNAP' : [ 0x50, { - 'Time' : [ 0x0, ['unsigned long long']], - 'Active' : [ 0x8, ['unsigned long long']], - 'Stall' : [ 0x10, ['unsigned long long']], - 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], - 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], - 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], - 'CyclesActive' : [ 0x30, ['unsigned long long']], - 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], - 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], -} ], - '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { - 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], -} ], - '__unnamed_2a57' : [ 0x4, { - 'ReferenceCount' : [ 0x0, ['unsigned long']], - 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], -} ], - '_MI_PER_SESSION_PROTOS' : [ 0x30, { - 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], - 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'DriverAddress' : [ 0x0, ['pointer64', ['void']]], - 'SessionId' : [ 0x18, ['unsigned long']], - 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], - 'SubsectionBase' : [ 0x20, ['pointer64', ['_MMPTE']]], - 'u2' : [ 0x28, ['__unnamed_2a57']], -} ], - '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { - 'Set' : [ 0x0, ['unsigned long']], - 'StateIndex' : [ 0x8, ['unsigned long']], - 'StateValue' : [ 0x8, ['unsigned long long']], -} ], - '__unnamed_2a5d' : [ 0x8, { - 'MessageAddressLow' : [ 0x0, ['unsigned long']], - 'MessageData' : [ 0x4, ['unsigned short']], - 'Reserved' : [ 0x6, ['unsigned short']], -} ], - '__unnamed_2a5f' : [ 0x8, { - 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], - 'Msi' : [ 0x0, ['__unnamed_2a5d']], -} ], - '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { - 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], - 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], - 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], - 'u' : [ 0x8, ['__unnamed_2a5f']], -} ], - '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { - 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], - 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], - 'Flags' : [ 0x10, ['unsigned long']], -} ], - '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'String' : [ 0x8, ['pointer64', ['unsigned short']]], -} ], - '_ARBITER_ORDERING' : [ 0x10, { - 'Start' : [ 0x0, ['unsigned long long']], - 'End' : [ 0x8, ['unsigned long long']], -} ], - '_RTL_AVL_TABLE' : [ 0x68, { - 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], - 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], - 'WhichOrderedElement' : [ 0x28, ['unsigned long']], - 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], - 'DepthOfTree' : [ 0x30, ['unsigned long']], - 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], - 'DeleteCount' : [ 0x40, ['unsigned long']], - 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], - 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], - 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], - 'TableContext' : [ 0x60, ['pointer64', ['void']]], -} ], - '_KTRANSACTION_HISTORY' : [ 0x8, { - 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], - 'Payload' : [ 0x4, ['unsigned long']], -} ], - '_PO_FX_PERF_STATE' : [ 0x10, { - 'Value' : [ 0x0, ['unsigned long long']], - 'Context' : [ 0x8, ['pointer64', ['void']]], -} ], -} From 5089b9ac5b3f6def98d478642ebde1c099fbf851 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Thu, 8 Sep 2016 15:30:40 -0400 Subject: [PATCH 025/304] win10: add 14393 profile --- volatility/plugins/overlays/windows/win10.py | 11 +- .../windows/win10_x64_DD08DD42_vtypes.py | 13679 ++++++++++++++++ 2 files changed, 13689 insertions(+), 1 deletion(-) create mode 100644 volatility/plugins/overlays/windows/win10_x64_DD08DD42_vtypes.py diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index aa033d3e6..ac21afe60 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -385,7 +385,7 @@ def modification(self, profile): metadata = profile.metadata build = metadata.get("build", 0) - if build == 10240: + if build >= 10240: header = _OBJECT_HEADER_10_1AC738FB else: header = _OBJECT_HEADER_10 @@ -448,6 +448,15 @@ class Win10x64_1AC738FB(obj.Profile): _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes' +class Win10x64_DD08DD42(obj.Profile): + """ A Profile for Windows 10 x64 from PDB DD08DD42""" + _md_memory_model = '64bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 4 + _md_build = 14393 + _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_DD08DD42_vtypes' + class Win10x86(obj.Profile): """ A Profile for Windows 10 x86 """ _md_memory_model = '32bit' diff --git a/volatility/plugins/overlays/windows/win10_x64_DD08DD42_vtypes.py b/volatility/plugins/overlays/windows/win10_x64_DD08DD42_vtypes.py new file mode 100644 index 000000000..f168265f2 --- /dev/null +++ b/volatility/plugins/overlays/windows/win10_x64_DD08DD42_vtypes.py @@ -0,0 +1,13679 @@ +ntkrnlmp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x708, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'NtBuildNumber' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'BootId' : [ 0x2c4, ['unsigned long']], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'VirtualizationFlags' : [ 0x2ed, ['unsigned char']], + 'Reserved12' : [ 0x2ee, ['array', 2, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgMultiUsersInSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCall' : [ 0x308, ['unsigned long']], + 'SystemCallPad0' : [ 0x30c, ['unsigned long']], + 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], + 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], + 'Reserved8' : [ 0x37c, ['unsigned long']], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_1080' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_1080']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1098' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109a' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_1098']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], + 'RaceDll' : [ 0x20, ['pointer64', ['void']]], + 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], + 'u' : [ 0x38, ['__unnamed_109a']], + 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x40, ['unsigned long']], +} ], + '_TEB' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], + 'ClientId' : [ 0x40, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], + 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['pointer64', ['void']]]], + 'SystemReserved1' : [ 0x190, ['array', 37, ['pointer64', ['void']]]], + 'WorkingOnBehalfTicket' : [ 0x2b8, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], + 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], + 'glSection' : [ 0x1230, ['pointer64', ['void']]], + 'glTable' : [ 0x1238, ['pointer64', ['void']]], + 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], + 'glContext' : [ 0x1248, ['pointer64', ['void']]], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], + 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], + 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], + 'Vdm' : [ 0x1690, ['pointer64', ['void']]], + 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], + 'PerflibData' : [ 0x1728, ['pointer64', ['void']]], + 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], + 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], + 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], + 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], + 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], + 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], + 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], + 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], + 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], + 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], + 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], + 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], + 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], + 'ReservedForWdf' : [ 0x1818, ['pointer64', ['void']]], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_LIST_ENTRY' : [ 0x10, { + 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x8, { + 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0x18, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { + 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'CurEntry' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer64', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['wchar']]], +} ], + '_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '__unnamed_110a' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_110a']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '_RTL_BITMAP' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS64' : [ 0x108, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_RB_TREE' : [ 0x10, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0x18, { + 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_AVL_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x6a80, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], + 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], + 'UserRsp' : [ 0x10, ['unsigned long long']], + 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], + 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], + 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Used_Self' : [ 0x30, ['pointer64', ['void']]], + 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], + 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'Irql' : [ 0x50, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], + 'ObsoleteNumber' : [ 0x52, ['unsigned char']], + 'Fill0' : [ 0x53, ['unsigned char']], + 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], + 'MajorVersion' : [ 0x60, ['unsigned short']], + 'MinorVersion' : [ 0x62, ['unsigned short']], + 'StallScaleFactor' : [ 0x64, ['unsigned long']], + 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], + 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], + 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], + 'Unused2' : [ 0x100, ['unsigned long']], + 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], + 'Unused3' : [ 0x110, ['pointer64', ['void']]], + 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], + 'Prcb' : [ 0x180, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x6900, { + 'MxCsr' : [ 0x0, ['unsigned long']], + 'LegacyNumber' : [ 0x4, ['unsigned char']], + 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], + 'InterruptRequest' : [ 0x6, ['unsigned char']], + 'IdleHalt' : [ 0x7, ['unsigned char']], + 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NestingLevel' : [ 0x20, ['unsigned char']], + 'ClockOwner' : [ 0x21, ['unsigned char']], + 'PendingTickFlags' : [ 0x22, ['unsigned char']], + 'PendingTick' : [ 0x22, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x22, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IdleState' : [ 0x23, ['unsigned char']], + 'Number' : [ 0x24, ['unsigned long']], + 'RspBase' : [ 0x28, ['unsigned long long']], + 'PrcbLock' : [ 0x30, ['unsigned long long']], + 'PriorityState' : [ 0x38, ['pointer64', ['unsigned char']]], + 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], + 'CpuType' : [ 0x5f0, ['unsigned char']], + 'CpuID' : [ 0x5f1, ['unsigned char']], + 'CpuStep' : [ 0x5f2, ['unsigned short']], + 'CpuStepping' : [ 0x5f2, ['unsigned char']], + 'CpuModel' : [ 0x5f3, ['unsigned char']], + 'MHz' : [ 0x5f4, ['unsigned long']], + 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], + 'MinorVersion' : [ 0x638, ['unsigned short']], + 'MajorVersion' : [ 0x63a, ['unsigned short']], + 'BuildType' : [ 0x63c, ['unsigned char']], + 'CpuVendor' : [ 0x63d, ['unsigned char']], + 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], + 'ParentNode' : [ 0x640, ['pointer64', ['_KNODE']]], + 'GroupSetMember' : [ 0x648, ['unsigned long long']], + 'Group' : [ 0x650, ['unsigned char']], + 'GroupIndex' : [ 0x651, ['unsigned char']], + 'PrcbPad05' : [ 0x652, ['array', 2, ['unsigned char']]], + 'InitialApicId' : [ 0x654, ['unsigned long']], + 'ScbOffset' : [ 0x658, ['unsigned long']], + 'ApicMask' : [ 0x65c, ['unsigned long']], + 'AcpiReserved' : [ 0x660, ['pointer64', ['void']]], + 'CFlushSize' : [ 0x668, ['unsigned long']], + 'PrcbPad10' : [ 0x66c, ['unsigned long']], + 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x2080, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PrcbPad20' : [ 0x2c80, ['unsigned long long']], + 'DeferredReadyListHead' : [ 0x2c88, ['_SINGLE_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x2c90, ['long']], + 'MmCopyOnWriteCount' : [ 0x2c94, ['long']], + 'MmTransitionCount' : [ 0x2c98, ['long']], + 'MmDemandZeroCount' : [ 0x2c9c, ['long']], + 'MmPageReadCount' : [ 0x2ca0, ['long']], + 'MmPageReadIoCount' : [ 0x2ca4, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x2ca8, ['long']], + 'MmDirtyWriteIoCount' : [ 0x2cac, ['long']], + 'MmMappedPagesWriteCount' : [ 0x2cb0, ['long']], + 'MmMappedWriteIoCount' : [ 0x2cb4, ['long']], + 'KeSystemCalls' : [ 0x2cb8, ['unsigned long']], + 'KeContextSwitches' : [ 0x2cbc, ['unsigned long']], + 'LdtSelector' : [ 0x2cc0, ['unsigned short']], + 'PrcbPad40' : [ 0x2cc2, ['unsigned short']], + 'CcFastReadNoWait' : [ 0x2cc4, ['unsigned long']], + 'CcFastReadWait' : [ 0x2cc8, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x2ccc, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x2cd0, ['unsigned long']], + 'CcCopyReadWait' : [ 0x2cd4, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x2cd8, ['unsigned long']], + 'IoReadOperationCount' : [ 0x2cdc, ['long']], + 'IoWriteOperationCount' : [ 0x2ce0, ['long']], + 'IoOtherOperationCount' : [ 0x2ce4, ['long']], + 'IoReadTransferCount' : [ 0x2ce8, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x2cf0, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x2cf8, ['_LARGE_INTEGER']], + 'PacketBarrier' : [ 0x2d00, ['long']], + 'TargetCount' : [ 0x2d04, ['long']], + 'IpiFrozen' : [ 0x2d08, ['unsigned long']], + 'IsrDpcStats' : [ 0x2d10, ['pointer64', ['void']]], + 'DeviceInterrupts' : [ 0x2d18, ['unsigned long']], + 'LookasideIrpFloat' : [ 0x2d1c, ['long']], + 'InterruptLastCount' : [ 0x2d20, ['unsigned long']], + 'InterruptRate' : [ 0x2d24, ['unsigned long']], + 'LastNonHrTimerExpiration' : [ 0x2d28, ['unsigned long long']], + 'PrcbPad41' : [ 0x2d30, ['array', 20, ['unsigned long']]], + 'DpcData' : [ 0x2d80, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2dd0, ['pointer64', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2dd8, ['long']], + 'DpcRequestRate' : [ 0x2ddc, ['unsigned long']], + 'MinimumDpcRate' : [ 0x2de0, ['unsigned long']], + 'DpcLastCount' : [ 0x2de4, ['unsigned long']], + 'ThreadDpcEnable' : [ 0x2de8, ['unsigned char']], + 'QuantumEnd' : [ 0x2de9, ['unsigned char']], + 'DpcRoutineActive' : [ 0x2dea, ['unsigned char']], + 'IdleSchedule' : [ 0x2deb, ['unsigned char']], + 'DpcRequestSummary' : [ 0x2dec, ['long']], + 'DpcRequestSlot' : [ 0x2dec, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x2dec, ['short']], + 'ThreadDpcState' : [ 0x2dee, ['short']], + 'DpcNormalProcessingActive' : [ 0x2dec, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x2dec, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x2dec, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x2dec, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x2dec, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x2dec, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x2dec, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x2dec, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x2dec, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x2dec, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2df0, ['unsigned long']], + 'LastTick' : [ 0x2df4, ['unsigned long']], + 'ClockInterrupts' : [ 0x2df8, ['unsigned long']], + 'ReadyScanTick' : [ 0x2dfc, ['unsigned long']], + 'InterruptObject' : [ 0x2e00, ['array', 256, ['pointer64', ['void']]]], + 'TimerTable' : [ 0x3600, ['_KTIMER_TABLE']], + 'DpcGate' : [ 0x5800, ['_KGATE']], + 'PrcbPad52' : [ 0x5818, ['pointer64', ['void']]], + 'CallDpc' : [ 0x5820, ['_KDPC']], + 'ClockKeepAlive' : [ 0x5860, ['long']], + 'PrcbPad60' : [ 0x5864, ['array', 2, ['unsigned char']]], + 'NmiActive' : [ 0x5866, ['unsigned short']], + 'DpcWatchdogPeriod' : [ 0x5868, ['long']], + 'DpcWatchdogCount' : [ 0x586c, ['long']], + 'KeSpinLockOrdering' : [ 0x5870, ['long']], + 'PrcbPad70' : [ 0x5874, ['array', 1, ['unsigned long']]], + 'CachedPtes' : [ 0x5878, ['pointer64', ['void']]], + 'WaitListHead' : [ 0x5880, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x5890, ['unsigned long long']], + 'ReadySummary' : [ 0x5898, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x589c, ['long']], + 'QueueIndex' : [ 0x58a0, ['unsigned long']], + 'PrcbPad75' : [ 0x58a4, ['array', 3, ['unsigned long']]], + 'TimerExpirationDpc' : [ 0x58b0, ['_KDPC']], + 'ScbQueue' : [ 0x58f0, ['_RTL_RB_TREE']], + 'DispatcherReadyListHead' : [ 0x5900, ['array', 32, ['_LIST_ENTRY']]], + 'InterruptCount' : [ 0x5b00, ['unsigned long']], + 'KernelTime' : [ 0x5b04, ['unsigned long']], + 'UserTime' : [ 0x5b08, ['unsigned long']], + 'DpcTime' : [ 0x5b0c, ['unsigned long']], + 'InterruptTime' : [ 0x5b10, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x5b14, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x5b18, ['unsigned char']], + 'GroupSchedulingOverQuota' : [ 0x5b19, ['unsigned char']], + 'DeepSleep' : [ 0x5b1a, ['unsigned char']], + 'PrcbPad80' : [ 0x5b1b, ['array', 5, ['unsigned char']]], + 'DpcTimeCount' : [ 0x5b20, ['unsigned long']], + 'DpcTimeLimit' : [ 0x5b24, ['unsigned long']], + 'PeriodicCount' : [ 0x5b28, ['unsigned long']], + 'PeriodicBias' : [ 0x5b2c, ['unsigned long']], + 'AvailableTime' : [ 0x5b30, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x5b34, ['unsigned long']], + 'StartCycles' : [ 0x5b38, ['unsigned long long']], + 'TaggedCyclesStart' : [ 0x5b40, ['unsigned long long']], + 'TaggedCycles' : [ 0x5b48, ['array', 2, ['unsigned long long']]], + 'GenerationTarget' : [ 0x5b58, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x5b60, ['unsigned long long']], + 'PrcbPad81' : [ 0x5b68, ['array', 29, ['unsigned long']]], + 'MmSpinLockOrdering' : [ 0x5bdc, ['long']], + 'PageColor' : [ 0x5be0, ['unsigned long']], + 'NodeColor' : [ 0x5be4, ['unsigned long']], + 'NodeShiftedColor' : [ 0x5be8, ['unsigned long']], + 'SecondaryColorMask' : [ 0x5bec, ['unsigned long']], + 'PrcbPad83' : [ 0x5bf0, ['unsigned long']], + 'CycleTime' : [ 0x5bf8, ['unsigned long long']], + 'Cycles' : [ 0x5c00, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'PrcbPad84' : [ 0x5c40, ['array', 16, ['unsigned long']]], + 'CcFastMdlReadNoWait' : [ 0x5c80, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x5c84, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x5c88, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x5c8c, ['unsigned long']], + 'CcMapDataWait' : [ 0x5c90, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x5c94, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x5c98, ['unsigned long']], + 'CcPinReadWait' : [ 0x5c9c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x5ca0, ['unsigned long']], + 'CcMdlReadWait' : [ 0x5ca4, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x5ca8, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x5cac, ['unsigned long']], + 'CcLazyWritePages' : [ 0x5cb0, ['unsigned long']], + 'CcDataFlushes' : [ 0x5cb4, ['unsigned long']], + 'CcDataPages' : [ 0x5cb8, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x5cbc, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x5cc0, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x5cc4, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x5cc8, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x5ccc, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x5cd0, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x5cd4, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x5cd8, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x5cdc, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x5ce0, ['unsigned long']], + 'CcReadAheadIos' : [ 0x5ce4, ['unsigned long']], + 'MmCacheTransitionCount' : [ 0x5ce8, ['long']], + 'MmCacheReadCount' : [ 0x5cec, ['long']], + 'MmCacheIoCount' : [ 0x5cf0, ['long']], + 'PrcbPad91' : [ 0x5cf4, ['array', 3, ['unsigned long']]], + 'PowerState' : [ 0x5d00, ['_PROCESSOR_POWER_STATE']], + 'ScbList' : [ 0x5ed0, ['_LIST_ENTRY']], + 'PrcbPad92' : [ 0x5ee0, ['array', 7, ['unsigned long']]], + 'KeAlignmentFixupCount' : [ 0x5efc, ['unsigned long']], + 'DpcWatchdogDpc' : [ 0x5f00, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x5f40, ['_KTIMER']], + 'Cache' : [ 0x5f80, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x5fbc, ['unsigned long']], + 'CachedCommit' : [ 0x5fc0, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x5fc4, ['unsigned long']], + 'HyperPte' : [ 0x5fc8, ['pointer64', ['void']]], + 'WheaInfo' : [ 0x5fd0, ['pointer64', ['void']]], + 'EtwSupport' : [ 0x5fd8, ['pointer64', ['void']]], + 'InterruptObjectPool' : [ 0x5fe0, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x5ff0, ['_SLIST_HEADER']], + 'HypercallCachedPages' : [ 0x6000, ['pointer64', ['void']]], + 'VirtualApicAssist' : [ 0x6008, ['pointer64', ['void']]], + 'StatisticsPage' : [ 0x6010, ['pointer64', ['unsigned long long']]], + 'PackageProcessorSet' : [ 0x6018, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x60c0, ['unsigned long long']], + 'SharedReadyQueue' : [ 0x60c8, ['pointer64', ['_KSHARED_READY_QUEUE']]], + 'SharedQueueScanOwner' : [ 0x60d0, ['unsigned long']], + 'ScanSiblingIndex' : [ 0x60d4, ['unsigned long']], + 'CoreProcessorSet' : [ 0x60d8, ['unsigned long long']], + 'ScanSiblingMask' : [ 0x60e0, ['unsigned long long']], + 'LLCMask' : [ 0x60e8, ['unsigned long long']], + 'CacheProcessorMask' : [ 0x60f0, ['array', 5, ['unsigned long long']]], + 'ProcessorProfileControlArea' : [ 0x6118, ['pointer64', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x6120, ['pointer64', ['void']]], + 'PrcbPad94' : [ 0x6128, ['array', 11, ['unsigned long long']]], + 'SynchCounters' : [ 0x6180, ['_SYNCH_COUNTERS']], + 'PteBitCache' : [ 0x6238, ['unsigned long long']], + 'PteBitOffset' : [ 0x6240, ['unsigned long']], + 'FsCounters' : [ 0x6248, ['_FILESYSTEM_DISK_COUNTERS']], + 'VendorString' : [ 0x6258, ['array', 13, ['unsigned char']]], + 'PrcbPad100' : [ 0x6265, ['array', 3, ['unsigned char']]], + 'FeatureBits' : [ 0x6268, ['unsigned long long']], + 'PrcbPad110' : [ 0x6270, ['unsigned long']], + 'UpdateSignature' : [ 0x6278, ['_LARGE_INTEGER']], + 'Context' : [ 0x6280, ['pointer64', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x6288, ['unsigned long']], + 'ExtendedState' : [ 0x6290, ['pointer64', ['_XSAVE_AREA']]], + 'IsrStack' : [ 0x6298, ['pointer64', ['void']]], + 'EntropyTimingState' : [ 0x62a0, ['_KENTROPY_TIMING_STATE']], + 'AbSelfIoBoostsList' : [ 0x63f0, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x63f8, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x6400, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x6440, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x6494, ['_IOP_IRP_STACK_PROFILER']], + 'LocalSharedReadyQueue' : [ 0x6500, ['_KSHARED_READY_QUEUE']], + 'TimerExpirationTrace' : [ 0x6760, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x6860, ['unsigned long']], + 'ExSaPageArray' : [ 0x6868, ['pointer64', ['void']]], + 'Mailbox' : [ 0x6880, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestMailbox' : [ 0x68c0, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KFLOATING_SAVE' : [ 0x4, { + 'Dummy' : [ 0x0, ['unsigned long']], +} ], + '_SINGLE_LIST_ENTRY32' : [ 0x4, { + 'Next' : [ 0x0, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { + 'TrustletIdentity' : [ 0x0, ['unsigned long long']], + 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { + 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], + 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { + 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], + 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { + 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { + 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_KPROCESS' : [ 0x2d8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x40, ['unsigned long']], + 'Spare0' : [ 0x44, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x48, ['unsigned long long']], + 'Affinity' : [ 0x50, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0xf8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x110, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x1b8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x1b8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x1b8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'DeepFreeze' : [ 0x1b8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x1b8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x1b8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SpareFlags0' : [ 0x1b8, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x1b8, ['BitField', dict(start_bit = 8, end_bit = 28, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x1b8, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x1b8, ['long']], + 'BasePriority' : [ 0x1bc, ['unsigned char']], + 'QuantumReset' : [ 0x1bd, ['unsigned char']], + 'Visited' : [ 0x1be, ['unsigned char']], + 'Flags' : [ 0x1bf, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x1c0, ['array', 20, ['unsigned long']]], + 'IdealNode' : [ 0x210, ['array', 20, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x238, ['unsigned short']], + 'Spare1' : [ 0x23a, ['unsigned short']], + 'StackCount' : [ 0x23c, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x240, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x250, ['unsigned long long']], + 'ContextSwitches' : [ 0x258, ['unsigned long long']], + 'SchedulingGroup' : [ 0x260, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'FreezeCount' : [ 0x268, ['unsigned long']], + 'KernelTime' : [ 0x26c, ['unsigned long']], + 'UserTime' : [ 0x270, ['unsigned long']], + 'LdtFreeSelectorHint' : [ 0x274, ['unsigned short']], + 'LdtTableLength' : [ 0x276, ['unsigned short']], + 'LdtSystemDescriptor' : [ 0x278, ['_KGDTENTRY64']], + 'LdtBaseAddress' : [ 0x288, ['pointer64', ['void']]], + 'LdtProcessLock' : [ 0x290, ['_FAST_MUTEX']], + 'InstrumentationCallback' : [ 0x2c8, ['pointer64', ['void']]], + 'SecurePid' : [ 0x2d0, ['unsigned long long']], +} ], + '_KTHREAD' : [ 0x5e0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x18, ['pointer64', ['void']]], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer64', ['void']]], + 'StackLimit' : [ 0x30, ['pointer64', ['void']]], + 'StackBase' : [ 0x38, ['pointer64', ['void']]], + 'ThreadLock' : [ 0x40, ['unsigned long long']], + 'CycleTime' : [ 0x48, ['unsigned long long']], + 'CurrentRunTime' : [ 0x50, ['unsigned long']], + 'ExpectedRunTime' : [ 0x54, ['unsigned long']], + 'KernelStack' : [ 0x58, ['pointer64', ['void']]], + 'StateSaveArea' : [ 0x60, ['pointer64', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x68, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x70, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x71, ['unsigned char']], + 'Alerted' : [ 0x72, ['array', 2, ['unsigned char']]], + 'AutoBoostActive' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitNext' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x74, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Alertable' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'TimerActive' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SystemThread' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x74, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CalloutActive' : [ 0x74, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x74, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x74, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x74, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x74, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x74, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SuspendSchedulerApcWait' : [ 0x74, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x74, ['long']], + 'AutoAlignment' : [ 0x78, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x78, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ThreadFlagsSpare0' : [ 0x78, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x78, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x78, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x78, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x78, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x78, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x78, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x78, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x78, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x78, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x78, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x78, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x78, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CommitFailTerminateRequest' : [ 0x78, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ProcessStackCountDecremented' : [ 0x78, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'RestrictedGuiThread' : [ 0x78, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ThreadFlagsSpare' : [ 0x78, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x78, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x78, ['long']], + 'Tag' : [ 0x7c, ['unsigned char']], + 'SystemHeteroCpuPolicy' : [ 0x7d, ['unsigned char']], + 'UserHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], + 'ExplicitSystemHeteroCpuPolicy' : [ 0x7e, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare0' : [ 0x7f, ['unsigned char']], + 'SystemCallNumber' : [ 0x80, ['unsigned long']], + 'Spare10' : [ 0x84, ['unsigned long']], + 'FirstArgument' : [ 0x88, ['pointer64', ['void']]], + 'TrapFrame' : [ 0x90, ['pointer64', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x98, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x98, ['array', 43, ['unsigned char']]], + 'Priority' : [ 0xc3, ['unsigned char']], + 'UserIdealProcessor' : [ 0xc4, ['unsigned long']], + 'WaitStatus' : [ 0xc8, ['long long']], + 'WaitBlockList' : [ 0xd0, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0xd8, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xe8, ['pointer64', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xf0, ['pointer64', ['void']]], + 'RelativeTimerBias' : [ 0xf8, ['unsigned long long']], + 'Timer' : [ 0x100, ['_KTIMER']], + 'WaitBlock' : [ 0x140, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill4' : [ 0x140, ['array', 20, ['unsigned char']]], + 'ContextSwitches' : [ 0x154, ['unsigned long']], + 'WaitBlockFill5' : [ 0x140, ['array', 68, ['unsigned char']]], + 'State' : [ 0x184, ['unsigned char']], + 'Spare13' : [ 0x185, ['unsigned char']], + 'WaitIrql' : [ 0x186, ['unsigned char']], + 'WaitMode' : [ 0x187, ['unsigned char']], + 'WaitBlockFill6' : [ 0x140, ['array', 116, ['unsigned char']]], + 'WaitTime' : [ 0x1b4, ['unsigned long']], + 'WaitBlockFill7' : [ 0x140, ['array', 164, ['unsigned char']]], + 'KernelApcDisable' : [ 0x1e4, ['short']], + 'SpecialApcDisable' : [ 0x1e6, ['short']], + 'CombinedApcDisable' : [ 0x1e4, ['unsigned long']], + 'WaitBlockFill8' : [ 0x140, ['array', 40, ['unsigned char']]], + 'ThreadCounters' : [ 0x168, ['pointer64', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0x140, ['array', 88, ['unsigned char']]], + 'XStateSave' : [ 0x198, ['pointer64', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0x140, ['array', 136, ['unsigned char']]], + 'Win32Thread' : [ 0x1c8, ['pointer64', ['void']]], + 'WaitBlockFill11' : [ 0x140, ['array', 176, ['unsigned char']]], + 'Ucb' : [ 0x1f0, ['pointer64', ['_UMS_CONTROL_BLOCK']]], + 'Uch' : [ 0x1f8, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], + 'TebMappedLowVa' : [ 0x200, ['pointer64', ['void']]], + 'QueueListEntry' : [ 0x208, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x218, ['unsigned long']], + 'NextProcessorNumber' : [ 0x218, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x218, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x21c, ['long']], + 'Process' : [ 0x220, ['pointer64', ['_KPROCESS']]], + 'UserAffinity' : [ 0x228, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x228, ['array', 10, ['unsigned char']]], + 'PreviousMode' : [ 0x232, ['unsigned char']], + 'BasePriority' : [ 0x233, ['unsigned char']], + 'PriorityDecrement' : [ 0x234, ['unsigned char']], + 'ForegroundBoost' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x235, ['unsigned char']], + 'AdjustReason' : [ 0x236, ['unsigned char']], + 'AdjustIncrement' : [ 0x237, ['unsigned char']], + 'AffinityVersion' : [ 0x238, ['unsigned long long']], + 'Affinity' : [ 0x240, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x240, ['array', 10, ['unsigned char']]], + 'ApcStateIndex' : [ 0x24a, ['unsigned char']], + 'WaitBlockCount' : [ 0x24b, ['unsigned char']], + 'IdealProcessor' : [ 0x24c, ['unsigned long']], + 'NpxState' : [ 0x250, ['unsigned long long']], + 'SavedApcState' : [ 0x258, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x258, ['array', 43, ['unsigned char']]], + 'WaitReason' : [ 0x283, ['unsigned char']], + 'SuspendCount' : [ 0x284, ['unsigned char']], + 'Saturation' : [ 0x285, ['unsigned char']], + 'SListFaultCount' : [ 0x286, ['unsigned short']], + 'SchedulerApc' : [ 0x288, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x288, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x289, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x288, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x28b, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x288, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x28c, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x288, ['array', 64, ['unsigned char']]], + 'WaitPrcb' : [ 0x2c8, ['pointer64', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x288, ['array', 72, ['unsigned char']]], + 'LegoData' : [ 0x2d0, ['pointer64', ['void']]], + 'SchedulerApcFill5' : [ 0x288, ['array', 83, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x2db, ['unsigned char']], + 'UserTime' : [ 0x2dc, ['unsigned long']], + 'SuspendEvent' : [ 0x2e0, ['_KEVENT']], + 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], + 'AbEntrySummary' : [ 0x318, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x319, ['unsigned char']], + 'Spare20' : [ 0x31a, ['unsigned short']], + 'SecureThreadCookie' : [ 0x31c, ['unsigned long']], + 'LockEntries' : [ 0x320, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x560, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x568, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x570, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x580, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x584, ['long']], + 'AbCompletedIoQoSBoostCount' : [ 0x588, ['long']], + 'KeReferenceCount' : [ 0x58c, ['short']], + 'AbOrphanedEntrySummary' : [ 0x58e, ['unsigned char']], + 'AbOwnedEntryCount' : [ 0x58f, ['unsigned char']], + 'ForegroundLossTime' : [ 0x590, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x598, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x598, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x5a0, ['unsigned long long']], + 'ReadOperationCount' : [ 0x5a8, ['long long']], + 'WriteOperationCount' : [ 0x5b0, ['long long']], + 'OtherOperationCount' : [ 0x5b8, ['long long']], + 'ReadTransferCount' : [ 0x5c0, ['long long']], + 'WriteTransferCount' : [ 0x5c8, ['long long']], + 'OtherTransferCount' : [ 0x5d0, ['long long']], + 'QueuedScb' : [ 0x5d8, ['pointer64', ['_KSCB']]], +} ], + '_KSTACK_CONTROL' : [ 0x30, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'ActualLimit' : [ 0x8, ['unsigned long long']], + 'StackExpansion' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_FAST_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'OldIrql' : [ 0x30, ['unsigned long']], +} ], + '_KEVENT' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '__unnamed_1269' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SLIST_HEADER' : [ 0x10, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Region' : [ 0x8, ['unsigned long long']], + 'HeaderX64' : [ 0x0, ['__unnamed_1269']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x60, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_SLIST_ENTRY' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_IO_STATUS_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer64', ['void']]], + 'Information' : [ 0x8, ['unsigned long long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x20, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Parameter' : [ 0x18, ['pointer64', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer64', ['void']]], + 'DeleteContext' : [ 0x10, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x10, { + 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0x140, { + 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long long']], + 'IdleSmtSet' : [ 0x8, ['unsigned long long']], + 'IdleCpuSet' : [ 0x10, ['unsigned long long']], + 'DeepIdleSet' : [ 0x40, ['unsigned long long']], + 'IdleConstrainedSet' : [ 0x48, ['unsigned long long']], + 'NonParkedSet' : [ 0x50, ['unsigned long long']], + 'ParkLock' : [ 0x58, ['long']], + 'Seed' : [ 0x5c, ['unsigned long']], + 'SiblingMask' : [ 0x80, ['unsigned long']], + 'Affinity' : [ 0x88, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x88, ['array', 10, ['unsigned char']]], + 'NodeNumber' : [ 0x92, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x94, ['unsigned short']], + 'Stride' : [ 0x96, ['unsigned char']], + 'Spare0' : [ 0x97, ['unsigned char']], + 'SharedReadyQueueLeaders' : [ 0x98, ['unsigned long long']], + 'ProximityId' : [ 0xa0, ['unsigned long']], + 'Lowest' : [ 0xa4, ['unsigned long']], + 'Highest' : [ 0xa8, ['unsigned long']], + 'MaximumProcessors' : [ 0xac, ['unsigned char']], + 'Flags' : [ 0xad, ['_flags']], + 'Spare10' : [ 0xae, ['unsigned char']], + 'HeteroSets' : [ 0xb0, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], +} ], + '_ENODE' : [ 0x840, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0x140, ['array', 8, ['pointer64', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x180, ['_EX_WORK_QUEUE']], + 'IoWorkQueue' : [ 0x450, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x720, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x738, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x778, ['_KEVENT']], + 'WaitBlocks' : [ 0x790, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x820, ['pointer64', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x828, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x82c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x82c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x82c, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x80, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long long']], + 'QuotaProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'HandleTableList' : [ 0x18, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'StrictFIFO' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x2c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x2c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x2c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x38, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x40, ['array', 32, ['unsigned char']]], + 'DebugInfo' : [ 0x60, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x8, { + 'AuditMask' : [ 0x0, ['unsigned long']], + 'MaxRelativeAccessMask' : [ 0x4, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x10, { + 'VolatileLowValue' : [ 0x0, ['long long']], + 'LowValue' : [ 0x0, ['long long']], + 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'HighValue' : [ 0x8, ['long long']], + 'NextFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x8, ['_EXHANDLE']], + 'RefCountField' : [ 0x0, ['long long']], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 17, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 20, native_type='unsigned long long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 64, native_type='unsigned long long')]], + 'GrantedAccessBits' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Spare1' : [ 0x8, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], + 'Spare2' : [ 0xc, ['unsigned long']], +} ], + '_EX_FAST_REF' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_135b' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0xa0, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'AuxData' : [ 0x48, ['pointer64', ['void']]], + 'Privileges' : [ 0x50, ['__unnamed_135b']], + 'AuditPrivileges' : [ 0x7c, ['unsigned char']], + 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xe0, { + 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x18, ['unsigned long']], + 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], + 'TransactionId' : [ 0x20, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], + 'SDLock' : [ 0x50, ['pointer64', ['void']]], + 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xd8, ['unsigned char']], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x7b0, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x2d8, ['_EX_PUSH_LOCK']], + 'RundownProtect' : [ 0x2e0, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0x2e8, ['pointer64', ['void']]], + 'ActiveProcessLinks' : [ 0x2f0, ['_LIST_ENTRY']], + 'Flags2' : [ 0x300, ['unsigned long']], + 'JobNotReallyActive' : [ 0x300, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x300, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x300, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x300, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x300, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x300, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0x300, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x300, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x300, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x300, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0x300, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0x300, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x300, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x300, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x300, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x300, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x300, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x300, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x300, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x300, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0x300, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x300, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0x300, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0x300, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x300, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0x300, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0x300, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0x300, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0x304, ['unsigned long']], + 'CreateReported' : [ 0x304, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x304, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x304, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x304, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0x304, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x304, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x304, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x304, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FailFastOnCommitFail' : [ 0x304, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x304, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x304, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x304, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x304, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x304, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x304, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x304, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x304, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x304, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0x304, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x304, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x304, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x304, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x304, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0x304, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x304, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x304, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x304, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x304, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CreateTime' : [ 0x308, ['_LARGE_INTEGER']], + 'ProcessQuotaUsage' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'ProcessQuotaPeak' : [ 0x320, ['array', 2, ['unsigned long long']]], + 'PeakVirtualSize' : [ 0x330, ['unsigned long long']], + 'VirtualSize' : [ 0x338, ['unsigned long long']], + 'SessionProcessLinks' : [ 0x340, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0x350, ['pointer64', ['void']]], + 'ExceptionPortValue' : [ 0x350, ['unsigned long long']], + 'ExceptionPortState' : [ 0x350, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Token' : [ 0x358, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0x360, ['unsigned long long']], + 'AddressCreationLock' : [ 0x368, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x370, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x378, ['pointer64', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x380, ['pointer64', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x388, ['pointer64', ['_EJOB']]], + 'CloneRoot' : [ 0x390, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x398, ['unsigned long long']], + 'NumberOfLockedPages' : [ 0x3a0, ['unsigned long long']], + 'Win32Process' : [ 0x3a8, ['pointer64', ['void']]], + 'Job' : [ 0x3b0, ['pointer64', ['_EJOB']]], + 'SectionObject' : [ 0x3b8, ['pointer64', ['void']]], + 'SectionBaseAddress' : [ 0x3c0, ['pointer64', ['void']]], + 'Cookie' : [ 0x3c8, ['unsigned long']], + 'WorkingSetWatch' : [ 0x3d0, ['pointer64', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x3d8, ['pointer64', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x3e0, ['pointer64', ['void']]], + 'LdtInformation' : [ 0x3e8, ['pointer64', ['void']]], + 'OwnerProcessId' : [ 0x3f0, ['unsigned long long']], + 'Peb' : [ 0x3f8, ['pointer64', ['_PEB']]], + 'Session' : [ 0x400, ['pointer64', ['_MM_SESSION_SPACE']]], + 'AweInfo' : [ 0x408, ['pointer64', ['void']]], + 'QuotaBlock' : [ 0x410, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x418, ['pointer64', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x420, ['pointer64', ['void']]], + 'WoW64Process' : [ 0x428, ['pointer64', ['_EWOW64PROCESS']]], + 'DeviceMap' : [ 0x430, ['pointer64', ['void']]], + 'EtwDataSource' : [ 0x438, ['pointer64', ['void']]], + 'PageDirectoryPte' : [ 0x440, ['unsigned long long']], + 'ImageFilePointer' : [ 0x448, ['pointer64', ['_FILE_OBJECT']]], + 'ImageFileName' : [ 0x450, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x45f, ['unsigned char']], + 'SecurityPort' : [ 0x460, ['pointer64', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x468, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x470, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x480, ['pointer64', ['void']]], + 'ThreadListHead' : [ 0x488, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x498, ['unsigned long']], + 'ImagePathHash' : [ 0x49c, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x4a0, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x4a4, ['long']], + 'PrefetchTrace' : [ 0x4a8, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x4b0, ['pointer64', ['void']]], + 'ReadOperationCount' : [ 0x4b8, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x4c0, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x4c8, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x4d0, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x4d8, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x4e0, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x4e8, ['unsigned long long']], + 'CommitCharge' : [ 0x4f0, ['unsigned long long']], + 'CommitChargePeak' : [ 0x4f8, ['unsigned long long']], + 'Vm' : [ 0x500, ['_MMSUPPORT_FULL']], + 'MmProcessLinks' : [ 0x608, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x618, ['unsigned long']], + 'ExitStatus' : [ 0x61c, ['long']], + 'VadRoot' : [ 0x620, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x628, ['pointer64', ['void']]], + 'VadCount' : [ 0x630, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x638, ['unsigned long long']], + 'VadPhysicalPagesLimit' : [ 0x640, ['unsigned long long']], + 'AlpcContext' : [ 0x648, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x668, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x678, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x680, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x684, ['unsigned long']], + 'ExitTime' : [ 0x688, ['_LARGE_INTEGER']], + 'InvertedFunctionTable' : [ 0x690, ['pointer64', ['_INVERTED_FUNCTION_TABLE']]], + 'InvertedFunctionTableLock' : [ 0x698, ['_EX_PUSH_LOCK']], + 'ActiveThreadsHighWatermark' : [ 0x6a0, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x6a4, ['unsigned long']], + 'ThreadListLock' : [ 0x6a8, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x6b0, ['pointer64', ['void']]], + 'Spare0' : [ 0x6b8, ['unsigned long long']], + 'SignatureLevel' : [ 0x6c0, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x6c1, ['unsigned char']], + 'Protection' : [ 0x6c2, ['_PS_PROTECTION']], + 'HangCount' : [ 0x6c3, ['unsigned char']], + 'Flags3' : [ 0x6c4, ['unsigned long']], + 'Minimal' : [ 0x6c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReplacingPageRoot' : [ 0x6c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DisableNonSystemFonts' : [ 0x6c4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AuditNonSystemFontLoading' : [ 0x6c4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Crashed' : [ 0x6c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'JobVadsAreTracked' : [ 0x6c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'VadTrackingDisabled' : [ 0x6c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AuxiliaryProcess' : [ 0x6c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SubsystemProcess' : [ 0x6c4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6c4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'InPrivate' : [ 0x6c4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProhibitRemoteImageMap' : [ 0x6c4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProhibitLowILImageMap' : [ 0x6c4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SignatureMitigationOptIn' : [ 0x6c4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DisableDynamicCodeAllowOptOut' : [ 0x6c4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'EnableFilteredWin32kAPIs' : [ 0x6c4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'AuditFilteredWin32kAPIs' : [ 0x6c4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'PreferSystem32Images' : [ 0x6c4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'RelinquishedCommit' : [ 0x6c4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AutomaticallyOverrideChildProcessPolicy' : [ 0x6c4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'HighGraphicsPriority' : [ 0x6c4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CommitFailLogged' : [ 0x6c4, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ReserveFailLogged' : [ 0x6c4, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DeviceAsid' : [ 0x6c8, ['long']], + 'SvmData' : [ 0x6d0, ['pointer64', ['void']]], + 'SvmProcessLock' : [ 0x6d8, ['_EX_PUSH_LOCK']], + 'SvmLock' : [ 0x6e0, ['unsigned long long']], + 'SvmProcessDeviceListHead' : [ 0x6e8, ['_LIST_ENTRY']], + 'LastFreezeInterruptTime' : [ 0x6f8, ['unsigned long long']], + 'DiskCounters' : [ 0x700, ['pointer64', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x708, ['pointer64', ['void']]], + 'TrustletIdentity' : [ 0x710, ['unsigned long long']], + 'KeepAliveCounter' : [ 0x718, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x71c, ['unsigned long']], + 'HighPriorityFaultsAllowed' : [ 0x720, ['unsigned long']], + 'EnergyValues' : [ 0x728, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'VmContext' : [ 0x730, ['pointer64', ['void']]], + 'SequenceNumber' : [ 0x738, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x740, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x748, ['unsigned long long']], + 'TotalUnbiasedFrozenTime' : [ 0x750, ['unsigned long long']], + 'LastAppStateUpdateTime' : [ 0x758, ['unsigned long long']], + 'LastAppStateUptime' : [ 0x760, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'LastAppState' : [ 0x760, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SharedCommitCharge' : [ 0x768, ['unsigned long long']], + 'SharedCommitLock' : [ 0x770, ['_EX_PUSH_LOCK']], + 'SharedCommitLinks' : [ 0x778, ['_LIST_ENTRY']], + 'AllowedCpuSets' : [ 0x788, ['unsigned long long']], + 'DefaultCpuSets' : [ 0x790, ['unsigned long long']], + 'AllowedCpuSetsIndirect' : [ 0x788, ['pointer64', ['unsigned long long']]], + 'DefaultCpuSetsIndirect' : [ 0x790, ['pointer64', ['unsigned long long']]], + 'DiskIoAttribution' : [ 0x798, ['pointer64', ['void']]], + 'ReadyTime' : [ 0x7a0, ['unsigned long']], + 'DxgProcess' : [ 0x7a8, ['pointer64', ['void']]], +} ], + '_EWOW64PROCESS' : [ 0x10, { + 'Peb' : [ 0x0, ['pointer64', ['void']]], + 'Machine' : [ 0x8, ['unsigned short']], +} ], + '_ETHREAD' : [ 0x7e0, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x5e0, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x5e8, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x5e8, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x5f8, ['pointer64', ['void']]], + 'PostBlockList' : [ 0x600, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x600, ['pointer64', ['void']]], + 'StartAddress' : [ 0x608, ['pointer64', ['void']]], + 'TerminationPort' : [ 0x610, ['pointer64', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x610, ['pointer64', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x610, ['pointer64', ['void']]], + 'ActiveTimerListLock' : [ 0x618, ['unsigned long long']], + 'ActiveTimerListHead' : [ 0x620, ['_LIST_ENTRY']], + 'Cid' : [ 0x630, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x640, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x640, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x660, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x668, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x678, ['unsigned long long']], + 'DeviceToVerify' : [ 0x680, ['pointer64', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x688, ['pointer64', ['void']]], + 'LegacyPowerObject' : [ 0x690, ['pointer64', ['void']]], + 'ThreadListEntry' : [ 0x698, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x6a8, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x6b0, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x6b8, ['unsigned long']], + 'MmLockOrdering' : [ 0x6bc, ['long']], + 'CrossThreadFlags' : [ 0x6c0, ['unsigned long']], + 'Terminated' : [ 0x6c0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x6c0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x6c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x6c0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x6c0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x6c0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x6c0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x6c0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x6c0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x6c0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x6c0, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x6c0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x6c0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x6c0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DisableDynamicCodeOptOut' : [ 0x6c0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ExplicitCaseSensitivity' : [ 0x6c0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x6c0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x6c4, ['unsigned long']], + 'ActiveExWorker' : [ 0x6c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x6c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'StoreLockThread' : [ 0x6c4, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'ClonedThread' : [ 0x6c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x6c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x6c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'RespectIoPriority' : [ 0x6c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ActivePageLists' : [ 0x6c4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedSameThreadPassiveFlags' : [ 0x6c4, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x6c8, ['unsigned long']], + 'OwnsProcessAddressSpaceExclusive' : [ 0x6c8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x6c8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardFaultBehavior' : [ 0x6c8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x6c8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x6c8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x6c8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Prefetching' : [ 0x6c8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x6c8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x6c9, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x6c9, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x6cc, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x6cd, ['unsigned char']], + 'ActiveFaultCount' : [ 0x6ce, ['unsigned char']], + 'LockOrderState' : [ 0x6cf, ['unsigned char']], + 'AlpcMessageId' : [ 0x6d0, ['unsigned long long']], + 'AlpcMessage' : [ 0x6d8, ['pointer64', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x6d8, ['unsigned long']], + 'AlpcWaitListEntry' : [ 0x6e0, ['_LIST_ENTRY']], + 'ExitStatus' : [ 0x6f0, ['long']], + 'CacheManagerCount' : [ 0x6f4, ['unsigned long']], + 'IoBoostCount' : [ 0x6f8, ['unsigned long']], + 'IoQoSBoostCount' : [ 0x6fc, ['unsigned long']], + 'IoQoSThrottleCount' : [ 0x700, ['unsigned long']], + 'BoostList' : [ 0x708, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x718, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x728, ['unsigned long long']], + 'IrpListLock' : [ 0x730, ['unsigned long long']], + 'ReservedForSynchTracking' : [ 0x738, ['pointer64', ['void']]], + 'CmCallbackListHead' : [ 0x740, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x748, ['pointer64', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x750, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x758, ['pointer64', ['void']]], + 'KernelStackReference' : [ 0x760, ['unsigned long']], + 'AdjustedClientToken' : [ 0x768, ['pointer64', ['void']]], + 'WorkOnBehalfThread' : [ 0x770, ['pointer64', ['void']]], + 'PropertySet' : [ 0x778, ['_PS_PROPERTY_SET']], + 'PicoContext' : [ 0x790, ['pointer64', ['void']]], + 'UserFsBase' : [ 0x798, ['unsigned long long']], + 'UserGsBase' : [ 0x7a0, ['unsigned long long']], + 'EnergyValues' : [ 0x7a8, ['pointer64', ['_THREAD_ENERGY_VALUES']]], + 'CmDbgInfo' : [ 0x7b0, ['pointer64', ['void']]], + 'SelectedCpuSets' : [ 0x7b8, ['unsigned long long']], + 'SelectedCpuSetsIndirect' : [ 0x7b8, ['pointer64', ['unsigned long long']]], + 'Silo' : [ 0x7c0, ['pointer64', ['_EJOB']]], + 'ThreadName' : [ 0x7c8, ['pointer64', ['_UNICODE_STRING']]], + 'SetContextState' : [ 0x7d0, ['pointer64', ['_CONTEXT']]], + 'ReadyTime' : [ 0x7d8, ['unsigned long']], +} ], + '__unnamed_13c7' : [ 0x8, { + 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_13cd' : [ 0x10, { + 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], + 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_13cf' : [ 0x10, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_13cd']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_13d8' : [ 0x58, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], + 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x40, ['unsigned long']], + 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x50, ['pointer64', ['void']]], +} ], + '__unnamed_13da' : [ 0x58, { + 'Overlay' : [ 0x0, ['__unnamed_13d8']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IRP' : [ 0xd0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'AllocationProcessorNumber' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'AssociatedIrp' : [ 0x18, ['__unnamed_13c7']], + 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x40, ['unsigned char']], + 'PendingReturned' : [ 0x41, ['unsigned char']], + 'StackCount' : [ 0x42, ['unsigned char']], + 'CurrentLocation' : [ 0x43, ['unsigned char']], + 'Cancel' : [ 0x44, ['unsigned char']], + 'CancelIrql' : [ 0x45, ['unsigned char']], + 'ApcEnvironment' : [ 0x46, ['unsigned char']], + 'AllocationFlags' : [ 0x47, ['unsigned char']], + 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Overlay' : [ 0x58, ['__unnamed_13cf']], + 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], + 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], + 'Tail' : [ 0x78, ['__unnamed_13da']], +} ], + '__unnamed_13e1' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'FileAttributes' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'EaLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13e5' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13e9' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13eb' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_13ef' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13f1' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13f3' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], +} ], + '__unnamed_13f5' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0x18, ['unsigned char']], + 'AdvanceOnly' : [ 0x19, ['unsigned char']], + 'ClusterCount' : [ 0x18, ['unsigned long']], + 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13f7' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x8, ['pointer64', ['void']]], + 'EaListLength' : [ 0x10, ['unsigned long']], + 'EaIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13f9' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13fd' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13ff' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'FsControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1401' : [ 0x18, { + 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1403' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'IoControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1405' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1407' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_140b' : [ 0x10, { + 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_140f' : [ 0x8, { + 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_1413' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x8, ['pointer64', ['void']]], + 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1417' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_141b' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Version' : [ 0xa, ['unsigned short']], + 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_141f' : [ 0x8, { + 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_1423' : [ 0x8, { + 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_1425' : [ 0x20, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['void']]], + 'Offset' : [ 0x10, ['unsigned long']], + 'Length' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1427' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_142b' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_142f' : [ 0x10, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1433' : [ 0x10, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_1437' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_143b' : [ 0x8, { + 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1443' : [ 0x20, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x10, ['_POWER_STATE']], + 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], +} ], + '__unnamed_1447' : [ 0x10, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1449' : [ 0x20, { + 'ProviderId' : [ 0x0, ['unsigned long long']], + 'DataPath' : [ 0x8, ['pointer64', ['void']]], + 'BufferSize' : [ 0x10, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_144b' : [ 0x20, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_144d' : [ 0x20, { + 'Create' : [ 0x0, ['__unnamed_13e1']], + 'CreatePipe' : [ 0x0, ['__unnamed_13e5']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13e9']], + 'Read' : [ 0x0, ['__unnamed_13eb']], + 'Write' : [ 0x0, ['__unnamed_13eb']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13ef']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13f1']], + 'QueryFile' : [ 0x0, ['__unnamed_13f3']], + 'SetFile' : [ 0x0, ['__unnamed_13f5']], + 'QueryEa' : [ 0x0, ['__unnamed_13f7']], + 'SetEa' : [ 0x0, ['__unnamed_13f9']], + 'QueryVolume' : [ 0x0, ['__unnamed_13fd']], + 'SetVolume' : [ 0x0, ['__unnamed_13fd']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13ff']], + 'LockControl' : [ 0x0, ['__unnamed_1401']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1403']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1405']], + 'SetSecurity' : [ 0x0, ['__unnamed_1407']], + 'MountVolume' : [ 0x0, ['__unnamed_140b']], + 'VerifyVolume' : [ 0x0, ['__unnamed_140b']], + 'Scsi' : [ 0x0, ['__unnamed_140f']], + 'QueryQuota' : [ 0x0, ['__unnamed_1413']], + 'SetQuota' : [ 0x0, ['__unnamed_13f9']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1417']], + 'QueryInterface' : [ 0x0, ['__unnamed_141b']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_141f']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1423']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1425']], + 'SetLock' : [ 0x0, ['__unnamed_1427']], + 'QueryId' : [ 0x0, ['__unnamed_142b']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_142f']], + 'UsageNotification' : [ 0x0, ['__unnamed_1433']], + 'WaitWake' : [ 0x0, ['__unnamed_1437']], + 'PowerSequence' : [ 0x0, ['__unnamed_143b']], + 'Power' : [ 0x0, ['__unnamed_1443']], + 'StartDevice' : [ 0x0, ['__unnamed_1447']], + 'WMI' : [ 0x0, ['__unnamed_1449']], + 'Others' : [ 0x0, ['__unnamed_144b']], +} ], + '_IO_STACK_LOCATION' : [ 0x48, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x8, ['__unnamed_144d']], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_1463' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], + 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'Characteristics' : [ 0x34, ['unsigned long']], + 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], + 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], + 'DeviceType' : [ 0x48, ['unsigned long']], + 'StackSize' : [ 0x4c, ['unsigned char']], + 'Queue' : [ 0x50, ['__unnamed_1463']], + 'AlignmentRequirement' : [ 0x98, ['unsigned long']], + 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0xc8, ['_KDPC']], + 'ActiveThreadCount' : [ 0x108, ['unsigned long']], + 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], + 'DeviceLock' : [ 0x118, ['_KEVENT']], + 'SectorSize' : [ 0x130, ['unsigned short']], + 'Spare1' : [ 0x132, ['unsigned short']], + 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0x140, ['pointer64', ['void']]], +} ], + '_KDPC' : [ 0x40, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x10, ['unsigned long long']], + 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], + 'DpcData' : [ 0x38, ['pointer64', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x28, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], + 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], + 'SiloContext' : [ 0x20, ['pointer64', ['_EJOB']]], +} ], + '_EJOB' : [ 0x5c8, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], + 'JobLock' : [ 0x38, ['_ERESOURCE']], + 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0xc0, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0xc8, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0xd0, ['unsigned long']], + 'TotalProcesses' : [ 0xd4, ['unsigned long']], + 'ActiveProcesses' : [ 0xd8, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0xdc, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0xe0, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xf0, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0xf8, ['unsigned long long']], + 'LimitFlags' : [ 0x100, ['unsigned long']], + 'ActiveProcessLimit' : [ 0x104, ['unsigned long']], + 'Affinity' : [ 0x108, ['_KAFFINITY_EX']], + 'AccessState' : [ 0x1b0, ['pointer64', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0x1b8, ['pointer64', ['void']]], + 'UIRestrictionsClass' : [ 0x1c0, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0x1c4, ['unsigned long']], + 'CompletionPort' : [ 0x1c8, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x1d0, ['pointer64', ['void']]], + 'CompletionCount' : [ 0x1d8, ['unsigned long long']], + 'SessionId' : [ 0x1e0, ['unsigned long']], + 'SchedulingClass' : [ 0x1e4, ['unsigned long']], + 'ReadOperationCount' : [ 0x1e8, ['unsigned long long']], + 'WriteOperationCount' : [ 0x1f0, ['unsigned long long']], + 'OtherOperationCount' : [ 0x1f8, ['unsigned long long']], + 'ReadTransferCount' : [ 0x200, ['unsigned long long']], + 'WriteTransferCount' : [ 0x208, ['unsigned long long']], + 'OtherTransferCount' : [ 0x210, ['unsigned long long']], + 'DiskIoInfo' : [ 0x218, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x240, ['unsigned long long']], + 'JobMemoryLimit' : [ 0x248, ['unsigned long long']], + 'JobTotalMemoryLimit' : [ 0x250, ['unsigned long long']], + 'PeakProcessMemoryUsed' : [ 0x258, ['unsigned long long']], + 'PeakJobMemoryUsed' : [ 0x260, ['unsigned long long']], + 'EffectiveAffinity' : [ 0x268, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x310, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x318, ['unsigned long long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x320, ['unsigned long long']], + 'EffectiveProcessMemoryLimit' : [ 0x328, ['unsigned long long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x330, ['pointer64', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x338, ['pointer64', ['_EJOB']]], + 'EffectiveNetIoRateLimitJob' : [ 0x340, ['pointer64', ['_EJOB']]], + 'EffectiveHeapAttributionJob' : [ 0x348, ['pointer64', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x350, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x354, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x358, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x35c, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x360, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x364, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x368, ['unsigned char']], + 'PriorityClass' : [ 0x369, ['unsigned char']], + 'NestingDepth' : [ 0x36a, ['unsigned char']], + 'Reserved1' : [ 0x36b, ['array', 1, ['unsigned char']]], + 'CompletionFilter' : [ 0x36c, ['unsigned long']], + 'WakeChannel' : [ 0x370, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x370, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x3a8, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x3b0, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x3b4, ['unsigned long']], + 'NotificationLink' : [ 0x3b8, ['pointer64', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x3c0, ['unsigned long long']], + 'NotificationInfo' : [ 0x3c8, ['pointer64', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x3d0, ['pointer64', ['void']]], + 'NotificationPacket' : [ 0x3d8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x3e0, ['pointer64', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x3e8, ['pointer64', ['void']]], + 'ReadyTime' : [ 0x3f0, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x3f8, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x400, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x410, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x420, ['pointer64', ['_EJOB']]], + 'ParentSilo' : [ 0x428, ['pointer64', ['_EJOB']]], + 'RootJob' : [ 0x430, ['pointer64', ['_EJOB']]], + 'IteratorListHead' : [ 0x438, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x448, ['unsigned long long']], + 'Ancestors' : [ 0x450, ['pointer64', ['pointer64', ['_EJOB']]]], + 'SessionObject' : [ 0x450, ['pointer64', ['void']]], + 'TimerListLock' : [ 0x458, ['unsigned long long']], + 'TimerListHead' : [ 0x460, ['_LIST_ENTRY']], + 'Accounting' : [ 0x470, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x4c8, ['unsigned long']], + 'ActiveAuxiliaryProcessCount' : [ 0x4cc, ['unsigned long']], + 'SequenceNumber' : [ 0x4d0, ['unsigned long']], + 'JobId' : [ 0x4d4, ['unsigned long']], + 'ContainerId' : [ 0x4d8, ['_GUID']], + 'ServerSiloGlobals' : [ 0x4e8, ['pointer64', ['_ESERVERSILO_GLOBALS']]], + 'PropertySet' : [ 0x4f0, ['_PS_PROPERTY_SET']], + 'Storage' : [ 0x508, ['pointer64', ['_PSP_STORAGE']]], + 'NetRateControl' : [ 0x510, ['pointer64', ['_JOB_NET_RATE_CONTROL']]], + 'JobFlags' : [ 0x518, ['unsigned long']], + 'CloseDone' : [ 0x518, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x518, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x518, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x518, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x518, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x518, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x518, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x518, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x518, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x518, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x518, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x518, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x518, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x518, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x518, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x518, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x518, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x518, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x518, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x518, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x518, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x518, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x518, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x518, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x518, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'NetRateControlActive' : [ 0x518, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'OwnNetRateControl' : [ 0x518, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IoRateControlActive' : [ 0x518, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'OwnIoRateControl' : [ 0x518, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'DisallowNewProcesses' : [ 0x518, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Silo' : [ 0x518, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare' : [ 0x518, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x51c, ['unsigned long']], + 'EnergyValues' : [ 0x520, ['pointer64', ['_PROCESS_ENERGY_VALUES']]], + 'SharedCommitCharge' : [ 0x528, ['unsigned long long']], + 'WakeRoot' : [ 0x530, ['pointer64', ['_EJOB']]], + 'DiskIoAttributionUserRefCount' : [ 0x538, ['unsigned long']], + 'DiskIoAttributionRefCount' : [ 0x53c, ['unsigned long']], + 'DiskIoAttributionContext' : [ 0x540, ['pointer64', ['void']]], + 'DiskIoAttributionOwnerJob' : [ 0x540, ['pointer64', ['_EJOB']]], + 'GlobalIoControl' : [ 0x548, ['_PS_IO_CONTROL_ENTRY']], + 'VolumeIoControlLock' : [ 0x580, ['long']], + 'VolumeIoControlTree' : [ 0x588, ['_RTL_RB_TREE']], + 'IoControlLock' : [ 0x598, ['_EX_PUSH_LOCK']], + 'SiloHardReferenceCount' : [ 0x5a0, ['unsigned long long']], + 'RundownWorkItem' : [ 0x5a8, ['_WORK_QUEUE_ITEM']], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_MDL' : [ 0x30, { + 'Next' : [ 0x0, ['pointer64', ['_MDL']]], + 'Size' : [ 0x8, ['short']], + 'MdlFlags' : [ 0xa, ['short']], + 'AllocationProcessorNumber' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], + 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'ByteCount' : [ 0x28, ['unsigned long']], + 'ByteOffset' : [ 0x2c, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x70, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer64', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x60, ['pointer64', ['void']]], + 'UserContext' : [ 0x68, ['pointer64', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0xd8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], + 'FsContext' : [ 0x18, ['pointer64', ['void']]], + 'FsContext2' : [ 0x20, ['pointer64', ['void']]], + 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], + 'FinalStatus' : [ 0x38, ['long']], + 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x48, ['unsigned char']], + 'DeletePending' : [ 0x49, ['unsigned char']], + 'ReadAccess' : [ 0x4a, ['unsigned char']], + 'WriteAccess' : [ 0x4b, ['unsigned char']], + 'DeleteAccess' : [ 0x4c, ['unsigned char']], + 'SharedRead' : [ 0x4d, ['unsigned char']], + 'SharedWrite' : [ 0x4e, ['unsigned char']], + 'SharedDelete' : [ 0x4f, ['unsigned char']], + 'Flags' : [ 0x50, ['unsigned long']], + 'FileName' : [ 0x58, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x70, ['unsigned long']], + 'Busy' : [ 0x74, ['unsigned long']], + 'LastLock' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['_KEVENT']], + 'Event' : [ 0x98, ['_KEVENT']], + 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0xb8, ['unsigned long long']], + 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], + 'CurrentFileIndex' : [ 0xc, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], + 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], + 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], + 'SessionId' : [ 0x40, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], + 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], + 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'Oplock' : [ 0x58, ['pointer64', ['void']]], + 'ReservedForRemote' : [ 0x58, ['pointer64', ['void']]], + 'ReservedContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_iobuf' : [ 0x30, { + '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], + '_cnt' : [ 0x8, ['long']], + '_base' : [ 0x10, ['pointer64', ['unsigned char']]], + '_flag' : [ 0x18, ['long']], + '_file' : [ 0x1c, ['long']], + '_charbuf' : [ 0x20, ['long']], + '_bufsiz' : [ 0x24, ['long']], + '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], +} ], + '_TlgProvider_t' : [ 0x40, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], + 'KeywordAny' : [ 0x10, ['unsigned long long']], + 'KeywordAll' : [ 0x18, ['unsigned long long']], + 'RegHandle' : [ 0x20, ['unsigned long long']], + 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], + 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '__unnamed_164d' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_164d']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0x10, { + 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'State' : [ 0x8, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], + 'Stats' : [ 0xc, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x68, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0x18, ['short']], + 'Flag' : [ 0x1a, ['unsigned short']], + 'ReservedLowFlags' : [ 0x1a, ['unsigned char']], + 'WaiterPriority' : [ 0x1b, ['unsigned char']], + 'SharedWaiters' : [ 0x20, ['_KWAIT_CHAIN']], + 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x40, ['unsigned long']], + 'ContentionCount' : [ 0x44, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], + 'Reserved2' : [ 0x50, ['pointer64', ['void']]], + 'Address' : [ 0x58, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], + 'SpinLock' : [ 0x60, ['unsigned long long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0x18, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x10, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x28, { + 'Total' : [ 0x0, ['unsigned long long']], + 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x10, ['unsigned long long']], + 'Blink' : [ 0x18, ['unsigned long long']], + 'Lock' : [ 0x20, ['unsigned long long']], +} ], + '_MMCLONE_DESCRIPTOR' : [ 0x50, { + 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Next' : [ 0x0, ['pointer64', ['_MMCLONE_DESCRIPTOR']]], + 'StartingCloneBlock' : [ 0x18, ['pointer64', ['_MMCLONE_BLOCK']]], + 'EndingCloneBlock' : [ 0x20, ['pointer64', ['_MMCLONE_BLOCK']]], + 'NumberOfPtes' : [ 0x28, ['unsigned long long']], + 'NumberOfReferences' : [ 0x30, ['unsigned long long']], + 'CloneHeader' : [ 0x38, ['pointer64', ['_MMCLONE_HEADER']]], + 'NonPagedPoolQuotaCharge' : [ 0x40, ['unsigned long long']], + 'NestingLevel' : [ 0x48, ['unsigned long long']], +} ], + '__unnamed_168d' : [ 0x8, { + 'Flink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeFlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 64, native_type='unsigned long long')]], + 'WsIndex' : [ 0x0, ['unsigned long long']], + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1692' : [ 0x2, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], +} ], + '__unnamed_1694' : [ 0x4, { + 'EntireField' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1696' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY1']], + 'e3' : [ 0x3, ['_MMPFNENTRY3']], + 'e2' : [ 0x0, ['__unnamed_1692']], + 'e4' : [ 0x0, ['__unnamed_1694']], +} ], + '__unnamed_16a2' : [ 0x8, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'Channel' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 38, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'Partition' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 50, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 52, native_type='unsigned long long')]], + 'FileOnly' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'PfnExists' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], +} ], + '_MMPFN' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'u1' : [ 0x0, ['__unnamed_168d']], + 'PteAddress' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x8, ['pointer64', ['void']]], + 'PteLong' : [ 0x8, ['unsigned long long']], + 'OriginalPte' : [ 0x10, ['_MMPTE']], + 'u2' : [ 0x18, ['_MIPFNBLINK']], + 'u3' : [ 0x20, ['__unnamed_1696']], + 'NodeBlinkLow' : [ 0x24, ['unsigned short']], + 'Unused' : [ 0x26, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'VaType' : [ 0x26, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'ViewCount' : [ 0x27, ['unsigned char']], + 'NodeFlinkLow' : [ 0x27, ['unsigned char']], + 'u4' : [ 0x28, ['__unnamed_16a2']], +} ], + '__unnamed_16aa' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_16aa']], +} ], + '_MMWSL_SHARED' : [ 0x60, { + 'FirstFree' : [ 0x0, ['unsigned long long']], + 'FirstDynamic' : [ 0x8, ['unsigned long long']], + 'LastEntry' : [ 0x10, ['unsigned long long']], + 'LastInitializedWsle' : [ 0x18, ['unsigned long long']], + 'WsleSize' : [ 0x20, ['unsigned long']], + 'NonDirectCount' : [ 0x28, ['unsigned long long']], + 'LowestPagableAddress' : [ 0x30, ['pointer64', ['void']]], + 'NonDirectHash' : [ 0x38, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x40, ['pointer64', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x48, ['pointer64', ['_MMWSLE_HASH']]], + 'Wsle' : [ 0x50, ['pointer64', ['_MMWSLE']]], +} ], + '__unnamed_16bd' : [ 0x8, { + 'ImageCommitment' : [ 0x0, ['unsigned long long']], + 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_16c1' : [ 0x8, { + 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_SEGMENT' : [ 0x48, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x30, ['__unnamed_16bd']], + 'u2' : [ 0x38, ['__unnamed_16c1']], + 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], +} ], + '__unnamed_16c6' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_16c9' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS2']], +} ], + '__unnamed_16d3' : [ 0x10, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], + 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_16d5' : [ 0x10, { + 'e2' : [ 0x0, ['__unnamed_16d3']], +} ], + '__unnamed_16d7' : [ 0x8, { + 'IoAttributionContext' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SpareImage' : [ 0x0, ['unsigned long long']], +} ], + '_CONTROL_AREA' : [ 0x80, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], + 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], + 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16c6']], + 'u1' : [ 0x3c, ['__unnamed_16c9']], + 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x48, ['long']], + 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], + 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x58, ['__unnamed_16d5']], + 'FileObjectLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'LockedPages' : [ 0x70, ['unsigned long long']], + 'u3' : [ 0x78, ['__unnamed_16d7']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x68, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'BasePte' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'VaType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaMaximumType', 15: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], + 'PteFailures' : [ 0x28, ['unsigned long']], + 'SpinLock' : [ 0x30, ['unsigned long long']], + 'GlobalPushLock' : [ 0x30, ['pointer64', ['_EX_PUSH_LOCK']]], + 'Vm' : [ 0x38, ['pointer64', ['_MMSUPPORT_INSTANCE']]], + 'TotalSystemPtes' : [ 0x40, ['unsigned long long']], + 'Hint' : [ 0x48, ['unsigned long long']], + 'LowestBitEverAllocated' : [ 0x50, ['unsigned long long']], + 'CachedPtes' : [ 0x58, ['pointer64', ['_MI_CACHED_PTES']]], + 'TotalFreeSystemPtes' : [ 0x60, ['unsigned long long']], +} ], + '__unnamed_16f1' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_16f4' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x40, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer64', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0x18, ['unsigned long']], + 'EndingVpn' : [ 0x1c, ['unsigned long']], + 'StartingVpnHigh' : [ 0x20, ['unsigned char']], + 'EndingVpnHigh' : [ 0x21, ['unsigned char']], + 'CommitChargeHigh' : [ 0x22, ['unsigned char']], + 'SpareNT64VadUChar' : [ 0x23, ['unsigned char']], + 'ReferenceCount' : [ 0x24, ['long']], + 'PushLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u' : [ 0x30, ['__unnamed_16f1']], + 'u1' : [ 0x34, ['__unnamed_16f4']], + 'EventList' : [ 0x38, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_MM_STORE_KEY' : [ 0x8, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'EntireKey' : [ 0x0, ['unsigned long long']], +} ], + '_HHIVE' : [ 0xa68, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], + 'ReleaseCellRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Allocate' : [ 0x18, ['pointer64', ['void']]], + 'Free' : [ 0x20, ['pointer64', ['void']]], + 'FileWrite' : [ 0x28, ['pointer64', ['void']]], + 'FileRead' : [ 0x30, ['pointer64', ['void']]], + 'HiveLoadFailure' : [ 0x38, ['pointer64', ['void']]], + 'BaseBlock' : [ 0x40, ['pointer64', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x48, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x58, ['unsigned long']], + 'DirtyAlloc' : [ 0x5c, ['unsigned long']], + 'UnreconciledVector' : [ 0x60, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x70, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x74, ['unsigned long']], + 'Cluster' : [ 0x78, ['unsigned long']], + 'Flat' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SystemCacheBacked' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x7d, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x80, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x84, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x88, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x8c, ['unsigned long']], + 'HiveFlags' : [ 0x90, ['unsigned long']], + 'CurrentLog' : [ 0x94, ['unsigned long']], + 'CurrentLogSequence' : [ 0x98, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x9c, ['unsigned long']], + 'CurrentLogOffset' : [ 0xa0, ['unsigned long']], + 'MinimumLogSequence' : [ 0xa4, ['unsigned long']], + 'LogFileSizeCap' : [ 0xa8, ['unsigned long']], + 'LogDataPresent' : [ 0xac, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0xae, ['unsigned char']], + 'BaseBlockDirty' : [ 0xaf, ['unsigned char']], + 'LastLogSwapTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'FirstLogFile' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0xb8, ['unsigned short']], + 'LogEntriesRecovered' : [ 0xba, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0xbc, ['unsigned long']], + 'StorageTypeCount' : [ 0xc0, ['unsigned long']], + 'Version' : [ 0xc4, ['unsigned long']], + 'ViewMap' : [ 0xc8, ['_HVIEW_MAP']], + 'Storage' : [ 0x578, ['array', 2, ['_DUAL']]], +} ], + '_HV_GET_CELL_CONTEXT' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'BinContext' : [ 0x4, ['_HV_GET_BIN_CONTEXT']], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Discarded' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x8, ['_CM_PATH_HASH']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x18, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x20, ['unsigned long']], + 'KcbPushlock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x30, ['pointer64', ['_KTHREAD']]], + 'SharedCount' : [ 0x30, ['long']], + 'DelayedDeref' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DelayedClose' : [ 0x38, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Parking' : [ 0x38, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'LayerSemantics' : [ 0x39, ['unsigned char']], + 'LayerHeight' : [ 0x3a, ['short']], + 'SlotHint' : [ 0x3c, ['unsigned long']], + 'ParentKcb' : [ 0x40, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x48, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x50, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x58, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x68, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x68, ['unsigned long']], + 'SubKeyCount' : [ 0x68, ['unsigned long']], + 'KeyBodyListHead' : [ 0x70, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x70, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x80, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0xa8, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0xaa, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0xac, ['unsigned long']], + 'KcbUserFlags' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'Spare3' : [ 0xb4, ['unsigned long']], + 'LayerInfo' : [ 0xb8, ['pointer64', ['_CM_KCB_LAYER_INFO']]], + 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], + 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], + 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], + 'FullKCBNameStale' : [ 0x120, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x120, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], +} ], + 'tagSWITCH_CONTEXT' : [ 0x68, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '_CM_KEY_BODY' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0x18, ['pointer64', ['void']]], + 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'Trans' : [ 0x38, ['_CM_TRANS_PTR']], + 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], + 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], +} ], + '__unnamed_1762' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1765' : [ 0x18, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x8, ['pointer64', ['void']]], + 'Status' : [ 0x10, ['long']], +} ], + '__unnamed_1767' : [ 0x8, { + 'CheckStack' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1769' : [ 0x20, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], + 'RootPoint' : [ 0x10, ['pointer64', ['void']]], + 'Index' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_176b' : [ 0x18, { + 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], + 'Index' : [ 0x8, ['unsigned long']], + 'Cell' : [ 0xc, ['unsigned long']], + 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], +} ], + '__unnamed_176f' : [ 0x10, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], +} ], + '__unnamed_1773' : [ 0x10, { + 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], + 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], +} ], + '__unnamed_1775' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x160, { + 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], + 'Index' : [ 0x8, ['unsigned long']], + 'RecoverableIndex' : [ 0xc, ['unsigned long']], + 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1762']]], + 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1762']]], + 'RegistryIO' : [ 0xd0, ['__unnamed_1765']], + 'CheckRegistry2' : [ 0xe8, ['__unnamed_1767']], + 'CheckKey' : [ 0xf0, ['__unnamed_1769']], + 'CheckValueList' : [ 0x110, ['__unnamed_176b']], + 'CheckHive' : [ 0x128, ['__unnamed_176f']], + 'CheckHive1' : [ 0x138, ['__unnamed_176f']], + 'CheckBin' : [ 0x148, ['__unnamed_1773']], + 'RecoverData' : [ 0x158, ['__unnamed_1775']], +} ], + '_CM_KCB_UOW' : [ 0x78, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], + 'UoWState' : [ 0x40, ['unsigned long']], + 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ParentUoW' : [ 0x50, ['pointer64', ['_CM_KCB_UOW']]], + 'ChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x58, ['unsigned long']], + 'OldValueCell' : [ 0x58, ['unsigned long']], + 'NewValueCell' : [ 0x5c, ['unsigned long']], + 'UserFlags' : [ 0x58, ['unsigned long']], + 'LastWriteTime' : [ 0x58, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x58, ['unsigned long']], + 'OldChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x60, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x60, ['unsigned long']], + 'PrepareDataPointer' : [ 0x68, ['pointer64', ['void']]], + 'SecurityData' : [ 0x68, ['pointer64', ['_CM_UOW_SET_SD_DATA']]], + 'ModifyKeysData' : [ 0x68, ['pointer64', ['_CM_UOW_KEY_STATE_MODIFICATION']]], + 'SetValueData' : [ 0x68, ['pointer64', ['_CM_UOW_SET_VALUE_LIST_DATA']]], + 'ValueData' : [ 0x70, ['pointer64', ['_CM_UOW_SET_VALUE_KEY_DATA']]], + 'DiscardReplaceContext' : [ 0x70, ['pointer64', ['_CMP_DISCARD_AND_REPLACE_KCB_CONTEXT']]], +} ], + '_CM_TRANS' : [ 0xb0, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Prepared' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Aborted' : [ 0x30, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Committed' : [ 0x30, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Initializing' : [ 0x30, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Invalid' : [ 0x30, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UseReservation' : [ 0x30, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'TmCallbacksActive' : [ 0x30, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LightWeight' : [ 0x30, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Freed1' : [ 0x30, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Freed2' : [ 0x30, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x30, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'Freed' : [ 0x30, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Spare' : [ 0x30, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long')]], + 'TransState' : [ 0x30, ['unsigned long']], + 'Trans' : [ 0x38, ['_CM_TRANS_PTR']], + 'CmRm' : [ 0x40, ['pointer64', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x48, ['pointer64', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x50, ['pointer64', ['void']]], + 'KtmUow' : [ 0x58, ['_GUID']], + 'StartLsn' : [ 0x68, ['unsigned long long']], + 'HiveCount' : [ 0x70, ['unsigned long']], + 'HiveArray' : [ 0x78, ['array', 7, ['pointer64', ['_CMHIVE']]]], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x10, ['unsigned long']], + 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xc0, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'ParkingStatus' : [ 0x80, ['unsigned long']], + 'CurrentFrequency' : [ 0x84, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], + 'StateFlags' : [ 0x8c, ['unsigned long']], + 'NominalThroughput' : [ 0x90, ['unsigned long']], + 'ActiveThroughput' : [ 0x94, ['unsigned long']], + 'ScaledThroughput' : [ 0x98, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb8, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x10, { + 'Data' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_TEB32' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], + 'SystemReserved1' : [ 0x10c, ['array', 36, ['unsigned long']]], + 'WorkingOnBehalfTicket' : [ 0x19c, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_TEB64' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], + 'SystemReserved1' : [ 0x190, ['array', 37, ['unsigned long long']]], + 'WorkingOnBehalfTicket' : [ 0x2b8, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DirectSyntheticTimers' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'AccessReenlightenmentControls' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], + 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], + 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], + 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], + 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x2200, { + 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], + 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x20, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['_LIST_ENTRY']], + 'Time' : [ 0x18, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x38, { + 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Level' : [ 0x10, ['unsigned char']], + 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x260, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'ReadySummary' : [ 0x8, ['unsigned long']], + 'ReadyListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x210, ['array', 64, ['unsigned char']]], + 'Span' : [ 0x250, ['unsigned char']], + 'LowProcIndex' : [ 0x251, ['unsigned char']], + 'QueueIndex' : [ 0x252, ['unsigned char']], + 'ProcCount' : [ 0x253, ['unsigned char']], + 'ScanOwner' : [ 0x254, ['unsigned char']], + 'Spare' : [ 0x255, ['array', 3, ['unsigned char']]], + 'Affinity' : [ 0x258, ['unsigned long long']], +} ], + '_KEXCEPTION_FRAME' : [ 0x140, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'Spare1' : [ 0x28, ['unsigned long long']], + 'Xmm6' : [ 0x30, ['_M128A']], + 'Xmm7' : [ 0x40, ['_M128A']], + 'Xmm8' : [ 0x50, ['_M128A']], + 'Xmm9' : [ 0x60, ['_M128A']], + 'Xmm10' : [ 0x70, ['_M128A']], + 'Xmm11' : [ 0x80, ['_M128A']], + 'Xmm12' : [ 0x90, ['_M128A']], + 'Xmm13' : [ 0xa0, ['_M128A']], + 'Xmm14' : [ 0xb0, ['_M128A']], + 'Xmm15' : [ 0xc0, ['_M128A']], + 'TrapFrame' : [ 0xd0, ['unsigned long long']], + 'OutputBuffer' : [ 0xd8, ['unsigned long long']], + 'OutputLength' : [ 0xe0, ['unsigned long long']], + 'Spare2' : [ 0xe8, ['unsigned long long']], + 'MxCsr' : [ 0xf0, ['unsigned long long']], + 'Rbp' : [ 0xf8, ['unsigned long long']], + 'Rbx' : [ 0x100, ['unsigned long long']], + 'Rdi' : [ 0x108, ['unsigned long long']], + 'Rsi' : [ 0x110, ['unsigned long long']], + 'R12' : [ 0x118, ['unsigned long long']], + 'R13' : [ 0x120, ['unsigned long long']], + 'R14' : [ 0x128, ['unsigned long long']], + 'R15' : [ 0x130, ['unsigned long long']], + 'Return' : [ 0x138, ['unsigned long long']], +} ], + '_KTRAP_FRAME' : [ 0x190, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'PreviousMode' : [ 0x28, ['unsigned char']], + 'PreviousIrql' : [ 0x29, ['unsigned char']], + 'FaultIndicator' : [ 0x2a, ['unsigned char']], + 'ExceptionActive' : [ 0x2b, ['unsigned char']], + 'MxCsr' : [ 0x2c, ['unsigned long']], + 'Rax' : [ 0x30, ['unsigned long long']], + 'Rcx' : [ 0x38, ['unsigned long long']], + 'Rdx' : [ 0x40, ['unsigned long long']], + 'R8' : [ 0x48, ['unsigned long long']], + 'R9' : [ 0x50, ['unsigned long long']], + 'R10' : [ 0x58, ['unsigned long long']], + 'R11' : [ 0x60, ['unsigned long long']], + 'GsBase' : [ 0x68, ['unsigned long long']], + 'GsSwap' : [ 0x68, ['unsigned long long']], + 'Xmm0' : [ 0x70, ['_M128A']], + 'Xmm1' : [ 0x80, ['_M128A']], + 'Xmm2' : [ 0x90, ['_M128A']], + 'Xmm3' : [ 0xa0, ['_M128A']], + 'Xmm4' : [ 0xb0, ['_M128A']], + 'Xmm5' : [ 0xc0, ['_M128A']], + 'FaultAddress' : [ 0xd0, ['unsigned long long']], + 'ContextRecord' : [ 0xd0, ['unsigned long long']], + 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], + 'Dr0' : [ 0xd8, ['unsigned long long']], + 'Dr1' : [ 0xe0, ['unsigned long long']], + 'Dr2' : [ 0xe8, ['unsigned long long']], + 'Dr3' : [ 0xf0, ['unsigned long long']], + 'Dr6' : [ 0xf8, ['unsigned long long']], + 'Dr7' : [ 0x100, ['unsigned long long']], + 'DebugControl' : [ 0x108, ['unsigned long long']], + 'LastBranchToRip' : [ 0x110, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], + 'SegDs' : [ 0x130, ['unsigned short']], + 'SegEs' : [ 0x132, ['unsigned short']], + 'SegFs' : [ 0x134, ['unsigned short']], + 'SegGs' : [ 0x136, ['unsigned short']], + 'TrapFrame' : [ 0x138, ['unsigned long long']], + 'Rbx' : [ 0x140, ['unsigned long long']], + 'Rdi' : [ 0x148, ['unsigned long long']], + 'Rsi' : [ 0x150, ['unsigned long long']], + 'Rbp' : [ 0x158, ['unsigned long long']], + 'ErrorCode' : [ 0x160, ['unsigned long long']], + 'ExceptionFrame' : [ 0x160, ['unsigned long long']], + 'TimeStampKlog' : [ 0x160, ['unsigned long long']], + 'Rip' : [ 0x168, ['unsigned long long']], + 'SegCs' : [ 0x170, ['unsigned short']], + 'Fill0' : [ 0x172, ['unsigned char']], + 'Logging' : [ 0x173, ['unsigned char']], + 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], + 'EFlags' : [ 0x178, ['unsigned long']], + 'Fill2' : [ 0x17c, ['unsigned long']], + 'Rsp' : [ 0x180, ['unsigned long long']], + 'SegSs' : [ 0x188, ['unsigned short']], + 'Fill3' : [ 0x18a, ['unsigned short']], + 'Fill4' : [ 0x18c, ['unsigned long']], +} ], + '__unnamed_18a0' : [ 0x8, { + 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_18a2' : [ 0x8, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], +} ], + '__unnamed_18a6' : [ 0x20, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0x18, ['pointer64', ['wchar']]], +} ], + '_DEVICE_NODE' : [ 0x2d0, { + 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x58, ['long']], + 'FxRemoveEvent' : [ 0x60, ['_KEVENT']], + 'FxActivationCount' : [ 0x78, ['long']], + 'FxSleepCount' : [ 0x7c, ['long']], + 'Plugin' : [ 0x80, ['pointer64', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x88, ['unsigned long']], + 'CurrentPowerState' : [ 0x8c, ['_POWER_STATE']], + 'Notify' : [ 0x90, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0xf8, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0x118, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0x128, ['unsigned long']], + 'State' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0x130, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0x134, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x184, ['unsigned long']], + 'CompletionStatus' : [ 0x188, ['long']], + 'Flags' : [ 0x18c, ['unsigned long']], + 'UserFlags' : [ 0x190, ['unsigned long']], + 'Problem' : [ 0x194, ['unsigned long']], + 'ProblemStatus' : [ 0x198, ['long']], + 'ResourceList' : [ 0x1a0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x1a8, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x1b0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x1b8, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x1c4, ['unsigned long']], + 'ChildInterfaceType' : [ 0x1c8, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x1cc, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x1d0, ['unsigned short']], + 'RemovalPolicy' : [ 0x1d2, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x1d3, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x1d8, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x1e8, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x1f8, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x208, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x20a, ['unsigned short']], + 'NoArbiterMask' : [ 0x20c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x20e, ['unsigned short']], + 'OverUsed1' : [ 0x210, ['__unnamed_18a0']], + 'OverUsed2' : [ 0x218, ['__unnamed_18a2']], + 'BootResources' : [ 0x220, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x228, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x230, ['unsigned long']], + 'DockInfo' : [ 0x238, ['__unnamed_18a6']], + 'DisableableDepends' : [ 0x258, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x260, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x270, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x280, ['unsigned long']], + 'PreviousParent' : [ 0x288, ['pointer64', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x290, ['long']], + 'NumaNodeIndex' : [ 0x294, ['unsigned long']], + 'ContainerID' : [ 0x298, ['_GUID']], + 'OverrideFlags' : [ 0x2a8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x2ac, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x2b0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x2b8, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x2c0, ['unsigned long']], + 'RebalanceContext' : [ 0x2c8, ['pointer64', ['_PNP_REBALANCE_TRACE_CONTEXT']]], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x48, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x30, ['pointer64', ['unsigned long']]], + 'EnableKeyWords' : [ 0x38, ['pointer64', ['unsigned long long']]], + 'EnableLevel' : [ 0x40, ['pointer64', ['unsigned char']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x10, ['unsigned long']], + 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x48, ['unsigned long long']], +} ], + '_KSEMAPHORE' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x18, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x68, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x10, ['unsigned long']], + 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x20, ['unsigned long']], + 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], + 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x38, ['long']], + 'StartIoKey' : [ 0x3c, ['long']], + 'StartIoFlags' : [ 0x40, ['unsigned long']], + 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], + 'DependencyNode' : [ 0x50, ['pointer64', ['void']]], + 'InterruptContext' : [ 0x58, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_GROUP_AFFINITY' : [ 0x10, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Group' : [ 0x8, ['unsigned short']], + 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], +} ], + '_KAFFINITY_EX' : [ 0xa8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 20, ['unsigned long long']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x40, { + 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0x10, ['unsigned long']], + 'Position' : [ 0x14, ['unsigned long']], + 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x20, ['pointer64', ['void']]], + 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x38, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_19a9' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_19a9']], +} ], + '__unnamed_19b0' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_19b0']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PEP_ACPI_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], + 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], + 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], + 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], + 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], + 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], + 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], +} ], + '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Information' : [ 0x4, ['unsigned char']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Alignment' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'Count' : [ 0x10, ['unsigned char']], + 'Pins' : [ 0x18, ['pointer64', ['unsigned long']]], +} ], + '_PEP_ACPI_GPIO_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], + 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], + 'DriveStrength' : [ 0x18, ['unsigned short']], + 'DebounceTimeout' : [ 0x1a, ['unsigned short']], + 'PinTable' : [ 0x20, ['pointer64', ['unsigned short']]], + 'PinCount' : [ 0x28, ['unsigned short']], + 'ResourceSourceIndex' : [ 0x2a, ['unsigned char']], + 'ResourceSourceName' : [ 0x30, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x38, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x40, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x30, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'SlaveAddress' : [ 0x2c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'BaudRate' : [ 0x28, ['unsigned long']], + 'RxBufferSize' : [ 0x2c, ['unsigned short']], + 'TxBufferSize' : [ 0x2e, ['unsigned short']], + 'Parity' : [ 0x30, ['unsigned char']], + 'LinesInUse' : [ 0x31, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x38, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x28, ['unsigned long']], + 'DataBitLength' : [ 0x2c, ['unsigned char']], + 'Phase' : [ 0x2d, ['unsigned char']], + 'Polarity' : [ 0x2e, ['unsigned char']], + 'DeviceSelection' : [ 0x30, ['unsigned short']], +} ], + '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'ResourceFlags' : [ 0x8, ['unsigned char']], + 'GeneralFlags' : [ 0x9, ['unsigned char']], + 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], + 'RevisionId' : [ 0xb, ['unsigned char']], + 'Reserved' : [ 0xc, ['unsigned char']], + 'Granularity' : [ 0x10, ['unsigned long long']], + 'MinimumAddress' : [ 0x18, ['unsigned long long']], + 'MaximumAddress' : [ 0x20, ['unsigned long long']], + 'TranslationAddress' : [ 0x28, ['unsigned long long']], + 'AddressLength' : [ 0x30, ['unsigned long long']], + 'TypeAttribute' : [ 0x38, ['unsigned long long']], + 'DescriptorName' : [ 0x40, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_PPM_PLATFORM_STATES' : [ 0x1c0, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'InterfaceVersion' : [ 0x4, ['unsigned long']], + 'ProcessorCount' : [ 0x8, ['unsigned long']], + 'CoordinatedInterface' : [ 0xc, ['unsigned char']], + 'IdleTest' : [ 0x10, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x18, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x20, ['pointer64', ['void']]], + 'QueryPlatformStateResidency' : [ 0x28, ['pointer64', ['void']]], + 'Accounting' : [ 0x30, ['pointer64', ['_PLATFORM_IDLE_ACCOUNTING']]], + 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_PPM_PROFILE' : [ 0xb30, { + 'Name' : [ 0x0, ['pointer64', ['wchar']]], + 'Id' : [ 0x8, ['unsigned char']], + 'Guid' : [ 0xc, ['_GUID']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Priority' : [ 0x20, ['unsigned char']], + 'Settings' : [ 0x28, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], + 'StartTime' : [ 0xb08, ['unsigned long long']], + 'Count' : [ 0xb10, ['unsigned long long']], + 'MaxDuration' : [ 0xb18, ['unsigned long long']], + 'MinDuration' : [ 0xb20, ['unsigned long long']], + 'TotalDuration' : [ 0xb28, ['unsigned long long']], +} ], + '_PPM_ENGINE_SETTINGS' : [ 0x570, { + 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], + 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], + 'PerfTimeCheck' : [ 0x14, ['unsigned long']], + 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], + 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], + 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], + 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], + 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], + 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], + 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], + 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], + 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], + 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], + 'PerfBoostMode' : [ 0x30, ['unsigned long']], + 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], + 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], + 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], + 'AutonomousPreference' : [ 0x40, ['unsigned char']], + 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], + 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], + 'DutyCycling' : [ 0x45, ['unsigned char']], + 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], + 'DistributeUtility' : [ 0x48, ['unsigned char']], + 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], + 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], + 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], + 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], + 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], + 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], + 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], + 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], + 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], + 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], + 'AllowScaling' : [ 0x5c, ['unsigned char']], + 'IdleDisabled' : [ 0x5d, ['unsigned char']], + 'IdleTimeCheck' : [ 0x60, ['unsigned long']], + 'IdleDemotePercent' : [ 0x64, ['unsigned char']], + 'IdlePromotePercent' : [ 0x65, ['unsigned char']], + 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], + 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], + 'HeteroDecreaseThreshold' : [ 0x68, ['array', 640, ['unsigned char']]], + 'HeteroIncreaseThreshold' : [ 0x2e8, ['array', 640, ['unsigned char']]], + 'Class0FloorPerformance' : [ 0x568, ['unsigned char']], + 'Class1InitialPerformance' : [ 0x569, ['unsigned char']], +} ], + '_ESERVERSILO_GLOBALS' : [ 0x430, { + 'ObSiloState' : [ 0x0, ['_OBP_SILODRIVERSTATE']], + 'SeSiloState' : [ 0x2e0, ['_SEP_SILOSTATE']], + 'SeRmSiloState' : [ 0x300, ['_SEP_RM_LSA_CONNECTION_STATE']], + 'EtwSiloState' : [ 0x350, ['pointer64', ['_ETW_SILODRIVERSTATE']]], + 'MiSessionLeaderProcess' : [ 0x358, ['pointer64', ['_EPROCESS']]], + 'ExpDefaultErrorPortProcess' : [ 0x360, ['pointer64', ['_EPROCESS']]], + 'ExpDefaultErrorPort' : [ 0x368, ['pointer64', ['void']]], + 'HardErrorState' : [ 0x370, ['unsigned long']], + 'WnfSiloState' : [ 0x378, ['_WNF_SILODRIVERSTATE']], + 'ApiSetSection' : [ 0x3b0, ['pointer64', ['void']]], + 'ApiSetSchema' : [ 0x3b8, ['pointer64', ['void']]], + 'OneCoreForwardersEnabled' : [ 0x3c0, ['unsigned char']], + 'SiloRootDirectoryName' : [ 0x3c8, ['_UNICODE_STRING']], + 'Storage' : [ 0x3d8, ['pointer64', ['_PSP_STORAGE']]], + 'State' : [ 0x3e0, ['Enumeration', dict(target = 'long', choices = {0: 'SERVERSILO_INITING', 1: 'SERVERSILO_STARTED', 2: 'SERVERSILO_SHUTTING_DOWN', 3: 'SERVERSILO_TERMINATING', 4: 'SERVERSILO_TERMINATED'})]], + 'ExitStatus' : [ 0x3e4, ['long']], + 'DeleteEvent' : [ 0x3e8, ['pointer64', ['_KEVENT']]], + 'UserSharedData' : [ 0x3f0, ['_SILO_USER_SHARED_DATA']], + 'TerminateWorkItem' : [ 0x410, ['_WORK_QUEUE_ITEM']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_PERF_FLAGS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], + 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], + 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0xd0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x20, ['unsigned long long']], + 'LogHandleContext' : [ 0x28, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0xc0, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0xc4, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0xc8, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x210, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], + 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x70, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], + 'Flags' : [ 0x98, ['unsigned long']], + 'Status' : [ 0x9c, ['long']], + 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], + 'Section' : [ 0xa8, ['pointer64', ['void']]], + 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], + 'PagesToWrite' : [ 0xc0, ['unsigned long']], + 'BeyondLastFlush' : [ 0xc8, ['long long']], + 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], + 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], + 'V1' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0x100, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0x108, ['unsigned long']], + 'LazyWritePassCount' : [ 0x10c, ['unsigned long']], + 'UninitializeEvent' : [ 0x110, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0x118, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0x150, ['_LARGE_INTEGER']], + 'Event' : [ 0x158, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0x170, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0x178, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x1f0, ['pointer64', ['void']]], + 'VolumeCacheMap' : [ 0x1f8, ['pointer64', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x200, ['unsigned long']], + 'WritesInProgress' : [ 0x204, ['unsigned long']], + 'AsyncReadRequestCount' : [ 0x208, ['unsigned long']], +} ], + '__unnamed_1aa8' : [ 0x10, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x28, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x10, ['__unnamed_1aa8']], + 'ArrayHead' : [ 0x20, ['pointer64', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1acc' : [ 0x10, { + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], + 'DiskIoAttribution' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_1ace' : [ 0x8, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1ad0' : [ 0x8, { + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], +} ], + '__unnamed_1ad2' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1ad4' : [ 0x30, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x8, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x10, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x28, ['unsigned char']], +} ], + '__unnamed_1ad8' : [ 0x68, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Length' : [ 0x18, ['unsigned long']], + 'PrefetchList' : [ 0x20, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'PrefetchPagePriority' : [ 0x28, ['unsigned long']], + 'Mdl' : [ 0x30, ['pointer64', ['_MDL']]], + 'IoStatusBlock' : [ 0x38, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallbackContext' : [ 0x40, ['pointer64', ['_CC_ASYNC_READ_CONTEXT']]], + 'OriginatingProcess' : [ 0x48, ['pointer64', ['_EPROCESS']]], + 'IoIssuerThread' : [ 0x50, ['pointer64', ['_ETHREAD']]], + 'DiskIoAttribution' : [ 0x58, ['pointer64', ['void']]], + 'RequestorMode' : [ 0x60, ['unsigned char']], + 'NestingLevel' : [ 0x64, ['unsigned long']], +} ], + '__unnamed_1ada' : [ 0x68, { + 'Read' : [ 0x0, ['__unnamed_1acc']], + 'Write' : [ 0x0, ['__unnamed_1ace']], + 'Event' : [ 0x0, ['__unnamed_1ad0']], + 'Notification' : [ 0x0, ['__unnamed_1ad2']], + 'LowPriWrite' : [ 0x0, ['__unnamed_1ad4']], + 'AsyncRead' : [ 0x0, ['__unnamed_1ad8']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x80, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x10, ['__unnamed_1ada']], + 'Function' : [ 0x78, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x30, { + 'Callback' : [ 0x0, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x8, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x98, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x10, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x18, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x30, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x68, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x6c, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x70, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x78, ['pointer64', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x80, ['unsigned long long']], + 'LastLWTimeStamp' : [ 0x88, ['_LARGE_INTEGER']], + 'Flags' : [ 0x90, ['unsigned long']], +} ], + '_MBCB' : [ 0xc0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x20, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], + 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x30, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x10, ['long long']], + 'FirstDirtyPage' : [ 0x18, ['unsigned long']], + 'LastDirtyPage' : [ 0x1c, ['unsigned long']], + 'DirtyPages' : [ 0x20, ['unsigned long']], + 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], + 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x38, { + 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x8, ['unsigned long']], + 'ExtraItem' : [ 0xc, ['unsigned long']], + 'ItemCount' : [ 0x10, ['unsigned long']], + 'OutOfRangeItems' : [ 0x14, ['unsigned long']], + 'BaseIndex' : [ 0x18, ['unsigned long']], + 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], + 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x2a0, { + 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], + 'Flags' : [ 0x70, ['unsigned long']], + 'ForceFlags' : [ 0x74, ['unsigned long']], + 'CompatibilityFlags' : [ 0x78, ['unsigned long']], + 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], + 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x90, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x94, ['unsigned long']], + 'Signature' : [ 0x98, ['unsigned long']], + 'SegmentReserve' : [ 0xa0, ['unsigned long long']], + 'SegmentCommit' : [ 0xa8, ['unsigned long long']], + 'DeCommitFreeBlockThreshold' : [ 0xb0, ['unsigned long long']], + 'DeCommitTotalFreeThreshold' : [ 0xb8, ['unsigned long long']], + 'TotalFreeSize' : [ 0xc0, ['unsigned long long']], + 'MaximumAllocationSize' : [ 0xc8, ['unsigned long long']], + 'ProcessHeapsListIndex' : [ 0xd0, ['unsigned short']], + 'HeaderValidateLength' : [ 0xd2, ['unsigned short']], + 'HeaderValidateCopy' : [ 0xd8, ['pointer64', ['void']]], + 'NextAvailableTagIndex' : [ 0xe0, ['unsigned short']], + 'MaximumTagIndex' : [ 0xe2, ['unsigned short']], + 'TagEntries' : [ 0xe8, ['pointer64', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0xf0, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x100, ['unsigned long long']], + 'AlignMask' : [ 0x108, ['unsigned long long']], + 'VirtualAllocdBlocks' : [ 0x110, ['_LIST_ENTRY']], + 'SegmentList' : [ 0x120, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0x130, ['unsigned short']], + 'NonDedicatedListLength' : [ 0x134, ['unsigned long']], + 'BlocksIndex' : [ 0x138, ['pointer64', ['void']]], + 'UCRIndex' : [ 0x140, ['pointer64', ['void']]], + 'PseudoTagEntries' : [ 0x148, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0x150, ['_LIST_ENTRY']], + 'LockVariable' : [ 0x160, ['pointer64', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0x168, ['pointer64', ['void']]], + 'StackTraceInitVar' : [ 0x170, ['_RTL_RUN_ONCE']], + 'FrontEndHeap' : [ 0x178, ['pointer64', ['void']]], + 'FrontHeapLockCount' : [ 0x180, ['unsigned short']], + 'FrontEndHeapType' : [ 0x182, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0x183, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0x188, ['pointer64', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0x190, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0x192, ['array', 129, ['unsigned char']]], + 'Counters' : [ 0x218, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x290, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1b49' : [ 0x68, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x68, { + 'Lock' : [ 0x0, ['__unnamed_1b49']], +} ], + '_HEAP_ENTRY' : [ 0x10, { + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x70, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x20, ['unsigned long long']], + 'ReserveSize' : [ 0x28, ['unsigned long long']], + 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x20, { + 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], + 'FreeList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '__unnamed_1b9c' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1b9e' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b9c']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1ba0' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1ba2' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1ba0']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_1b9e']], + 'u2' : [ 0x4, ['__unnamed_1ba2']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x18, ['unsigned long']], + 'ClientViewSize' : [ 0x20, ['unsigned long long']], + 'CallbackId' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x30, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer64', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], + 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], + 'UsualSize' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_1bbd' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1bbf' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1bbd']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x30, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_1bbf']], + 'ResourceId' : [ 0x11, ['unsigned char']], + 'CachedReferences' : [ 0x12, ['short']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Lock' : [ 0x20, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1bd1' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1bd3' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bd1']], +} ], + '_KALPC_SECTION' : [ 0x48, { + 'SectionObject' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], + 'u1' : [ 0x30, ['__unnamed_1bd3']], + 'NumberOfRegions' : [ 0x34, ['unsigned long']], + 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], +} ], + '__unnamed_1bdc' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1bde' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bdc']], +} ], + '_KALPC_REGION' : [ 0x58, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], + 'Offset' : [ 0x18, ['unsigned long long']], + 'Size' : [ 0x20, ['unsigned long long']], + 'ViewSize' : [ 0x28, ['unsigned long long']], + 'u1' : [ 0x30, ['__unnamed_1bde']], + 'NumberOfViews' : [ 0x34, ['unsigned long']], + 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], +} ], + '__unnamed_1be4' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1be6' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1be4']], +} ], + '_KALPC_VIEW' : [ 0x60, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'Address' : [ 0x28, ['pointer64', ['void']]], + 'Size' : [ 0x30, ['unsigned long long']], + 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], + 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], + 'u1' : [ 0x48, ['__unnamed_1be6']], + 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x48, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x40, ['pointer64', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1c04' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1c06' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c04']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x1d8, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], + 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x38, ['pointer64', ['void']]], + 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x90, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0xa0, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0xb8, ['_LIST_ENTRY']], + 'DirectQueueLock' : [ 0xc8, ['_EX_PUSH_LOCK']], + 'DirectQueue' : [ 0xd0, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0xe8, ['_LIST_ENTRY']], + 'Semaphore' : [ 0xf8, ['pointer64', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0xf8, ['pointer64', ['_KEVENT']]], + 'PortAttributes' : [ 0x100, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0x148, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0x150, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0x168, ['pointer64', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0x170, ['pointer64', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0x178, ['pointer64', ['void']]], + 'CanceledQueue' : [ 0x180, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0x190, ['long']], + 'ReferenceNo' : [ 0x194, ['long']], + 'ReferenceNoWait' : [ 0x198, ['pointer64', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0x1a0, ['__unnamed_1c06']], + 'TargetQueuePort' : [ 0x1a8, ['pointer64', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0x1b0, ['pointer64', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x1b8, ['pointer64', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x1c0, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x1c4, ['unsigned long']], + 'PendingQueueLength' : [ 0x1c8, ['unsigned long']], + 'DirectQueueLength' : [ 0x1cc, ['unsigned long']], + 'CanceledQueueLength' : [ 0x1d0, ['unsigned long']], + 'WaitQueueLength' : [ 0x1d4, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0xa0, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'CompletionListLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x20, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x28, ['pointer64', ['void']]], + 'UserLimit' : [ 0x30, ['pointer64', ['void']]], + 'DataUserVa' : [ 0x38, ['pointer64', ['void']]], + 'SystemVa' : [ 0x40, ['pointer64', ['void']]], + 'TotalSize' : [ 0x48, ['unsigned long long']], + 'Header' : [ 0x50, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x58, ['pointer64', ['void']]], + 'ListSize' : [ 0x60, ['unsigned long long']], + 'Bitmap' : [ 0x68, ['pointer64', ['void']]], + 'BitmapSize' : [ 0x70, ['unsigned long long']], + 'Data' : [ 0x78, ['pointer64', ['void']]], + 'DataSize' : [ 0x80, ['unsigned long long']], + 'BitmapLimit' : [ 0x88, ['unsigned long']], + 'BitmapNextHint' : [ 0x8c, ['unsigned long']], + 'ConcurrencyCount' : [ 0x90, ['unsigned long']], + 'AttributeFlags' : [ 0x94, ['unsigned long']], + 'AttributeSize' : [ 0x98, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'Attributes' : [ 0x18, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0xd8, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], + 'Index' : [ 0x28, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], + 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0xb8, ['_EX_PUSH_LOCK']], + 'Key' : [ 0xc0, ['unsigned long']], + 'CallbackList' : [ 0xc8, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x20, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x18, ['long']], +} ], + '_PORT_MESSAGE32' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1b9e']], + 'u2' : [ 0x4, ['__unnamed_1ba2']], + 'ClientId' : [ 0x8, ['_CLIENT_ID32']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1c2c' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1c2e' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c2c']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x110, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'u1' : [ 0x28, ['__unnamed_1c2e']], + 'SequenceNo' : [ 0x2c, ['long']], + 'QuotaProcess' : [ 0x30, ['pointer64', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x30, ['pointer64', ['void']]], + 'CancelSequencePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x40, ['pointer64', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x48, ['long']], + 'CancelListEntry' : [ 0x50, ['_LIST_ENTRY']], + 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x68, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0xb0, ['pointer64', ['void']]], + 'CommunicationInfo' : [ 0xb8, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0xc0, ['pointer64', ['_ALPC_PORT']]], + 'ServerThread' : [ 0xc8, ['pointer64', ['_ETHREAD']]], + 'WakeReference' : [ 0xd0, ['pointer64', ['void']]], + 'ExtensionBuffer' : [ 0xd8, ['pointer64', ['void']]], + 'ExtensionBufferSize' : [ 0xe0, ['unsigned long long']], + 'PortMessage' : [ 0xe8, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x40, { + 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], + 'DirectEvent' : [ 0x28, ['_KALPC_DIRECT_EVENT']], + 'Flags' : [ 0x30, ['unsigned long']], + 'TotalLength' : [ 0x34, ['unsigned short']], + 'Type' : [ 0x36, ['unsigned short']], + 'DataInfoOffset' : [ 0x38, ['unsigned short']], + 'SignalCompletion' : [ 0x3a, ['unsigned char']], + 'PostedToCompletionList' : [ 0x3b, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x8, ['unsigned long long']], + 'ViewBase' : [ 0x10, ['pointer64', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x28, { + 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x20, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x30, { + 'ObjectType' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x48, { + 'ClientContext' : [ 0x0, ['pointer64', ['void']]], + 'ServerContext' : [ 0x8, ['pointer64', ['void']]], + 'PortContext' : [ 0x10, ['pointer64', ['void']]], + 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], + 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], + 'DirectEvent' : [ 0x38, ['_KALPC_DIRECT_EVENT']], + 'WorkOnBehalfData' : [ 0x40, ['_KALPC_WORK_ON_BEHALF_DATA']], +} ], + '__unnamed_1c73' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1c75' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c73']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x70, { + 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], + 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x68, ['__unnamed_1c75']], +} ], + '_KALPC_DIRECT_EVENT' : [ 0x8, { + 'Event' : [ 0x0, ['unsigned long long']], + 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x10, ['unsigned long']], + 'KeyContext' : [ 0x18, ['pointer64', ['void']]], + 'ApcContext' : [ 0x20, ['pointer64', ['void']]], + 'IoStatus' : [ 0x28, ['long']], + 'IoStatusInformation' : [ 0x30, ['unsigned long long']], + 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Allocated' : [ 0x48, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x38, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer64', ['void']]], + 'DiskIoAttributionHandle' : [ 0x10, ['unsigned long long']], + 'ActivityId' : [ 0x18, ['_GUID']], + 'Timestamp' : [ 0x28, ['_LARGE_INTEGER']], + 'ZeroingOffset' : [ 0x28, ['unsigned long']], + 'FsTrackOffsetBlob' : [ 0x28, ['pointer64', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], + 'FsTrackedOffset' : [ 0x30, ['long long']], +} ], + '_DRIVER_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'DriverStart' : [ 0x18, ['pointer64', ['void']]], + 'DriverSize' : [ 0x20, ['unsigned long']], + 'DriverSection' : [ 0x28, ['pointer64', ['void']]], + 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x38, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x58, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x20, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x50, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], + 'FoIoPriorityHint' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0xc0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x10, ['long']], + 'Information' : [ 0x18, ['unsigned long long']], + 'ParseCheck' : [ 0x20, ['unsigned long']], + 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x40, ['unsigned long']], + 'FileAttributes' : [ 0x44, ['unsigned short']], + 'ShareAccess' : [ 0x46, ['unsigned short']], + 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], + 'EaLength' : [ 0x50, ['unsigned long']], + 'Options' : [ 0x54, ['unsigned long']], + 'Disposition' : [ 0x58, ['unsigned long']], + 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], + 'Override' : [ 0x80, ['unsigned char']], + 'QueryOnly' : [ 0x81, ['unsigned char']], + 'DeleteOnly' : [ 0x82, ['unsigned char']], + 'FullAttributes' : [ 0x83, ['unsigned char']], + 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x90, ['unsigned long']], + 'AccessMode' : [ 0x94, ['unsigned char']], + 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1d3b' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x118, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1d3b']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer64', ['wchar']]], + 'LogFileName' : [ 0x40, ['pointer64', ['wchar']]], + 'TimeZone' : [ 0x48, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf8, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0x100, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x108, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x110, ['unsigned long']], + 'BuffersLost' : [ 0x114, ['unsigned long']], +} ], + '_RTL_HASH_TABLE' : [ 0x10, { + 'EntryCount' : [ 0x0, ['unsigned long']], + 'MaskBitCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'BucketCount' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Buckets' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_HASH_ENTRY' : [ 0x10, { + 'BucketLink' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Key' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_HASH_TABLE_ITERATOR' : [ 0x18, { + 'Hash' : [ 0x0, ['pointer64', ['_RTL_HASH_TABLE']]], + 'HashEntry' : [ 0x8, ['pointer64', ['_RTL_HASH_ENTRY']]], + 'Bucket' : [ 0x10, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_CHASH_TABLE' : [ 0x18, { + 'Table' : [ 0x0, ['pointer64', ['_RTL_CHASH_ENTRY']]], + 'EntrySizeShift' : [ 0x8, ['unsigned long']], + 'EntryMax' : [ 0xc, ['unsigned long']], + 'EntryCount' : [ 0x10, ['unsigned long']], +} ], + '_RTL_CHASH_ENTRY' : [ 0x8, { + 'Key' : [ 0x0, ['unsigned long long']], +} ], + '_ETW_BUFFER_QUEUE' : [ 0x10, { + 'QueueTail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStatePendingCompression', 5: 'EtwBufferStateCompressed', 6: 'EtwBufferStatePlaceholder', 7: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer64', ['void']]], + 'Pointer1' : [ 0x40, ['pointer64', ['void']]], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x440, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 2, ['unsigned long']]], + 'ErrorMarker' : [ 0x1c, ['unsigned long']], + 'SizeMask' : [ 0x20, ['unsigned long']], + 'GetCpuClock' : [ 0x28, ['pointer64', ['void']]], + 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x38, ['long']], + 'FailureReason' : [ 0x3c, ['unsigned long']], + 'BufferQueue' : [ 0x40, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x50, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x60, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x70, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x80, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x80, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileName' : [ 0x98, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0xa8, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0xb8, ['_UNICODE_STRING']], + 'ClockType' : [ 0xc8, ['unsigned long']], + 'LastFlushedBuffer' : [ 0xcc, ['unsigned long']], + 'FlushTimer' : [ 0xd0, ['unsigned long']], + 'FlushThreshold' : [ 0xd4, ['unsigned long']], + 'ByteOffset' : [ 0xd8, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0xe0, ['unsigned long']], + 'BuffersAvailable' : [ 0xe4, ['long']], + 'NumberOfBuffers' : [ 0xe8, ['long']], + 'MaximumBuffers' : [ 0xec, ['unsigned long']], + 'EventsLost' : [ 0xf0, ['unsigned long']], + 'PeakBuffersCount' : [ 0xf4, ['long']], + 'BuffersWritten' : [ 0xf8, ['unsigned long']], + 'LogBuffersLost' : [ 0xfc, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0x100, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0x104, ['unsigned long']], + 'SequencePtr' : [ 0x108, ['pointer64', ['long']]], + 'LocalSequence' : [ 0x110, ['unsigned long']], + 'InstanceGuid' : [ 0x114, ['_GUID']], + 'MaximumFileSize' : [ 0x124, ['unsigned long']], + 'FileCounter' : [ 0x128, ['long']], + 'PoolType' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0x130, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0x140, ['long']], + 'ProviderInfoSize' : [ 0x144, ['unsigned long']], + 'Consumers' : [ 0x148, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x158, ['unsigned long']], + 'TransitionConsumer' : [ 0x160, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x168, ['pointer64', ['void']]], + 'RealtimeLogfileName' : [ 0x170, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x180, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x188, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x190, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x198, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x1a0, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x1a8, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x1b0, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x1c8, ['_KEVENT']], + 'FlushEvent' : [ 0x1e0, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x1f8, ['_KTIMER']], + 'LoggerDpc' : [ 0x238, ['_KDPC']], + 'LoggerMutex' : [ 0x278, ['_KMUTANT']], + 'LoggerLock' : [ 0x2b0, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x2b8, ['unsigned long long']], + 'BufferListPushLock' : [ 0x2b8, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x2c0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x308, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x310, ['_EX_FAST_REF']], + 'StartTime' : [ 0x318, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x320, ['pointer64', ['void']]], + 'BufferSequenceNumber' : [ 0x328, ['long long']], + 'Flags' : [ 0x330, ['unsigned long']], + 'Persistent' : [ 0x330, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x330, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x330, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x330, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x330, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x330, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x330, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x330, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x330, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x330, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x330, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x330, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x330, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'StackLookasideListAllocated' : [ 0x330, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SecurityTrace' : [ 0x330, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x330, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x330, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x330, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x330, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x334, ['unsigned long']], + 'DbgRequestNewFile' : [ 0x334, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x334, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x334, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x334, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x334, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x334, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x334, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x334, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDeferredFlush' : [ 0x334, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDeferredFlushTimer' : [ 0x334, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x334, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x334, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x334, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x338, ['_RTL_BITMAP']], + 'StackCache' : [ 0x348, ['pointer64', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x350, ['pointer64', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x358, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x368, ['pointer64', ['pointer64', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x370, ['_DISALLOWED_GUIDS']], + 'SoftRestartContext' : [ 0x380, ['pointer64', ['_ETW_SOFT_RESTART_CONTEXT']]], + 'SiloState' : [ 0x388, ['pointer64', ['_ETW_SILODRIVERSTATE']]], + 'CompressionWorkItem' : [ 0x390, ['_WORK_QUEUE_ITEM']], + 'CompressionWorkItemState' : [ 0x3b0, ['long']], + 'CompressionLock' : [ 0x3b8, ['_EX_PUSH_LOCK']], + 'CompressionTarget' : [ 0x3c0, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CompressionWorkspace' : [ 0x3c8, ['pointer64', ['void']]], + 'CompressionOn' : [ 0x3d0, ['long']], + 'CompressionRatioGuess' : [ 0x3d4, ['unsigned long']], + 'PartialBufferCompressionLevel' : [ 0x3d8, ['unsigned long']], + 'CompressionResumptionMode' : [ 0x3dc, ['Enumeration', dict(target = 'long', choices = {0: 'EtwCompressionModeRestart', 1: 'EtwCompressionModeNoDisable', 2: 'EtwCompressionModeNoRestart'})]], + 'PlaceholderList' : [ 0x3e0, ['_SINGLE_LIST_ENTRY']], + 'CompressionDpc' : [ 0x3e8, ['_KDPC']], + 'LastBufferSwitchTime' : [ 0x428, ['_LARGE_INTEGER']], + 'BufferWriteDuration' : [ 0x430, ['_LARGE_INTEGER']], + 'BufferCompressDuration' : [ 0x438, ['_LARGE_INTEGER']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x28, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer64', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_SILODRIVERSTATE' : [ 0x13a8, { + 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], + 'EtwpLoggerRundown' : [ 0x190, ['array', 64, ['pointer64', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], + 'WmipLoggerContext' : [ 0x390, ['array', 64, ['pointer64', ['_WMI_LOGGER_CONTEXT']]]], + 'EtwpGuidHashTable' : [ 0x590, ['array', 64, ['_ETW_HASH_BUCKET']]], + 'EtwpSecurityLoggers' : [ 0x1390, ['array', 8, ['unsigned short']]], + 'EtwpSecurityProviderEnableMask' : [ 0x13a0, ['unsigned char']], + 'EtwpShutdownInProgress' : [ 0x13a1, ['unsigned char']], + 'EtwpSecurityProviderPID' : [ 0x13a4, ['unsigned long']], +} ], + '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x18, { + 'RunRefs' : [ 0x0, ['pointer64', ['_EX_RUNDOWN_REF']]], + 'PoolToFree' : [ 0x8, ['pointer64', ['void']]], + 'RunRefSize' : [ 0x10, ['unsigned long']], + 'Number' : [ 0x14, ['unsigned long']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x488, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x38, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0xa0, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0xa8, ['pointer64', ['void']]], + 'DynamicPart' : [ 0xb0, ['pointer64', ['unsigned long']]], + 'DefaultDacl' : [ 0xb8, ['pointer64', ['_ACL']]], + 'TokenType' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xc8, ['unsigned long']], + 'TokenInUse' : [ 0xcc, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xd0, ['unsigned long']], + 'MandatoryPolicy' : [ 0xd4, ['unsigned long']], + 'LogonSession' : [ 0xd8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xe0, ['_LUID']], + 'SidHash' : [ 0xe8, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x1f8, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x308, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x310, ['pointer64', ['void']]], + 'Capabilities' : [ 0x318, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x320, ['unsigned long']], + 'CapabilitiesHash' : [ 0x328, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x438, ['pointer64', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x440, ['pointer64', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x448, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x450, ['pointer64', ['void']]], + 'TrustLinkedToken' : [ 0x458, ['pointer64', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x460, ['pointer64', ['void']]], + 'TokenSidValues' : [ 0x468, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'IndexEntry' : [ 0x470, ['pointer64', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], + 'DiagnosticInfo' : [ 0x478, ['pointer64', ['_SEP_TOKEN_DIAG_TRACK_ENTRY']]], + 'VariablePart' : [ 0x480, ['unsigned long long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0xc0, { + 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x8, ['_LUID']], + 'BuddyLogonId' : [ 0x10, ['_LUID']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'pDeviceMap' : [ 0x28, ['pointer64', ['_DEVICE_MAP']]], + 'Token' : [ 0x30, ['pointer64', ['void']]], + 'AccountName' : [ 0x38, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x48, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x58, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x70, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x78, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'RevocationBlock' : [ 0x80, ['_OB_HANDLE_REVOCATION_BLOCK']], + 'ServerSilo' : [ 0xa0, ['pointer64', ['_EJOB']]], + 'SiblingAuthId' : [ 0xa8, ['_LUID']], + 'TokenList' : [ 0xb0, ['_LIST_ENTRY']], +} ], + '_OBJECT_HEADER' : [ 0x38, { + 'PointerCount' : [ 0x0, ['long long']], + 'HandleCount' : [ 0x8, ['long long']], + 'NextToFree' : [ 0x8, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0x18, ['unsigned char']], + 'TraceFlags' : [ 0x19, ['unsigned char']], + 'DbgRefTrace' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0x1a, ['unsigned char']], + 'Flags' : [ 0x1b, ['unsigned char']], + 'NewObject' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0x1b, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0x1b, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0x1b, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0x1b, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Reserved' : [ 0x1c, ['unsigned long']], + 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], + 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], + 'Body' : [ 0x30, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], + 'Reserved2' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { + 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { + 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0x18, ['long']], + 'Reserved' : [ 0x1c, ['unsigned long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], + 'Reserved1' : [ 0x1a, ['unsigned short']], + 'Reserved2' : [ 0x1c, ['unsigned long']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x10, { + 'SecurityDescriptor' : [ 0x0, ['pointer64', ['void']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_EXTENDED_INFO' : [ 0x10, { + 'Footer' : [ 0x0, ['pointer64', ['_OBJECT_FOOTER']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_FOOTER' : [ 0x30, { + 'HandleRevocationInfo' : [ 0x0, ['_HANDLE_REVOCATION_INFO']], + 'ExtendedUserInfo' : [ 0x20, ['_OB_EXTENDED_USER_INFO']], +} ], + '_OB_EXTENDED_USER_INFO' : [ 0x10, { + 'Context1' : [ 0x0, ['pointer64', ['void']]], + 'Context2' : [ 0x8, ['pointer64', ['void']]], +} ], + '_HANDLE_REVOCATION_INFO' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'RevocationBlock' : [ 0x10, ['pointer64', ['_OB_HANDLE_REVOCATION_BLOCK']]], + 'AllowHandleRevocation' : [ 0x18, ['unsigned char']], + 'Padding1' : [ 0x19, ['array', 3, ['unsigned char']]], + 'Padding2' : [ 0x1c, ['array', 4, ['unsigned char']]], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x28, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'EntryLink' : [ 0x10, ['pointer64', ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0x18, ['unsigned long']], + 'HashIndex' : [ 0x1c, ['unsigned short']], + 'DirectoryLocked' : [ 0x1e, ['unsigned char']], + 'LockedExclusive' : [ 0x1f, ['unsigned char']], + 'LockStateSignature' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0x158, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x138, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0x140, ['unsigned long']], + 'NamespaceEntry' : [ 0x148, ['pointer64', ['void']]], + 'Flags' : [ 0x150, ['unsigned long']], +} ], + '_OBP_SILODRIVERSTATE' : [ 0x2e0, { + 'SystemDeviceMap' : [ 0x0, ['pointer64', ['_DEVICE_MAP']]], + 'SystemDosDeviceState' : [ 0x8, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], + 'DeviceMapLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'PrivateNamespaceLookupTable' : [ 0x80, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], +} ], + '_WHEAP_INFO_BLOCK' : [ 0x18, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x8, ['pointer64', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x10, ['pointer64', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x428, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x10, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x14, ['unsigned long']], + 'ErrorCount' : [ 0x18, ['long']], + 'RecordCount' : [ 0x1c, ['unsigned long']], + 'RecordLength' : [ 0x20, ['unsigned long']], + 'PoolTag' : [ 0x24, ['unsigned long']], + 'Type' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x30, ['pointer64', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x38, ['pointer64', ['void']]], + 'SectionCount' : [ 0x40, ['unsigned long']], + 'SectionLength' : [ 0x44, ['unsigned long']], + 'TickCountAtLastError' : [ 0x48, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x50, ['unsigned long']], + 'TotalErrors' : [ 0x54, ['unsigned long']], + 'Deferred' : [ 0x58, ['unsigned char']], + 'Descriptor' : [ 0x59, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xf0, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x10, ['unsigned long']], + 'ProcessorNumber' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x1c, ['long']], + 'ErrorSource' : [ 0x20, ['pointer64', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x28, ['_WHEA_ERROR_RECORD']], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x28, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ImageControlAreaOnRemovableMedia' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PageSize64K' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_PEP_ACPI_SPB_RESOURCE' : [ 0x28, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], + 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], + 'ResourceSourceName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x18, ['pointer64', ['unsigned char']]], + 'VendorDataLength' : [ 0x20, ['unsigned short']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x10, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x18, ['long']], + 'HighWaterMark' : [ 0x1c, ['unsigned long']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], +} ], + '_KDPC_DATA' : [ 0x28, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x10, ['unsigned long long']], + 'DpcQueueDepth' : [ 0x18, ['long']], + 'DpcCount' : [ 0x1c, ['unsigned long']], + 'ActiveDpc' : [ 0x20, ['pointer64', ['_KDPC']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { + 'ResetCount' : [ 0x0, ['unsigned long']], + 'StateCount' : [ 0x4, ['unsigned long']], + 'DeepSleepCount' : [ 0x8, ['unsigned long']], + 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_1f02' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x4000, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_1f02']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long long']], + 'NonPagablePages' : [ 0x28, ['unsigned long long']], + 'CommittedPages' : [ 0x30, ['unsigned long long']], + 'PagedPoolStart' : [ 0x38, ['pointer64', ['void']]], + 'PagedPoolEnd' : [ 0x40, ['pointer64', ['void']]], + 'SessionObject' : [ 0x48, ['pointer64', ['void']]], + 'SessionObjectHandle' : [ 0x50, ['pointer64', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x58, ['array', 4, ['unsigned long']]], + 'ImageTree' : [ 0x68, ['_RTL_AVL_TREE']], + 'LocaleId' : [ 0x70, ['unsigned long']], + 'AttachCount' : [ 0x74, ['unsigned long']], + 'AttachGate' : [ 0x78, ['_KGATE']], + 'WsListEntry' : [ 0x90, ['_LIST_ENTRY']], + 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xb40, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xb60, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xbc0, ['_MMSUPPORT_FULL']], + 'AggregateSessionWs' : [ 0xd00, ['_MMSUPPORT_AGGREGATION']], + 'DriverUnload' : [ 0xd20, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xd40, ['_POOL_DESCRIPTOR']], + 'PageDirectory' : [ 0x1e80, ['_MMPTE']], + 'SessionVaLock' : [ 0x1e88, ['_EX_PUSH_LOCK']], + 'DynamicVaBitMap' : [ 0x1e90, ['_RTL_BITMAP']], + 'DynamicVaHint' : [ 0x1ea0, ['unsigned long']], + 'SpecialPool' : [ 0x1ea8, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1ef8, ['_EX_PUSH_LOCK']], + 'PoolBigEntriesInUse' : [ 0x1f00, ['long']], + 'PagedPoolPdeCount' : [ 0x1f04, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1f08, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1f0c, ['unsigned long']], + 'SystemPteInfo' : [ 0x1f10, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1f78, ['pointer64', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1f80, ['unsigned long long']], + 'PoolTrackBigPages' : [ 0x1f88, ['pointer64', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1f90, ['unsigned long long']], + 'IoState' : [ 0x1f98, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1f9c, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1fa0, ['_KEVENT']], + 'ServerSilo' : [ 0x1fb8, ['pointer64', ['_EJOB']]], + 'CreateTime' : [ 0x1fc0, ['unsigned long long']], + 'PoolTags' : [ 0x2000, ['array', 8192, ['unsigned char']]], +} ], + '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x260, { + 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], + 'Lock' : [ 0x250, ['_EX_PUSH_LOCK']], + 'NumberOfPrivateSpaces' : [ 0x258, ['unsigned long']], +} ], + '_MI_CACHED_PTES' : [ 0x48, { + 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], + 'CachedPteCount' : [ 0x40, ['long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x78, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeFlags2' : [ 0x3, ['unsigned char']], + 'UseExtendedParameters' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], + 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], + 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], + 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], + 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], + 'ParseProcedureEx' : [ 0x50, ['pointer64', ['void']]], + 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], + 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], + 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], + 'WaitObjectFlagMask' : [ 0x70, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x74, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x76, ['unsigned short']], +} ], + '_KLOCK_ENTRY' : [ 0x60, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'EntryFlags' : [ 0x18, ['unsigned long']], + 'EntryOffset' : [ 0x18, ['unsigned char']], + 'ThreadLocalFlags' : [ 0x19, ['unsigned char']], + 'WaitingBit' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare0' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'AcquiredByte' : [ 0x1a, ['unsigned char']], + 'AcquiredBit' : [ 0x1a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadFlags' : [ 0x1b, ['unsigned char']], + 'HeadNodeBit' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IoPriorityBit' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IoQoSWaiter' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'StaticState' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'AllFlags' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'SpareFlags' : [ 0x1c, ['unsigned long']], + 'LockState' : [ 0x20, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x20, ['pointer64', ['void']]], + 'CrossThreadReleasableAndBusyByte' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x21, ['array', 6, ['unsigned char']]], + 'InTreeByte' : [ 0x27, ['unsigned char']], + 'SessionState' : [ 0x28, ['pointer64', ['void']]], + 'SessionId' : [ 0x28, ['unsigned long']], + 'SessionPad' : [ 0x2c, ['unsigned long']], + 'OwnerTree' : [ 0x30, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x40, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x30, ['unsigned char']], + 'EntryLock' : [ 0x50, ['unsigned long long']], + 'AllBoosts' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 17, native_type='unsigned long')]], + 'CpuBoostsBitmap' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 15, native_type='unsigned short')]], + 'IoBoost' : [ 0x58, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'IoQoSBoost' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned short')]], + 'IoQoSWaiterCount' : [ 0x5a, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'SparePad' : [ 0x5c, ['unsigned long']], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ContextSwitches' : [ 0x14, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x48, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], + 'TagIndex' : [ 0x10, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], + 'TagName' : [ 0x14, ['array', 24, ['wchar']]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PageSize64K' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], +} ], + '_HEAP_COUNTERS' : [ 0x78, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], + 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], + 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], + 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], + 'TotalSegments' : [ 0x20, ['unsigned long']], + 'TotalUCRs' : [ 0x24, ['unsigned long']], + 'CommittOps' : [ 0x28, ['unsigned long']], + 'DeCommitOps' : [ 0x2c, ['unsigned long']], + 'LockAcquires' : [ 0x30, ['unsigned long']], + 'LockCollisions' : [ 0x34, ['unsigned long']], + 'CommitRate' : [ 0x38, ['unsigned long']], + 'DecommittRate' : [ 0x3c, ['unsigned long']], + 'CommitFailures' : [ 0x40, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], + 'PollIntervalCounter' : [ 0x48, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x4c, ['unsigned long']], + 'HeapPollInterval' : [ 0x50, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x54, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x58, ['unsigned long']], + 'InBlockDeccommits' : [ 0x5c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x60, ['unsigned long long']], + 'HighWatermarkSize' : [ 0x68, ['unsigned long long']], + 'LastPolledSize' : [ 0x70, ['unsigned long long']], +} ], + '_INTERFACE' : [ 0x20, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x30, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'Irp' : [ 0x18, ['pointer64', ['_IRP']]], + 'Device' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x28, ['unsigned char']], +} ], + '__unnamed_1f6b' : [ 0x20, { + 'CallerCompletion' : [ 0x0, ['pointer64', ['void']]], + 'CallerContext' : [ 0x8, ['pointer64', ['void']]], + 'CallerDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_1f6e' : [ 0x10, { + 'NotifyDevice' : [ 0x0, ['pointer64', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x8, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0xf8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x30, ['unsigned long long']], + 'WatchdogTimer' : [ 0x38, ['_KTIMER']], + 'WatchdogDpc' : [ 0x78, ['_KDPC']], + 'MinorFunction' : [ 0xb8, ['unsigned char']], + 'PowerStateType' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0xc0, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0xc4, ['unsigned char']], + 'FxDevice' : [ 0xc8, ['pointer64', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0xd0, ['unsigned char']], + 'NotifyPEP' : [ 0xd1, ['unsigned char']], + 'Device' : [ 0xd8, ['__unnamed_1f6b']], + 'System' : [ 0xd8, ['__unnamed_1f6e']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x8, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_CLIENT_ID' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], + 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_POOL_TRACKER_TABLE' : [ 0x28, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0x10, ['unsigned long long']], + 'PagedAllocs' : [ 0x18, ['unsigned long']], + 'PagedFrees' : [ 0x1c, ['unsigned long']], + 'PagedBytes' : [ 0x20, ['unsigned long long']], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_STACK_TABLE' : [ 0x8088, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], +} ], + '_PPM_IDLE_STATES' : [ 0x418, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'UnaccountedTransition' : [ 0x5, ['unsigned char']], + 'IdleDurationLimited' : [ 0x6, ['unsigned char']], + 'IdleCheckLimited' : [ 0x7, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0xe0, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x188, ['pointer64', ['void']]], + 'IdlePreExecute' : [ 0x190, ['pointer64', ['void']]], + 'IdleExecute' : [ 0x198, ['pointer64', ['void']]], + 'IdlePreselect' : [ 0x1a0, ['pointer64', ['void']]], + 'IdleTest' : [ 0x1a8, ['pointer64', ['void']]], + 'IdleAvailabilityCheck' : [ 0x1b0, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x1b8, ['pointer64', ['void']]], + 'IdleCancel' : [ 0x1c0, ['pointer64', ['void']]], + 'IdleIsHalted' : [ 0x1c8, ['pointer64', ['void']]], + 'IdleInitiateWake' : [ 0x1d0, ['pointer64', ['void']]], + 'PrepareInfo' : [ 0x1d8, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'DeepIdleSnapshot' : [ 0x230, ['_KAFFINITY_EX']], + 'Tracing' : [ 0x2d8, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'CoordinatedTracing' : [ 0x2e0, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'ProcessorMenu' : [ 0x2e8, ['_PPM_SELECTION_MENU']], + 'CoordinatedMenu' : [ 0x2f8, ['_PPM_SELECTION_MENU']], + 'CoordinatedSelection' : [ 0x308, ['_PPM_COORDINATED_SELECTION']], + 'State' : [ 0x320, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_HASH_BUCKET' : [ 0x38, { + 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], + 'BucketLock' : [ 0x30, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1fb5' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], + 'GenErrDescriptorV2' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR_V2']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1fb5']], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], + 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], + 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], + 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_SEP_TOKEN_DIAG_TRACK_ENTRY' : [ 0x120, { + 'ProcessCid' : [ 0x0, ['pointer64', ['void']]], + 'ThreadCid' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'CreateMethod' : [ 0x20, ['unsigned long']], + 'CreateTrace' : [ 0x28, ['array', 30, ['unsigned long long']]], + 'Count' : [ 0x118, ['long']], + 'CaptureCount' : [ 0x11c, ['long']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { + 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0x110, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long long']], + 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_KSCHEDULING_GROUP' : [ 0x240, { + 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], + 'RelativeWeight' : [ 0x8, ['unsigned long']], + 'ChildMinRate' : [ 0xc, ['unsigned long']], + 'ChildMinWeight' : [ 0x10, ['unsigned long']], + 'ChildTotalWeight' : [ 0x14, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], + 'NotificationCycles' : [ 0x20, ['long long']], + 'MaxQuotaLimitCycles' : [ 0x28, ['long long']], + 'MaxQuotaCyclesRemaining' : [ 0x30, ['long long']], + 'SchedulingGroupList' : [ 0x38, ['_LIST_ENTRY']], + 'Sibling' : [ 0x38, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x48, ['pointer64', ['_KDPC']]], + 'ChildList' : [ 0x50, ['_LIST_ENTRY']], + 'Parent' : [ 0x60, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'PerProcessor' : [ 0x80, ['array', 1, ['_KSCB']]], +} ], + '_CM_INTENT_LOCK' : [ 0x10, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x260, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x10, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0x18, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x20, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x130, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x240, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x248, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x250, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x258, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_TEB_ACTIVE_FRAME' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_LOCK_HEADER' : [ 0x20, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x8, ['unsigned long long']], + 'Lock' : [ 0x10, ['unsigned long long']], + 'Valid' : [ 0x18, ['unsigned long']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_KHETERO_PROCESSOR_SET' : [ 0x18, { + 'IdealMask' : [ 0x0, ['unsigned long long']], + 'PreferredMask' : [ 0x8, ['unsigned long long']], + 'AvailableMask' : [ 0x10, ['unsigned long long']], +} ], + '_MMSESSION' : [ 0x20, { + 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'SystemSpaceViewLockPointer' : [ 0x8, ['pointer64', ['_EX_PUSH_LOCK']]], + 'ViewRoot' : [ 0x10, ['_RTL_AVL_TREE']], + 'ViewCount' : [ 0x18, ['unsigned long']], + 'BitmapFailures' : [ 0x1c, ['unsigned long']], +} ], + '_CC_ASYNC_READ_CONTEXT' : [ 0x20, { + 'CompletionRoutine' : [ 0x0, ['pointer64', ['void']]], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'RequestorMode' : [ 0x18, ['unsigned char']], + 'NestingLevel' : [ 0x1c, ['unsigned long']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0x18, { + 'DirtyPages' : [ 0x0, ['unsigned long long']], + 'DirtyPagesLastScan' : [ 0x8, ['unsigned long long']], + 'DirtyPagesScheduledLastScan' : [ 0x10, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x58, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'ReadyTime' : [ 0x10, ['unsigned long long']], + 'CycleTime' : [ 0x18, ['unsigned long long']], + 'ContextSwitches' : [ 0x20, ['unsigned long long']], + 'ReadOperationCount' : [ 0x28, ['long long']], + 'WriteOperationCount' : [ 0x30, ['long long']], + 'OtherOperationCount' : [ 0x38, ['long long']], + 'ReadTransferCount' : [ 0x40, ['long long']], + 'WriteTransferCount' : [ 0x48, ['long long']], + 'OtherTransferCount' : [ 0x50, ['long long']], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x10, { + 'Sid' : [ 0x0, ['pointer64', ['void']]], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_DEVICE_MAP' : [ 0x48, { + 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x18, ['long']], + 'DriveMap' : [ 0x1c, ['unsigned long']], + 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], + 'ServerSilo' : [ 0x40, ['pointer64', ['_EJOB']]], +} ], + '_RTL_BITMAP_EX' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 15, native_type='unsigned long long')]], + 'ExecutePrivilege' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_TRIAGE_9F_PNP' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'CompletionQueue' : [ 0x8, ['pointer64', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], + 'DelayedWorkQueue' : [ 0x10, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x18, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'DeviceState' : [ 0x10, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x8, ['unsigned long long']], + 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x10, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR_V2' : [ 0x50, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'ReadAckAddressSpaceID' : [ 0x34, ['unsigned char']], + 'ReadAckAddressBitWidth' : [ 0x35, ['unsigned char']], + 'ReadAckAddressBitOffset' : [ 0x36, ['unsigned char']], + 'ReadAckAddressAccessSize' : [ 0x37, ['unsigned char']], + 'ReadAckAddress' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAckPreserveMask' : [ 0x40, ['unsigned long long']], + 'ReadAckWriteMask' : [ 0x48, ['unsigned long long']], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x10, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], +} ], + '_LPCP_MESSAGE' : [ 0x50, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x8, ['unsigned long']], + 'SenderPort' : [ 0x10, ['pointer64', ['void']]], + 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'PortContext' : [ 0x20, ['pointer64', ['void']]], + 'Request' : [ 0x28, ['_PORT_MESSAGE']], +} ], + '_MI_SPECIAL_POOL' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0x40, ['_RTL_BITMAP']], +} ], + '_PCW_MASK_INFORMATION' : [ 0x28, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0x10, ['unsigned long']], + 'CollectMultiple' : [ 0x14, ['unsigned char']], + 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], +} ], + '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], + 'BreakPointHandle' : [ 0x10, ['unsigned long']], + 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], + 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_OBJECT_REF_INFO' : [ 0x28, { + 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x20, ['unsigned short']], + 'MaxStacks' : [ 0x22, ['unsigned short']], + 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x10, ['unsigned char']], + 'Spare' : [ 0x11, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0x14, ['unsigned long']], + 'DebugId' : [ 0x18, ['_CVDD']], +} ], + '_MMWSLENTRY' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'HighActiveFlink' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'HighActiveBlink' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 56, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PS_PROPERTY_SET' : [ 0x18, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['unsigned long long']], +} ], + '_TRIAGE_EX_WORK_QUEUE' : [ 0x2b0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long long']], + 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], + 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], + 'MaxSectionSize' : [ 0x28, ['unsigned long long']], + 'MaxViewSize' : [ 0x30, ['unsigned long long']], + 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], + 'DupObjectTypes' : [ 0x40, ['unsigned long']], + 'Reserved' : [ 0x44, ['unsigned long']], +} ], + '_THREAD_ENERGY_VALUES' : [ 0x40, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], +} ], + '_MMWSLE_HASH' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long long']], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x88, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x10, ['unsigned long long']], + 'ItemCount' : [ 0x18, ['long']], + 'Dpc' : [ 0x20, ['_KDPC']], + 'WorkItem' : [ 0x60, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x80, ['pointer64', ['void']]], +} ], + '_EXCEPTION_RECORD' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], + 'NumberParameters' : [ 0x18, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_RTL_RUN_ONCE' : [ 0x8, { + 'Ptr' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], +} ], + '_CM_PATH_HASH' : [ 0x4, { + 'Hash' : [ 0x0, ['unsigned long']], +} ], + '_EXHANDLE' : [ 0x8, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x28, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Group' : [ 0x10, ['pointer64', ['void']]], + 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], + 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], + 'Lock' : [ 0x40, ['_FAST_MUTEX']], + 'List' : [ 0x78, ['_LIST_ENTRY']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x38, ['unsigned char']], + 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x48, ['pointer64', ['wchar']]], + 'DriverName' : [ 0x50, ['pointer64', ['wchar']]], + 'ChildCount' : [ 0x58, ['unsigned long']], + 'ActiveChild' : [ 0x5c, ['unsigned long']], + 'ParentCount' : [ 0x60, ['unsigned long']], + 'ActiveParent' : [ 0x64, ['unsigned long']], +} ], + '_DUAL' : [ 0x278, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], + 'Guard' : [ 0x18, ['unsigned long']], + 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x260, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x270, ['unsigned long']], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], + 'SecureInfo' : [ 0x10, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x10, ['_RTL_BITMAP_EX']], + 'InPageSupport' : [ 0x10, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'LargePage' : [ 0x10, ['_MI_LARGEPAGE_IMAGE_INFO']], + 'CreatingThread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'PebTeb' : [ 0x10, ['_MI_SUB64K_FREE_RANGES']], +} ], + '__unnamed_20a4' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '__unnamed_20a6' : [ 0x4, { + 'NumberOfChildViews' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_20a8' : [ 0x4, { + 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SUBSECTION' : [ 0x38, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'GlobalPerSessionHead' : [ 0x18, ['_RTL_AVL_TREE']], + 'CreationWaitList' : [ 0x18, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'SessionDriverProtos' : [ 0x18, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], + 'u' : [ 0x20, ['__unnamed_20a4']], + 'StartingSector' : [ 0x24, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x28, ['unsigned long']], + 'PtesInSubsection' : [ 0x2c, ['unsigned long']], + 'u1' : [ 0x30, ['__unnamed_20a6']], + 'UnusedPtes' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u2' : [ 0x34, ['__unnamed_20a8']], +} ], + '_KUMS_CONTEXT_HEADER' : [ 0x70, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'StackTop' : [ 0x20, ['pointer64', ['void']]], + 'StackSize' : [ 0x28, ['unsigned long long']], + 'RspOffset' : [ 0x30, ['unsigned long long']], + 'Rip' : [ 0x38, ['unsigned long long']], + 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], + 'Flags' : [ 0x48, ['unsigned long long']], + 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], + 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], + 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], + 'Return' : [ 0x68, ['unsigned long long']], +} ], + '_REQUEST_MAILBOX' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x8, ['unsigned long long']], + 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x30, ['pointer64', ['long']]], + 'NodeTargetCount' : [ 0x38, ['long']], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { + 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], + 'StackId' : [ 0x20, ['unsigned long']], +} ], + 'CMP_OFFSET_ARRAY' : [ 0x18, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], + 'DataLength' : [ 0x10, ['unsigned long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x10, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x30, { + 'AllocAddress' : [ 0x0, ['unsigned long long']], + 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x10, ['unsigned long long']], + 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x20, ['unsigned long long']], + 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], +} ], + '_SEP_RM_LSA_CONNECTION_STATE' : [ 0x50, { + 'LsaProcessHandle' : [ 0x0, ['pointer64', ['void']]], + 'LsaCommandPortHandle' : [ 0x8, ['pointer64', ['void']]], + 'SepRmThreadHandle' : [ 0x10, ['pointer64', ['void']]], + 'RmCommandPortHandle' : [ 0x18, ['pointer64', ['void']]], + 'RmCommandServerPortHandle' : [ 0x20, ['pointer64', ['void']]], + 'LsaCommandPortSectionHandle' : [ 0x28, ['pointer64', ['void']]], + 'LsaCommandPortSectionSize' : [ 0x30, ['_LARGE_INTEGER']], + 'LsaViewPortMemory' : [ 0x38, ['pointer64', ['void']]], + 'RmViewPortMemory' : [ 0x40, ['pointer64', ['void']]], + 'LsaCommandPortMemoryDelta' : [ 0x48, ['long']], + 'LsaCommandPortActive' : [ 0x4c, ['unsigned char']], +} ], + '_CM_KCB_LAYER_INFO' : [ 0x30, { + 'LayerListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Kcb' : [ 0x10, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'LowerLayer' : [ 0x18, ['pointer64', ['_CM_KCB_LAYER_INFO']]], + 'UpperLayerListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_CM_RM' : [ 0x88, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x20, ['pointer64', ['void']]], + 'Tm' : [ 0x28, ['pointer64', ['void']]], + 'RmHandle' : [ 0x30, ['pointer64', ['void']]], + 'KtmRm' : [ 0x38, ['pointer64', ['void']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'ContainerNum' : [ 0x44, ['unsigned long']], + 'ContainerSize' : [ 0x48, ['unsigned long long']], + 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], + 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], + 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], + 'RmFlags' : [ 0x68, ['unsigned long']], + 'LogStartStatus1' : [ 0x6c, ['long']], + 'LogStartStatus2' : [ 0x70, ['long']], + 'BaseLsn' : [ 0x78, ['unsigned long long']], + 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x38, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'PagedPoolAllocationMap' : [ 0x8, ['_RTL_BITMAP_EX']], + 'FirstPteForPagedPool' : [ 0x18, ['pointer64', ['_MMPTE']]], + 'MaximumSize' : [ 0x20, ['unsigned long long']], + 'PagedPoolHint' : [ 0x28, ['unsigned long long']], + 'AllocatedPagedPool' : [ 0x30, ['unsigned long long']], +} ], + '_PPM_IDLE_STATE' : [ 0xf8, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Name' : [ 0xa8, ['_UNICODE_STRING']], + 'Latency' : [ 0xb8, ['unsigned long']], + 'BreakEvenDuration' : [ 0xbc, ['unsigned long']], + 'Power' : [ 0xc0, ['unsigned long']], + 'StateFlags' : [ 0xc4, ['unsigned long']], + 'VetoAccounting' : [ 0xc8, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0xf0, ['unsigned char']], + 'InterruptsEnabled' : [ 0xf1, ['unsigned char']], + 'Interruptible' : [ 0xf2, ['unsigned char']], + 'ContextRetained' : [ 0xf3, ['unsigned char']], + 'CacheCoherent' : [ 0xf4, ['unsigned char']], + 'WakesSpuriously' : [ 0xf5, ['unsigned char']], + 'PlatformOnly' : [ 0xf6, ['unsigned char']], + 'NoCState' : [ 0xf7, ['unsigned char']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CACHED_CHILD_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x8, ['unsigned long long']], + 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '__unnamed_20dc' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_20de' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_20dc']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x120, { + 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x8, ['pointer64', ['void']]], + 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], + 'u1' : [ 0x20, ['__unnamed_20de']], + 'Signature' : [ 0x28, ['unsigned long long']], + 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], + 'PagedBytes' : [ 0x60, ['unsigned long long']], + 'NonPagedBytes' : [ 0x68, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], + 'RaiseIrqls' : [ 0x80, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], + 'AllocationsFailed' : [ 0x90, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], + 'LockedBytes' : [ 0x98, ['unsigned long long']], + 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], + 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], + 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], + 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], + 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], + 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], + 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], + 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], + 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], + 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], + 'ExecutePoolTypes' : [ 0xf8, ['unsigned long']], + 'ExecutePageProtections' : [ 0xfc, ['unsigned long']], + 'ExecutePageMappings' : [ 0x100, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x104, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0x108, ['unsigned long']], + 'UnsupportedRelocs' : [ 0x10c, ['unsigned long']], + 'IATInExecutableSection' : [ 0x110, ['unsigned long']], +} ], + '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Luid' : [ 0x20, ['unsigned long long']], + 'IndexIntoGlobalSingletonTable' : [ 0x28, ['unsigned long long']], + 'MarkedForDeletion' : [ 0x30, ['unsigned char']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x18, { + 'DynamicRelocations' : [ 0x0, ['pointer64', ['void']]], + 'SecurityContext' : [ 0x8, ['_IMAGE_SECURITY_CONTEXT']], + 'StrongImageReference' : [ 0x10, ['unsigned long long']], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderFirmwareKsr', 35: 'LoaderMaximum'})]], + 'BasePage' : [ 0x18, ['unsigned long long']], + 'PageCount' : [ 0x20, ['unsigned long long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { + 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], + 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], +} ], + '_WNF_SILODRIVERSTATE' : [ 0x38, { + 'ScopeMap' : [ 0x0, ['pointer64', ['_WNF_SCOPE_MAP']]], + 'PermanentNameStoreRootKey' : [ 0x8, ['pointer64', ['void']]], + 'PersistentNameStoreRootKey' : [ 0x10, ['pointer64', ['void']]], + 'PermanentNameSequenceNumber' : [ 0x18, ['long long']], + 'PermanentNameSequenceNumberLock' : [ 0x20, ['_WNF_LOCK']], + 'PermanentNameSequenceNumberPool' : [ 0x28, ['long long']], + 'RuntimeNameSequenceNumber' : [ 0x30, ['long long']], +} ], + '_DELAY_ACK_FO' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_DISPATCHER_HEADER' : [ 0x18, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Minimal' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved4' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x20, { + 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'Rundown' : [ 0x18, ['_EX_RUNDOWN_REF']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x38, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long long']], + 'DirtyPageThresholdTop' : [ 0x8, ['unsigned long long']], + 'DirtyPageThresholdBottom' : [ 0x10, ['unsigned long long']], + 'DirtyPageTarget' : [ 0x18, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x20, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x28, ['unsigned long long']], + 'AvailableHistory' : [ 0x30, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x90, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'Count' : [ 0x28, ['unsigned long long']], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'StackTrace' : [ 0x40, ['array', 8, ['pointer64', ['void']]]], + 'Who' : [ 0x80, ['unsigned long']], + 'Process' : [ 0x88, ['pointer64', ['_EPROCESS']]], +} ], + '_CONTEXT' : [ 0x4d0, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5Home' : [ 0x20, ['unsigned long long']], + 'P6Home' : [ 0x28, ['unsigned long long']], + 'ContextFlags' : [ 0x30, ['unsigned long']], + 'MxCsr' : [ 0x34, ['unsigned long']], + 'SegCs' : [ 0x38, ['unsigned short']], + 'SegDs' : [ 0x3a, ['unsigned short']], + 'SegEs' : [ 0x3c, ['unsigned short']], + 'SegFs' : [ 0x3e, ['unsigned short']], + 'SegGs' : [ 0x40, ['unsigned short']], + 'SegSs' : [ 0x42, ['unsigned short']], + 'EFlags' : [ 0x44, ['unsigned long']], + 'Dr0' : [ 0x48, ['unsigned long long']], + 'Dr1' : [ 0x50, ['unsigned long long']], + 'Dr2' : [ 0x58, ['unsigned long long']], + 'Dr3' : [ 0x60, ['unsigned long long']], + 'Dr6' : [ 0x68, ['unsigned long long']], + 'Dr7' : [ 0x70, ['unsigned long long']], + 'Rax' : [ 0x78, ['unsigned long long']], + 'Rcx' : [ 0x80, ['unsigned long long']], + 'Rdx' : [ 0x88, ['unsigned long long']], + 'Rbx' : [ 0x90, ['unsigned long long']], + 'Rsp' : [ 0x98, ['unsigned long long']], + 'Rbp' : [ 0xa0, ['unsigned long long']], + 'Rsi' : [ 0xa8, ['unsigned long long']], + 'Rdi' : [ 0xb0, ['unsigned long long']], + 'R8' : [ 0xb8, ['unsigned long long']], + 'R9' : [ 0xc0, ['unsigned long long']], + 'R10' : [ 0xc8, ['unsigned long long']], + 'R11' : [ 0xd0, ['unsigned long long']], + 'R12' : [ 0xd8, ['unsigned long long']], + 'R13' : [ 0xe0, ['unsigned long long']], + 'R14' : [ 0xe8, ['unsigned long long']], + 'R15' : [ 0xf0, ['unsigned long long']], + 'Rip' : [ 0xf8, ['unsigned long long']], + 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], + 'Header' : [ 0x100, ['array', 2, ['_M128A']]], + 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], + 'Xmm0' : [ 0x1a0, ['_M128A']], + 'Xmm1' : [ 0x1b0, ['_M128A']], + 'Xmm2' : [ 0x1c0, ['_M128A']], + 'Xmm3' : [ 0x1d0, ['_M128A']], + 'Xmm4' : [ 0x1e0, ['_M128A']], + 'Xmm5' : [ 0x1f0, ['_M128A']], + 'Xmm6' : [ 0x200, ['_M128A']], + 'Xmm7' : [ 0x210, ['_M128A']], + 'Xmm8' : [ 0x220, ['_M128A']], + 'Xmm9' : [ 0x230, ['_M128A']], + 'Xmm10' : [ 0x240, ['_M128A']], + 'Xmm11' : [ 0x250, ['_M128A']], + 'Xmm12' : [ 0x260, ['_M128A']], + 'Xmm13' : [ 0x270, ['_M128A']], + 'Xmm14' : [ 0x280, ['_M128A']], + 'Xmm15' : [ 0x290, ['_M128A']], + 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], + 'VectorControl' : [ 0x4a0, ['unsigned long long']], + 'DebugControl' : [ 0x4a8, ['unsigned long long']], + 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_MMSECTION_FLAGS2' : [ 0x4, { + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'NumberOfChildViews' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer64', ['_MMPTE']]], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x48, ['unsigned long']], + 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x18, { + 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], +} ], + '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { + 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'AccessRights' : [ 0x0, ['unsigned char']], +} ], + '_KREQUEST_PACKET' : [ 0x20, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_2130' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2132' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2130']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2132']], +} ], + '_PROCESS_ENERGY_VALUES' : [ 0x90, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'DiskEnergy' : [ 0x40, ['unsigned long long']], + 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], + 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], + 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], + 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], + 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DesktopVisible' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WindowInformation' : [ 0x68, ['unsigned short']], + 'CompositorRendered' : [ 0x6a, ['unsigned short']], + 'DirtyGenerated' : [ 0x6c, ['unsigned short']], + 'DirtyPropagated' : [ 0x6e, ['unsigned short']], + 'DesktopVisibilityReportTimestamp' : [ 0x70, ['long long']], + 'DesktopVisibleTime' : [ 0x78, ['unsigned long long']], + 'ForegroundReportTimestamp' : [ 0x80, ['long long']], + 'ForegroundTime' : [ 0x88, ['unsigned long long']], +} ], + '_MMCLONE_HEADER' : [ 0x18, { + 'NumberOfPtes' : [ 0x0, ['unsigned long long']], + 'NumberOfProcessReferences' : [ 0x8, ['unsigned long long']], + 'ClonePtes' : [ 0x10, ['pointer64', ['_MMCLONE_BLOCK']]], +} ], + '_MI_SYSTEM_INFORMATION' : [ 0x1ec0, { + 'Pools' : [ 0x0, ['_MI_POOL_STATE']], + 'Sections' : [ 0x100, ['_MI_SECTION_STATE']], + 'SystemImages' : [ 0x380, ['_MI_SYSTEM_IMAGE_STATE']], + 'Sessions' : [ 0x440, ['_MI_SESSION_STATE']], + 'Processes' : [ 0x4e0, ['_MI_PROCESS_STATE']], + 'Hardware' : [ 0x540, ['_MI_HARDWARE_STATE']], + 'SystemVa' : [ 0x640, ['_MI_SYSTEM_VA_STATE']], + 'PageCombines' : [ 0x940, ['_MI_COMBINE_STATE']], + 'PageLists' : [ 0xae0, ['_MI_PAGELIST_STATE']], + 'Partitions' : [ 0xaf0, ['_MI_PARTITION_STATE']], + 'Shutdowns' : [ 0xb50, ['_MI_SHUTDOWN_STATE']], + 'Errors' : [ 0xbd0, ['_MI_ERROR_STATE']], + 'AccessLog' : [ 0xcc0, ['_MI_ACCESS_LOG_STATE']], + 'Debugger' : [ 0xd40, ['_MI_DEBUGGER_STATE']], + 'Standby' : [ 0xe80, ['_MI_STANDBY_STATE']], + 'SystemPtes' : [ 0xf40, ['_MI_SYSTEM_PTE_STATE']], + 'IoPages' : [ 0x1100, ['_MI_IO_PAGE_STATE']], + 'PagingIo' : [ 0x1170, ['_MI_PAGING_IO_STATE']], + 'CommonPages' : [ 0x11c0, ['_MI_COMMON_PAGE_STATE']], + 'Trims' : [ 0x1280, ['_MI_SYSTEM_TRIM_STATE']], + 'ResTrack' : [ 0x12c0, ['_MI_RESAVAIL_TRACKER']], + 'Cookie' : [ 0x1640, ['unsigned long long']], + 'ZeroingDisabled' : [ 0x1648, ['long']], + 'BootRegistryRuns' : [ 0x1650, ['pointer64', ['pointer64', ['void']]]], + 'FullyInitialized' : [ 0x1658, ['unsigned char']], + 'SafeBooted' : [ 0x1659, ['unsigned char']], + 'TraceLogging' : [ 0x1660, ['pointer64', ['_TlgProvider_t']]], + 'Vs' : [ 0x1680, ['_MI_VISIBLE_STATE']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 28, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x30, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x18, ['_KEVENT']], +} ], + '__unnamed_2160' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2162' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2160']], +} ], + '__unnamed_2164' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_2162']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_2164']], +} ], + '_HMAP_DIRECTORY' : [ 0x2000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], +} ], + '__unnamed_216c' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_216c']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x10, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MI_LARGEPAGE_IMAGE_INFO' : [ 0x10, { + 'LargeImageBias' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'ActualImageViewSize' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2179' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x28, { + 'NodeRangeSize' : [ 0x0, ['unsigned long long']], + 'NodeCount' : [ 0x8, ['unsigned long long']], + 'Tables' : [ 0x10, ['pointer64', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x18, ['unsigned long']], + 'UseSessionId' : [ 0x1c, ['unsigned char']], + 'u1' : [ 0x20, ['__unnamed_2179']], +} ], + '_SILO_USER_SHARED_DATA' : [ 0x20, { + 'ServiceSessionId' : [ 0x0, ['unsigned long']], + 'ActiveConsoleId' : [ 0x4, ['unsigned long']], + 'ConsoleSessionForegroundProcessId' : [ 0x8, ['long long']], + 'NtProductType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'SuiteMask' : [ 0x14, ['unsigned long']], + 'IsMultiSessionSku' : [ 0x18, ['unsigned char']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], + 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], + 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], +} ], + '_MMSUPPORT_FULL' : [ 0x108, { + 'Instance' : [ 0x0, ['_MMSUPPORT_INSTANCE']], + 'Shared' : [ 0xc0, ['_MMSUPPORT_SHARED']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_MI_PROCESS_STATE' : [ 0x60, { + 'ColorSeed' : [ 0x0, ['unsigned long']], + 'CloneDereferenceEvent' : [ 0x8, ['_KEVENT']], + 'CloneProtosSListHead' : [ 0x20, ['_SLIST_HEADER']], + 'SystemDllBase' : [ 0x30, ['pointer64', ['void']]], + 'RotatingUniprocessorNumber' : [ 0x38, ['long']], + 'CriticalSectionTimeout' : [ 0x40, ['_LARGE_INTEGER']], + 'ProcessList' : [ 0x48, ['_LIST_ENTRY']], + 'SharedUserDataPte' : [ 0x58, ['pointer64', ['_MMPTE']]], +} ], + '_MMSUPPORT_AGGREGATION' : [ 0x20, { + 'PageFaultCount' : [ 0x0, ['unsigned long']], + 'WorkingSetSize' : [ 0x8, ['unsigned long long']], + 'WorkingSetLeafSize' : [ 0x10, ['unsigned long long']], + 'PeakWorkingSetSize' : [ 0x18, ['unsigned long long']], +} ], + '_IO_TIMER' : [ 0x30, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x8, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_EXCEPTION_POINTERS' : [ 0x10, { + 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x78, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long long']], + 'PipelinedReadAheadRequestSize' : [ 0x58, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x5c, ['unsigned long']], + 'PrivateLinks' : [ 0x60, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x70, ['pointer64', ['void']]], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_ETW_GUID_ENTRY' : [ 0x190, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x10, ['long long']], + 'Guid' : [ 0x18, ['_GUID']], + 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x40, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x170, ['pointer64', ['_ETW_FILTER_HEADER']]], + 'SiloState' : [ 0x178, ['pointer64', ['_ETW_SILODRIVERSTATE']]], + 'Lock' : [ 0x180, ['_EX_PUSH_LOCK']], + 'LockOwner' : [ 0x188, ['pointer64', ['_ETHREAD']]], +} ], + '_ARBITER_INSTANCE' : [ 0x150, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], + 'Name' : [ 0x10, ['pointer64', ['wchar']]], + 'OrderingName' : [ 0x18, ['pointer64', ['wchar']]], + 'ResourceType' : [ 0x20, ['long']], + 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x58, ['long']], + 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], + 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], + 'PackResource' : [ 0x80, ['pointer64', ['void']]], + 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], + 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], + 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], + 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], + 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], + 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], + 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], + 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], + 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], + 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], + 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], + 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], + 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], + 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], + 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], + 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], + 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], + 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], + 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], + 'TransactionInProgress' : [ 0x120, ['unsigned char']], + 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], + 'Extension' : [ 0x130, ['pointer64', ['void']]], + 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], + 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0x10, ['pointer64', ['void']]], + 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], + 'ServerIsRemote' : [ 0x1a, ['unsigned char']], + 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], +} ], + '_VF_POOL_TRACE' : [ 0x80, { + 'Address' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '_MI_SYSTEM_IMAGE_STATE' : [ 0xc0, { + 'FixupLock' : [ 0x0, ['long']], + 'FixupList' : [ 0x8, ['_LIST_ENTRY']], + 'LoadLock' : [ 0x18, ['_KMUTANT']], + 'FirstLoadEver' : [ 0x50, ['unsigned char']], + 'LargePageAll' : [ 0x51, ['unsigned char']], + 'LastPage' : [ 0x58, ['unsigned long long']], + 'LargePageList' : [ 0x60, ['_LIST_ENTRY']], + 'StrongCodeLoadFailureList' : [ 0x70, ['_LIST_ENTRY']], + 'BeingDeleted' : [ 0x80, ['pointer64', ['_KLDR_DATA_TABLE_ENTRY']]], + 'MappingRangesPushLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'MappingRanges' : [ 0x90, ['array', 2, ['pointer64', ['_MI_DRIVER_VA']]]], + 'PageCount' : [ 0xa0, ['unsigned long long']], + 'PageCounts' : [ 0xa8, ['_MM_SYSTEM_PAGE_COUNTS']], + 'CollidedLock' : [ 0xb8, ['_EX_PUSH_LOCK']], +} ], + '_MMPFNENTRY1' : [ 0x1, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_FAULT_TRACE' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_MI_FLAGS' : [ 0x4, { + 'EntireFlags' : [ 0x0, ['long']], + 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'FullHvci' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SlatKernelCodeProtected' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'BootDebuggerActive' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x54, ['unsigned long']], + 'ProfileChangingEject' : [ 0x58, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], + 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x68, ['unsigned char']], + 'DeleteType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_DEFERRED_WRITE' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x10, ['unsigned long']], + 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Context1' : [ 0x38, ['pointer64', ['void']]], + 'Context2' : [ 0x40, ['pointer64', ['void']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x48, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x10, ['unsigned long']], + 'SyncCallback' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ZeroMapRegisters' : [ 0x14, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x14, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], + 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], + 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], + 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], + 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'HiberFileType' : [ 0x16, ['unsigned char']], + 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], + 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_EX_WORK_QUEUE' : [ 0x2d0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x2b0, ['pointer64', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x2b8, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x2bc, ['unsigned long']], + 'ThreadCount' : [ 0x2c0, ['long']], + 'MinThreads' : [ 0x2c4, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x2c4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x2c8, ['long']], + 'QueueIndex' : [ 0x2cc, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'IoPoolUntrusted', 2: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_KWAIT_CHAIN' : [ 0x8, { + 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'ActiveCount' : [ 0xc, ['unsigned long']], + 'PendingNullCount' : [ 0x10, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], + 'PendingDelete' : [ 0x18, ['unsigned long']], + 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], + 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_VF_DRIVER_IO_CALLBACKS' : [ 0x100, { + 'DriverInit' : [ 0x0, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x8, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x10, ['pointer64', ['void']]], + 'AddDevice' : [ 0x18, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x20, ['array', 28, ['pointer64', ['void']]]], +} ], + '_CM_UOW_SET_VALUE_KEY_DATA' : [ 0x10, { + 'PreparedCell' : [ 0x0, ['unsigned long']], + 'OldValueCell' : [ 0x4, ['unsigned long']], + 'NameLength' : [ 0x8, ['unsigned short']], + 'DataSize' : [ 0xc, ['unsigned long']], +} ], + '_MI_PARTITION_STATE' : [ 0x60, { + 'PartitionLock' : [ 0x0, ['unsigned long long']], + 'PartitionIdLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'InitialPartitionIdBits' : [ 0x10, ['unsigned long long']], + 'PartitionList' : [ 0x18, ['_LIST_ENTRY']], + 'PartitionIdBitmap' : [ 0x28, ['pointer64', ['_RTL_BITMAP']]], + 'InitialPartitionIdBitmap' : [ 0x30, ['_RTL_BITMAP']], + 'TempPartitionPointers' : [ 0x40, ['array', 1, ['pointer64', ['_MI_PARTITION']]]], + 'Partition' : [ 0x48, ['pointer64', ['pointer64', ['_MI_PARTITION']]]], + 'TotalPagesInChildPartitions' : [ 0x50, ['unsigned long long']], + 'CrossPartitionDenials' : [ 0x58, ['unsigned long']], +} ], + '_POP_THERMAL_ZONE' : [ 0x358, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], + 'State' : [ 0x40, ['unsigned char']], + 'Flags' : [ 0x41, ['unsigned char']], + 'Removing' : [ 0x42, ['unsigned char']], + 'Mode' : [ 0x43, ['unsigned char']], + 'PendingMode' : [ 0x44, ['unsigned char']], + 'ActivePoint' : [ 0x45, ['unsigned char']], + 'PendingActivePoint' : [ 0x46, ['unsigned char']], + 'Critical' : [ 0x47, ['unsigned char']], + 'ThermalStandby' : [ 0x48, ['unsigned char']], + 'OverThrottled' : [ 0x49, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x4c, ['long']], + 'Throttle' : [ 0x50, ['long']], + 'PendingThrottle' : [ 0x54, ['long']], + 'ThrottleReasons' : [ 0x58, ['unsigned long']], + 'LastTime' : [ 0x60, ['unsigned long long']], + 'SampleRate' : [ 0x68, ['unsigned long']], + 'LastTemp' : [ 0x6c, ['unsigned long']], + 'PassiveTimer' : [ 0x70, ['_KTIMER']], + 'PassiveDpc' : [ 0xb0, ['_KDPC']], + 'Info' : [ 0xf0, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0x148, ['_LARGE_INTEGER']], + 'Policy' : [ 0x150, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x168, ['unsigned char']], + 'LastActiveStartTime' : [ 0x170, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x178, ['unsigned long long']], + 'WorkItem' : [ 0x180, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x1a0, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x1b0, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x1c8, ['_KEVENT']], + 'InstanceId' : [ 0x1e0, ['unsigned long']], + 'TelemetryTracker' : [ 0x1e8, ['_POP_THERMAL_TELEMETRY_TRACKER']], + 'Description' : [ 0x348, ['_UNICODE_STRING']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_BUS_EXTENSION_LIST' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_MMPFNENTRY3' : [ 0x1, { + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SystemChargedPage' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x20, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x8, ['long long']], + 'SidCount' : [ 0x10, ['unsigned long']], + 'SidValuesStart' : [ 0x18, ['unsigned long long']], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x8, { + 'Function' : [ 0x0, ['pointer64', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_2278' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_227a' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_2278']], + 'Private' : [ 0x0, ['__unnamed_227a']], +} ], + '_CM_TRANS_PTR' : [ 0x8, { + 'LightWeight' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'TransPtr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { + 'Version' : [ 0x0, ['unsigned char']], + 'DataCount' : [ 0x1, ['unsigned char']], + 'SemanticType' : [ 0x2, ['unsigned char']], + 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], + 'AttributeType' : [ 0x0, ['unsigned long']], +} ], + '_CM_KEY_HASH' : [ 0x20, { + 'ConvKey' : [ 0x0, ['_CM_PATH_HASH']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], +} ], + '_FAST_IO_DISPATCH' : [ 0xe0, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], + 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], + 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], + 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], + 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], + 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], + 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], + 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], + 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], + 'MdlRead' : [ 0x80, ['pointer64', ['void']]], + 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], + 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], + 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], + 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], + 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], + 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], + 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], + 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], + 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], + 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_KGATE' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_PS_IO_CONTROL_ENTRY' : [ 0x38, { + 'VolumeTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ReservedForParentValue' : [ 0x10, ['unsigned long long']], + 'VolumeKey' : [ 0x18, ['unsigned long long']], + 'Rundown' : [ 0x20, ['_EX_RUNDOWN_REF']], + 'IoControl' : [ 0x28, ['pointer64', ['void']]], + 'VolumeIoAttribution' : [ 0x30, ['pointer64', ['void']]], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_CM_UOW_SET_VALUE_LIST_DATA' : [ 0xc, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x4, ['_CHILD_LIST']], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x10, { + 'Port' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['pointer64', ['void']]], +} ], + '_VF_TRACKER_STAMP' : [ 0x10, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x8, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x8, ['unsigned long long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'PagesAllocated' : [ 0x48, ['unsigned long long']], + 'BigPagesAllocated' : [ 0x50, ['unsigned long long']], + 'BytesAllocated' : [ 0x58, ['unsigned long long']], + 'RunningDeallocs' : [ 0x80, ['long']], + 'PagesDeallocated' : [ 0x88, ['unsigned long long']], + 'BigPagesDeallocated' : [ 0x90, ['unsigned long long']], + 'BytesDeallocated' : [ 0x98, ['unsigned long long']], + 'PoolIndex' : [ 0xc0, ['unsigned long']], + 'PoolTypeCopy' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'ThreadsProcessingDeferrals' : [ 0x108, ['long']], + 'PendingFreeDepth' : [ 0x10c, ['long']], + 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x28, ['unsigned long']], + 'PagingCount' : [ 0x2c, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '__unnamed_22ec' : [ 0x4, { + 'PercentLevel' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_22ee' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0x10, ['__unnamed_22ec']], + 'Button' : [ 0x10, ['__unnamed_22ee']], +} ], + '_RTL_ATOM_TABLE' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0x10, ['pointer64', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'NumberOfBuckets' : [ 0x1c, ['unsigned long']], + 'Buckets' : [ 0x20, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_KTIMER2' : [ 0x88, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'RbNodes' : [ 0x18, ['array', 2, ['_RTL_BALANCED_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'DueTime' : [ 0x48, ['array', 2, ['unsigned long long']]], + 'Period' : [ 0x58, ['long long']], + 'Callback' : [ 0x60, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x68, ['pointer64', ['void']]], + 'DisableCallback' : [ 0x70, ['pointer64', ['void']]], + 'DisableContext' : [ 0x78, ['pointer64', ['void']]], + 'AbsoluteSystemTime' : [ 0x80, ['unsigned char']], + 'TypeFlags' : [ 0x81, ['unsigned char']], + 'Unused' : [ 0x81, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IdleResilient' : [ 0x81, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HighResolution' : [ 0x81, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'NoWake' : [ 0x81, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Unused1' : [ 0x81, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CollectionIndex' : [ 0x82, ['array', 2, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x20, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], +} ], + '_MI_SESSION_STATE' : [ 0xa0, { + 'SystemSession' : [ 0x0, ['_MMSESSION']], + 'CodePageEdited' : [ 0x20, ['unsigned char']], + 'DynamicPoolBitBuffer' : [ 0x28, ['pointer64', ['unsigned long']]], + 'DynamicVaBitBuffer' : [ 0x30, ['pointer64', ['unsigned long']]], + 'DynamicVaBitBufferPages' : [ 0x38, ['unsigned long long']], + 'DynamicVaStart' : [ 0x40, ['pointer64', ['void']]], + 'ImageVaStart' : [ 0x48, ['pointer64', ['void']]], + 'DynamicPtesBitBuffer' : [ 0x50, ['pointer64', ['unsigned long']]], + 'IdLock' : [ 0x58, ['_EX_PUSH_LOCK']], + 'DetachTimeStamp' : [ 0x60, ['unsigned long']], + 'LeaderProcess' : [ 0x68, ['pointer64', ['_EPROCESS']]], + 'InitializeLock' : [ 0x70, ['_EX_PUSH_LOCK']], + 'WorkingSetList' : [ 0x78, ['pointer64', ['_MMWSL_FULL']]], + 'WsHashStart' : [ 0x80, ['pointer64', ['_MMWSLE_HASH']]], + 'WsHashEnd' : [ 0x88, ['pointer64', ['_MMWSLE_HASH']]], + 'SessionBase' : [ 0x90, ['pointer64', ['void']]], + 'SessionCore' : [ 0x98, ['pointer64', ['void']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x330, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'ControlFlags' : [ 0x14, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], + 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], + 'AlignedFeatures' : [ 0x220, ['unsigned long long']], + 'AllFeatureSize' : [ 0x228, ['unsigned long']], + 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'AccessMask' : [ 0x20, ['unsigned long']], +} ], + '_MI_SECTION_STATE' : [ 0x280, { + 'SectionObjectPointersLock' : [ 0x0, ['long']], + 'SectionExtendLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'SectionExtendSetLock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'SectionBasedRoot' : [ 0x18, ['_RTL_AVL_TREE']], + 'SectionBasedLock' : [ 0x20, ['_EX_PUSH_LOCK']], + 'UnusedSubsectionPagedPool' : [ 0x28, ['unsigned long long']], + 'UnusedSegmentForceFree' : [ 0x30, ['unsigned long']], + 'DataSectionProtectionMask' : [ 0x34, ['unsigned long']], + 'HighSectionBase' : [ 0x38, ['pointer64', ['void']]], + 'PhysicalSubsection' : [ 0x40, ['_MSUBSECTION']], + 'PhysicalControlArea' : [ 0xb0, ['_CONTROL_AREA']], + 'DanglingExtentsPages' : [ 0x130, ['pointer64', ['_MMPFN']]], + 'DanglingExtentsLock' : [ 0x138, ['long']], + 'DanglingExtentsWorkItem' : [ 0x140, ['_WORK_QUEUE_ITEM']], + 'DanglingExtentsWorkerActive' : [ 0x160, ['unsigned char']], + 'PageFileSectionHead' : [ 0x168, ['_RTL_AVL_TREE']], + 'PageFileSectionListSpinLock' : [ 0x170, ['long']], + 'SharedSegmentCharges' : [ 0x178, ['_MI_CROSS_PARTITION_CHARGES']], + 'SharedPageCombineCharges' : [ 0x1a0, ['_MI_CROSS_PARTITION_CHARGES']], + 'ImageBias' : [ 0x1c8, ['unsigned long']], + 'RelocateBitmapsLock' : [ 0x1d0, ['_EX_PUSH_LOCK']], + 'ImageBitMap' : [ 0x1d8, ['_RTL_BITMAP']], + 'ImageBias64Low' : [ 0x1e8, ['unsigned long']], + 'ImageBias64High' : [ 0x1ec, ['unsigned long']], + 'ImageBitMap64Low' : [ 0x1f0, ['_RTL_BITMAP']], + 'ImageBitMap64High' : [ 0x200, ['_RTL_BITMAP']], + 'ImageBitMapWow64Dll' : [ 0x210, ['_RTL_BITMAP']], + 'ApiSetSection' : [ 0x220, ['pointer64', ['void']]], + 'ApiSetSchema' : [ 0x228, ['pointer64', ['void']]], + 'ApiSetSchemaSize' : [ 0x230, ['unsigned long long']], + 'LostDataFiles' : [ 0x238, ['unsigned long']], + 'LostDataPages' : [ 0x23c, ['unsigned long']], + 'ImageFailureReason' : [ 0x240, ['unsigned long']], + 'CfgBitMapSection32' : [ 0x248, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea32' : [ 0x250, ['pointer64', ['_CONTROL_AREA']]], + 'CfgBitMapSection64' : [ 0x258, ['pointer64', ['_SECTION']]], + 'CfgBitMapControlArea64' : [ 0x260, ['pointer64', ['_CONTROL_AREA']]], + 'ImageCfgFailure' : [ 0x268, ['unsigned long']], + 'ImageValidationFailed' : [ 0x26c, ['long']], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x30, { + 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x8, ['unsigned short']], + 'Atom' : [ 0xa, ['unsigned short']], + 'Reference' : [ 0x10, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x28, ['unsigned char']], + 'Name' : [ 0x2a, ['array', 1, ['wchar']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_UOW_KEY_STATE_MODIFICATION' : [ 0x14, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'SubKeyListCount' : [ 0x4, ['array', 2, ['unsigned long']]], + 'NewSubKeyList' : [ 0xc, ['array', 2, ['unsigned long']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'WaitResponse' : [ 0xc, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x28, { + 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x8, ['long']], + 'RecursionCount' : [ 0xc, ['long']], + 'OwningThread' : [ 0x10, ['pointer64', ['void']]], + 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], + 'SpinCount' : [ 0x20, ['unsigned long long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x10, ['unsigned char']], + 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], + 'State' : [ 0x68, ['unsigned char']], + 'ResourcesChanged' : [ 0x69, ['unsigned char']], +} ], + '_ETW_FILTER_HEADER' : [ 0x50, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x8, ['pointer64', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x10, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0x18, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x20, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x28, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x30, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x38, ['pointer64', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x40, ['pointer64', ['_EVENT_FILTER_HEADER']]], + 'EventNameFilter' : [ 0x48, ['pointer64', ['_ETW_FILTER_EVENT_NAME_DATA']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 24, native_type='unsigned long long')]], + 'LocalPartition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0xb0, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long long']], + 'NonPagedBytes' : [ 0x58, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], + 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], + 'SessionTrims' : [ 0x74, ['unsigned long']], + 'OptionChanges' : [ 0x78, ['unsigned long']], + 'VerifyMode' : [ 0x7c, ['unsigned long']], + 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], + 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], + 'ExecutePageProtections' : [ 0x94, ['unsigned long']], + 'ExecutePageMappings' : [ 0x98, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], + 'UnsupportedRelocs' : [ 0xa4, ['unsigned long']], + 'IATInExecutableSection' : [ 0xa8, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PEB' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'IsLongPathAwareProcess' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['pointer64', ['void']]], + 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], + 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], + 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['_SLIST_HEADER']]], + 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], + 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], + 'SparePvoid0' : [ 0x90, ['pointer64', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], + 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], + 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], + 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], + 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], + 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], + 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], + 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], + 'pUnused' : [ 0x368, ['pointer64', ['void']]], + 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['_LIST_ENTRY']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['pointer64', ['void']]]], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x10, ['unsigned long']], + 'Unloads' : [ 0x14, ['unsigned long']], + 'BaseName' : [ 0x18, ['_UNICODE_STRING']], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x20, { + 'IssueType' : [ 0x0, ['unsigned long long']], + 'Address' : [ 0x8, ['pointer64', ['void']]], + 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], +} ], + '_KDEVICE_QUEUE' : [ 0x28, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x18, ['unsigned long long']], + 'Busy' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], +} ], + '__unnamed_2366' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHigh' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_236b' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_KGDTENTRY64' : [ 0x10, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'Bytes' : [ 0x4, ['__unnamed_2366']], + 'Bits' : [ 0x4, ['__unnamed_236b']], + 'BaseUpper' : [ 0x8, ['unsigned long']], + 'MustBeZero' : [ 0xc, ['unsigned long']], + 'DataLow' : [ 0x0, ['long long']], + 'DataHigh' : [ 0x8, ['long long']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x50, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x30, ['unsigned long']], + 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x40, ['unsigned short']], + 'RangeAttributes' : [ 0x42, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], + 'WorkSpace' : [ 0x48, ['unsigned long long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x10, { + 'BasePage' : [ 0x0, ['unsigned long long']], + 'PageCount' : [ 0x8, ['unsigned long long']], +} ], + '_MI_SUB64K_FREE_RANGES' : [ 0x30, { + 'BitMap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Vad' : [ 0x20, ['pointer64', ['_MMVAD_SHORT']]], + 'SubListIndex' : [ 0x28, ['unsigned short']], + 'Hint' : [ 0x2a, ['unsigned short']], + 'SetBits' : [ 0x2c, ['unsigned long']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_SEP_SILOSTATE' : [ 0x20, { + 'SystemLogonSession' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'AnonymousLogonSession' : [ 0x8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'AnonymousLogonToken' : [ 0x10, ['pointer64', ['void']]], + 'AnonymousLogonTokenNoEveryone' : [ 0x18, ['pointer64', ['void']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'HandleCount' : [ 0x28, ['unsigned long']], + 'Handles' : [ 0x30, ['pointer64', ['pointer64', ['void']]]], +} ], + '__unnamed_2385' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2388' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0x1b0, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Event' : [ 0x20, ['_KEVENT']], + 'CollidedEvent' : [ 0x38, ['_KEVENT']], + 'IoStatus' : [ 0x50, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x60, ['_LARGE_INTEGER']], + 'ApcState' : [ 0x68, ['_KAPC_STATE']], + 'Thread' : [ 0x98, ['pointer64', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0xa0, ['pointer64', ['_MMPFN']]], + 'PteContents' : [ 0xa8, ['_MMPTE']], + 'WaitCount' : [ 0xb0, ['long']], + 'ByteCount' : [ 0xb4, ['unsigned long']], + 'u3' : [ 0xb8, ['__unnamed_2385']], + 'u1' : [ 0xbc, ['__unnamed_2388']], + 'FilePointer' : [ 0xc0, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xc8, ['pointer64', ['_CONTROL_AREA']]], + 'Subsection' : [ 0xc8, ['pointer64', ['_SUBSECTION']]], + 'Autoboost' : [ 0xd0, ['pointer64', ['void']]], + 'FaultingAddress' : [ 0xd8, ['pointer64', ['void']]], + 'PointerPte' : [ 0xe0, ['pointer64', ['_MMPTE']]], + 'BasePte' : [ 0xe8, ['pointer64', ['_MMPTE']]], + 'Pfn' : [ 0xf0, ['pointer64', ['_MMPFN']]], + 'PrefetchMdl' : [ 0xf8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0x100, ['_MDL']], + 'Page' : [ 0x130, ['array', 16, ['unsigned long long']]], + 'FlowThrough' : [ 0x130, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_CMP_DISCARD_AND_REPLACE_KCB_CONTEXT' : [ 0x20, { + 'BaseKcb' : [ 0x0, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'PrepareStatus' : [ 0x8, ['long']], + 'ClonedKcbListHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], + 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], + 'RequestArgument' : [ 0x20, ['unsigned long long']], + 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], + 'ActivityId' : [ 0x38, ['_GUID']], +} ], + '_PPM_PLATFORM_STATE' : [ 0x180, { + 'Latency' : [ 0x0, ['unsigned long']], + 'BreakEvenDuration' : [ 0x4, ['unsigned long']], + 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], + 'TransitionDebugger' : [ 0x30, ['unsigned char']], + 'Platform' : [ 0x31, ['unsigned char']], + 'DependencyListCount' : [ 0x34, ['unsigned long']], + 'Processors' : [ 0x38, ['_KAFFINITY_EX']], + 'Name' : [ 0xe0, ['_UNICODE_STRING']], + 'DependencyLists' : [ 0xf0, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], + 'Synchronization' : [ 0xf8, ['_PPM_COORDINATED_SYNCHRONIZATION']], + 'EnterTime' : [ 0x100, ['unsigned long long']], + 'RefCount' : [ 0x140, ['long']], + 'CacheAlign0' : [ 0x140, ['array', 64, ['unsigned char']]], +} ], + '_PEB_LDR_DATA' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer64', ['void']]], + 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], + 'ShutdownInProgress' : [ 0x48, ['unsigned char']], + 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_KAPC' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], + 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], + 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Reserved' : [ 0x20, ['array', 3, ['pointer64', ['void']]]], + 'NormalContext' : [ 0x38, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], + 'ApcStateIndex' : [ 0x50, ['unsigned char']], + 'ApcMode' : [ 0x51, ['unsigned char']], + 'Inserted' : [ 0x52, ['unsigned char']], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'LowboxNumber' : [ 0x28, ['unsigned long']], + 'AtomTable' : [ 0x30, ['pointer64', ['void']]], +} ], + '_PPM_SELECTION_MENU' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Entries' : [ 0x8, ['pointer64', ['_PPM_SELECTION_MENU_ENTRY']]], +} ], + '_MI_PARTITION' : [ 0x2780, { + 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], + 'Modwriter' : [ 0x160, ['_MI_PARTITION_MODWRITES']], + 'Store' : [ 0x430, ['_MI_PARTITION_STORES']], + 'Segments' : [ 0x4c0, ['_MI_PARTITION_SEGMENTS']], + 'PageLists' : [ 0x640, ['_MI_PARTITION_PAGE_LISTS']], + 'Commit' : [ 0x1180, ['_MI_PARTITION_COMMIT']], + 'Zeroing' : [ 0x1200, ['_MI_PARTITION_ZEROING']], + 'PageCombine' : [ 0x1260, ['_MI_PAGE_COMBINING_SUPPORT']], + 'WorkingSetControl' : [ 0x13e8, ['pointer64', ['void']]], + 'WorkingSetExpansionHead' : [ 0x13f0, ['_MMWORKING_SET_EXPANSION_HEAD']], + 'Vp' : [ 0x1400, ['_MI_VISIBLE_PARTITION']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_KIDTENTRY64' : [ 0x10, { + 'OffsetLow' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'OffsetMiddle' : [ 0x6, ['unsigned short']], + 'OffsetHigh' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_IO_WORKITEM' : [ 0x58, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x20, ['pointer64', ['void']]], + 'IoObject' : [ 0x28, ['pointer64', ['void']]], + 'Context' : [ 0x30, ['pointer64', ['void']]], + 'WorkOnBehalfThread' : [ 0x38, ['pointer64', ['_ETHREAD']]], + 'Type' : [ 0x40, ['unsigned long']], + 'ActivityId' : [ 0x44, ['_GUID']], +} ], + '_DISALLOWED_GUIDS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_PI_BUS_EXTENSION' : [ 0x70, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], + 'DataPortMapped' : [ 0x10, ['unsigned char']], + 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], + 'AddrPortMapped' : [ 0x20, ['unsigned char']], + 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], + 'CmdPortMapped' : [ 0x30, ['unsigned char']], + 'NextSlotNumber' : [ 0x34, ['unsigned long']], + 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x60, ['unsigned long']], + 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_CMHIVE' : [ 0x17a8, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0xa68, ['array', 6, ['pointer64', ['void']]]], + 'NotifyList' : [ 0xa98, ['_LIST_ENTRY']], + 'HiveList' : [ 0xaa8, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0xab8, ['_LIST_ENTRY']], + 'FailedUnloadList' : [ 0xac8, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0xad8, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0xae0, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0xaf0, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0xaf8, ['unsigned long']], + 'DeletedKcbTable' : [ 0xb00, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0xb08, ['unsigned long']], + 'Identity' : [ 0xb0c, ['unsigned long']], + 'HiveLock' : [ 0xb10, ['pointer64', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0xb18, ['pointer64', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0xb20, ['pointer64', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0xb28, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0xb38, ['unsigned long']], + 'FlushLogEntry' : [ 0xb40, ['pointer64', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0xb48, ['unsigned long']], + 'FlushHiveTruncated' : [ 0xb4c, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0xb50, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0xb58, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0xb68, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0xb70, ['pointer64', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0xb78, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0xb80, ['pointer64', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0xb88, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0xb90, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0xb94, ['unsigned long']], + 'ActualFileSize' : [ 0xb98, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0xba0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0xbb0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0xbc0, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0xbd0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0xbe0, ['unsigned long']], + 'SecurityCacheSize' : [ 0xbe4, ['unsigned long']], + 'SecurityHitHint' : [ 0xbe8, ['long']], + 'SecurityCache' : [ 0xbf0, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0xbf8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0xff8, ['unsigned long']], + 'UnloadEventArray' : [ 0x1000, ['pointer64', ['pointer64', ['_KEVENT']]]], + 'RootKcb' : [ 0x1008, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x1010, ['unsigned char']], + 'UnloadWorkItem' : [ 0x1018, ['pointer64', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x1020, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0x1048, ['unsigned char']], + 'GrowOffset' : [ 0x104c, ['unsigned long']], + 'KcbConvertListHead' : [ 0x1050, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0x1060, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0x1068, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0x14f0, ['unsigned long']], + 'TrustClassEntry' : [ 0x14f8, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0x1508, ['unsigned long long']], + 'UnreconciledTime' : [ 0x1510, ['unsigned long long']], + 'CmRm' : [ 0x1518, ['pointer64', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0x1520, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0x1524, ['long']], + 'CreatorOwner' : [ 0x1528, ['pointer64', ['_KTHREAD']]], + 'RundownThread' : [ 0x1530, ['pointer64', ['_KTHREAD']]], + 'LastWriteTime' : [ 0x1538, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0x1540, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0x1558, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0x1570, ['unsigned long']], + 'FlushActive' : [ 0x1570, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0x1570, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0x1570, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0x1570, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0x1574, ['unsigned long']], + 'ReferenceCount' : [ 0x1578, ['long']], + 'UnloadHistoryIndex' : [ 0x157c, ['long']], + 'UnloadHistory' : [ 0x1580, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0x1780, ['unsigned long']], + 'UnaccessedStart' : [ 0x1784, ['unsigned long']], + 'UnaccessedEnd' : [ 0x1788, ['unsigned long']], + 'LoadedKeyCount' : [ 0x178c, ['unsigned long']], + 'HandleClosePending' : [ 0x1790, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0x1798, ['_EX_PUSH_LOCK']], + 'FinalFlushSucceeded' : [ 0x17a0, ['unsigned char']], + 'FailedUnload' : [ 0x17a1, ['unsigned char']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_KPROCESSOR_STATE' : [ 0x5b0, { + 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], + 'ContextFrame' : [ 0xe0, ['_CONTEXT']], +} ], + '_KAPC_STATE' : [ 0x30, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x28, ['unsigned char']], + 'KernelApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x29, ['unsigned char']], + 'UserApcPending' : [ 0x2a, ['unsigned char']], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x10, ['unsigned long']], + 'Inserted' : [ 0x14, ['unsigned char']], +} ], + '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { + 'AsULong' : [ 0x0, ['unsigned long']], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0x18, { + 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], + 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], +} ], + '_MI_PARTITION_PAGE_LISTS' : [ 0xb40, { + 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer64', ['_MMPFNLIST']]]], + 'FreePageSlist' : [ 0x10, ['array', 2, ['pointer64', ['_SLIST_HEADER']]]], + 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], + 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], + 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], + 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], + 'ModifiedPageListNoReservation' : [ 0x240, ['_MMPFNLIST']], + 'ModifiedPageListByReservation' : [ 0x280, ['array', 16, ['_MMPFNLIST']]], + 'MappedPageListHead' : [ 0x500, ['array', 16, ['_MMPFNLIST']]], + 'BadPageListHead' : [ 0x780, ['_MMPFNLIST']], + 'EnclavePageListHead' : [ 0x7c0, ['_MMPFNLIST']], + 'PageLocationList' : [ 0x7e8, ['array', 8, ['pointer64', ['_MMPFNLIST']]]], + 'StandbyRepurposedByPriority' : [ 0x828, ['array', 8, ['unsigned long']]], + 'MappedPageListHeadEvent' : [ 0x848, ['array', 16, ['_KEVENT']]], + 'DecayClusterTimerHeads' : [ 0x9c8, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], + 'DecayHand' : [ 0x9e8, ['unsigned long']], + 'LastDecayHandUpdateTime' : [ 0x9f0, ['unsigned long long']], + 'LastChanceLdwContext' : [ 0x9f8, ['_MI_LDW_WORK_CONTEXT']], + 'AvailableEventsLock' : [ 0xa40, ['unsigned long long']], + 'AvailablePageWaitStates' : [ 0xa48, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], + 'LowMemoryThreshold' : [ 0xaa8, ['unsigned long long']], + 'HighMemoryThreshold' : [ 0xab0, ['unsigned long long']], + 'TransitionPrivatePages' : [ 0xac0, ['unsigned long long']], + 'StandbyListDiscard' : [ 0xac8, ['unsigned long']], + 'FreeListDiscard' : [ 0xacc, ['unsigned char']], + 'MirrorListLocks' : [ 0xad0, ['pointer64', ['void']]], + 'LargePfnBitMapsReady' : [ 0xad8, ['unsigned char']], + 'LargePfnBitMap' : [ 0xae0, ['array', 2, ['_RTL_BITMAP_EX']]], + 'LargePfnBitMapLock' : [ 0xb00, ['unsigned long long']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '__unnamed_2436' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2438' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_243a' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_2436']], + 'Interrupt' : [ 0x0, ['__unnamed_2438']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_2438']], + 'Sci' : [ 0x0, ['__unnamed_2438']], + 'Nmi' : [ 0x0, ['__unnamed_2438']], + 'Sea' : [ 0x0, ['__unnamed_2438']], + 'Sei' : [ 0x0, ['__unnamed_2438']], + 'Gsiv' : [ 0x0, ['__unnamed_2438']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_243a']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], + 'MinimumThrottle' : [ 0x50, ['unsigned long']], + 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x8, { + 'LogHandleContext' : [ 0x0, ['pointer64', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_KPRIQUEUE' : [ 0x2b0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x218, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x298, ['unsigned long']], + 'ThreadListHead' : [ 0x2a0, ['_LIST_ENTRY']], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x38, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x18, ['unsigned long']], + 'RealRefCount' : [ 0x1c, ['unsigned long']], + 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_KSCB' : [ 0x1a8, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], + 'RankCycleTarget' : [ 0x18, ['unsigned long long']], + 'LongTermCycles' : [ 0x20, ['unsigned long long']], + 'LastReportedCycles' : [ 0x28, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], + 'ReadyTime' : [ 0x38, ['unsigned long long']], + 'InsertTime' : [ 0x40, ['unsigned long long']], + 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x58, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x70, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'MaxOverQuota' : [ 0x70, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'MinOverQuota' : [ 0x70, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x70, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SoftCap' : [ 0x70, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ShareRankOwner' : [ 0x70, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x70, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Depth' : [ 0x71, ['unsigned char']], + 'ReadySummary' : [ 0x72, ['unsigned short']], + 'Rank' : [ 0x74, ['unsigned long']], + 'ShareRank' : [ 0x78, ['pointer64', ['unsigned long']]], + 'OwnerShareRank' : [ 0x80, ['unsigned long']], + 'ReadyListHead' : [ 0x88, ['array', 16, ['_LIST_ENTRY']]], + 'ChildScbQueue' : [ 0x188, ['_RTL_RB_TREE']], + 'Parent' : [ 0x198, ['pointer64', ['_KSCB']]], + 'Root' : [ 0x1a0, ['pointer64', ['_KSCB']]], +} ], + '__unnamed_2458' : [ 0x2, { + 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'EntireField' : [ 0x0, ['unsigned short']], +} ], + '_KLDR_DATA_TABLE_ENTRY' : [ 0xa0, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'ExceptionTable' : [ 0x10, ['pointer64', ['void']]], + 'ExceptionTableSize' : [ 0x18, ['unsigned long']], + 'GpValue' : [ 0x20, ['pointer64', ['void']]], + 'NonPagedDebugInfo' : [ 0x28, ['pointer64', ['_NON_PAGED_DEBUG_INFO']]], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'Flags' : [ 0x68, ['unsigned long']], + 'LoadCount' : [ 0x6c, ['unsigned short']], + 'u1' : [ 0x6e, ['__unnamed_2458']], + 'SectionPointer' : [ 0x70, ['pointer64', ['void']]], + 'CheckSum' : [ 0x78, ['unsigned long']], + 'CoverageSectionSize' : [ 0x7c, ['unsigned long']], + 'CoverageSection' : [ 0x80, ['pointer64', ['void']]], + 'LoadedImports' : [ 0x88, ['pointer64', ['void']]], + 'Spare' : [ 0x90, ['pointer64', ['void']]], + 'SizeOfImageNotRounded' : [ 0x98, ['unsigned long']], + 'TimeDateStamp' : [ 0x9c, ['unsigned long']], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { + 'ExpansionLock' : [ 0x0, ['unsigned long long']], + 'TrimInProgressCount' : [ 0x8, ['long']], + 'PeriodicWorkingSetEvent' : [ 0x10, ['_KEVENT']], + 'TrimAllPageFaultCount' : [ 0x28, ['array', 3, ['unsigned long']]], +} ], + '_KMUTANT' : [ 0x38, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], + 'Abandoned' : [ 0x30, ['unsigned char']], + 'ApcDisable' : [ 0x31, ['unsigned char']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x8, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { + 'SystemCodePage' : [ 0x0, ['unsigned long']], + 'SystemDriverPage' : [ 0x4, ['unsigned long']], + 'TotalSystemCodePages' : [ 0x8, ['long']], + 'TotalSystemDriverPages' : [ 0xc, ['long']], +} ], + '_KENLISTMENT' : [ 0x1e0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x30, ['_GUID']], + 'Mutex' : [ 0x40, ['_KMUTANT']], + 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], + 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0xac, ['unsigned long']], + 'NotificationMask' : [ 0xb0, ['unsigned long']], + 'Key' : [ 0xb8, ['pointer64', ['void']]], + 'KeyRefCount' : [ 0xc0, ['unsigned long']], + 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], + 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], + 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], + 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], + 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], + 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], + 'NextHistory' : [ 0x138, ['unsigned long']], + 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_THERMAL_POLICY' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ThermalStandby' : [ 0x7, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], + 'OverThrottled' : [ 0x14, ['unsigned char']], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_MI_ACCESS_LOG_STATE' : [ 0x80, { + 'CcAccessLog' : [ 0x0, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'Enabled' : [ 0x8, ['unsigned long']], + 'DisableAccessLogging' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'MinLoggingPriority' : [ 0x30, ['unsigned long']], + 'AccessLoggingLock' : [ 0x40, ['unsigned long long']], +} ], + '_HMAP_TABLE' : [ 0x5000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '__unnamed_248a' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_248c' : [ 0x20, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_248a']], +} ], + '_VF_TARGET_DRIVER' : [ 0x40, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE_EX']], + 'u1' : [ 0x18, ['__unnamed_248c']], + 'VerifiedData' : [ 0x38, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x18, { + 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x10, ['unsigned long']], + 'FullCreateOptions' : [ 0x14, ['unsigned long']], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x28, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x10, ['pointer64', ['void']]], + 'SessionViewVa' : [ 0x10, ['pointer64', ['void']]], + 'VadsProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'Type' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionType' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SectionOffset' : [ 0x20, ['unsigned long long']], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0x18, { + 'ActiveThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'WaitList' : [ 0x8, ['pointer64', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x10, ['unsigned long']], +} ], + '_MI_SYSTEM_PTE_STATE' : [ 0x1c0, { + 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'PteTrackerLock' : [ 0x10, ['unsigned long long']], + 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], + 'PteTrackingBitmap' : [ 0xc0, ['_RTL_BITMAP_EX']], + 'CachedPteHeads' : [ 0xd0, ['pointer64', ['_MI_CACHED_PTES']]], + 'SystemViewPteInfo' : [ 0xd8, ['_MI_SYSTEM_PTE_TYPE']], + 'KernelStackPages' : [ 0x140, ['unsigned char']], + 'QueuedStacks' : [ 0x150, ['_SLIST_HEADER']], + 'StackGrowthFailures' : [ 0x160, ['unsigned long']], + 'TrackPtesAborted' : [ 0x164, ['unsigned char']], + 'AdjustCounter' : [ 0x165, ['unsigned char']], + 'ReservedMappingLock' : [ 0x168, ['long']], + 'ReservedMappingTree' : [ 0x170, ['_RTL_AVL_TREE']], + 'ReservedMappingPageTablePfns' : [ 0x178, ['pointer64', ['_MMPFN']]], + 'QueuedStacksWorkItem' : [ 0x180, ['_MI_QUEUED_DEADSTACK_WORKITEM']], +} ], + '__unnamed_249e' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], +} ], + '_MI_PARTITION_CORE' : [ 0x160, { + 'PartitionId' : [ 0x0, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_249e']], + 'Signature' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0x10, ['unsigned long long']], + 'ParentPartition' : [ 0x18, ['pointer64', ['_MI_PARTITION']]], + 'ListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'NodeInformation' : [ 0x30, ['pointer64', ['_MI_NODE_INFORMATION']]], + 'PageRoot' : [ 0x38, ['_RTL_AVL_TREE']], + 'MemoryNodeRuns' : [ 0x40, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'MemoryBlockReferences' : [ 0x48, ['unsigned long long']], + 'PfnUnmapWorkItem' : [ 0x50, ['_WORK_QUEUE_ITEM']], + 'PfnUnmapActive' : [ 0x70, ['unsigned char']], + 'PfnUnmapCount' : [ 0x78, ['unsigned long long']], + 'PfnUnmapWaitList' : [ 0x80, ['pointer64', ['void']]], + 'MemoryRuns' : [ 0x88, ['pointer64', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'ExitEvent' : [ 0x90, ['_KEVENT']], + 'SystemThreadHandles' : [ 0xa8, ['array', 5, ['pointer64', ['void']]]], + 'PartitionObject' : [ 0xd0, ['pointer64', ['void']]], + 'PartitionObjectHandle' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicMemoryPushLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'DynamicMemoryLock' : [ 0xe8, ['long']], + 'TemporaryMemoryEvent' : [ 0xf0, ['_KEVENT']], + 'MemoryEvents' : [ 0x108, ['array', 11, ['pointer64', ['_KEVENT']]]], +} ], + '_KTSS64' : [ 0x68, { + 'Reserved0' : [ 0x0, ['unsigned long']], + 'Rsp0' : [ 0x4, ['unsigned long long']], + 'Rsp1' : [ 0xc, ['unsigned long long']], + 'Rsp2' : [ 0x14, ['unsigned long long']], + 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], + 'Reserved1' : [ 0x5c, ['unsigned long long']], + 'Reserved2' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], +} ], + '__unnamed_24ad' : [ 0x8, { + 'InstancedWorkingSet' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMSUPPORT_INSTANCE' : [ 0xc0, { + 'NextPageColor' : [ 0x0, ['unsigned short']], + 'LastTrimStamp' : [ 0x2, ['unsigned short']], + 'PageFaultCount' : [ 0x4, ['unsigned long']], + 'TrimmedPageCount' : [ 0x8, ['unsigned long long']], + 'VmWorkingSetList' : [ 0x10, ['pointer64', ['_MMWSL_INSTANCE']]], + 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long long']]], + 'ExitOutswapGate' : [ 0x60, ['pointer64', ['_KGATE']]], + 'MinimumWorkingSetSize' : [ 0x68, ['unsigned long long']], + 'WorkingSetLeafSize' : [ 0x70, ['unsigned long long']], + 'WorkingSetLeafPrivateSize' : [ 0x78, ['unsigned long long']], + 'WorkingSetSize' : [ 0x80, ['unsigned long long']], + 'WorkingSetPrivateSize' : [ 0x88, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0x90, ['unsigned long long']], + 'PeakWorkingSetSize' : [ 0x98, ['unsigned long long']], + 'HardFaultCount' : [ 0xa0, ['unsigned long']], + 'PartitionId' : [ 0xa4, ['unsigned short']], + 'Pad0' : [ 0xa6, ['unsigned short']], + 'u1' : [ 0xa8, ['__unnamed_24ad']], + 'Reserved0' : [ 0xb0, ['unsigned long long']], + 'Flags' : [ 0xb8, ['_MMSUPPORT_FLAGS']], +} ], + '_KWAIT_BLOCK' : [ 0x30, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x10, ['unsigned char']], + 'BlockState' : [ 0x11, ['unsigned char']], + 'WaitKey' : [ 0x12, ['unsigned short']], + 'SpareLong' : [ 0x14, ['long']], + 'Thread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NotificationQueue' : [ 0x18, ['pointer64', ['_KQUEUE']]], + 'Object' : [ 0x20, ['pointer64', ['void']]], + 'SparePtr' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PPM_SELECTION_MENU_ENTRY' : [ 0x18, { + 'StrictDependency' : [ 0x0, ['unsigned char']], + 'InitiatingState' : [ 0x1, ['unsigned char']], + 'DependentState' : [ 0x2, ['unsigned char']], + 'StateIndex' : [ 0x4, ['unsigned long']], + 'Dependencies' : [ 0x8, ['unsigned long']], + 'DependencyList' : [ 0x10, ['pointer64', ['_PPM_SELECTION_DEPENDENCY']]], +} ], + '_VPB' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_HV_GET_BIN_CONTEXT' : [ 0x2, { + 'OutstandingReference' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredRundown' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], +} ], + '_INVERTED_FUNCTION_TABLE' : [ 0x1810, { + 'CurrentSize' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'Epoch' : [ 0x8, ['unsigned long']], + 'Overflow' : [ 0xc, ['unsigned char']], + 'TableEntry' : [ 0x10, ['array', 256, ['_INVERTED_FUNCTION_TABLE_ENTRY']]], +} ], + '_POP_FX_PLUGIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long long']], + 'WorkQueue' : [ 0x20, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x60, ['pointer64', ['void']]], + 'AcceptProcessorNotification' : [ 0x68, ['pointer64', ['void']]], + 'AcceptAcpiNotification' : [ 0x70, ['pointer64', ['void']]], + 'WorkOrderCount' : [ 0x78, ['unsigned long']], + 'WorkOrders' : [ 0x80, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_NT_TIB' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x8, ['pointer64', ['void']]], + 'StackLimit' : [ 0x10, ['pointer64', ['void']]], + 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], + 'FiberData' : [ 0x20, ['pointer64', ['void']]], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], + 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], +} ], + '_ETW_REG_ENTRY' : [ 0x70, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x30, ['pointer64', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x30, ['array', 4, ['pointer64', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x30, ['pointer64', ['void']]], + 'SessionId' : [ 0x38, ['unsigned long']], + 'Process' : [ 0x50, ['pointer64', ['_EPROCESS']]], + 'CallbackContext' : [ 0x50, ['pointer64', ['void']]], + 'Callback' : [ 0x58, ['pointer64', ['void']]], + 'Index' : [ 0x60, ['unsigned short']], + 'Flags' : [ 0x62, ['unsigned short']], + 'DbgKernelRegistration' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgUserRegistration' : [ 0x62, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgReplyRegistration' : [ 0x62, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgClassicRegistration' : [ 0x62, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgSessionSpaceRegistration' : [ 0x62, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgModernRegistration' : [ 0x62, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClosed' : [ 0x62, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgInserted' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DbgWow64' : [ 0x62, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'EnableMask' : [ 0x64, ['unsigned char']], + 'GroupEnableMask' : [ 0x65, ['unsigned char']], + 'UseDescriptorType' : [ 0x66, ['unsigned char']], + 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_TERMINATION_PORT' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], + 'Port' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_MI_SYSTEM_VA_STATE' : [ 0x300, { + 'SystemTablesLock' : [ 0x0, ['unsigned long long']], + 'AvailableSystemCacheVa' : [ 0x8, ['unsigned long long']], + 'DynamicBitMapSystemPtes' : [ 0x10, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapDriverImages' : [ 0x60, ['array', 2, ['_MI_DYNAMIC_BITMAP']]], + 'DynamicBitMapPagedPool' : [ 0x100, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSpecialPool' : [ 0x150, ['_MI_DYNAMIC_BITMAP']], + 'DynamicBitMapSystemCache' : [ 0x1a0, ['_MI_DYNAMIC_BITMAP']], + 'SystemVaAssignment' : [ 0x1f0, ['array', 8, ['unsigned long']]], + 'SystemVaAssignmentHint' : [ 0x210, ['unsigned long']], + 'HyperSpaceEnd' : [ 0x218, ['pointer64', ['void']]], + 'WorkingSetListHashStart' : [ 0x220, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListHashEnd' : [ 0x228, ['pointer64', ['_MMWSLE_HASH']]], + 'WorkingSetListIndirectHashStart' : [ 0x230, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'FreeSystemCacheVa' : [ 0x238, ['_KEVENT']], + 'SystemVaLock' : [ 0x250, ['unsigned long long']], + 'DeleteKvaLock' : [ 0x258, ['long']], + 'FreeSystemCache' : [ 0x260, ['_MI_PTE_CHAIN_HEAD']], + 'SystemCacheViewLock' : [ 0x278, ['unsigned long long']], + 'SystemCacheInitLock' : [ 0x280, ['_EX_PUSH_LOCK']], + 'UnusableWsles' : [ 0x288, ['array', 5, ['unsigned long long']]], + 'PossibleWsles' : [ 0x2b0, ['array', 5, ['unsigned long long']]], + 'SystemWs' : [ 0x2d8, ['array', 3, ['pointer64', ['_MMSUPPORT_INSTANCE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x8, ['pointer64', ['void']]], +} ], + '_GDI_TEB_BATCH' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_MMSUPPORT_SHARED' : [ 0x48, { + 'WorkingSetLock' : [ 0x0, ['long']], + 'ReleasedCommitDebt' : [ 0x8, ['unsigned long long']], + 'ResetPagesRepurposedCount' : [ 0x10, ['unsigned long long']], + 'WsSwapSupport' : [ 0x18, ['pointer64', ['void']]], + 'CommitReleaseContext' : [ 0x20, ['pointer64', ['void']]], + 'AccessLog' : [ 0x28, ['pointer64', ['void']]], + 'ChargedWslePages' : [ 0x30, ['unsigned long long']], + 'ActualWslePages' : [ 0x38, ['unsigned long long']], + 'WorkingSetSizeOverhead' : [ 0x40, ['unsigned long long']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { + 'ImpersonationData' : [ 0x0, ['unsigned long long']], + 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_PO_IRP_MANAGER' : [ 0x20, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], +} ], + '_CM_RESOURCE_LIST' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MMCLONE_BLOCK' : [ 0x20, { + 'ProtoPte' : [ 0x0, ['_MMPTE']], + 'PaddingFor16ByteAlignment' : [ 0x8, ['unsigned long long']], + 'CloneCommitCount' : [ 0x10, ['unsigned long long']], + 'u1' : [ 0x10, ['_MI_CLONE_BLOCK_FLAGS']], + 'CloneRefCount' : [ 0x18, ['unsigned long long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Propagated' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { + 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], +} ], + '__unnamed_2537' : [ 0x8, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], + 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], +} ], + '_SECTION' : [ 0x40, { + 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u1' : [ 0x28, ['__unnamed_2537']], + 'SizeOfSection' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_16c6']], + 'InitialPageProtection' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'SessionId' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x3c, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'CompactionMask' : [ 0x8, ['unsigned long long']], + 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0xb8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x10, ['unsigned long']], + 'ArgumentStatus' : [ 0x14, ['long']], + 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'Lock' : [ 0x44, ['unsigned long']], + 'Cancel' : [ 0x48, ['unsigned char']], + 'Parent' : [ 0x50, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'ActivityId' : [ 0x58, ['_GUID']], + 'Data' : [ 0x68, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x10, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], +} ], + '_MI_LDW_WORK_CONTEXT' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'FileObject' : [ 0x20, ['pointer64', ['_FILE_OBJECT']]], + 'ErrorStatus' : [ 0x28, ['long']], + 'Active' : [ 0x2c, ['long']], + 'FreeWhenDone' : [ 0x30, ['unsigned char']], +} ], + '_MI_DEBUGGER_STATE' : [ 0x118, { + 'TransientWrite' : [ 0x0, ['unsigned char']], + 'CodePageEdited' : [ 0x1, ['unsigned char']], + 'DebugPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'PoisonedTb' : [ 0x10, ['unsigned long']], + 'InDebugger' : [ 0x14, ['long']], + 'Pfns' : [ 0x18, ['array', 32, ['pointer64', ['void']]]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x10, { + 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 63, native_type='unsigned long long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'LockState' : [ 0x0, ['pointer64', ['void']]], + 'SessionState' : [ 0x8, ['pointer64', ['void']]], + 'SessionId' : [ 0x8, ['unsigned long']], + 'SessionPad' : [ 0xc, ['unsigned long']], +} ], + '_RTL_RANGE' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer64', ['void']]], + 'Owner' : [ 0x18, ['pointer64', ['void']]], + 'Attributes' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { + 'ClientToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], + 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ETIMER' : [ 0x138, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x40, ['unsigned long long']], + 'TimerApc' : [ 0x48, ['_KAPC']], + 'TimerDpc' : [ 0xa0, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0xe0, ['_LIST_ENTRY']], + 'Period' : [ 0xf0, ['unsigned long']], + 'TimerFlags' : [ 0xf4, ['unsigned char']], + 'ApcAssociated' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0xf5, ['unsigned char']], + 'Spare2' : [ 0xf6, ['unsigned short']], + 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x110, ['pointer64', ['void']]], + 'VirtualizedTimerLinks' : [ 0x118, ['_LIST_ENTRY']], + 'DueTime' : [ 0x128, ['unsigned long long']], + 'CoalescingWindow' : [ 0x130, ['unsigned long']], +} ], + '_MI_SHUTDOWN_STATE' : [ 0x80, { + 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], + 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], + 'SystemShutdown' : [ 0x4, ['unsigned long']], + 'ShutdownFlushInProgress' : [ 0x8, ['long']], + 'ResumeItem' : [ 0x10, ['_MI_RESUME_WORKITEM']], + 'MirrorHoldsPfn' : [ 0x48, ['pointer64', ['_ETHREAD']]], + 'MirroringActive' : [ 0x50, ['unsigned long']], + 'MirrorBitMaps' : [ 0x58, ['array', 2, ['_RTL_BITMAP_EX']]], + 'CrashDumpPte' : [ 0x78, ['pointer64', ['_MMPTE']]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_VI_TRACK_IRQL' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'OldIrql' : [ 0x8, ['unsigned char']], + 'NewIrql' : [ 0x9, ['unsigned char']], + 'Processor' : [ 0xa, ['unsigned short']], + 'TickCount' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], +} ], + '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { + 'Continue' : [ 0x0, ['unsigned long']], + 'TraceFlag' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], +} ], + '_OWNER_ENTRY' : [ 0x10, { + 'OwnerThread' : [ 0x0, ['unsigned long long']], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoQoSPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x8, ['unsigned long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { + 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x1d0, { + 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x8, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x10, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x18, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x20, ['unsigned long long']], + 'IdleTimeExpiration' : [ 0x28, ['unsigned long long']], + 'NonInterruptibleTransition' : [ 0x30, ['unsigned char']], + 'PepWokenTransition' : [ 0x31, ['unsigned char']], + 'EfficiencyClass' : [ 0x32, ['unsigned char']], + 'SchedulingClass' : [ 0x33, ['unsigned char']], + 'TargetIdleState' : [ 0x34, ['unsigned long']], + 'IdlePolicy' : [ 0x38, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x40, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x48, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xd8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], + 'LastSysTime' : [ 0xdc, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xe0, ['unsigned long long']], + 'WmiInterfaceEnabled' : [ 0xe8, ['long']], + 'FFHThrottleStateInfo' : [ 0xf0, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0x110, ['_KDPC']], + 'PerfActionMask' : [ 0x150, ['long']], + 'HvIdleCheck' : [ 0x158, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x168, ['pointer64', ['_PROC_PERF_CHECK']]], + 'Domain' : [ 0x170, ['pointer64', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x178, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x180, ['pointer64', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x188, ['pointer64', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x190, ['pointer64', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x198, ['unsigned char']], + 'HvTargetState' : [ 0x199, ['unsigned char']], + 'Parked' : [ 0x19a, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x19c, ['unsigned long']], + 'AveragePerformancePercent' : [ 0x1a0, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x1a4, ['unsigned long']], + 'RelativePerformance' : [ 0x1a8, ['unsigned long']], + 'Utility' : [ 0x1ac, ['unsigned long']], + 'AffinitizedUtility' : [ 0x1b0, ['unsigned long']], + 'SnapTimeLast' : [ 0x1b8, ['unsigned long long']], + 'EnergyConsumed' : [ 0x1b8, ['unsigned long long']], + 'ActiveTime' : [ 0x1c0, ['unsigned long long']], + 'TotalTime' : [ 0x1c8, ['unsigned long long']], +} ], + '_MI_PARTITION_SEGMENTS' : [ 0x180, { + 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], + 'UnusedSegmentCleanup' : [ 0x18, ['_KEVENT']], + 'SubsectionDeletePtes' : [ 0x30, ['unsigned long long']], + 'DereferenceSegmentHeader' : [ 0x38, ['_MMDEREFERENCE_SEGMENT_HEADER']], + 'DeleteOnCloseList' : [ 0x68, ['_LIST_ENTRY']], + 'DeleteOnCloseTimer' : [ 0x78, ['_KTIMER']], + 'DeleteOnCloseTimerActive' : [ 0xb8, ['unsigned char']], + 'DeleteOnCloseCount' : [ 0xbc, ['unsigned long']], + 'UnusedSegmentList' : [ 0xc0, ['_LIST_ENTRY']], + 'UnusedSubsectionList' : [ 0xd0, ['_LIST_ENTRY']], + 'DeleteSubsectionList' : [ 0xe0, ['_LIST_ENTRY']], + 'ControlAreaDeleteEvent' : [ 0xf0, ['_KEVENT']], + 'ControlAreaDeleteList' : [ 0x108, ['_SINGLE_LIST_ENTRY']], + 'SegmentListLock' : [ 0x140, ['long']], + 'ControlAreaCount' : [ 0x148, ['long long']], +} ], + '_MI_RESAVAIL_TRACKER' : [ 0x380, { + 'AllocateKernelStack' : [ 0x0, ['unsigned long long']], + 'AllocateGrowKernelStack' : [ 0x8, ['unsigned long long']], + 'FreeKernelStack' : [ 0x10, ['unsigned long long']], + 'FreeKernelStackError' : [ 0x18, ['unsigned long long']], + 'FreeGrowKernelStackError' : [ 0x20, ['unsigned long long']], + 'AllocateCreateProcess' : [ 0x28, ['unsigned long long']], + 'FreeCreateProcessError' : [ 0x30, ['unsigned long long']], + 'FreeDeleteProcess' : [ 0x38, ['unsigned long long']], + 'FreeCleanProcess' : [ 0x40, ['unsigned long long']], + 'FreeCleanProcessError' : [ 0x48, ['unsigned long long']], + 'AllocateWsIncrease' : [ 0x50, ['unsigned long long']], + 'FreeWsIncreaseError' : [ 0x58, ['unsigned long long']], + 'FreeWsIncreaseErrorMax' : [ 0x60, ['unsigned long long']], + 'FreeWsDecrease' : [ 0x68, ['unsigned long long']], + 'AllocateWorkingSetPage' : [ 0x70, ['unsigned long long']], + 'FreeWorkingSetPageError' : [ 0x78, ['unsigned long long']], + 'FreeDeletePteRange' : [ 0x80, ['unsigned long long']], + 'AllocatePageTablesForProcessMetadata' : [ 0x88, ['unsigned long long']], + 'AllocatePageTablesForSystem' : [ 0x90, ['unsigned long long']], + 'FreePageTablesExcess' : [ 0x98, ['unsigned long long']], + 'FreeSystemVaPageTables' : [ 0xa0, ['unsigned long long']], + 'FreeSessionVaPageTables' : [ 0xa8, ['unsigned long long']], + 'AllocateCreateSession' : [ 0xb0, ['unsigned long long']], + 'FreeSessionWsDereference' : [ 0xb8, ['unsigned long long']], + 'FreeSessionDereference' : [ 0xc0, ['unsigned long long']], + 'AllocateLockedSessionImage' : [ 0xc8, ['unsigned long long']], + 'FreeLockedSessionImage' : [ 0xd0, ['unsigned long long']], + 'FreeSessionImageConversion' : [ 0xd8, ['unsigned long long']], + 'AllocateWsAdjustPageTable' : [ 0xe0, ['unsigned long long']], + 'FreeWsAdjustPageTable' : [ 0xe8, ['unsigned long long']], + 'FreeWsAdjustPageTableError' : [ 0xf0, ['unsigned long long']], + 'AllocateNoLowMemory' : [ 0xf8, ['unsigned long long']], + 'AllocatePagedPoolLockedDown' : [ 0x100, ['unsigned long long']], + 'FreePagedPoolLockedDown' : [ 0x108, ['unsigned long long']], + 'AllocateSystemBitmaps' : [ 0x110, ['unsigned long long']], + 'FreeSystemBitmapsError' : [ 0x118, ['unsigned long long']], + 'AllocateForMdl' : [ 0x120, ['unsigned long long']], + 'FreeFromMdl' : [ 0x128, ['unsigned long long']], + 'AllocateForMdlPartition' : [ 0x130, ['unsigned long long']], + 'FreeFromMdlPartition' : [ 0x138, ['unsigned long long']], + 'FreeMdlExcess' : [ 0x140, ['unsigned long long']], + 'AllocateExpansionNonPagedPool' : [ 0x148, ['unsigned long long']], + 'FreeExpansionNonPagedPool' : [ 0x150, ['unsigned long long']], + 'AllocateVad' : [ 0x158, ['unsigned long long']], + 'RemoveVad' : [ 0x160, ['unsigned long long']], + 'FreeVad' : [ 0x168, ['unsigned long long']], + 'AllocateContiguous' : [ 0x170, ['unsigned long long']], + 'FreeContiguousPages' : [ 0x178, ['unsigned long long']], + 'FreeContiguousError' : [ 0x180, ['unsigned long long']], + 'FreeLargePageMemory' : [ 0x188, ['unsigned long long']], + 'AllocateSystemWsles' : [ 0x190, ['unsigned long long']], + 'FreeSystemWsles' : [ 0x198, ['unsigned long long']], + 'AllocateSystemInitWs' : [ 0x1a0, ['unsigned long long']], + 'AllocateSessionInitWs' : [ 0x1a8, ['unsigned long long']], + 'FreeSessionInitWsError' : [ 0x1b0, ['unsigned long long']], + 'AllocateSystemImage' : [ 0x1b8, ['unsigned long long']], + 'AllocateSystemImageLoad' : [ 0x1c0, ['unsigned long long']], + 'AllocateSessionSharedImage' : [ 0x1c8, ['unsigned long long']], + 'FreeSystemImageInitCode' : [ 0x1d0, ['unsigned long long']], + 'FreeSystemImageLargePageConversion' : [ 0x1d8, ['unsigned long long']], + 'FreeSystemImageError' : [ 0x1e0, ['unsigned long long']], + 'FreeSystemImageLoadExcess' : [ 0x1e8, ['unsigned long long']], + 'FreeUnloadSystemImage' : [ 0x1f0, ['unsigned long long']], + 'FreeReloadBootImageLarge' : [ 0x1f8, ['unsigned long long']], + 'FreeIndependent' : [ 0x200, ['unsigned long long']], + 'AllocateHotRemove' : [ 0x208, ['unsigned long long']], + 'FreeHotAdd' : [ 0x210, ['unsigned long long']], + 'AllocateBoot' : [ 0x218, ['unsigned long long']], + 'FreeLoaderBlock' : [ 0x220, ['unsigned long long']], + 'AllocateNonPagedSpecialPool' : [ 0x228, ['unsigned long long']], + 'FreeNonPagedSpecialPoolError' : [ 0x230, ['unsigned long long']], + 'FreeNonPagedSpecialPool' : [ 0x238, ['unsigned long long']], + 'AllocateSharedSegmentPage' : [ 0x240, ['unsigned long long']], + 'FreeSharedSegmentPage' : [ 0x248, ['unsigned long long']], + 'AllocateZeroPage' : [ 0x250, ['unsigned long long']], + 'FreeZeroPage' : [ 0x258, ['unsigned long long']], + 'AllocateForPo' : [ 0x260, ['unsigned long long']], + 'AllocateForPoForce' : [ 0x268, ['unsigned long long']], + 'FreeForPo' : [ 0x270, ['unsigned long long']], + 'AllocateThreadHardFaultBehavior' : [ 0x278, ['unsigned long long']], + 'FreeThreadHardFaultBehavior' : [ 0x280, ['unsigned long long']], + 'ObtainFaultCharges' : [ 0x288, ['unsigned long long']], + 'FreeFaultCharges' : [ 0x290, ['unsigned long long']], + 'AllocateStoreCharges' : [ 0x298, ['unsigned long long']], + 'FreeStoreCharges' : [ 0x2a0, ['unsigned long long']], + 'ObtainLockedPageCharge' : [ 0x2c0, ['unsigned long long']], + 'FreeLockedPageCharge' : [ 0x300, ['unsigned long long']], + 'AllocateStore' : [ 0x308, ['unsigned long long']], + 'FreeStore' : [ 0x310, ['unsigned long long']], + 'AllocateSystemImageProtos' : [ 0x318, ['unsigned long long']], + 'FreeSystemImageProtos' : [ 0x320, ['unsigned long long']], + 'AllocateModWriterCharge' : [ 0x328, ['unsigned long long']], + 'FreeModWriterCharge' : [ 0x330, ['unsigned long long']], + 'AllocateMappedWriterCharge' : [ 0x338, ['unsigned long long']], + 'FreeMappedWriterCharge' : [ 0x340, ['unsigned long long']], + 'AllocateRegistryCharges' : [ 0x348, ['unsigned long long']], + 'FreeRegistryCharges' : [ 0x350, ['unsigned long long']], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'EventSets' : [ 0x18, ['unsigned long']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KRESOURCEMANAGER' : [ 0x250, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x20, ['unsigned long']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x88, ['_GUID']], + 'NotificationQueue' : [ 0x98, ['_KQUEUE']], + 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], + 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x120, ['unsigned long']], + 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], + 'Key' : [ 0x130, ['pointer64', ['void']]], + 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], + 'Description' : [ 0x170, ['_UNICODE_STRING']], + 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_POP_FX_DEVICE' : [ 0x278, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DevNode' : [ 0x30, ['pointer64', ['_DEVICE_NODE']]], + 'DpmContext' : [ 0x38, ['pointer64', ['PEPHANDLE__']]], + 'Plugin' : [ 0x40, ['pointer64', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x48, ['pointer64', ['PEPHANDLE__']]], + 'AcpiPlugin' : [ 0x50, ['pointer64', ['_POP_FX_PLUGIN']]], + 'AcpiPluginHandle' : [ 0x58, ['pointer64', ['PEPHANDLE__']]], + 'DeviceObject' : [ 0x60, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x68, ['pointer64', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x70, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0xa8, ['pointer64', ['void']]], + 'AcpiLink' : [ 0xb0, ['_LIST_ENTRY']], + 'DeviceId' : [ 0xc0, ['_UNICODE_STRING']], + 'RemoveLock' : [ 0xd0, ['_IO_REMOVE_LOCK']], + 'AcpiRemoveLock' : [ 0xf0, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0x110, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0x148, ['unsigned long long']], + 'IdleTimer' : [ 0x150, ['_KTIMER']], + 'IdleDpc' : [ 0x190, ['_KDPC']], + 'IdleTimeout' : [ 0x1d0, ['unsigned long long']], + 'IdleStamp' : [ 0x1d8, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x1e0, ['array', 2, ['pointer64', ['_DEVICE_OBJECT']]]], + 'NextIrpPowerState' : [ 0x1f0, ['array', 2, ['_POWER_STATE']]], + 'NextIrpCallerCompletion' : [ 0x1f8, ['array', 2, ['pointer64', ['void']]]], + 'NextIrpCallerContext' : [ 0x208, ['array', 2, ['pointer64', ['void']]]], + 'IrpCompleteEvent' : [ 0x218, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x230, ['pointer64', ['void']]], + 'Accounting' : [ 0x238, ['_POP_FX_ACCOUNTING']], + 'Flags' : [ 0x268, ['unsigned long']], + 'ComponentCount' : [ 0x26c, ['unsigned long']], + 'Components' : [ 0x270, ['pointer64', ['pointer64', ['_POP_FX_COMPONENT']]]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_IOV_IRP_TRACE' : [ 0x80, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x10, ['short']], + 'SpecialApcDisable' : [ 0x12, ['short']], + 'CombinedApcDisable' : [ 0x10, ['unsigned long']], + 'Irql' : [ 0x14, ['unsigned char']], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '_MI_CLONE_BLOCK_FLAGS' : [ 0x8, { + 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 59, native_type='unsigned long long')]], + 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x28, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Active' : [ 0x20, ['long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { + 'Key' : [ 0x0, ['pointer64', ['void']]], + 'Index' : [ 0x8, ['unsigned long long']], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Processors' : [ 0x8, ['unsigned long']], + 'ActiveProcessors' : [ 0xc, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x10, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x8, ['unsigned long long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], + 'ZeroInit1' : [ 0x8, ['unsigned long long']], +} ], + '_VF_AVL_TABLE' : [ 0xc0, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x70, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['long']], +} ], + '__unnamed_25dc' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_25de' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_25dc']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x60, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x20, ['_LIST_ENTRY']], + 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CoolingExtension' : [ 0x40, ['pointer64', ['_POP_COOLING_EXTENSION']]], + 'Volume' : [ 0x48, ['_LIST_ENTRY']], + 'Specific' : [ 0x58, ['__unnamed_25de']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { + 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], +} ], + '_CM_UOW_SET_SD_DATA' : [ 0x4, { + 'SecurityCell' : [ 0x0, ['unsigned long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'Context' : [ 0x18, ['pointer64', ['void']]], + 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x24, ['unsigned long']], + 'Status' : [ 0x28, ['long']], + 'Information' : [ 0x30, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x38, ['long']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { + 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], + 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_KDPC_LIST' : [ 0x10, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0x100, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x30, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], + 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], + 'PortContext' : [ 0x50, ['pointer64', ['void']]], + 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0xe0, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], + 'Flags' : [ 0xe4, ['unsigned long']], + 'WaitEvent' : [ 0xe8, ['_KEVENT']], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x8, ['_CM_COMPONENT_HASH']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0x18, ['unsigned short']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_RTL_SRWLOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], + 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x160, { + 'AccountingDisabled' : [ 0x0, ['unsigned char']], + 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], + 'TotalPassiveTime' : [ 0x10, ['array', 21, ['unsigned long long']]], + 'PassiveTimeSnap' : [ 0xb8, ['array', 21, ['unsigned long long']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_MI_VISIBLE_PARTITION' : [ 0x1380, { + 'LowestPhysicalPage' : [ 0x0, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x8, ['unsigned long long']], + 'NumberOfPhysicalPages' : [ 0x10, ['unsigned long long']], + 'NumberOfPagingFiles' : [ 0x18, ['unsigned long']], + 'PagingFile' : [ 0x20, ['array', 16, ['pointer64', ['_MMPAGING_FILE']]]], + 'AvailablePages' : [ 0xc0, ['unsigned long long']], + 'ResidentAvailablePages' : [ 0x100, ['unsigned long long']], + 'PartitionWs' : [ 0x140, ['array', 1, ['_MMSUPPORT_INSTANCE']]], + 'PartitionWorkingSetLists' : [ 0x200, ['array', 1, ['_MMWSL_INSTANCE']]], + 'SystemCacheInitialized' : [ 0x3a0, ['unsigned char']], + 'TotalCommittedPages' : [ 0x3a8, ['unsigned long long']], + 'ModifiedPageListHead' : [ 0x3c0, ['_MMPFNLIST']], + 'ModifiedNoWritePageListHead' : [ 0x400, ['_MMPFNLIST']], + 'TotalCommitLimit' : [ 0x428, ['unsigned long long']], + 'TotalPagesForPagingFile' : [ 0x430, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x438, ['unsigned long long']], + 'ProcessLockedFilePages' : [ 0x440, ['unsigned long long']], + 'ChargeCommitmentFailures' : [ 0x448, ['array', 4, ['unsigned long']]], + 'PageTableBitmapPages' : [ 0x458, ['unsigned long long']], + 'PageFileTraceIndex' : [ 0x460, ['long']], + 'PageFileTraces' : [ 0x468, ['array', 32, ['_MI_PAGEFILE_TRACES']]], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { + 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_FREE_DISPLAY' : [ 0x18, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x58, { + 'Context' : [ 0x0, ['pointer64', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x38, ['unsigned long']], + 'DependencyUsed' : [ 0x3c, ['unsigned long']], + 'DependencyArray' : [ 0x40, ['pointer64', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x48, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x4c, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x50, ['unsigned long']], +} ], + '_PNP_REBALANCE_TRACE_CONTEXT' : [ 0x70, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'RebalancePhase' : [ 0x4, ['unsigned long']], + 'Reason' : [ 0x8, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'RebalanceReasonUnknown', 1: 'RebalanceReasonRequirementsChanged', 2: 'RebalanceReasonNewDevice'})]]], + 'Failure' : [ 0x10, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'RebalanceFailureNone', 1: 'RebalanceFailureDisabled', 2: 'RebalanceFailureNoMemory', 3: 'RebalanceFailureQueryStopUnexpectedVeto', 4: 'RebalanceFailureNoRequirements', 5: 'RebalanceFailureNoCandidates', 6: 'RebalanceFailureNoConfiguration'})]]], + 'SubtreeRoot' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'SubtreeIncludesRoot' : [ 0x20, ['unsigned char']], + 'TriggerRoot' : [ 0x28, ['pointer64', ['_DEVICE_NODE']]], + 'RebalanceDueToDynamicPartitioning' : [ 0x30, ['unsigned char']], + 'BeginTime' : [ 0x38, ['unsigned long long']], + 'VetoNode' : [ 0x40, ['array', 2, ['pointer64', ['_DEVICE_NODE']]]], + 'VetoQueryRebalanceReason' : [ 0x50, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceQueryRebalanceSucceeded', 1: 'DeviceQueryStopFailed', 2: 'DeviceFailedGetNewResourceRequirement', 3: 'DeviceInUnexpectedState', 4: 'DeviceNotSupportQueryRebalance'})]]], + 'ConflictContext' : [ 0x58, ['_PNP_RESOURCE_CONFLICT_TRACE_CONTEXT']], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x28, { + 'BlockOffset' : [ 0x0, ['unsigned long long']], + 'PermanentBinAddress' : [ 0x8, ['unsigned long long']], + 'TemporaryBinAddress' : [ 0x10, ['unsigned long long']], + 'TemporaryBinRundown' : [ 0x18, ['_EX_RUNDOWN_REF']], + 'MemAlloc' : [ 0x20, ['unsigned long']], +} ], + '__unnamed_2642' : [ 0x18, { + 'RequestedTime' : [ 0x0, ['unsigned long long']], + 'ProgrammedTime' : [ 0x8, ['unsigned long long']], + 'TimerInfo' : [ 0x10, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0x110, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x48, ['unsigned long long']], + 'SleepTime' : [ 0x50, ['unsigned long long']], + 'WakeFirstUnattendedTime' : [ 0x58, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x68, ['array', 3, ['__unnamed_2642']]], + 'WakeAlarmPaused' : [ 0xb0, ['unsigned char']], + 'WakeAlarmLastTime' : [ 0xb8, ['unsigned long long']], + 'FilteredCapabilities' : [ 0xc0, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_RTL_RANGE_LIST' : [ 0x20, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Count' : [ 0x14, ['unsigned long']], + 'Stamp' : [ 0x18, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_WNF_LOCK' : [ 0x8, { + 'PushLock' : [ 0x0, ['_EX_PUSH_LOCK']], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '_ISR_THUNK' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KINTERRUPT' : [ 0x100, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], + 'MessageIndex' : [ 0x28, ['unsigned long']], + 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], + 'SpinLock' : [ 0x38, ['unsigned long long']], + 'TickCount' : [ 0x40, ['unsigned long']], + 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], + 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], + 'Vector' : [ 0x58, ['unsigned long']], + 'Irql' : [ 0x5c, ['unsigned char']], + 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], + 'FloatingSave' : [ 0x5e, ['unsigned char']], + 'Connected' : [ 0x5f, ['unsigned char']], + 'Number' : [ 0x60, ['unsigned long']], + 'ShareVector' : [ 0x64, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x65, ['unsigned char']], + 'ActiveCount' : [ 0x66, ['unsigned short']], + 'InternalState' : [ 0x68, ['long']], + 'Mode' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x74, ['unsigned long']], + 'DispatchCount' : [ 0x78, ['unsigned long']], + 'PassiveEvent' : [ 0x80, ['pointer64', ['_KEVENT']]], + 'TrapFrame' : [ 0x88, ['pointer64', ['_KTRAP_FRAME']]], + 'DisconnectData' : [ 0x90, ['pointer64', ['void']]], + 'ServiceThread' : [ 0x98, ['pointer64', ['_KTHREAD']]], + 'ConnectionData' : [ 0xa0, ['pointer64', ['_INTERRUPT_CONNECTION_DATA']]], + 'IntTrackEntry' : [ 0xa8, ['pointer64', ['void']]], + 'IsrDpcStats' : [ 0xb0, ['_ISRDPCSTATS']], + 'RedirectObject' : [ 0xf0, ['pointer64', ['void']]], + 'Padding' : [ 0xf8, ['array', 8, ['unsigned char']]], +} ], + '_MI_PARTITION_ZEROING' : [ 0x60, { + 'PageEvent' : [ 0x0, ['_KEVENT']], + 'ThreadActive' : [ 0x18, ['unsigned char']], + 'ZeroFreePageSlistMinimum' : [ 0x1c, ['long']], + 'RebalanceZeroFreeWorkItem' : [ 0x20, ['_WORK_QUEUE_ITEM']], + 'ThreadCount' : [ 0x40, ['long']], + 'Gate' : [ 0x48, ['_KGATE']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'StackLimit' : [ 0x8, ['unsigned long long']], + 'KernelStack' : [ 0x10, ['unsigned long long']], + 'InitialStack' : [ 0x18, ['unsigned long long']], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x38, { + 'ComponentActive' : [ 0x0, ['pointer64', ['void']]], + 'ComponentIdle' : [ 0x8, ['pointer64', ['void']]], + 'ComponentIdleState' : [ 0x10, ['pointer64', ['void']]], + 'DevicePowerRequired' : [ 0x18, ['pointer64', ['void']]], + 'DevicePowerNotRequired' : [ 0x20, ['pointer64', ['void']]], + 'PowerControl' : [ 0x28, ['pointer64', ['void']]], + 'ComponentCriticalTransition' : [ 0x30, ['pointer64', ['void']]], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'u1' : [ 0x0, ['unsigned short']], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'u2' : [ 0x3, ['unsigned char']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_WAITING_IRP' : [ 0x38, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'CompletionRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'Information' : [ 0x30, ['unsigned long']], + 'BreakAllRH' : [ 0x34, ['unsigned char']], +} ], + '_MI_DYNAMIC_BITMAP' : [ 0x50, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'MaximumSize' : [ 0x10, ['unsigned long long']], + 'Hint' : [ 0x18, ['unsigned long long']], + 'BaseVa' : [ 0x20, ['pointer64', ['void']]], + 'SizeTopDown' : [ 0x28, ['unsigned long long']], + 'HintTopDown' : [ 0x30, ['unsigned long long']], + 'BaseVaTopDown' : [ 0x38, ['pointer64', ['void']]], + 'SpinLock' : [ 0x40, ['unsigned long long']], + 'Vm' : [ 0x48, ['pointer64', ['_MMSUPPORT_INSTANCE']]], +} ], + '_UNEXPECTED_INTERRUPT' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 28, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { + 'CancelCount' : [ 0x0, ['unsigned long']], + 'FailureCount' : [ 0x4, ['unsigned long']], + 'SuccessCount' : [ 0x8, ['unsigned long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'TotalTime' : [ 0x20, ['unsigned long long']], + 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], + 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_PROC_FEEDBACK' : [ 0x90, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer64', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x28, ['unsigned long long']], + 'UnscaledTime' : [ 0x30, ['unsigned long long']], + 'UnaccountedTime' : [ 0x38, ['long long']], + 'ScaledTime' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x50, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x58, ['unsigned long long']], + 'UserTimeLast' : [ 0x60, ['unsigned long']], + 'KernelTimeLast' : [ 0x64, ['unsigned long']], + 'IdleGenerationNumberLast' : [ 0x68, ['unsigned long long']], + 'HvActiveTimeLast' : [ 0x70, ['unsigned long long']], + 'StallCyclesLast' : [ 0x78, ['unsigned long long']], + 'StallTime' : [ 0x80, ['unsigned long long']], + 'KernelTimesIndex' : [ 0x88, ['unsigned char']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x30, { + 'InstantaneousRead' : [ 0x0, ['pointer64', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer64', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'Scaling' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x28, ['unsigned long long']], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_MI_DRIVER_VA' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_DRIVER_VA']]], + 'PointerPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'BitMap' : [ 0x10, ['_RTL_BITMAP']], + 'Hint' : [ 0x20, ['unsigned long']], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_PEB64' : [ 0x7a0, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'IsLongPathAwareProcess' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['unsigned long long']], + 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], + 'Ldr' : [ 0x18, ['unsigned long long']], + 'ProcessParameters' : [ 0x20, ['unsigned long long']], + 'SubSystemData' : [ 0x28, ['unsigned long long']], + 'ProcessHeap' : [ 0x30, ['unsigned long long']], + 'FastPebLock' : [ 0x38, ['unsigned long long']], + 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], + 'IFEOKey' : [ 0x48, ['unsigned long long']], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], + 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['unsigned long long']], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['unsigned long long']], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], + 'SparePvoid0' : [ 0x90, ['unsigned long long']], + 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], + 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], + 'OemCodePageData' : [ 0xa8, ['unsigned long long']], + 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], + 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], + 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['unsigned long long']], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], + 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['unsigned long long']], + 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], + 'CSDVersion' : [ 0x2e8, ['_STRING64']], + 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], + 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], + 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], + 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['unsigned long long']], + 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], + 'FlsBitmap' : [ 0x338, ['unsigned long long']], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['unsigned long long']], + 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], + 'pUnused' : [ 0x368, ['unsigned long long']], + 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x388, ['unsigned long long']], + 'TppWorkerpList' : [ 0x390, ['LIST_ENTRY64']], + 'WaitOnAddressHashTable' : [ 0x3a0, ['array', 128, ['unsigned long long']]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0xa0, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], + 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], + 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], + 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], + 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], + 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x50, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], + 'LoggerId' : [ 0x58, ['unsigned short']], + 'Flags' : [ 0x5a, ['unsigned char']], + 'ShutDownRequested' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x5a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x5a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Wow' : [ 0x5a, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], + 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], + 'UserPagesReused' : [ 0x80, ['unsigned long']], + 'EventsLostCount' : [ 0x88, ['pointer64', ['unsigned long']]], + 'BuffersLostCount' : [ 0x90, ['pointer64', ['unsigned long']]], + 'SiloState' : [ 0x98, ['pointer64', ['_ETW_SILODRIVERSTATE']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x1d0, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x3, ['unsigned char']], + 'InitializationFinished' : [ 0x4, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'HvCaptureReadyBarrier' : [ 0x14, ['long']], + 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], + 'MapFrozen' : [ 0x1c, ['unsigned char']], + 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x30, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x40, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x50, ['unsigned long']], + 'ClonedPageCount' : [ 0x58, ['unsigned long long']], + 'CurrentMap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x68, ['pointer64', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x70, ['unsigned long long']], + 'LoaderMdl' : [ 0x78, ['pointer64', ['_MDL']]], + 'AllocatedMdl' : [ 0x80, ['pointer64', ['_MDL']]], + 'PagesOut' : [ 0x88, ['unsigned long long']], + 'IoPages' : [ 0x90, ['pointer64', ['void']]], + 'IoPagesCount' : [ 0x98, ['unsigned long']], + 'CurrentMcb' : [ 0xa0, ['pointer64', ['void']]], + 'DumpStack' : [ 0xa8, ['pointer64', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0xb0, ['pointer64', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0xb8, ['unsigned long']], + 'Status' : [ 0xbc, ['long']], + 'GraphicsProc' : [ 0xc0, ['unsigned long']], + 'MemoryImage' : [ 0xc8, ['pointer64', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0xd0, ['pointer64', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0xd8, ['pointer64', ['_MDL']]], + 'SiLogOffset' : [ 0xe0, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0xe8, ['pointer64', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0xf0, ['pointer64', ['void']]], + 'ResumeContext' : [ 0xf8, ['pointer64', ['void']]], + 'ResumeContextPages' : [ 0x100, ['unsigned long']], + 'SecurePages' : [ 0x104, ['unsigned long']], + 'ProcessorCount' : [ 0x108, ['unsigned long']], + 'ProcessorContext' : [ 0x110, ['pointer64', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0x118, ['pointer64', ['unsigned char']]], + 'ProdConsSize' : [ 0x120, ['unsigned long']], + 'MaxDataPages' : [ 0x124, ['unsigned long']], + 'ExtraBuffer' : [ 0x128, ['pointer64', ['void']]], + 'ExtraBufferSize' : [ 0x130, ['unsigned long long']], + 'ExtraMapVa' : [ 0x138, ['pointer64', ['void']]], + 'BitlockerKeyPFN' : [ 0x140, ['unsigned long long']], + 'IoInfo' : [ 0x148, ['_POP_IO_INFO']], + 'IoChecksums' : [ 0x1b8, ['pointer64', ['unsigned short']]], + 'IoChecksumsSize' : [ 0x1c0, ['unsigned long long']], + 'HardwareConfigurationSignature' : [ 0x1c8, ['unsigned long']], + 'IumEnabled' : [ 0x1cc, ['unsigned char']], +} ], + '__unnamed_26c2' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], +} ], + '_MI_DECAY_TIMER_LINK' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_26c2']], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '__unnamed_26c9' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0xd0, { + 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x48, ['__unnamed_26c9']], + 'ChildrenCount' : [ 0x4c, ['long']], + 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], + 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x10, { + 'p' : [ 0x0, ['pointer64', ['void']]], + 'RangeSize' : [ 0x8, ['unsigned long long']], +} ], + '_MI_PARTITION_COMMIT' : [ 0x80, { + 'PeakCommitment' : [ 0x0, ['unsigned long long']], + 'TotalCommitLimitMaximum' : [ 0x8, ['unsigned long long']], + 'Popups' : [ 0x10, ['array', 2, ['long']]], + 'LowCommitThreshold' : [ 0x18, ['unsigned long long']], + 'HighCommitThreshold' : [ 0x20, ['unsigned long long']], + 'EventLock' : [ 0x28, ['unsigned long long']], + 'SystemCommitReserve' : [ 0x30, ['unsigned long long']], + 'OverCommit' : [ 0x40, ['unsigned long long']], +} ], + '_TRIAGE_DEVICE_NODE' : [ 0x58, { + 'Sibling' : [ 0x0, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_TRIAGE_POP_FX_DEVICE']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x28, { + 'Size' : [ 0x0, ['unsigned long long']], + 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], + 'ProcessId' : [ 0x18, ['unsigned long']], + 'ServiceTag' : [ 0x1c, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], + 'DevicePathOffset' : [ 0x18, ['unsigned long long']], + 'ReasonOffset' : [ 0x20, ['unsigned long long']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x40, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x48, { + 'InitiatingThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ThreadId' : [ 0x10, ['pointer64', ['void']]], + 'ProcessId' : [ 0x18, ['pointer64', ['void']]], + 'Code' : [ 0x20, ['unsigned long']], + 'Parameter1' : [ 0x28, ['unsigned long long']], + 'Parameter2' : [ 0x30, ['unsigned long long']], + 'Parameter3' : [ 0x38, ['unsigned long long']], + 'Parameter4' : [ 0x40, ['unsigned long long']], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x40, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ProbeMode' : [ 0x10, ['unsigned char']], + 'PagedPoolCharge' : [ 0x14, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x8, ['pointer64', ['wchar']]], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x8180, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], + 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], + 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x8010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], + 'NodesSearched' : [ 0x801c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], + 'SequenceNumber' : [ 0x8024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], + 'DepthLimitHits' : [ 0x8030, ['unsigned long']], + 'SearchLimitHits' : [ 0x8034, ['unsigned long']], + 'StackLimitHits' : [ 0x8038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x803c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x8040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x8044, ['unsigned long']], + 'TotalReleases' : [ 0x8048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x804c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x8050, ['unsigned long']], + 'Instigator' : [ 0x8058, ['pointer64', ['void']]], + 'NumberOfParticipants' : [ 0x8060, ['unsigned long']], + 'Participant' : [ 0x8068, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x8168, ['long']], + 'StackType' : [ 0x816c, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x8170, ['unsigned long long']], + 'StackHighLimit' : [ 0x8178, ['unsigned long long']], +} ], + 'DOCK_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], + 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x3c8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long long']], + 'PageSize' : [ 0x18, ['unsigned long']], + 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x28, ['unsigned long long']], + 'FeatureFlags' : [ 0x30, ['unsigned long long']], + 'HiberFlags' : [ 0x38, ['unsigned char']], + 'spare' : [ 0x39, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x3c, ['unsigned long']], + 'HiberVa' : [ 0x40, ['unsigned long long']], + 'NoFreePages' : [ 0x48, ['unsigned long']], + 'FreeMapCheck' : [ 0x4c, ['unsigned long']], + 'WakeCheck' : [ 0x50, ['unsigned long']], + 'NumPagesForLoader' : [ 0x58, ['unsigned long long']], + 'FirstSecureRestorePage' : [ 0x60, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x68, ['unsigned long long']], + 'FirstKernelRestorePage' : [ 0x70, ['unsigned long long']], + 'FirstChecksumRestorePage' : [ 0x78, ['unsigned long long']], + 'NoChecksumEntries' : [ 0x80, ['unsigned long long']], + 'PerfInfo' : [ 0x88, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x270, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x278, ['array', 1, ['unsigned long long']]], + 'SiLogOffset' : [ 0x280, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x284, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x288, ['array', 24, ['unsigned long long']]], + 'NotUsed' : [ 0x348, ['unsigned long']], + 'ResumeContextCheck' : [ 0x34c, ['unsigned long']], + 'ResumeContextPages' : [ 0x350, ['unsigned long']], + 'Hiberboot' : [ 0x354, ['unsigned char']], + 'HvCr3' : [ 0x358, ['unsigned long long']], + 'HvEntryPoint' : [ 0x360, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x368, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x370, ['unsigned long long']], + 'BootFlags' : [ 0x378, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x380, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x388, ['unsigned long long']], + 'BitlockerKeyPfns' : [ 0x390, ['array', 4, ['unsigned long long']]], + 'HardwareSignature' : [ 0x3b0, ['unsigned long']], + 'SMBiosTablePhysicalAddress' : [ 0x3b8, ['_LARGE_INTEGER']], + 'SMBiosTableLength' : [ 0x3c0, ['unsigned long']], + 'SMBiosMajorVersion' : [ 0x3c4, ['unsigned char']], + 'SMBiosMinorVersion' : [ 0x3c5, ['unsigned char']], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_KTIMER' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], + 'Processor' : [ 0x38, ['unsigned long']], + 'Period' : [ 0x3c, ['unsigned long']], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { + 'PageHashes' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x60, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x10, ['unsigned long']], + 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x2c, ['unsigned long']], + 'WorkSpace' : [ 0x30, ['long long']], + 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x3c, ['unsigned long']], + 'BusNumber' : [ 0x40, ['unsigned long']], + 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_MI_PAGING_IO_STATE' : [ 0x50, { + 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], + 'PageFileHeadSpinLock' : [ 0x8, ['long']], + 'PrefetchSeekThreshold' : [ 0xc, ['long']], + 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], + 'InPageSupportSListMinimum' : [ 0x30, ['array', 2, ['unsigned char']]], + 'InPageSinglePages' : [ 0x34, ['unsigned long']], + 'DelayPageFaults' : [ 0x38, ['long']], + 'FileCompressionBoundary' : [ 0x3c, ['unsigned long']], + 'MdlsAdjusted' : [ 0x40, ['unsigned char']], +} ], + '_MI_STANDBY_STATE' : [ 0xc0, { + 'TransitionSharedPages' : [ 0x0, ['unsigned long long']], + 'TransitionSharedPagesPeak' : [ 0x8, ['array', 3, ['unsigned long long']]], + 'FirstDecayPage' : [ 0x20, ['unsigned long long']], + 'PfnDecayFreeSList' : [ 0x30, ['_SLIST_HEADER']], + 'PfnRepurposeLog' : [ 0x40, ['pointer64', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'AllocatePfnRepurposeDpc' : [ 0x48, ['_KDPC']], +} ], + '_MI_DECAY_TIMER_LINKAGE' : [ 0x8, { + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x150, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x108, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x148, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_TRIAGE_9F_POWER' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'IrpList' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadList' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'DelayedWorkQueue' : [ 0x18, ['pointer64', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x38, { + 'Page' : [ 0x0, ['array', 1, ['unsigned long long']]], + 'InitialInPageSupport' : [ 0x8, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'PagingFile' : [ 0x10, ['pointer64', ['_MMPAGING_FILE']]], + 'PageFileOffset' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['_RTL_BALANCED_NODE']], +} ], + '_MI_COMBINE_STATE' : [ 0x1a0, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'CombiningThreadCount' : [ 0x4, ['unsigned long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], + 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], + 'CrossPartition' : [ 0x18, ['_MI_PAGE_COMBINING_SUPPORT']], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Type' : [ 0x18, ['unsigned long']], + 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], +} ], + '_PTE_TRACKER' : [ 0x80, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'Count' : [ 0x18, ['unsigned long long']], + 'SystemVa' : [ 0x20, ['pointer64', ['void']]], + 'StartVa' : [ 0x28, ['pointer64', ['void']]], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'GuardPte' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x48, ['array', 7, ['pointer64', ['void']]]], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_HIVE_WAIT_PACKET' : [ 0x28, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Next' : [ 0x20, ['pointer64', ['_HIVE_WAIT_PACKET']]], +} ], + '_VF_AVL_TREE_NODE_EX' : [ 0x18, { + 'Base' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'SessionId' : [ 0x10, ['unsigned long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_CM_INDEX' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], + 'HashKey' : [ 0x4, ['_CM_COMPONENT_HASH']], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_MMPAGING_FILE' : [ 0x120, { + 'Size' : [ 0x0, ['unsigned long long']], + 'MaximumSize' : [ 0x8, ['unsigned long long']], + 'MinimumSize' : [ 0x10, ['unsigned long long']], + 'FreeSpace' : [ 0x18, ['unsigned long long']], + 'PeakUsage' : [ 0x20, ['unsigned long long']], + 'HighestPage' : [ 0x28, ['unsigned long long']], + 'FreeReservationSpace' : [ 0x30, ['unsigned long long']], + 'File' : [ 0x38, ['pointer64', ['_FILE_OBJECT']]], + 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x50, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x60, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x70, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x78, ['unsigned long']], + 'LargestAllocationCluster' : [ 0x7c, ['unsigned long']], + 'RefreshAllocationCluster' : [ 0x80, ['unsigned long']], + 'LastRefreshAllocationCluster' : [ 0x84, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x88, ['unsigned long']], + 'MaximumRunLengthInBitmaps' : [ 0x8c, ['unsigned long']], + 'BitmapsCacheLengthTree' : [ 0x90, ['_RTL_RB_TREE']], + 'BitmapsCacheLocationTree' : [ 0xa0, ['_RTL_RB_TREE']], + 'BitmapsCacheFreeList' : [ 0xb0, ['_LIST_ENTRY']], + 'BitmapsCacheEntries' : [ 0xc0, ['pointer64', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], + 'ToBeEvictedCount' : [ 0xc8, ['unsigned long']], + 'HybridPriority' : [ 0xc8, ['unsigned long']], + 'PageFileNumber' : [ 0xcc, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0xcc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'NoReservations' : [ 0xcc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'VirtualStorePagefile' : [ 0xcc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SwapSupported' : [ 0xcc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'NodeInserted' : [ 0xcc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'StackNotified' : [ 0xcc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0xcc, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], + 'AdriftMdls' : [ 0xce, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0xce, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'IgnoreReservations' : [ 0xcf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare2' : [ 0xcf, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0xd0, ['unsigned long']], + 'PageHashPagesPeak' : [ 0xd4, ['unsigned long']], + 'PageHash' : [ 0xd8, ['pointer64', ['unsigned long']]], + 'FileHandle' : [ 0xe0, ['pointer64', ['void']]], + 'Lock' : [ 0xe8, ['unsigned long long']], + 'LockOwner' : [ 0xf0, ['pointer64', ['_ETHREAD']]], + 'FlowThroughReadRoot' : [ 0xf8, ['_RTL_AVL_TREE']], + 'Partition' : [ 0x100, ['pointer64', ['_MI_PARTITION']]], + 'FileObjectNode' : [ 0x108, ['_RTL_BALANCED_NODE']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_HVIEW_MAP' : [ 0x4b0, { + 'MappedLength' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Directory' : [ 0x18, ['pointer64', ['_HVIEW_MAP_DIRECTORY']]], + 'PagesCharged' : [ 0x20, ['unsigned long']], + 'PinLog' : [ 0x28, ['_HVIEW_MAP_PIN_LOG']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x20, ['long']], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'WatchdogTimerInfo' : [ 0x30, ['pointer64', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x18, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned short']], + 'Flags' : [ 0x16, ['unsigned short']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PAGELIST_STATE' : [ 0x10, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], +} ], + '_CRITICAL_PROCESS_EXCEPTION_DATA' : [ 0x30, { + 'ReportId' : [ 0x0, ['_GUID']], + 'ModuleName' : [ 0x10, ['_UNICODE_STRING']], + 'ModuleTimestamp' : [ 0x20, ['unsigned long']], + 'ModuleSize' : [ 0x24, ['unsigned long']], + 'Offset' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_2770' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2772' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_2770']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2772']], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x408, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_RELATION_LIST' : [ 0x10, { + 'DeviceObjectList' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT_LIST']]], + 'Sorted' : [ 0x8, ['unsigned char']], +} ], + '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x10, { + 'Validation' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'TrackedOffsetCallback' : [ 0x8, ['pointer64', ['void']]], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ulTargetPlatform' : [ 0x8, ['unsigned long']], + 'ullContextMinimum' : [ 0x10, ['unsigned long long']], + 'guPlatform' : [ 0x18, ['_GUID']], + 'guMinPlatform' : [ 0x28, ['_GUID']], + 'ulContextSource' : [ 0x38, ['unsigned long']], + 'ulElementCount' : [ 0x3c, ['unsigned long']], + 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x10, ['unsigned long']], + 'LowboxMap' : [ 0x18, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_POP_IO_INFO' : [ 0x70, { + 'DumpMdl' : [ 0x0, ['pointer64', ['_MDL']]], + 'IoStatus' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x10, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x18, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x20, ['unsigned long long']], + 'RequestSize' : [ 0x28, ['unsigned long long']], + 'IoLocation' : [ 0x30, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x38, ['unsigned long long']], + 'Buffer' : [ 0x40, ['pointer64', ['void']]], + 'AsyncCapable' : [ 0x48, ['unsigned char']], + 'BytesToRead' : [ 0x50, ['unsigned long long']], + 'Pages' : [ 0x58, ['unsigned long']], + 'HighestChecksumIndex' : [ 0x60, ['unsigned long long']], + 'PreviousChecksum' : [ 0x68, ['unsigned short']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x58, { + 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'AppContainerNumber' : [ 0x30, ['unsigned long']], + 'PackageSid' : [ 0x38, ['pointer64', ['void']]], + 'CapabilitiesHash' : [ 0x40, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x48, ['pointer64', ['void']]], + 'SecurityAttributes' : [ 0x50, ['pointer64', ['void']]], +} ], + '_MMWSL_INSTANCE' : [ 0x1a0, { + 'NextSlot' : [ 0x0, ['unsigned long long']], + 'NextAgingSlot' : [ 0x8, ['unsigned long long']], + 'NextAccessClearingSlot' : [ 0x10, ['unsigned long long']], + 'LastAccessClearingRemainder' : [ 0x18, ['unsigned long']], + 'LastAgingRemainder' : [ 0x1c, ['unsigned long']], + 'ActiveWsleCounts' : [ 0x20, ['array', 16, ['unsigned long long']]], + 'ActiveWsles' : [ 0xa0, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], +} ], + '_MIPFNBLINK' : [ 0x8, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeBlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 56, native_type='unsigned long long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 60, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 62, native_type='unsigned long long')]], + 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], + 'Lock' : [ 0x0, ['long long']], + 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 62, native_type='unsigned long long')]], + 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 62, end_bit = 63, native_type='unsigned long long')]], + 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { + 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], + 'Object' : [ 0x10, ['pointer64', ['void']]], + 'TargetAccess' : [ 0x18, ['unsigned long']], + 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x24, ['unsigned long']], +} ], + '_PPM_COORDINATED_SELECTION' : [ 0x18, { + 'MaximumStates' : [ 0x0, ['unsigned long']], + 'SelectedStates' : [ 0x4, ['unsigned long']], + 'DefaultSelection' : [ 0x8, ['unsigned long']], + 'Selection' : [ 0x10, ['pointer64', ['unsigned long']]], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x10, ['pointer64', ['void']]], + 'Key' : [ 0x18, ['unsigned long long']], + 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], +} ], + '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], + 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], + 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], + 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], + 'LoaderFlags' : [ 0x68, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], + 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '__unnamed_27b3' : [ 0x38, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x30, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x78, { + 'Status' : [ 0x0, ['long']], + 'PartitionId' : [ 0x4, ['unsigned short']], + 'Priority' : [ 0x6, ['unsigned char']], + 'IrpPriority' : [ 0x7, ['unsigned char']], + 'ReservationWrite' : [ 0x8, ['unsigned char']], + 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x18, ['unsigned long long']], + 'ModifiedPagesTotal' : [ 0x20, ['unsigned long long']], + 'ModifiedPagefilePages' : [ 0x28, ['unsigned long long']], + 'ModifiedNoWritePages' : [ 0x30, ['unsigned long long']], + 'ModifiedPagefileNoReservationPages' : [ 0x38, ['unsigned long long']], + 'MdlHack' : [ 0x40, ['__unnamed_27b3']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { + 'Va' : [ 0x0, ['unsigned long long']], + 'Key' : [ 0x8, ['unsigned long']], + 'Pattern' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolType' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], + 'SlushSize' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_27c0' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_27c0']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x40, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'LastTotalAllocates' : [ 0x24, ['unsigned long']], + 'LastAllocateMisses' : [ 0x28, ['unsigned long']], + 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'UtilityTotal' : [ 0x8, ['unsigned long']], + 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], + 'FrequencyTotal' : [ 0x10, ['unsigned long']], + 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], + 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_DEVICE_RELATIONS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '__unnamed_27d1' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_27d4' : [ 0x8, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x88, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x40, ['__unnamed_27d1']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], + 'u4' : [ 0x78, ['__unnamed_27d4']], + 'FileObject' : [ 0x80, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1f, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1e, ['unsigned char']], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x408, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_UMS_CONTROL_BLOCK' : [ 0x90, { + 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], + 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], + 'UmsQueue' : [ 0x20, ['_KQUEUE']], + 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], + 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], + 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], + 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], + 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], + 'UmsWaitEvent' : [ 0x30, ['_KEVENT']], + 'StagingArea' : [ 0x48, ['pointer64', ['void']]], + 'UmsPrimaryDeliveredContext' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsFlags' : [ 0x50, ['unsigned long']], + 'TebSelector' : [ 0x88, ['unsigned short']], +} ], + '_KTM' : [ 0x3c0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x8, ['_KMUTANT']], + 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x70, ['_GUID']], + 'Flags' : [ 0x80, ['unsigned long']], + 'VolatileFlags' : [ 0x84, ['unsigned long']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], + 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], + 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x288, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], + 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], + 'LogFlags' : [ 0x378, ['unsigned long']], + 'LogFullStatus' : [ 0x37c, ['long']], + 'RecoveryStatus' : [ 0x380, ['long']], + 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], +} ], + '_PO_IRP_QUEUE' : [ 0x10, { + 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], +} ], + '_KALPC_WORK_ON_BEHALF_DATA' : [ 0x8, { + 'Ticket' : [ 0x0, ['_ALPC_WORK_ON_BEHALF_TICKET']], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x58, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0x120, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x68, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x68, ['unsigned long']], + 'PackagedBinary' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x68, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x68, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LoadConfigProcessed' : [ 0x68, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x68, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x68, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x68, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x68, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x68, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x68, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x68, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x68, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x68, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x68, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x68, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x68, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x6c, ['unsigned short']], + 'TlsIndex' : [ 0x6e, ['unsigned short']], + 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x80, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x90, ['pointer64', ['void']]], + 'DdagNode' : [ 0x98, ['pointer64', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0xa0, ['_LIST_ENTRY']], + 'LoadContext' : [ 0xb0, ['pointer64', ['_LDRP_LOAD_CONTEXT']]], + 'ParentDllBase' : [ 0xb8, ['pointer64', ['void']]], + 'SwitchBackContext' : [ 0xc0, ['pointer64', ['void']]], + 'BaseAddressIndexNode' : [ 0xc8, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0xe0, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0xf8, ['unsigned long long']], + 'LoadTime' : [ 0x100, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x108, ['unsigned long']], + 'LoadReason' : [ 0x10c, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x110, ['unsigned long']], + 'ReferenceCount' : [ 0x114, ['unsigned long']], + 'DependentLoadFlags' : [ 0x118, ['unsigned long']], +} ], + '_KTIMER2_COLLECTION' : [ 0x18, { + 'Tree' : [ 0x0, ['_RTL_RB_TREE']], + 'NextDueTime' : [ 0x10, ['unsigned long long']], +} ], + '_VF_WATCHDOG_IRP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'DueTickCount' : [ 0x18, ['unsigned long']], + 'Inserted' : [ 0x1c, ['unsigned char']], + 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 32, native_type='unsigned long')]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_MI_PARTITION_MODWRITES' : [ 0x2d0, { + 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], + 'PageFileContract' : [ 0x60, ['_MMPAGE_FILE_EXPANSION']], + 'NumberOfMappedMdls' : [ 0xc0, ['unsigned long long']], + 'NumberOfMappedMdlsInUse' : [ 0xc8, ['long']], + 'NumberOfMappedMdlsInUsePeak' : [ 0xcc, ['unsigned long']], + 'MappedFileHeader' : [ 0xd0, ['_MMMOD_WRITER_LISTHEAD']], + 'NeedMappedMdl' : [ 0xf8, ['unsigned char']], + 'NeedPageFileMdl' : [ 0xf9, ['unsigned char']], + 'TransitionInserted' : [ 0xfa, ['unsigned char']], + 'LastModifiedWriteError' : [ 0xfc, ['long']], + 'LastMappedWriteError' : [ 0x100, ['long']], + 'MappedFileWriteSucceeded' : [ 0x104, ['unsigned long']], + 'MappedWriteBurstCount' : [ 0x108, ['unsigned long']], + 'LowPriorityModWritesOutstanding' : [ 0x10c, ['unsigned long']], + 'BoostModWriteIoPriorityEvent' : [ 0x110, ['_KEVENT']], + 'ModifiedWriterThreadPriority' : [ 0x128, ['long']], + 'ModifiedPagesLowPriorityGoal' : [ 0x130, ['unsigned long long']], + 'ModifiedPageWriterEvent' : [ 0x138, ['_KEVENT']], + 'ModifiedWriterExitedEvent' : [ 0x150, ['_KEVENT']], + 'WriteAllPagefilePages' : [ 0x168, ['long']], + 'WriteAllMappedPages' : [ 0x16c, ['long']], + 'MappedPageWriterEvent' : [ 0x170, ['_KEVENT']], + 'ModWriteData' : [ 0x188, ['_MI_MODWRITE_DATA']], + 'RescanPageFilesEvent' : [ 0x1c8, ['_KEVENT']], + 'PagingFileHeader' : [ 0x1e0, ['_MMMOD_WRITER_LISTHEAD']], + 'ModifiedPageWriterThread' : [ 0x208, ['pointer64', ['_ETHREAD']]], + 'ModifiedPageWriterRundown' : [ 0x210, ['_EX_RUNDOWN_REF']], + 'PagefileScanWorkItem' : [ 0x218, ['_WORK_QUEUE_ITEM']], + 'PagefileScanCount' : [ 0x238, ['unsigned long']], + 'ClusterWritesDisabled' : [ 0x23c, ['array', 2, ['long']]], + 'NotifyStoreMemoryConditions' : [ 0x248, ['_KEVENT']], + 'DelayMappedWrite' : [ 0x260, ['unsigned char']], + 'PagefileReservationsEnabled' : [ 0x264, ['unsigned long']], + 'PageFileCreationLock' : [ 0x268, ['_EX_PUSH_LOCK']], + 'TrimPagefileWorkItem' : [ 0x270, ['_WORK_QUEUE_ITEM']], + 'LastTrimPagefileTime' : [ 0x290, ['unsigned long long']], + 'WsSwapPagefileContractWorkItem' : [ 0x298, ['_WORK_QUEUE_ITEM']], + 'WsSwapPageFileContractionInProgress' : [ 0x2b8, ['long']], + 'WorkingSetSwapLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'WorkingSetInswapLock' : [ 0x2c8, ['long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_OB_EXTENDED_PARSE_PARAMETERS' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'RestrictedAccessMask' : [ 0x4, ['unsigned long']], + 'Silo' : [ 0x8, ['pointer64', ['_EJOB']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_RTL_AVL_TABLE' : [ 0x68, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], + 'WhichOrderedElement' : [ 0x28, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], + 'DepthOfTree' : [ 0x30, ['unsigned long']], + 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x40, ['unsigned long']], + 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], + 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], + 'TableContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'Flags' : [ 0x28, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], + 'SpareUSHORT' : [ 0x2e, ['unsigned short']], +} ], + '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned char']], + 'DripsRequiredState' : [ 0xc, ['unsigned long']], + 'Level' : [ 0x10, ['long']], + 'ActiveStamp' : [ 0x18, ['long long']], + 'CsActiveTime' : [ 0x20, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x28, ['long long']], +} ], + '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long']], + 'Weight' : [ 0x0, ['unsigned short']], + 'MinRate' : [ 0x0, ['unsigned short']], + 'MaxRate' : [ 0x2, ['unsigned short']], + 'AllFlags' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_POLICY_DEVICE' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], +} ], + '_INVERTED_FUNCTION_TABLE_ENTRY' : [ 0x18, { + 'FunctionTable' : [ 0x0, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'DynamicTable' : [ 0x0, ['pointer64', ['_DYNAMIC_FUNCTION_TABLE']]], + 'ImageBase' : [ 0x8, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'SizeOfTable' : [ 0x14, ['unsigned long']], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x78, { + 'SelectedCount' : [ 0x0, ['unsigned long long']], + 'VetoCount' : [ 0x8, ['unsigned long long']], + 'PreVetoCount' : [ 0x10, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'IdleDurationCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], + 'InterruptibleCount' : [ 0x48, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], + 'CstateCheckCount' : [ 0x58, ['unsigned long long']], + 'NoCStateCount' : [ 0x60, ['unsigned long long']], + 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], + 'PreVetoAccounting' : [ 0x70, ['pointer64', ['_PPM_VETO_ACCOUNTING']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '__unnamed_285d' : [ 0x4, { + 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], + 'Long' : [ 0x0, ['long']], +} ], + '_MI_PARTITION_STORES' : [ 0x90, { + 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_285d']], + 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], + 'Registered' : [ 0x8, ['unsigned long']], + 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], + 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], + 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], + 'WriteIssueFailures' : [ 0x18, ['unsigned long']], + 'EvictionThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'EvictEvent' : [ 0x28, ['_KEVENT']], + 'EvictFlushCompleteEvent' : [ 0x40, ['_KEVENT']], + 'WriteSupportSListHead' : [ 0x60, ['_SLIST_HEADER']], + 'EvictFlushLock' : [ 0x70, ['long']], + 'ModifiedWriteFailedBitmap' : [ 0x78, ['pointer64', ['_RTL_BITMAP']]], + 'StoreProcess' : [ 0x80, ['pointer64', ['_EPROCESS']]], +} ], + '_POP_FX_COMPONENT' : [ 0x100, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x18, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x58, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x60, ['long']], + 'ActiveEvent' : [ 0x68, ['_KEVENT']], + 'IdleLock' : [ 0x80, ['unsigned long long']], + 'IdleConditionComplete' : [ 0x88, ['long']], + 'IdleStateComplete' : [ 0x8c, ['long']], + 'IdleStamp' : [ 0x90, ['unsigned long long']], + 'CurrentIdleState' : [ 0x98, ['unsigned long']], + 'IdleStateCount' : [ 0x9c, ['unsigned long']], + 'IdleStates' : [ 0xa0, ['pointer64', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0xa8, ['unsigned long']], + 'ProviderCount' : [ 0xac, ['unsigned long']], + 'Providers' : [ 0xb0, ['pointer64', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0xb8, ['unsigned long']], + 'DependentCount' : [ 0xbc, ['unsigned long']], + 'Dependents' : [ 0xc0, ['pointer64', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0xc8, ['_POP_FX_ACCOUNTING']], + 'Performance' : [ 0xf8, ['pointer64', ['_POP_FX_PERF_INFO']]], +} ], + '_DYNAMIC_FUNCTION_TABLE' : [ 0x70, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FunctionTable' : [ 0x10, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'TimeStamp' : [ 0x18, ['_LARGE_INTEGER']], + 'MinimumAddress' : [ 0x20, ['unsigned long long']], + 'MaximumAddress' : [ 0x28, ['unsigned long long']], + 'BaseAddress' : [ 0x30, ['unsigned long long']], + 'Callback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'OutOfProcessCallbackDll' : [ 0x48, ['pointer64', ['wchar']]], + 'Type' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'RF_SORTED', 1: 'RF_UNSORTED', 2: 'RF_CALLBACK', 3: 'RF_KERNEL_DYNAMIC'})]], + 'EntryCount' : [ 0x54, ['unsigned long']], + 'TreeNode' : [ 0x58, ['_RTL_BALANCED_NODE']], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], + 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], +} ], + '_MMPAGE_FILE_EXPANSION' : [ 0x60, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'DereferenceList' : [ 0x8, ['_LIST_ENTRY']], + 'Partition' : [ 0x18, ['pointer64', ['_MI_PARTITION']]], + 'RequestedExpansionSize' : [ 0x20, ['unsigned long long']], + 'ActualExpansion' : [ 0x28, ['unsigned long long']], + 'Event' : [ 0x30, ['_KEVENT']], + 'InProgress' : [ 0x48, ['long']], + 'u' : [ 0x4c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], + 'ActiveEntry' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'AttemptForCantExtend' : [ 0x58, ['unsigned char']], + 'PageFileContract' : [ 0x59, ['unsigned char']], +} ], + '_LAZY_WRITER' : [ 0x88, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x40, ['_KTIMER']], + 'ScanActive' : [ 0x80, ['unsigned char']], + 'OtherWork' : [ 0x81, ['unsigned char']], + 'PendingTeardownScan' : [ 0x82, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], + 'PendingPowerScan' : [ 0x85, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x86, ['unsigned char']], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'Unused' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '_HVIEW_MAP_PIN_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], +} ], + '_IO_REMOVE_LOCK' : [ 0x20, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x10, { + 'Stream' : [ 0x0, ['pointer64', ['void']]], + 'Detail' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2891' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_2891']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_MI_POOL_STATE' : [ 0xf8, { + 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long long']], + 'NonPagedPoolSListMaximum' : [ 0x8, ['array', 3, ['unsigned long']]], + 'AllocatedNonPagedPool' : [ 0x18, ['unsigned long long']], + 'BadPoolHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'HighEventSets' : [ 0x28, ['unsigned long']], + 'HighEventSetsValid' : [ 0x2c, ['unsigned char']], + 'PoolFailures' : [ 0x30, ['array', 3, ['array', 3, ['unsigned long']]]], + 'PoolFailureReasons' : [ 0x54, ['_MI_POOL_FAILURE_REASONS']], + 'LowPagedPoolThreshold' : [ 0x80, ['unsigned long long']], + 'HighPagedPoolThreshold' : [ 0x88, ['unsigned long long']], + 'PagedPoolSListMaximum' : [ 0x90, ['unsigned long']], + 'PreemptiveTrims' : [ 0x94, ['array', 4, ['unsigned long']]], + 'SpecialPagesInUsePeak' : [ 0xa8, ['unsigned long long']], + 'SpecialPoolRejected' : [ 0xb0, ['array', 9, ['unsigned long']]], + 'SpecialPagesNonPaged' : [ 0xd8, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0xe0, ['long']], + 'SessionSpecialPoolPdesMax' : [ 0xe4, ['unsigned long']], + 'TotalPagedPoolQuota' : [ 0xe8, ['unsigned long long']], + 'TotalNonPagedPoolQuota' : [ 0xf0, ['unsigned long long']], +} ], + '_IMAGE_RUNTIME_FUNCTION_ENTRY' : [ 0xc, { + 'BeginAddress' : [ 0x0, ['unsigned long']], + 'EndAddress' : [ 0x4, ['unsigned long']], + 'UnwindInfoAddress' : [ 0x8, ['unsigned long']], + 'UnwindData' : [ 0x8, ['unsigned long']], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x40, { + 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], + 'ZeroBits' : [ 0x8, ['unsigned long']], + 'MaximumStackSize' : [ 0x10, ['unsigned long long']], + 'CommittedStackSize' : [ 0x18, ['unsigned long long']], + 'SubSystemType' : [ 0x20, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], + 'SubSystemVersion' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'OperatingSystemVersion' : [ 0x28, ['unsigned long']], + 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], + 'DllCharacteristics' : [ 0x2e, ['unsigned short']], + 'Machine' : [ 0x30, ['unsigned short']], + 'ImageContainsCode' : [ 0x32, ['unsigned char']], + 'ImageFlags' : [ 0x33, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ComPlusPrefer32bit' : [ 0x33, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x34, ['unsigned long']], + 'ImageFileSize' : [ 0x38, ['unsigned long']], + 'CheckSum' : [ 0x3c, ['unsigned long']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x30, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'ConnectLock' : [ 0x8, ['_KEVENT']], + 'LineMasked' : [ 0x20, ['unsigned char']], + 'InterruptList' : [ 0x28, ['pointer64', ['_KINTERRUPT']]], +} ], + '_PPM_SELECTION_DEPENDENCY' : [ 0x18, { + 'Processor' : [ 0x0, ['unsigned long']], + 'Menu' : [ 0x8, ['_PPM_SELECTION_MENU']], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_CM_WORKITEM' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x10, ['unsigned long']], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Parameter' : [ 0x20, ['pointer64', ['void']]], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], +} ], + '_MI_HARDWARE_STATE' : [ 0x100, { + 'NodeMask' : [ 0x0, ['unsigned long']], + 'NodeGraph' : [ 0x8, ['pointer64', ['unsigned short']]], + 'SystemNodeInformation' : [ 0x10, ['pointer64', ['_MI_SYSTEM_NODE_INFORMATION']]], + 'NumaLastRangeIndex' : [ 0x18, ['unsigned long']], + 'NumaMemoryRanges' : [ 0x20, ['pointer64', ['_HAL_NODE_RANGE']]], + 'NumaTableCaptured' : [ 0x28, ['unsigned char']], + 'NodeShift' : [ 0x29, ['unsigned char']], + 'ChannelMemoryRanges' : [ 0x30, ['pointer64', ['_HAL_CHANNEL_MEMORY_RANGES']]], + 'ChannelShift' : [ 0x38, ['unsigned char']], + 'SecondLevelCacheSize' : [ 0x3c, ['unsigned long']], + 'FirstLevelCacheSize' : [ 0x40, ['unsigned long']], + 'PhysicalAddressBits' : [ 0x44, ['unsigned long']], + 'AllMainMemoryMustBeCached' : [ 0x48, ['unsigned char']], + 'TotalPagesAllowed' : [ 0x50, ['unsigned long long']], + 'SecondaryColorMask' : [ 0x58, ['unsigned long']], + 'SecondaryColors' : [ 0x5c, ['unsigned long']], + 'FlushTbForAttributeChange' : [ 0x60, ['unsigned long']], + 'FlushCacheForAttributeChange' : [ 0x64, ['unsigned long']], + 'FlushCacheForPageAttributeChange' : [ 0x68, ['unsigned long']], + 'CacheFlushPromoteThreshold' : [ 0x6c, ['unsigned long']], + 'FlushTbThreshold' : [ 0x70, ['unsigned long long']], + 'OptimalZeroingAttribute' : [ 0x78, ['array', 4, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'MiNonCached', 1: 'MiCached', 2: 'MiWriteCombined', 3: 'MiNotMapped'})]]]], + 'AttributeChangeRequiresReZero' : [ 0xb8, ['unsigned char']], + 'ZeroCostCounts' : [ 0xc0, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], + 'PrimaryPfns' : [ 0xe0, ['unsigned long long']], + 'HighestPossiblePhysicalPage' : [ 0xe8, ['unsigned long long']], + 'EnclaveRegions' : [ 0xf0, ['_RTL_AVL_TREE']], + 'VsmKernelPageCount' : [ 0xf8, ['unsigned long long']], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x28, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x8, ['_LIST_ENTRY']], + 'CsAccountingBlocks' : [ 0x18, ['unsigned char']], + 'BlocksDrips' : [ 0x19, ['unsigned char']], + 'PreallocatedVetoCount' : [ 0x1c, ['unsigned long']], + 'PreallocatedVetoList' : [ 0x20, ['pointer64', ['_PPM_VETO_ENTRY']]], +} ], + '__unnamed_28be' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_28be']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_SYSPTES_HEADER' : [ 0x118, { + 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], + 'Count' : [ 0x100, ['unsigned long long']], + 'NumberOfEntries' : [ 0x108, ['unsigned long long']], + 'NumberOfEntriesPeak' : [ 0x110, ['unsigned long long']], +} ], + '_MI_ERROR_STATE' : [ 0xb8, { + 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], + 'ProbeRaises' : [ 0x38, ['_MI_PROBE_RAISE_TRACKER']], + 'ForcedCommits' : [ 0x78, ['_MI_FORCED_COMMITS']], + 'WsleFailures' : [ 0x80, ['array', 2, ['unsigned long']]], + 'WsLinear' : [ 0x88, ['unsigned long']], + 'PageHashErrors' : [ 0x8c, ['unsigned long']], + 'CheckZeroCount' : [ 0x90, ['unsigned long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x94, ['long']], + 'BadPagesDetected' : [ 0x98, ['long']], + 'ScrubPasses' : [ 0x9c, ['long']], + 'ScrubBadPagesFound' : [ 0xa0, ['long']], + 'UserViewFailures' : [ 0xa4, ['unsigned long']], + 'UserViewCollisionFailures' : [ 0xa8, ['unsigned long']], + 'ResavailFailures' : [ 0xac, ['_MI_RESAVAIL_FAILURES']], + 'PendingBadPages' : [ 0xb4, ['unsigned char']], + 'InitFailure' : [ 0xb5, ['unsigned char']], + 'StopBadMaps' : [ 0xb6, ['unsigned char']], +} ], + '_PROC_PERF_DOMAIN' : [ 0x190, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], + 'Members' : [ 0x18, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0xc0, ['unsigned long']], + 'EfficiencyClass' : [ 0xc4, ['unsigned char']], + 'NominalPerformanceClass' : [ 0xc5, ['unsigned char']], + 'HighestPerformanceClass' : [ 0xc6, ['unsigned char']], + 'Spare' : [ 0xc7, ['unsigned char']], + 'Processors' : [ 0xc8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0xd0, ['pointer64', ['void']]], + 'TimeWindowHandler' : [ 0xd8, ['pointer64', ['void']]], + 'BoostPolicyHandler' : [ 0xe0, ['pointer64', ['void']]], + 'BoostModeHandler' : [ 0xe8, ['pointer64', ['void']]], + 'EnergyPerfPreferenceHandler' : [ 0xf0, ['pointer64', ['void']]], + 'AutonomousActivityWindowHandler' : [ 0xf8, ['pointer64', ['void']]], + 'AutonomousModeHandler' : [ 0x100, ['pointer64', ['void']]], + 'ReinitializeHandler' : [ 0x108, ['pointer64', ['void']]], + 'PerfSelectionHandler' : [ 0x110, ['pointer64', ['void']]], + 'PerfControlHandler' : [ 0x118, ['pointer64', ['void']]], + 'MaxFrequency' : [ 0x120, ['unsigned long']], + 'NominalFrequency' : [ 0x124, ['unsigned long']], + 'MaxPercent' : [ 0x128, ['unsigned long']], + 'MinPerfPercent' : [ 0x12c, ['unsigned long']], + 'MinThrottlePercent' : [ 0x130, ['unsigned long']], + 'MinimumRelativePerformance' : [ 0x138, ['unsigned long long']], + 'NominalRelativePerformance' : [ 0x140, ['unsigned long long']], + 'Coordination' : [ 0x148, ['unsigned char']], + 'HardPlatformCap' : [ 0x149, ['unsigned char']], + 'AffinitizeControl' : [ 0x14a, ['unsigned char']], + 'EfficientThrottle' : [ 0x14b, ['unsigned char']], + 'AutonomousMode' : [ 0x14c, ['unsigned char']], + 'SelectedPercent' : [ 0x150, ['unsigned long']], + 'SelectedFrequency' : [ 0x154, ['unsigned long']], + 'DesiredPercent' : [ 0x158, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x15c, ['unsigned long']], + 'MinPolicyPercent' : [ 0x160, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x164, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x168, ['unsigned long']], + 'GuaranteedPercent' : [ 0x16c, ['unsigned long']], + 'TolerancePercent' : [ 0x170, ['unsigned long']], + 'SelectedState' : [ 0x178, ['unsigned long long']], + 'PerfChangeTime' : [ 0x180, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0x188, ['unsigned long']], + 'Force' : [ 0x18c, ['unsigned char']], + 'ProvideGuidance' : [ 0x18d, ['unsigned char']], +} ], + '_MI_COMMON_PAGE_STATE' : [ 0xa8, { + 'PageOfOnesPfn' : [ 0x0, ['pointer64', ['_MMPFN']]], + 'PageOfOnes' : [ 0x8, ['unsigned long long']], + 'DummyPagePfn' : [ 0x10, ['pointer64', ['_MMPFN']]], + 'DummyPage' : [ 0x18, ['unsigned long long']], + 'PageOfZeroes' : [ 0x20, ['unsigned long long']], + 'ZeroMapping' : [ 0x28, ['pointer64', ['void']]], + 'OnesMapping' : [ 0x30, ['pointer64', ['void']]], + 'ZeroCrc' : [ 0x38, ['unsigned long long']], + 'OnesCrc' : [ 0x40, ['unsigned long long']], + 'BitmapGapFrames' : [ 0x48, ['array', 4, ['unsigned long long']]], + 'PfnGapFrames' : [ 0x68, ['array', 4, ['unsigned long long']]], + 'PageTableOfZeroes' : [ 0x88, ['unsigned long long']], + 'PdeOfZeroes' : [ 0x90, ['_MMPTE']], + 'PageTableOfOnes' : [ 0x98, ['unsigned long long']], + 'PdeOfOnes' : [ 0xa0, ['_MMPTE']], +} ], + '_RTL_BALANCED_LINKS' : [ 0x20, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0x18, ['unsigned char']], + 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], +} ], + '_HEAP_EXTENDED_ENTRY' : [ 0x10, { + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'IoTracker' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_POP_COOLING_EXTENSION' : [ 0x90, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'RequestListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Lock' : [ 0x20, ['_POP_RW_LOCK']], + 'DeviceObject' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'NotificationEntry' : [ 0x38, ['pointer64', ['void']]], + 'Enabled' : [ 0x40, ['unsigned char']], + 'ActiveEngaged' : [ 0x41, ['unsigned char']], + 'ThrottleLimit' : [ 0x42, ['unsigned char']], + 'UpdatingToCurrent' : [ 0x43, ['unsigned char']], + 'RemovalFlushEvent' : [ 0x48, ['pointer64', ['_KEVENT']]], + 'PnpFlushEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Interface' : [ 0x58, ['_THERMAL_COOLING_INTERFACE']], +} ], + '__unnamed_28f1' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x58, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x8, ['__unnamed_28f1']], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x20, ['unsigned char']], +} ], + '_POOL_HEADER' : [ 0x10, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'AllocatorBackTraceIndex' : [ 0x8, ['unsigned short']], + 'PoolTagHash' : [ 0xa, ['unsigned short']], +} ], + '_POP_POWER_SETTING_VALUES' : [ 0x13c, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], + 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], + 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], + 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], + 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], + 'AwayModeIgnoreAction' : [ 0xf8, ['long']], + 'DisableFastS4' : [ 0xfc, ['unsigned char']], + 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], + 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], + 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], + 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], + 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], + 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], + 'VideoDimBrightness' : [ 0x114, ['unsigned long']], + 'AlsOffset' : [ 0x118, ['unsigned long']], + 'AlsEnabled' : [ 0x11c, ['unsigned long']], + 'EsBrightness' : [ 0x120, ['unsigned long']], + 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], + 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], + 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], + 'OffloadedAudio' : [ 0x12d, ['unsigned char']], + 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], + 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], + 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], + 'EsAggressive' : [ 0x134, ['unsigned char']], + 'EsUserAwaySetting' : [ 0x135, ['unsigned char']], + 'ConnectivityInStandby' : [ 0x138, ['unsigned long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '__unnamed_2904' : [ 0x8, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x10, { + 'u1' : [ 0x0, ['__unnamed_2904']], + 'EndVa' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_MI_ZERO_COST_COUNTS' : [ 0x10, { + 'NativeSum' : [ 0x0, ['unsigned long long']], + 'CachedSum' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x88, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x40, ['_KDPC']], + 'WorkOrder' : [ 0x80, ['pointer64', ['_POP_FX_WORK_ORDER']]], +} ], + '_ARBITER_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['unsigned long']], +} ], + '__unnamed_2919' : [ 0x20, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x20, { + 'Parameters' : [ 0x0, ['__unnamed_2919']], +} ], + '__unnamed_291d' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2921' : [ 0x18, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_2923' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2925' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_2927' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_2929' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_292b' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_292d' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_292f' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2931' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_2933' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2935' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_291d']], + 'Memory' : [ 0x0, ['__unnamed_291d']], + 'Interrupt' : [ 0x0, ['__unnamed_2921']], + 'Dma' : [ 0x0, ['__unnamed_2923']], + 'DmaV3' : [ 0x0, ['__unnamed_2925']], + 'Generic' : [ 0x0, ['__unnamed_291d']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2927']], + 'BusNumber' : [ 0x0, ['__unnamed_2929']], + 'ConfigData' : [ 0x0, ['__unnamed_292b']], + 'Memory40' : [ 0x0, ['__unnamed_292d']], + 'Memory48' : [ 0x0, ['__unnamed_292f']], + 'Memory64' : [ 0x0, ['__unnamed_2931']], + 'Connection' : [ 0x0, ['__unnamed_2933']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_2935']], +} ], + '_HEAP_UNPACKED_ENTRY' : [ 0x10, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Address' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_DRIVER_EXTENSION' : [ 0x50, { + 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x8, ['pointer64', ['void']]], + 'Count' : [ 0x10, ['unsigned long']], + 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x38, ['pointer64', ['void']]], + 'DvCallbacks' : [ 0x40, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x48, ['pointer64', ['void']]], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x20, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x10, ['pointer64', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0x18, ['pointer64', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x20, ['pointer64', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x28, ['pointer64', ['void']]], + 'RegIndex' : [ 0x30, ['unsigned short']], + 'ReplyIndex' : [ 0x32, ['unsigned short']], + 'Flags' : [ 0x34, ['unsigned long']], +} ], + '_MI_PARTITION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PureHoldingPartition' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0x60, { + 'Count' : [ 0x0, ['unsigned long']], + 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_NON_PAGED_DEBUG_INFO' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Machine' : [ 0x8, ['unsigned short']], + 'Characteristics' : [ 0xa, ['unsigned short']], + 'TimeDateStamp' : [ 0xc, ['unsigned long']], + 'CheckSum' : [ 0x10, ['unsigned long']], + 'SizeOfImage' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { + 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_MMMOD_WRITER_LISTHEAD' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Gate' : [ 0x10, ['_KGATE']], + 'Event' : [ 0x10, ['_KEVENT']], +} ], + '__unnamed_2959' : [ 0x10, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0x108, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x10, ['__unnamed_2959']], + 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], + 'u1' : [ 0x28, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x2c, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x30, ['_KAPC']], + 'ByteCount' : [ 0x88, ['unsigned long']], + 'ChargedPages' : [ 0x8c, ['unsigned long']], + 'PagingFile' : [ 0x90, ['pointer64', ['_MMPAGING_FILE']]], + 'File' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xa0, ['pointer64', ['_CONTROL_AREA']]], + 'FileResource' : [ 0xa8, ['pointer64', ['_ERESOURCE']]], + 'WriteOffset' : [ 0xb0, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'Partition' : [ 0xc0, ['pointer64', ['_MI_PARTITION']]], + 'PointerMdl' : [ 0xc8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0xd0, ['_MDL']], + 'Page' : [ 0x100, ['array', 1, ['unsigned long long']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0xa0, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer64', ['_IRP']]], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x20, ['unsigned char']], + 'IrpOplocksR' : [ 0x28, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x38, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x48, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x58, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x68, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x78, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x88, ['pointer64', ['_GUID']]], + 'OplockState' : [ 0x90, ['unsigned long']], + 'FastMutex' : [ 0x98, ['pointer64', ['_FAST_MUTEX']]], +} ], + '__unnamed_2962' : [ 0x10, { + 'UserData' : [ 0x0, ['pointer64', ['void']]], + 'Owner' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_2963' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_2962']], + 'Merged' : [ 0x10, ['__unnamed_2963']], + 'Attributes' : [ 0x20, ['unsigned char']], + 'PublicFlags' : [ 0x21, ['unsigned char']], + 'PrivateFlags' : [ 0x22, ['unsigned short']], + 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], +} ], + '__unnamed_2967' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2969' : [ 0x10, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_296b' : [ 0x10, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_296d' : [ 0x10, { + 'Raw' : [ 0x0, ['__unnamed_296b']], + 'Translated' : [ 0x0, ['__unnamed_2969']], +} ], + '__unnamed_296f' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2971' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_2973' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2975' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2977' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2979' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_297b' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_297d' : [ 0x10, { + 'Generic' : [ 0x0, ['__unnamed_2967']], + 'Port' : [ 0x0, ['__unnamed_2967']], + 'Interrupt' : [ 0x0, ['__unnamed_2969']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_296d']], + 'Memory' : [ 0x0, ['__unnamed_2967']], + 'Dma' : [ 0x0, ['__unnamed_296f']], + 'DmaV3' : [ 0x0, ['__unnamed_2971']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2927']], + 'BusNumber' : [ 0x0, ['__unnamed_2973']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_2975']], + 'Memory40' : [ 0x0, ['__unnamed_2977']], + 'Memory48' : [ 0x0, ['__unnamed_2979']], + 'Memory64' : [ 0x0, ['__unnamed_297b']], + 'Connection' : [ 0x0, ['__unnamed_2933']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_297d']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x80, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_ETW_FILTER_EVENT_NAME_DATA' : [ 0x28, { + 'FilterIn' : [ 0x0, ['unsigned char']], + 'Level' : [ 0x1, ['unsigned char']], + 'MatchAnyKeyword' : [ 0x8, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x10, ['unsigned long long']], + 'NameTable' : [ 0x18, ['_RTL_HASH_TABLE']], +} ], + '_MI_VISIBLE_STATE' : [ 0x840, { + 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], + 'SessionWsList' : [ 0x50, ['_LIST_ENTRY']], + 'SessionIdBitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'PagedPoolInfo' : [ 0x68, ['_MM_PAGED_POOL_INFO']], + 'MaximumNonPagedPoolInPages' : [ 0xa0, ['unsigned long long']], + 'SizeOfPagedPoolInPages' : [ 0xa8, ['unsigned long long']], + 'SystemPteInfo' : [ 0xb0, ['_MI_SYSTEM_PTE_TYPE']], + 'NonPagedPoolCommit' : [ 0x118, ['unsigned long long']], + 'BootCommit' : [ 0x120, ['unsigned long long']], + 'MdlPagesAllocated' : [ 0x128, ['unsigned long long']], + 'SystemPageTableCommit' : [ 0x130, ['unsigned long long']], + 'SpecialPagesInUse' : [ 0x138, ['unsigned long long']], + 'WsOverheadPages' : [ 0x140, ['unsigned long long']], + 'VadBitmapPages' : [ 0x148, ['unsigned long long']], + 'ProcessCommit' : [ 0x150, ['unsigned long long']], + 'SharedCommit' : [ 0x158, ['unsigned long long']], + 'DriverCommit' : [ 0x160, ['long']], + 'SystemWs' : [ 0x180, ['array', 3, ['_MMSUPPORT_FULL']]], + 'SystemCacheShared' : [ 0x4c0, ['_MMSUPPORT_SHARED']], + 'AggregateSystemWs' : [ 0x540, ['array', 1, ['_MMSUPPORT_AGGREGATION']]], + 'SystemCacheSharedWorkingSetList' : [ 0x560, ['_MMWSL_SHARED']], + 'MapCacheFailures' : [ 0x5c0, ['unsigned long']], + 'PagefileHashPages' : [ 0x5c8, ['unsigned long long']], + 'PteHeader' : [ 0x5d0, ['_SYSPTES_HEADER']], + 'SessionSpecialPool' : [ 0x6e8, ['pointer64', ['_MI_SPECIAL_POOL']]], + 'SystemVaTypeCount' : [ 0x6f0, ['array', 14, ['unsigned long long']]], + 'SystemVaRegions' : [ 0x760, ['array', 14, ['_MI_SYSTEM_VA_ASSIGNMENT']]], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_CM_COMPONENT_HASH' : [ 0x4, { + 'Hash' : [ 0x0, ['unsigned long']], +} ], + '_KSPECIAL_REGISTERS' : [ 0xe0, { + 'Cr0' : [ 0x0, ['unsigned long long']], + 'Cr2' : [ 0x8, ['unsigned long long']], + 'Cr3' : [ 0x10, ['unsigned long long']], + 'Cr4' : [ 0x18, ['unsigned long long']], + 'KernelDr0' : [ 0x20, ['unsigned long long']], + 'KernelDr1' : [ 0x28, ['unsigned long long']], + 'KernelDr2' : [ 0x30, ['unsigned long long']], + 'KernelDr3' : [ 0x38, ['unsigned long long']], + 'KernelDr6' : [ 0x40, ['unsigned long long']], + 'KernelDr7' : [ 0x48, ['unsigned long long']], + 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], + 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], + 'Tr' : [ 0x70, ['unsigned short']], + 'Ldtr' : [ 0x72, ['unsigned short']], + 'MxCsr' : [ 0x74, ['unsigned long']], + 'DebugControl' : [ 0x78, ['unsigned long long']], + 'LastBranchToRip' : [ 0x80, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], + 'Cr8' : [ 0xa0, ['unsigned long long']], + 'MsrGsBase' : [ 0xa8, ['unsigned long long']], + 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], + 'MsrStar' : [ 0xb8, ['unsigned long long']], + 'MsrLStar' : [ 0xc0, ['unsigned long long']], + 'MsrCStar' : [ 0xc8, ['unsigned long long']], + 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], + 'Xcr0' : [ 0xd8, ['unsigned long long']], +} ], + '_RH_OP_CONTEXT' : [ 0x48, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x10, ['pointer64', ['_IRP']]], + 'OplockRequestFileObject' : [ 0x18, ['pointer64', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x28, ['pointer64', ['_ETHREAD']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'AtomicLinks' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_MSUBSECTION' : [ 0x70, { + 'Core' : [ 0x0, ['_SUBSECTION']], + 'SubsectionNode' : [ 0x38, ['_RTL_BALANCED_NODE']], + 'DereferenceList' : [ 0x50, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x60, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x68, ['unsigned long']], +} ], + '_PROC_PERF_CHECK' : [ 0xc0, { + 'LastActive' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'LastStall' : [ 0x10, ['unsigned long long']], + 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], + 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], + 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], + 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], + 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_PEB32' : [ 0x460, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'IsLongPathAwareProcess' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['unsigned long']], + 'ImageBaseAddress' : [ 0x8, ['unsigned long']], + 'Ldr' : [ 0xc, ['unsigned long']], + 'ProcessParameters' : [ 0x10, ['unsigned long']], + 'SubSystemData' : [ 0x14, ['unsigned long']], + 'ProcessHeap' : [ 0x18, ['unsigned long']], + 'FastPebLock' : [ 0x1c, ['unsigned long']], + 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], + 'IFEOKey' : [ 0x24, ['unsigned long']], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], + 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['unsigned long']], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['unsigned long']], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], + 'SparePvoid0' : [ 0x50, ['unsigned long']], + 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], + 'AnsiCodePageData' : [ 0x58, ['unsigned long']], + 'OemCodePageData' : [ 0x5c, ['unsigned long']], + 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['unsigned long']], + 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], + 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['unsigned long']], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], + 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['unsigned long']], + 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], + 'CSDVersion' : [ 0x1f0, ['_STRING32']], + 'ActivationContextData' : [ 0x1f8, ['unsigned long']], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], + 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], + 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['unsigned long']], + 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], + 'FlsBitmap' : [ 0x218, ['unsigned long']], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['unsigned long']], + 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], + 'pUnused' : [ 0x238, ['unsigned long']], + 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], + 'TppWorkerpList' : [ 0x254, ['LIST_ENTRY32']], + 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['unsigned long']]], +} ], + '_MMWSL_FULL' : [ 0x200, { + 'Instance' : [ 0x0, ['_MMWSL_INSTANCE']], + 'Shared' : [ 0x1a0, ['_MMWSL_SHARED']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x1d0, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], + 'Order' : [ 0x30, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x1a8, ['_LIST_ENTRY']], + 'Status' : [ 0x1b8, ['long']], + 'FailedDevice' : [ 0x1c0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x1c8, ['unsigned char']], + 'Cancelled' : [ 0x1c9, ['unsigned char']], + 'IgnoreErrors' : [ 0x1ca, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x1cb, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x1cc, ['unsigned char']], +} ], + '_THERMAL_INFORMATION' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['unsigned long long']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x98, { + 'FileName' : [ 0x0, ['pointer64', ['wchar']]], + 'BaseName' : [ 0x8, ['pointer64', ['wchar']]], + 'RegRootName' : [ 0x10, ['pointer64', ['wchar']]], + 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x20, ['unsigned long']], + 'CmHiveFlags' : [ 0x24, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], + 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'HiveMounted' : [ 0x38, ['unsigned char']], + 'ThreadFinished' : [ 0x39, ['unsigned char']], + 'ThreadStarted' : [ 0x3a, ['unsigned char']], + 'Allocate' : [ 0x3b, ['unsigned char']], + 'WinPERequired' : [ 0x3c, ['unsigned char']], + 'StartEvent' : [ 0x40, ['_KEVENT']], + 'FinishedEvent' : [ 0x58, ['_KEVENT']], + 'MountLock' : [ 0x70, ['_KEVENT']], + 'FilePath' : [ 0x88, ['_UNICODE_STRING']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x178, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x10, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_PPM_VETO_ENTRY' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'VetoReason' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'HitCount' : [ 0x18, ['unsigned long long']], + 'LastActivationTime' : [ 0x20, ['unsigned long long']], + 'TotalActiveTime' : [ 0x28, ['unsigned long long']], + 'CsActivationTime' : [ 0x30, ['unsigned long long']], + 'CsActiveTime' : [ 0x38, ['unsigned long long']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x38, { + 'BugCheckCode' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['long']], + 'Data' : [ 0x8, ['unsigned long']], + 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_KWAIT_CHAIN_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned char']], + 'LayerSemantics' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Spare1' : [ 0xd, ['BitField', dict(start_bit = 2, end_bit = 7, native_type='unsigned char')]], + 'InheritClass' : [ 0xd, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0xe, ['unsigned short']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x28, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x8, ['_RTL_BITMAP']], + 'HashTable' : [ 0x18, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x20, ['unsigned char']], +} ], + '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x30, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'ListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '_KQUEUE' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x28, ['unsigned long']], + 'MaximumCount' : [ 0x2c, ['unsigned long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], +} ], + '__unnamed_29e8' : [ 0x4, { + 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_NODE_INFORMATION' : [ 0x890, { + 'LargePageFreeCount' : [ 0x0, ['array', 3, ['array', 2, ['unsigned long long']]]], + 'LargePages' : [ 0x30, ['array', 3, ['array', 2, ['array', 2, ['array', 4, ['_LIST_ENTRY']]]]]], + 'LargePagesCount' : [ 0x330, ['array', 3, ['array', 2, ['array', 2, ['array', 4, ['unsigned long long']]]]]], + 'LargePageRebuildTimer' : [ 0x4b0, ['_MI_REBUILD_LARGE_PAGE_TIMER']], + 'StandbyPageList' : [ 0x4e0, ['array', 4, ['array', 8, ['_MMPFNLIST_SHORT']]]], + 'FreeCount' : [ 0x7e0, ['array', 2, ['unsigned long long']]], + 'TotalPages' : [ 0x7f0, ['array', 4, ['unsigned long long']]], + 'TotalPagesEntireNode' : [ 0x810, ['unsigned long long']], + 'MmShiftedColor' : [ 0x818, ['unsigned long']], + 'Color' : [ 0x81c, ['unsigned long']], + 'ChannelFreeCount' : [ 0x820, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'Flags' : [ 0x860, ['__unnamed_29e8']], + 'NodeLock' : [ 0x868, ['_EX_PUSH_LOCK']], + 'ZeroThreadHugeMapLock' : [ 0x870, ['unsigned long long']], + 'ChannelStatus' : [ 0x878, ['unsigned char']], + 'ChannelOrdering' : [ 0x879, ['array', 4, ['unsigned char']]], + 'LockedChannelOrdering' : [ 0x87d, ['array', 4, ['unsigned char']]], + 'PowerAttribute' : [ 0x881, ['array', 4, ['unsigned char']]], + 'LargePageLock' : [ 0x888, ['unsigned long long']], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_TRIAGE_POP_FX_DEVICE' : [ 0x38, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_TRIAGE_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['long']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'DeviceNode' : [ 0x30, ['pointer64', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_LPCP_PORT_QUEUE' : [ 0x20, { + 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x60, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], + 'AccessBufferMax' : [ 0x28, ['unsigned long']], + 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x50, ['long']], + 'Flags' : [ 0x54, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x58, ['long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], + 'CallCount' : [ 0x20, ['unsigned long']], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { + 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x20, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0x18, ['unsigned long long']], +} ], + '_MI_SYSTEM_NODE_INFORMATION' : [ 0x1a0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x10, ['array', 3, ['_SLIST_HEADER']]], + 'NonPagedPoolSListHeadNx' : [ 0x40, ['array', 3, ['_SLIST_HEADER']]], + 'CachedKernelStacks' : [ 0x70, ['array', 2, ['_CACHED_KSTACK_LIST']]], + 'NonPagedBitMapMaximum' : [ 0xb0, ['unsigned long long']], + 'DynamicBitMapNonPagedPool' : [ 0xb8, ['_MI_DYNAMIC_BITMAP']], + 'NonPagedPoolLowestPage' : [ 0x108, ['unsigned long long']], + 'NonPagedPoolHighestPage' : [ 0x110, ['unsigned long long']], + 'AllocatedNonPagedPool' : [ 0x118, ['unsigned long long']], + 'PartialLargePoolRegions' : [ 0x120, ['unsigned long long']], + 'PagesInPartialLargePoolRegions' : [ 0x128, ['unsigned long long']], + 'CachedNonPagedPoolCount' : [ 0x130, ['unsigned long long']], + 'NonPagedPoolSpinLock' : [ 0x138, ['unsigned long long']], + 'CachedNonPagedPool' : [ 0x140, ['pointer64', ['_MMPFN']]], + 'NonPagedPoolFirstVa' : [ 0x148, ['pointer64', ['void']]], + 'NonPagedPoolLastVa' : [ 0x150, ['pointer64', ['void']]], + 'NonPagedBitMap' : [ 0x158, ['array', 3, ['_RTL_BITMAP_EX']]], + 'NonPagedHint' : [ 0x188, ['array', 2, ['unsigned long long']]], +} ], + '_MI_PAGE_COMBINING_SUPPORT' : [ 0x188, { + 'Partition' : [ 0x0, ['pointer64', ['_MI_PARTITION']]], + 'ArbitraryPfnMapList' : [ 0x8, ['_LIST_ENTRY']], + 'FreeCombinePoolItem' : [ 0x18, ['_MI_COMBINE_WORKITEM']], + 'CombiningThreadCount' : [ 0x40, ['unsigned long']], + 'CombinePageFreeList' : [ 0x48, ['_LIST_ENTRY']], + 'CombineFreeListLock' : [ 0x58, ['unsigned long long']], + 'CombinePageListHeads' : [ 0x60, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], + 'PageCombineStats' : [ 0x160, ['_MI_PAGE_COMBINE_STATISTICS']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { + 'BadPageCount' : [ 0x0, ['unsigned long long']], + 'BadPagesDetected' : [ 0x8, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0xc, ['long']], + 'ScrubPasses' : [ 0x10, ['long']], + 'ScrubBadPagesFound' : [ 0x14, ['long']], + 'PageHashErrors' : [ 0x18, ['unsigned long']], + 'FeatureBits' : [ 0x20, ['unsigned long long']], + 'TimeZoneId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['_MI_FLAGS']], + 'VsmConnection' : [ 0x30, ['pointer64', ['void']]], +} ], + '_MI_FORCED_COMMITS' : [ 0x8, { + 'Regular' : [ 0x0, ['unsigned long']], + 'Wrap' : [ 0x4, ['unsigned long']], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x20, { + 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0x18, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + '_MI_REBUILD_LARGE_PAGE_TIMER' : [ 0x30, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'SecondsLeft' : [ 0x20, ['unsigned char']], + 'RebuildActive' : [ 0x21, ['unsigned char']], + 'NextPassDelta' : [ 0x22, ['unsigned char']], + 'LargeSubPagesActive' : [ 0x23, ['unsigned char']], + 'SequenceNumber' : [ 0x24, ['unsigned long']], + 'WaitList' : [ 0x28, ['pointer64', ['_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK']]], +} ], + '_MI_IO_PAGE_STATE' : [ 0x68, { + 'IoPfnLock' : [ 0x0, ['unsigned long long']], + 'IoPfnRoot' : [ 0x8, ['array', 3, ['_RTL_AVL_TREE']]], + 'UnusedCachedMaps' : [ 0x20, ['_LIST_ENTRY']], + 'OldestCacheFlushTimeStamp' : [ 0x30, ['unsigned long']], + 'IoCacheStats' : [ 0x38, ['_MI_IO_CACHE_STATS']], + 'InvariantIoSpace' : [ 0x60, ['_RTL_AVL_TREE']], +} ], + '_ETW_REPLY_QUEUE' : [ 0x48, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x40, ['long']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_MI_CROSS_PARTITION_CHARGES' : [ 0x28, { + 'CurrentCharges' : [ 0x0, ['unsigned long long']], + 'ChargeFailures' : [ 0x8, ['unsigned long long']], + 'ChargePeak' : [ 0x10, ['unsigned long long']], + 'ChargeMinimum' : [ 0x18, ['unsigned long long']], + 'ChargeMaximum' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_2a29' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned long']], + 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], +} ], + '_MI_PER_SESSION_PROTOS' : [ 0x30, { + 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'DriverAddress' : [ 0x0, ['pointer64', ['void']]], + 'SessionId' : [ 0x18, ['unsigned long']], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionBase' : [ 0x20, ['pointer64', ['_MMPTE']]], + 'u2' : [ 0x28, ['__unnamed_2a29']], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_MI_MODWRITE_DATA' : [ 0x40, { + 'PagesLoad' : [ 0x0, ['long long']], + 'PagesAverage' : [ 0x8, ['unsigned long long']], + 'AverageAvailablePages' : [ 0x10, ['unsigned long long']], + 'PagesWritten' : [ 0x18, ['unsigned long long']], + 'WritesIssued' : [ 0x20, ['unsigned long']], + 'IgnoredReservationsCount' : [ 0x24, ['unsigned long']], + 'FreedReservationsCount' : [ 0x28, ['unsigned long']], + 'WriteBurstCount' : [ 0x2c, ['unsigned long']], + 'IgnoreReservationsStartTime' : [ 0x30, ['unsigned long long']], + 'ReservationClusterInfo' : [ 0x38, ['_MI_RESERVATION_CLUSTER_INFO']], + 'IgnoreReservations' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'Spare1' : [ 0x3e, ['unsigned short']], +} ], + '_PROC_IDLE_POLICY' : [ 0x6, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], + 'ForceLightIdle' : [ 0x5, ['unsigned char']], +} ], + '_MI_RESAVAIL_FAILURES' : [ 0x8, { + 'Wrap' : [ 0x0, ['unsigned long']], + 'NoCharge' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_WORK_ON_BEHALF_TICKET' : [ 0x8, { + 'ThreadId' : [ 0x0, ['unsigned long']], + 'ThreadCreationTimeLow' : [ 0x4, ['unsigned long']], +} ], + '_PO_HIBER_PERF' : [ 0x1e8, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], + 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], + 'HibernateCompleteTimestamp' : [ 0x48, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x50, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x54, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x58, ['unsigned long']], + 'ResumeAppTicks' : [ 0x60, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x68, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x70, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x78, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x80, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x88, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x90, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x98, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0xa8, ['unsigned long long']], + 'ResumeMapTicks' : [ 0xb0, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xb8, ['unsigned long long']], + 'ResumeChecksumTicks' : [ 0xc0, ['unsigned long long']], + 'ResumeChecksumIoTicks' : [ 0xc8, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xd0, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xd8, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xe0, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xe8, ['unsigned long long']], + 'HalTscOffset' : [ 0xf0, ['unsigned long long']], + 'HvlTscOffset' : [ 0xf8, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0x100, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0x108, ['unsigned long long']], + 'IoBoundedness' : [ 0x110, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0x118, ['unsigned long long']], + 'KernelIoTicks' : [ 0x120, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x128, ['unsigned long long']], + 'ReadCheckCount' : [ 0x130, ['unsigned long long']], + 'KernelInitTicks' : [ 0x138, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x140, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x148, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x150, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x158, ['unsigned long long']], + 'KernelChecksumTicks' : [ 0x160, ['unsigned long long']], + 'KernelChecksumIoTicks' : [ 0x168, ['unsigned long long']], + 'AnimationStart' : [ 0x170, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x178, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x180, ['unsigned long']], + 'SecurePagesProcessed' : [ 0x188, ['unsigned long long']], + 'BootPagesProcessed' : [ 0x190, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x198, ['unsigned long long']], + 'BootBytesWritten' : [ 0x1a0, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x1a8, ['unsigned long long']], + 'BootPagesWritten' : [ 0x1b0, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x1b8, ['unsigned long long']], + 'BytesWritten' : [ 0x1c0, ['unsigned long long']], + 'PagesWritten' : [ 0x1c8, ['unsigned long']], + 'FileRuns' : [ 0x1cc, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x1d0, ['unsigned long']], + 'MaxHuffRatio' : [ 0x1d4, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x1d8, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1e0, ['unsigned long long']], +} ], + '_KTRANSACTION' : [ 0x2d8, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x20, ['_KMUTANT']], + 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0xb0, ['_GUID']], + 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xd8, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], + 'PendingResponses' : [ 0xec, ['unsigned long']], + 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xf8, ['_CLS_LSN']], + 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], + 'IsolationLevel' : [ 0x120, ['unsigned long']], + 'IsolationFlags' : [ 0x124, ['unsigned long']], + 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], + 'Description' : [ 0x130, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0x168, ['_KDPC']], + 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], + 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], + 'CommitReservation' : [ 0x208, ['long long']], + 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], + 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], + 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1e, { + 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], +} ], + '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { + 'UserRangeInKernel' : [ 0x0, ['unsigned long']], + 'FaultFailed' : [ 0x4, ['unsigned long']], + 'WriteFaultFailed' : [ 0x8, ['unsigned long']], + 'LargePageFailed' : [ 0xc, ['unsigned long']], + 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], + 'BadPageLocation' : [ 0x14, ['unsigned long']], + 'InsufficientCharge' : [ 0x18, ['unsigned long']], + 'PageTableCharge' : [ 0x1c, ['unsigned long']], + 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], + 'NoIoReference' : [ 0x24, ['unsigned long']], + 'ProbeFailed' : [ 0x28, ['unsigned long']], + 'PteIsZero' : [ 0x2c, ['unsigned long']], + 'StrongCodeWrite' : [ 0x30, ['unsigned long']], + 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], + 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], + 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0xa8, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x68, ['_KMUTANT']], + 'LinksOffset' : [ 0xa0, ['unsigned short']], + 'GuidOffset' : [ 0xa2, ['unsigned short']], + 'Expired' : [ 0xa4, ['unsigned char']], +} ], + '__unnamed_2a4f' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2a51' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2a54' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_2a58' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x58, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x18, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x28, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x38, ['__unnamed_2a4f']], + 'HvDeviceId' : [ 0x40, ['unsigned long long']], + 'XapicMessage' : [ 0x48, ['__unnamed_2a51']], + 'Hypertransport' : [ 0x48, ['__unnamed_2a54']], + 'GenericMessage' : [ 0x48, ['__unnamed_2a51']], + 'MessageRequest' : [ 0x48, ['__unnamed_2a58']], +} ], + '_CM_NAME_HASH' : [ 0x18, { + 'ConvKey' : [ 0x0, ['_CM_COMPONENT_HASH']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x10, ['unsigned short']], + 'Name' : [ 0x12, ['array', 1, ['wchar']]], +} ], + '_LDR_DDAG_NODE' : [ 0x50, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x10, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0x18, ['unsigned long']], + 'LoadWhileUnloadingCount' : [ 0x1c, ['unsigned long']], + 'LowestLink' : [ 0x20, ['unsigned long']], + 'Dependencies' : [ 0x28, ['_LDRP_CSLIST']], + 'IncomingDependencies' : [ 0x30, ['_LDRP_CSLIST']], + 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x48, ['unsigned long']], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x178, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0x108, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0x110, ['pointer64', ['void']]], + 'PointersLength' : [ 0x118, ['unsigned long']], + 'ModulePrefix' : [ 0x120, ['pointer64', ['wchar']]], + 'DriverList' : [ 0x128, ['_LIST_ENTRY']], + 'InitMsg' : [ 0x138, ['_STRING']], + 'ProgMsg' : [ 0x148, ['_STRING']], + 'DoneMsg' : [ 0x158, ['_STRING']], + 'FileObject' : [ 0x168, ['pointer64', ['void']]], + 'UsageType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_HAL_NODE_RANGE' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'Node' : [ 0x8, ['unsigned long']], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x38, { + 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'LocationTreeNode' : [ 0x18, ['_RTL_BALANCED_NODE']], + 'StartingIndex' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], +} ], + '_RTL_UMS_CONTEXT' : [ 0x520, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Context' : [ 0x10, ['_CONTEXT']], + 'Teb' : [ 0x4e0, ['pointer64', ['void']]], + 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Flags' : [ 0x4f0, ['long']], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], + 'ContextLock' : [ 0x4f8, ['unsigned long long']], + 'PrimaryUmsContext' : [ 0x500, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'SwitchCount' : [ 0x508, ['unsigned long']], + 'KernelYieldCount' : [ 0x50c, ['unsigned long']], + 'MixedYieldCount' : [ 0x510, ['unsigned long']], + 'YieldCount' : [ 0x514, ['unsigned long']], +} ], + '_MI_RESUME_WORKITEM' : [ 0x38, { + 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_KDESCRIPTOR' : [ 0x10, { + 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], + 'Limit' : [ 0x6, ['unsigned short']], + 'Base' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_2a80' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a82' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a84' : [ 0x10, { + 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], + 'DeviceId' : [ 0x8, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a86' : [ 0x8, { + 'Notification' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_2a88' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a8a' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a8c' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2a8e' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a90' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_2a92' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_2a80']], + 'TargetDevice' : [ 0x0, ['__unnamed_2a82']], + 'InstallDevice' : [ 0x0, ['__unnamed_2a82']], + 'CustomNotification' : [ 0x0, ['__unnamed_2a84']], + 'ProfileNotification' : [ 0x0, ['__unnamed_2a86']], + 'PowerNotification' : [ 0x0, ['__unnamed_2a88']], + 'VetoNotification' : [ 0x0, ['__unnamed_2a8a']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_2a8c']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_2a8e']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_2a90']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_2a82']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_2a82']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], + 'u' : [ 0x30, ['__unnamed_2a92']], +} ], + '_CM_KEY_REFERENCE' : [ 0x10, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], +} ], + '_HVIEW_MAP_DIRECTORY' : [ 0x400, { + 'Tables' : [ 0x0, ['array', 128, ['pointer64', ['_HVIEW_MAP_TABLE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x20, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x10, ['long']], + 'Misses' : [ 0x14, ['unsigned long']], + 'MissesLast' : [ 0x18, ['unsigned long']], + 'AllStacksInUse' : [ 0x1c, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '_HAL_CHANNEL_MEMORY_RANGES' : [ 0x10, { + 'PageFrameIndex' : [ 0x0, ['unsigned long long']], + 'MpnId' : [ 0x8, ['unsigned short']], + 'Node' : [ 0xa, ['unsigned short']], + 'Channel' : [ 0xc, ['unsigned short']], + 'IsPowerManageable' : [ 0xe, ['unsigned char']], + 'DeepPowerState' : [ 0xf, ['unsigned char']], +} ], + '_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK']]], + 'Gate' : [ 0x8, ['_KGATE']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x38, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Link' : [ 0x20, ['_LIST_ENTRY']], + 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x58, { + 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], + 'PerfContext' : [ 0x8, ['unsigned long long']], + 'ProcCap' : [ 0x10, ['unsigned long']], + 'ProcFloor' : [ 0x14, ['unsigned long']], + 'PlatformCap' : [ 0x18, ['unsigned long']], + 'ThermalCap' : [ 0x1c, ['unsigned long']], + 'LimitReasons' : [ 0x20, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x28, ['unsigned long long']], + 'TargetPercent' : [ 0x30, ['unsigned long']], + 'SelectedPercent' : [ 0x34, ['unsigned long']], + 'SelectedFrequency' : [ 0x38, ['unsigned long']], + 'PreviousFrequency' : [ 0x3c, ['unsigned long']], + 'PreviousPercent' : [ 0x40, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x44, ['unsigned long']], + 'SelectedState' : [ 0x48, ['unsigned long long']], + 'Force' : [ 0x50, ['unsigned char']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x20, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x10, { + 'DeviceHandle' : [ 0x0, ['pointer64', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x488, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x410, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], + 'ConsoleFlags' : [ 0x18, ['unsigned long']], + 'StandardInput' : [ 0x20, ['pointer64', ['void']]], + 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], + 'StandardError' : [ 0x30, ['pointer64', ['void']]], + 'CurrentDirectory' : [ 0x38, ['_CURDIR']], + 'DllPath' : [ 0x50, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], + 'Environment' : [ 0x80, ['pointer64', ['void']]], + 'StartingX' : [ 0x88, ['unsigned long']], + 'StartingY' : [ 0x8c, ['unsigned long']], + 'CountX' : [ 0x90, ['unsigned long']], + 'CountY' : [ 0x94, ['unsigned long']], + 'CountCharsX' : [ 0x98, ['unsigned long']], + 'CountCharsY' : [ 0x9c, ['unsigned long']], + 'FillAttribute' : [ 0xa0, ['unsigned long']], + 'WindowFlags' : [ 0xa4, ['unsigned long']], + 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], + 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], + 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], + 'PackageDependencyData' : [ 0x400, ['pointer64', ['void']]], + 'ProcessGroupId' : [ 0x408, ['unsigned long']], + 'LoaderThreads' : [ 0x40c, ['unsigned long']], +} ], + '_MI_IO_CACHE_STATS' : [ 0x28, { + 'UnusedBlocks' : [ 0x0, ['unsigned long long']], + 'ActiveCacheMatch' : [ 0x8, ['unsigned long']], + 'ActiveCacheOverride' : [ 0xc, ['unsigned long']], + 'UnmappedCacheFlush' : [ 0x10, ['unsigned long']], + 'UnmappedCacheMatch' : [ 0x14, ['unsigned long']], + 'UnmappedCacheConflict' : [ 0x18, ['unsigned long']], + 'PermanentIoAttributeConflict' : [ 0x1c, ['unsigned long']], + 'PermanentIoNodeConflict' : [ 0x20, ['unsigned long']], +} ], + '__unnamed_2ad8' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2ada' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2adc' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2ad8']], + 'Gpt' : [ 0x0, ['__unnamed_2ada']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0x108, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], + 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], + 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], + 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], + 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], + 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], + 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], + 'CrashDump' : [ 0x68, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x69, ['unsigned char']], + 'HiberResume' : [ 0x6a, ['unsigned char']], + 'Reserved1' : [ 0x6b, ['unsigned char']], + 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], + 'CommonBufferSize' : [ 0x70, ['unsigned long']], + 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], + 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], + 'PartitionStyle' : [ 0x88, ['unsigned long']], + 'DiskInfo' : [ 0x8c, ['__unnamed_2adc']], + 'ReadRoutine' : [ 0xa0, ['pointer64', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0xa8, ['pointer64', ['void']]], + 'LogSectionTruncateSize' : [ 0xb0, ['unsigned long']], + 'Parameters' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xf8, ['pointer64', ['void']]], + 'DumpNotifyRoutine' : [ 0x100, ['pointer64', ['void']]], +} ], + '_THERMAL_COOLING_INTERFACE' : [ 0x38, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'ActiveCooling' : [ 0x28, ['pointer64', ['void']]], + 'PassiveCooling' : [ 0x30, ['pointer64', ['void']]], +} ], + '_VF_ADDRESS_RANGE' : [ 0x10, { + 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], + 'End' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_POP_FX_PERF_INFO' : [ 0xa0, { + 'Component' : [ 0x0, ['pointer64', ['_POP_FX_COMPONENT']]], + 'CompletedEvent' : [ 0x8, ['_KEVENT']], + 'ComponentPerfState' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['_POP_FX_PERF_FLAGS']], + 'LastChange' : [ 0x30, ['pointer64', ['_PO_FX_PERF_STATE_CHANGE']]], + 'LastChangeCount' : [ 0x38, ['unsigned long']], + 'LastChangeStamp' : [ 0x40, ['unsigned long long']], + 'LastChangeNominal' : [ 0x48, ['unsigned char']], + 'PepRegistered' : [ 0x49, ['unsigned char']], + 'QueryOnIdleStates' : [ 0x4a, ['unsigned char']], + 'RequestDriverContext' : [ 0x50, ['pointer64', ['void']]], + 'WorkOrder' : [ 0x58, ['_POP_FX_WORK_ORDER']], + 'SetsCount' : [ 0x90, ['unsigned long']], + 'Sets' : [ 0x98, ['pointer64', ['_POP_FX_PERF_SET']]], +} ], + '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { + 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], +} ], + '_MMPFNLIST_SHORT' : [ 0x18, { + 'Total' : [ 0x0, ['unsigned long long']], + 'Flink' : [ 0x8, ['unsigned long long']], + 'Blink' : [ 0x10, ['unsigned long long']], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x8, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], +} ], + '_TRIAGE_POP_IRP_DATA' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_2b0b' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2b0d' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2b0f' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2b11' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_2b0b']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_2b0d']], + 'Raw' : [ 0x0, ['__unnamed_2b0f']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'Operation' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0xc, ['__unnamed_2b11']], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x10, { + 'Table' : [ 0x0, ['_RTL_AVL_TREE']], + 'Lock' : [ 0x8, ['long']], +} ], + '_VI_POOL_ENTRY' : [ 0x20, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x28, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x8, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0x18, ['_RTL_BITMAP']], + 'EvictedBitmap' : [ 0x18, ['_RTL_BITMAP']], +} ], + '_MI_SYSTEM_VA_ASSIGNMENT' : [ 0x10, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x8, ['unsigned long long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2b21' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2b23' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2b21']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2b26' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2b28' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2b26']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_2b23']], + 'HighPart' : [ 0x4, ['__unnamed_2b28']], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x80, { + 'UncompressedData' : [ 0x0, ['pointer64', ['unsigned char']]], + 'MappingVa' : [ 0x8, ['pointer64', ['void']]], + 'XpressEncodeWorkspace' : [ 0x10, ['pointer64', ['void']]], + 'CompressedDataBuffer' : [ 0x18, ['pointer64', ['unsigned char']]], + 'CopyTicks' : [ 0x20, ['unsigned long long']], + 'CompressTicks' : [ 0x28, ['unsigned long long']], + 'BytesCopied' : [ 0x30, ['unsigned long long']], + 'PagesProcessed' : [ 0x38, ['unsigned long long']], + 'DecompressTicks' : [ 0x40, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x48, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x50, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x68, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x78, ['unsigned long']], + 'HuffCompressCount' : [ 0x7c, ['unsigned long']], +} ], + '_PROC_PERF_CHECK_SNAP' : [ 0x50, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned long long']], + 'Stall' : [ 0x10, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], + 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x48, { + 'ViewOffset' : [ 0x0, ['unsigned long']], + 'Pinned' : [ 0x4, ['unsigned char']], + 'PinMask' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'Stack' : [ 0x18, ['array', 6, ['pointer64', ['void']]]], +} ], + '_MI_COMBINE_WORKITEM' : [ 0x28, { + 'NextEntry' : [ 0x0, ['pointer64', ['void']]], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], +} ], + '_PNP_RESOURCE_CONFLICT_TRACE_CONTEXT' : [ 0x18, { + 'ResourceType' : [ 0x0, ['unsigned char']], + 'AlternativeCount' : [ 0x4, ['unsigned long']], + 'ResourceRequests' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ArbiterInstance' : [ 0x10, ['pointer64', ['void']]], +} ], + '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { + 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], + 'PriorityTooLow' : [ 0x4, ['unsigned long']], + 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], + 'PagedNoPtes' : [ 0xc, ['unsigned long']], + 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], + 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], + 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], + 'PagedNoCommit' : [ 0x1c, ['unsigned long']], + 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], + 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], + 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x20, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], + 'Tag' : [ 0x18, ['unsigned long long']], +} ], + '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { + 'PagesScannedActive' : [ 0x0, ['unsigned long long']], + 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], + 'PagesCombined' : [ 0x10, ['unsigned long long']], + 'CombineScanCount' : [ 0x18, ['unsigned long']], + 'CombinedBlocksInUse' : [ 0x1c, ['long']], + 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x10, { + 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], +} ], + '_HVIEW_MAP_TABLE' : [ 0x800, { + 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], +} ], + '_LDRP_CSLIST' : [ 0x8, { + 'Tail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { + 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'EntireInfo' : [ 0x0, ['long']], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0x18, { + 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], + 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer64', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x68, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], + 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], + 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], + 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], + 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], +} ], + '_POP_FX_PERF_SET' : [ 0x20, { + 'PerfSet' : [ 0x0, ['pointer64', ['_PO_FX_COMPONENT_PERF_SET']]], + 'CurrentPerf' : [ 0x8, ['unsigned long long']], + 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], + 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], +} ], + '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { + 'Set' : [ 0x0, ['unsigned long']], + 'StateIndex' : [ 0x8, ['unsigned long']], + 'StateValue' : [ 0x8, ['unsigned long long']], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], +} ], + '_HVIEW_MAP_ENTRY' : [ 0x20, { + 'ViewStart' : [ 0x0, ['pointer64', ['void']]], + 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Bcb' : [ 0x8, ['pointer64', ['void']]], + 'PinnedPages' : [ 0x10, ['unsigned long long']], + 'Size' : [ 0x18, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], +} ], + '__unnamed_2b7a' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['pointer64', ['_PO_FX_PERF_STATE']]], +} ], + '__unnamed_2b7c' : [ 0x10, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], +} ], + '_PO_FX_COMPONENT_PERF_SET' : [ 0x30, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], + 'Flags' : [ 0x10, ['unsigned long long']], + 'Unit' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], + 'Discrete' : [ 0x20, ['__unnamed_2b7a']], + 'Range' : [ 0x20, ['__unnamed_2b7c']], +} ], + '_CURDIR' : [ 0x18, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], +} ], + '__unnamed_2b82' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_2b84' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_2b82']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_2b84']], +} ], + '_PO_FX_PERF_STATE' : [ 0x10, { + 'Value' : [ 0x0, ['unsigned long long']], + 'Context' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_2b8a' : [ 0x10, { + 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], +} ], + '__unnamed_2b8c' : [ 0x8, { + 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], +} ], + '__unnamed_2b92' : [ 0x10, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], + 'OutputInformation' : [ 0x8, ['pointer64', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], +} ], + '__unnamed_2b96' : [ 0x10, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x8, ['unsigned char']], +} ], + '__unnamed_2b98' : [ 0x28, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], + 'Argument5' : [ 0x20, ['pointer64', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x28, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_2b8a']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2b8c']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2b92']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_2b96']], + 'Others' : [ 0x0, ['__unnamed_2b98']], +} ], + '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'SizeReturned' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], +} ], +} From 5b68c5b0f43ab14117a82c65ddca9b9f189c0248 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sat, 10 Sep 2016 23:36:15 -0400 Subject: [PATCH 026/304] win10: add 14393 profile for x86 --- volatility/plugins/overlays/windows/win10.py | 9 + .../windows/win10_x86_9619274A_vtypes.py | 13166 ++++++++++++++++ 2 files changed, 13175 insertions(+) create mode 100644 volatility/plugins/overlays/windows/win10_x86_9619274A_vtypes.py diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index ac21afe60..cb8f9b748 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -474,3 +474,12 @@ class Win10x86_44B89EEA(obj.Profile): _md_minor = 4 _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_44B89EEA_vtypes' + +class Win10x86_9619274A(obj.Profile): + """ A Profile for Windows 10 x86 from PDB 9619274A""" + _md_memory_model = '32bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 4 + _md_build = 14393 + _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_9619274A_vtypes' diff --git a/volatility/plugins/overlays/windows/win10_x86_9619274A_vtypes.py b/volatility/plugins/overlays/windows/win10_x86_9619274A_vtypes.py new file mode 100644 index 000000000..63a6cf4b2 --- /dev/null +++ b/volatility/plugins/overlays/windows/win10_x86_9619274A_vtypes.py @@ -0,0 +1,13166 @@ +ntkrpamp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x708, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'NtBuildNumber' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'BootId' : [ 0x2c4, ['unsigned long']], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'VirtualizationFlags' : [ 0x2ed, ['unsigned char']], + 'Reserved12' : [ 0x2ee, ['array', 2, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgMultiSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgMultiUsersInSessionSku' : [ 0x2f0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCall' : [ 0x308, ['unsigned long']], + 'SystemCallPad0' : [ 0x30c, ['unsigned long']], + 'SystemCallPad' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrementShift' : [ 0x368, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x369, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x36a, ['unsigned short']], + 'EnclaveFeatureMask' : [ 0x36c, ['array', 4, ['unsigned long']]], + 'Reserved8' : [ 0x37c, ['unsigned long']], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_107d' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_107d']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1081' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1081']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '__unnamed_109c' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109e' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_109c']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x4, ['pointer', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x8, ['pointer', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0xc, ['pointer', ['void']]], + 'RaceDll' : [ 0x10, ['pointer', ['void']]], + 'ActivationContext' : [ 0x14, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x18, ['pointer', ['void']]], + 'u' : [ 0x1c, ['__unnamed_109e']], + 'CallbackPriority' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x24, ['unsigned long']], +} ], + '_TEB' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x1c, ['pointer', ['void']]], + 'ClientId' : [ 0x20, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x28, ['pointer', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x2c, ['pointer', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x30, ['pointer', ['_PEB']]], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['pointer', ['void']]], + 'Win32ThreadInfo' : [ 0x40, ['pointer', ['void']]], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['pointer', ['void']]], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['pointer', ['void']]]], + 'SystemReserved1' : [ 0x10c, ['array', 36, ['pointer', ['void']]]], + 'WorkingOnBehalfTicket' : [ 0x19c, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['pointer', ['_ACTIVATION_CONTEXT_STACK']]], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['pointer', ['void']]], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['pointer', ['void']]], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['pointer', ['void']]]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['pointer', ['void']]], + 'glSectionInfo' : [ 0xbe0, ['pointer', ['void']]], + 'glSection' : [ 0xbe4, ['pointer', ['void']]], + 'glTable' : [ 0xbe8, ['pointer', ['void']]], + 'glCurrentRC' : [ 0xbec, ['pointer', ['void']]], + 'glContext' : [ 0xbf0, ['pointer', ['void']]], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['pointer', ['void']]], + 'TlsSlots' : [ 0xe10, ['array', 64, ['pointer', ['void']]]], + 'TlsLinks' : [ 0xf10, ['_LIST_ENTRY']], + 'Vdm' : [ 0xf18, ['pointer', ['void']]], + 'ReservedForNtRpc' : [ 0xf1c, ['pointer', ['void']]], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['pointer', ['void']]]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['pointer', ['void']]]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['pointer', ['void']]], + 'PerflibData' : [ 0xf64, ['pointer', ['void']]], + 'EtwTraceData' : [ 0xf68, ['pointer', ['void']]], + 'WinSockData' : [ 0xf6c, ['pointer', ['void']]], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['pointer', ['void']]], + 'ReservedForOle' : [ 0xf80, ['pointer', ['void']]], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['pointer', ['void']]], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['pointer', ['void']]], + 'TlsExpansionSlots' : [ 0xf94, ['pointer', ['pointer', ['void']]]], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['pointer', ['void']]], + 'pShimData' : [ 0xfa4, ['pointer', ['void']]], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['pointer', ['void']]], + 'ActiveFrame' : [ 0xfb0, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0xfb4, ['pointer', ['void']]], + 'PreferredLanguages' : [ 0xfb8, ['pointer', ['void']]], + 'UserPrefLanguages' : [ 0xfbc, ['pointer', ['void']]], + 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], + 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], + 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['pointer', ['void']]], + 'ReservedForWdf' : [ 0xfe4, ['pointer', ['void']]], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_LIST_ENTRY' : [ 0x8, { + 'Flink' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'Blink' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x4, { + 'Next' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0xc, { + 'Parent' : [ 0x0, ['pointer', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x4, ['pointer', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x8, ['pointer', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0xc, { + 'ChainHead' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x14, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'CurEntry' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'ChainHead' : [ 0xc, ['pointer', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x10, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x24, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['wchar']]], +} ], + '_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS' : [ 0xf8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_RB_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0xc, { + 'Children' : [ 0x0, ['array', 2, ['pointer', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x8, ['unsigned long']], +} ], + '_RTL_AVL_TREE' : [ 0x4, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x4a20, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'Used_ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Used_StackBase' : [ 0x4, ['pointer', ['void']]], + 'MxCsr' : [ 0x8, ['unsigned long']], + 'TssCopy' : [ 0xc, ['pointer', ['void']]], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'SetMemberCopy' : [ 0x14, ['unsigned long']], + 'Used_Self' : [ 0x18, ['pointer', ['void']]], + 'SelfPcr' : [ 0x1c, ['pointer', ['_KPCR']]], + 'Prcb' : [ 0x20, ['pointer', ['_KPRCB']]], + 'Irql' : [ 0x24, ['unsigned char']], + 'IRR' : [ 0x28, ['unsigned long']], + 'IrrActive' : [ 0x2c, ['unsigned long']], + 'IDR' : [ 0x30, ['unsigned long']], + 'KdVersionBlock' : [ 0x34, ['pointer', ['void']]], + 'IDT' : [ 0x38, ['pointer', ['_KIDTENTRY']]], + 'GDT' : [ 0x3c, ['pointer', ['_KGDTENTRY']]], + 'TSS' : [ 0x40, ['pointer', ['_KTSS']]], + 'MajorVersion' : [ 0x44, ['unsigned short']], + 'MinorVersion' : [ 0x46, ['unsigned short']], + 'SetMember' : [ 0x48, ['unsigned long']], + 'StallScaleFactor' : [ 0x4c, ['unsigned long']], + 'SpareUnused' : [ 0x50, ['unsigned char']], + 'Number' : [ 0x51, ['unsigned char']], + 'Spare0' : [ 0x52, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x53, ['unsigned char']], + 'VdmAlert' : [ 0x54, ['unsigned long']], + 'KernelReserved' : [ 0x58, ['array', 14, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0x90, ['unsigned long']], + 'HalReserved' : [ 0x94, ['array', 16, ['unsigned long']]], + 'InterruptMode' : [ 0xd4, ['unsigned long']], + 'Spare1' : [ 0xd8, ['unsigned char']], + 'KernelReserved2' : [ 0xdc, ['array', 17, ['unsigned long']]], + 'PrcbData' : [ 0x120, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x4900, { + 'MinorVersion' : [ 0x0, ['unsigned short']], + 'MajorVersion' : [ 0x2, ['unsigned short']], + 'CurrentThread' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'NextThread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'IdleThread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'LegacyNumber' : [ 0x10, ['unsigned char']], + 'NestingLevel' : [ 0x11, ['unsigned char']], + 'BuildType' : [ 0x12, ['unsigned short']], + 'CpuType' : [ 0x14, ['unsigned char']], + 'CpuID' : [ 0x15, ['unsigned char']], + 'CpuStep' : [ 0x16, ['unsigned short']], + 'CpuStepping' : [ 0x16, ['unsigned char']], + 'CpuModel' : [ 0x17, ['unsigned char']], + 'ProcessorState' : [ 0x18, ['_KPROCESSOR_STATE']], + 'ParentNode' : [ 0x338, ['pointer', ['_KNODE']]], + 'PriorityState' : [ 0x33c, ['pointer', ['unsigned char']]], + 'KernelReserved' : [ 0x340, ['array', 14, ['unsigned long']]], + 'HalReserved' : [ 0x378, ['array', 16, ['unsigned long']]], + 'CFlushSize' : [ 0x3b8, ['unsigned long']], + 'CoresPerPhysicalProcessor' : [ 0x3bc, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x3bd, ['unsigned char']], + 'CpuVendor' : [ 0x3be, ['unsigned char']], + 'PrcbPad0' : [ 0x3bf, ['array', 1, ['unsigned char']]], + 'MHz' : [ 0x3c0, ['unsigned long']], + 'GroupIndex' : [ 0x3c4, ['unsigned char']], + 'Group' : [ 0x3c5, ['unsigned char']], + 'PrcbPad05' : [ 0x3c6, ['array', 2, ['unsigned char']]], + 'GroupSetMember' : [ 0x3c8, ['unsigned long']], + 'Number' : [ 0x3cc, ['unsigned long']], + 'ClockOwner' : [ 0x3d0, ['unsigned char']], + 'PendingTickFlags' : [ 0x3d1, ['unsigned char']], + 'PendingTick' : [ 0x3d1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x3d1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'PrcbPad10' : [ 0x3d2, ['array', 70, ['unsigned char']]], + 'LockQueue' : [ 0x418, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'InterruptCount' : [ 0x4a0, ['unsigned long']], + 'KernelTime' : [ 0x4a4, ['unsigned long']], + 'UserTime' : [ 0x4a8, ['unsigned long']], + 'DpcTime' : [ 0x4ac, ['unsigned long']], + 'DpcTimeCount' : [ 0x4b0, ['unsigned long']], + 'InterruptTime' : [ 0x4b4, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x4b8, ['unsigned long']], + 'PageColor' : [ 0x4bc, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x4c0, ['unsigned char']], + 'NodeColor' : [ 0x4c1, ['unsigned char']], + 'DeepSleep' : [ 0x4c2, ['unsigned char']], + 'PrcbPad20' : [ 0x4c3, ['array', 5, ['unsigned char']]], + 'NodeShiftedColor' : [ 0x4c8, ['unsigned long']], + 'SecondaryColorMask' : [ 0x4cc, ['unsigned long']], + 'DpcTimeLimit' : [ 0x4d0, ['unsigned long']], + 'PrcbPad21' : [ 0x4d4, ['array', 3, ['unsigned long']]], + 'CcFastReadNoWait' : [ 0x4e0, ['unsigned long']], + 'CcFastReadWait' : [ 0x4e4, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x4e8, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x4ec, ['unsigned long']], + 'CcCopyReadWait' : [ 0x4f0, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x4f4, ['unsigned long']], + 'MmSpinLockOrdering' : [ 0x4f8, ['long']], + 'IoReadOperationCount' : [ 0x4fc, ['long']], + 'IoWriteOperationCount' : [ 0x500, ['long']], + 'IoOtherOperationCount' : [ 0x504, ['long']], + 'IoReadTransferCount' : [ 0x508, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x510, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x518, ['_LARGE_INTEGER']], + 'CcFastMdlReadNoWait' : [ 0x520, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x524, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x528, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x52c, ['unsigned long']], + 'CcMapDataWait' : [ 0x530, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x534, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x538, ['unsigned long']], + 'CcPinReadWait' : [ 0x53c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x540, ['unsigned long']], + 'CcMdlReadWait' : [ 0x544, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x548, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x54c, ['unsigned long']], + 'CcLazyWritePages' : [ 0x550, ['unsigned long']], + 'CcDataFlushes' : [ 0x554, ['unsigned long']], + 'CcDataPages' : [ 0x558, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x55c, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x560, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x564, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x568, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x56c, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x570, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x574, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x578, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x57c, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x580, ['unsigned long']], + 'CcReadAheadIos' : [ 0x584, ['unsigned long']], + 'KeAlignmentFixupCount' : [ 0x588, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x58c, ['unsigned long']], + 'KeSystemCalls' : [ 0x590, ['unsigned long']], + 'AvailableTime' : [ 0x594, ['unsigned long']], + 'PrcbPad22' : [ 0x598, ['array', 2, ['unsigned long']]], + 'PPLookasideList' : [ 0x5a0, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x620, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0xf20, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x1820, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PacketBarrier' : [ 0x2120, ['long']], + 'ReverseStall' : [ 0x2124, ['long']], + 'IpiFrame' : [ 0x2128, ['pointer', ['void']]], + 'PrcbPad3' : [ 0x212c, ['array', 52, ['unsigned char']]], + 'CurrentPacket' : [ 0x2160, ['array', 3, ['pointer', ['void']]]], + 'TargetSet' : [ 0x216c, ['unsigned long']], + 'WorkerRoutine' : [ 0x2170, ['pointer', ['void']]], + 'IpiFrozen' : [ 0x2174, ['unsigned long']], + 'PrcbPad4' : [ 0x2178, ['array', 40, ['unsigned char']]], + 'RequestSummary' : [ 0x21a0, ['unsigned long']], + 'TargetCount' : [ 0x21a4, ['long']], + 'LastNonHrTimerExpiration' : [ 0x21a8, ['unsigned long long']], + 'PrcbPad50' : [ 0x21b0, ['array', 32, ['unsigned char']]], + 'InterruptLastCount' : [ 0x21d0, ['unsigned long']], + 'InterruptRate' : [ 0x21d4, ['unsigned long']], + 'DeviceInterrupts' : [ 0x21d8, ['unsigned long']], + 'IsrDpcStats' : [ 0x21dc, ['pointer', ['void']]], + 'DpcData' : [ 0x21e0, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2210, ['pointer', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2214, ['long']], + 'DpcRequestRate' : [ 0x2218, ['unsigned long']], + 'MinimumDpcRate' : [ 0x221c, ['unsigned long']], + 'DpcLastCount' : [ 0x2220, ['unsigned long']], + 'PrcbLock' : [ 0x2224, ['unsigned long']], + 'DpcGate' : [ 0x2228, ['_KGATE']], + 'IdleState' : [ 0x2238, ['unsigned char']], + 'QuantumEnd' : [ 0x2239, ['unsigned char']], + 'DpcRoutineActive' : [ 0x223a, ['unsigned char']], + 'IdleSchedule' : [ 0x223b, ['unsigned char']], + 'DpcRequestSummary' : [ 0x223c, ['long']], + 'DpcRequestSlot' : [ 0x223c, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x223c, ['short']], + 'ThreadDpcState' : [ 0x223e, ['short']], + 'DpcNormalProcessingActive' : [ 0x223c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x223c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x223c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x223c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x223c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x223c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x223c, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x223c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x223c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x223c, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2240, ['unsigned long']], + 'LastTick' : [ 0x2244, ['unsigned long']], + 'PeriodicCount' : [ 0x2248, ['unsigned long']], + 'PeriodicBias' : [ 0x224c, ['unsigned long']], + 'ClockInterrupts' : [ 0x2250, ['unsigned long']], + 'ReadyScanTick' : [ 0x2254, ['unsigned long']], + 'GroupSchedulingOverQuota' : [ 0x2258, ['unsigned char']], + 'ThreadDpcEnable' : [ 0x2259, ['unsigned char']], + 'PrcbPad41' : [ 0x225a, ['array', 2, ['unsigned char']]], + 'TimerTable' : [ 0x2260, ['_KTIMER_TABLE']], + 'CallDpc' : [ 0x3aa0, ['_KDPC']], + 'ClockKeepAlive' : [ 0x3ac0, ['long']], + 'PrcbPad6' : [ 0x3ac4, ['array', 4, ['unsigned char']]], + 'DpcWatchdogPeriod' : [ 0x3ac8, ['long']], + 'DpcWatchdogCount' : [ 0x3acc, ['long']], + 'KeSpinLockOrdering' : [ 0x3ad0, ['long']], + 'PrcbPad70' : [ 0x3ad4, ['array', 1, ['unsigned long']]], + 'QueueIndex' : [ 0x3ad8, ['unsigned long']], + 'DeferredReadyListHead' : [ 0x3adc, ['_SINGLE_LIST_ENTRY']], + 'ReadySummary' : [ 0x3ae0, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x3ae4, ['long']], + 'WaitLock' : [ 0x3ae8, ['unsigned long']], + 'WaitListHead' : [ 0x3aec, ['_LIST_ENTRY']], + 'ScbOffset' : [ 0x3af4, ['unsigned long']], + 'StartCycles' : [ 0x3af8, ['unsigned long long']], + 'TaggedCyclesStart' : [ 0x3b00, ['unsigned long long']], + 'TaggedCycles' : [ 0x3b08, ['array', 2, ['unsigned long long']]], + 'GenerationTarget' : [ 0x3b18, ['unsigned long long']], + 'CycleTime' : [ 0x3b20, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x3b28, ['unsigned long long']], + 'HighCycleTime' : [ 0x3b30, ['unsigned long']], + 'Cycles' : [ 0x3b38, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'PrcbPad71' : [ 0x3b78, ['array', 10, ['unsigned long']]], + 'DispatcherReadyListHead' : [ 0x3ba0, ['array', 32, ['_LIST_ENTRY']]], + 'ChainedInterruptList' : [ 0x3ca0, ['pointer', ['void']]], + 'LookasideIrpFloat' : [ 0x3ca4, ['long']], + 'ScbQueue' : [ 0x3ca8, ['_RTL_RB_TREE']], + 'ScbList' : [ 0x3cb0, ['_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x3cb8, ['long']], + 'MmCopyOnWriteCount' : [ 0x3cbc, ['long']], + 'MmTransitionCount' : [ 0x3cc0, ['long']], + 'MmCacheTransitionCount' : [ 0x3cc4, ['long']], + 'MmDemandZeroCount' : [ 0x3cc8, ['long']], + 'MmPageReadCount' : [ 0x3ccc, ['long']], + 'MmPageReadIoCount' : [ 0x3cd0, ['long']], + 'MmCacheReadCount' : [ 0x3cd4, ['long']], + 'MmCacheIoCount' : [ 0x3cd8, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x3cdc, ['long']], + 'MmDirtyWriteIoCount' : [ 0x3ce0, ['long']], + 'MmMappedPagesWriteCount' : [ 0x3ce4, ['long']], + 'MmMappedWriteIoCount' : [ 0x3ce8, ['long']], + 'CachedCommit' : [ 0x3cec, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x3cf0, ['unsigned long']], + 'HyperPte' : [ 0x3cf4, ['pointer', ['void']]], + 'PrcbPad8' : [ 0x3cf8, ['array', 4, ['unsigned char']]], + 'VendorString' : [ 0x3cfc, ['array', 13, ['unsigned char']]], + 'InitialApicId' : [ 0x3d09, ['unsigned char']], + 'LogicalProcessorsPerPhysicalProcessor' : [ 0x3d0a, ['unsigned char']], + 'PrcbPad9' : [ 0x3d0b, ['array', 1, ['unsigned char']]], + 'FeatureBits' : [ 0x3d10, ['unsigned long long']], + 'UpdateSignature' : [ 0x3d18, ['_LARGE_INTEGER']], + 'IsrTime' : [ 0x3d20, ['unsigned long long']], + 'PrcbPad90' : [ 0x3d28, ['array', 2, ['unsigned long']]], + 'PowerState' : [ 0x3d30, ['_PROCESSOR_POWER_STATE']], + 'PrcbPad91' : [ 0x3eb0, ['array', 17, ['unsigned long']]], + 'DpcWatchdogDpc' : [ 0x3ef4, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x3f18, ['_KTIMER']], + 'HypercallPageList' : [ 0x3f40, ['_SLIST_HEADER']], + 'HypercallCachedPages' : [ 0x3f48, ['pointer', ['void']]], + 'VirtualApicAssist' : [ 0x3f4c, ['pointer', ['void']]], + 'StatisticsPage' : [ 0x3f50, ['pointer', ['unsigned long long']]], + 'Cache' : [ 0x3f54, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x3f90, ['unsigned long']], + 'PackageProcessorSet' : [ 0x3f94, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x3fa0, ['unsigned long']], + 'SharedReadyQueue' : [ 0x3fa4, ['pointer', ['_KSHARED_READY_QUEUE']]], + 'SharedQueueScanOwner' : [ 0x3fa8, ['unsigned long']], + 'CoreProcessorSet' : [ 0x3fac, ['unsigned long']], + 'ScanSiblingMask' : [ 0x3fb0, ['unsigned long']], + 'LLCMask' : [ 0x3fb4, ['unsigned long']], + 'CacheProcessorMask' : [ 0x3fb8, ['array', 5, ['unsigned long']]], + 'ScanSiblingIndex' : [ 0x3fcc, ['unsigned long']], + 'WheaInfo' : [ 0x3fd0, ['pointer', ['void']]], + 'EtwSupport' : [ 0x3fd4, ['pointer', ['void']]], + 'InterruptObjectPool' : [ 0x3fd8, ['_SLIST_HEADER']], + 'PrcbPad92' : [ 0x3fe0, ['array', 3, ['unsigned long']]], + 'PteBitCache' : [ 0x3fec, ['unsigned long']], + 'PteBitOffset' : [ 0x3ff0, ['unsigned long']], + 'PrcbPad93' : [ 0x3ff4, ['unsigned long']], + 'ProcessorProfileControlArea' : [ 0x3ff8, ['pointer', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x3ffc, ['pointer', ['void']]], + 'TimerExpirationDpc' : [ 0x4000, ['_KDPC']], + 'SynchCounters' : [ 0x4020, ['_SYNCH_COUNTERS']], + 'FsCounters' : [ 0x40d8, ['_FILESYSTEM_DISK_COUNTERS']], + 'Context' : [ 0x40e8, ['pointer', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x40ec, ['unsigned long']], + 'ExtendedState' : [ 0x40f0, ['pointer', ['_XSAVE_AREA']]], + 'EntropyTimingState' : [ 0x40f4, ['_KENTROPY_TIMING_STATE']], + 'IsrStack' : [ 0x421c, ['pointer', ['void']]], + 'VectorToInterruptObject' : [ 0x4220, ['array', 208, ['pointer', ['_KINTERRUPT']]]], + 'AbSelfIoBoostsList' : [ 0x4560, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x4564, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x4568, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x4588, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x45dc, ['_IOP_IRP_STACK_PROFILER']], + 'TimerExpirationTrace' : [ 0x4630, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x4730, ['unsigned long']], + 'ExSaPageArray' : [ 0x4734, ['pointer', ['void']]], + 'PrcbPad100' : [ 0x4738, ['array', 10, ['unsigned long']]], + 'LocalSharedReadyQueue' : [ 0x4760, ['_KSHARED_READY_QUEUE']], + 'PrcbPad95' : [ 0x4894, ['array', 12, ['unsigned char']]], + 'Mailbox' : [ 0x48a0, ['pointer', ['_REQUEST_MAILBOX']]], + 'PrcbPad' : [ 0x48a4, ['array', 60, ['unsigned char']]], + 'RequestMailbox' : [ 0x48e0, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KAPC' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'ApcListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x14, ['pointer', ['void']]], + 'RundownRoutine' : [ 0x18, ['pointer', ['void']]], + 'NormalRoutine' : [ 0x1c, ['pointer', ['void']]], + 'Reserved' : [ 0x14, ['array', 3, ['pointer', ['void']]]], + 'NormalContext' : [ 0x20, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x24, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x28, ['pointer', ['void']]], + 'ApcStateIndex' : [ 0x2c, ['unsigned char']], + 'ApcMode' : [ 0x2d, ['unsigned char']], + 'Inserted' : [ 0x2e, ['unsigned char']], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_PS_TRUSTLET_CREATE_ATTRIBUTES' : [ 0x18, { + 'TrustletIdentity' : [ 0x0, ['unsigned long long']], + 'Attributes' : [ 0x8, ['array', 1, ['_PS_TRUSTLET_ATTRIBUTE_DATA']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_DATA' : [ 0x10, { + 'Header' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_HEADER']], + 'Data' : [ 0x8, ['array', 1, ['unsigned long long']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_HEADER' : [ 0x8, { + 'AttributeType' : [ 0x0, ['_PS_TRUSTLET_ATTRIBUTE_TYPE']], + 'InstanceNumber' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRUSTLET_MAILBOX_KEY' : [ 0x10, { + 'SecretValue' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_TRUSTLET_COLLABORATION_ID' : [ 0x10, { + 'Value' : [ 0x0, ['array', 2, ['unsigned long long']]], +} ], + '_KPROCESS' : [ 0xa8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x10, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x18, ['unsigned long']], + 'LdtDescriptor' : [ 0x1c, ['_KGDTENTRY']], + 'Int21Descriptor' : [ 0x24, ['_KIDTENTRY']], + 'ThreadListHead' : [ 0x2c, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x34, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x38, ['unsigned long long']], + 'Affinity' : [ 0x40, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0x4c, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x54, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x58, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x64, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x64, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x64, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'DeepFreeze' : [ 0x64, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x64, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x64, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SpareFlags0' : [ 0x64, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x64, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x64, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x64, ['long']], + 'BasePriority' : [ 0x68, ['unsigned char']], + 'QuantumReset' : [ 0x69, ['unsigned char']], + 'Visited' : [ 0x6a, ['unsigned char']], + 'Flags' : [ 0x6b, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x6c, ['array', 1, ['unsigned long']]], + 'IdealNode' : [ 0x70, ['array', 1, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x72, ['unsigned short']], + 'Spare1' : [ 0x74, ['unsigned short']], + 'IopmOffset' : [ 0x76, ['unsigned short']], + 'SchedulingGroup' : [ 0x78, ['pointer', ['_KSCHEDULING_GROUP']]], + 'StackCount' : [ 0x7c, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x80, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x88, ['unsigned long long']], + 'ContextSwitches' : [ 0x90, ['unsigned long long']], + 'FreezeCount' : [ 0x98, ['unsigned long']], + 'KernelTime' : [ 0x9c, ['unsigned long']], + 'UserTime' : [ 0xa0, ['unsigned long']], + 'VdmTrapcHandler' : [ 0xa4, ['pointer', ['void']]], +} ], + '_KTHREAD' : [ 0x348, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x10, ['pointer', ['void']]], + 'QuantumTarget' : [ 0x18, ['unsigned long long']], + 'InitialStack' : [ 0x20, ['pointer', ['void']]], + 'StackLimit' : [ 0x24, ['pointer', ['void']]], + 'StackBase' : [ 0x28, ['pointer', ['void']]], + 'ThreadLock' : [ 0x2c, ['unsigned long']], + 'CycleTime' : [ 0x30, ['unsigned long long']], + 'HighCycleTime' : [ 0x38, ['unsigned long']], + 'ServiceTable' : [ 0x3c, ['pointer', ['void']]], + 'CurrentRunTime' : [ 0x40, ['unsigned long']], + 'ExpectedRunTime' : [ 0x44, ['unsigned long']], + 'KernelStack' : [ 0x48, ['pointer', ['void']]], + 'StateSaveArea' : [ 0x4c, ['pointer', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x50, ['pointer', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x54, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x55, ['unsigned char']], + 'Alerted' : [ 0x56, ['array', 2, ['unsigned char']]], + 'AutoBoostActive' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitNext' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Alertable' : [ 0x58, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x58, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x58, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x58, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x58, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'TimerActive' : [ 0x58, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SystemThread' : [ 0x58, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x58, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CalloutActive' : [ 0x58, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x58, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x58, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x58, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x58, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x58, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x58, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SuspendSchedulerApcWait' : [ 0x58, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x58, ['long']], + 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ThreadFlagsSpare0' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x5c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x5c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x5c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x5c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x5c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x5c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x5c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x5c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x5c, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x5c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x5c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CommitFailTerminateRequest' : [ 0x5c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ProcessStackCountDecremented' : [ 0x5c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'RestrictedGuiThread' : [ 0x5c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ThreadFlagsSpare' : [ 0x5c, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x5c, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x5c, ['long']], + 'Tag' : [ 0x60, ['unsigned char']], + 'SystemHeteroCpuPolicy' : [ 0x61, ['unsigned char']], + 'UserHeteroCpuPolicy' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 7, native_type='unsigned char')]], + 'ExplicitSystemHeteroCpuPolicy' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare0' : [ 0x63, ['unsigned char']], + 'SystemCallNumber' : [ 0x64, ['unsigned long']], + 'FirstArgument' : [ 0x68, ['pointer', ['void']]], + 'TrapFrame' : [ 0x6c, ['pointer', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x70, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x70, ['array', 23, ['unsigned char']]], + 'Priority' : [ 0x87, ['unsigned char']], + 'UserIdealProcessor' : [ 0x88, ['unsigned long']], + 'ContextSwitches' : [ 0x8c, ['unsigned long']], + 'State' : [ 0x90, ['unsigned char']], + 'Spare12' : [ 0x91, ['unsigned char']], + 'WaitIrql' : [ 0x92, ['unsigned char']], + 'WaitMode' : [ 0x93, ['unsigned char']], + 'WaitStatus' : [ 0x94, ['long']], + 'WaitBlockList' : [ 0x98, ['pointer', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0x9c, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x9c, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xa4, ['pointer', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xa8, ['pointer', ['void']]], + 'RelativeTimerBias' : [ 0xb0, ['unsigned long long']], + 'Timer' : [ 0xb8, ['_KTIMER']], + 'WaitBlock' : [ 0xe0, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill8' : [ 0xe0, ['array', 20, ['unsigned char']]], + 'ThreadCounters' : [ 0xf4, ['pointer', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0xe0, ['array', 44, ['unsigned char']]], + 'XStateSave' : [ 0x10c, ['pointer', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0xe0, ['array', 68, ['unsigned char']]], + 'Win32Thread' : [ 0x124, ['pointer', ['void']]], + 'WaitBlockFill11' : [ 0xe0, ['array', 88, ['unsigned char']]], + 'WaitTime' : [ 0x138, ['unsigned long']], + 'KernelApcDisable' : [ 0x13c, ['short']], + 'SpecialApcDisable' : [ 0x13e, ['short']], + 'CombinedApcDisable' : [ 0x13c, ['unsigned long']], + 'QueueListEntry' : [ 0x140, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x148, ['unsigned long']], + 'NextProcessorNumber' : [ 0x148, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x148, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x14c, ['long']], + 'Process' : [ 0x150, ['pointer', ['_KPROCESS']]], + 'UserAffinity' : [ 0x154, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x154, ['array', 6, ['unsigned char']]], + 'PreviousMode' : [ 0x15a, ['unsigned char']], + 'BasePriority' : [ 0x15b, ['unsigned char']], + 'PriorityDecrement' : [ 0x15c, ['unsigned char']], + 'ForegroundBoost' : [ 0x15c, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x15c, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x15d, ['unsigned char']], + 'AdjustReason' : [ 0x15e, ['unsigned char']], + 'AdjustIncrement' : [ 0x15f, ['unsigned char']], + 'AffinityVersion' : [ 0x160, ['unsigned long']], + 'Affinity' : [ 0x164, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x164, ['array', 6, ['unsigned char']]], + 'ApcStateIndex' : [ 0x16a, ['unsigned char']], + 'WaitBlockCount' : [ 0x16b, ['unsigned char']], + 'IdealProcessor' : [ 0x16c, ['unsigned long']], + 'Spare15' : [ 0x170, ['array', 1, ['unsigned long']]], + 'SavedApcState' : [ 0x174, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x174, ['array', 23, ['unsigned char']]], + 'WaitReason' : [ 0x18b, ['unsigned char']], + 'SuspendCount' : [ 0x18c, ['unsigned char']], + 'Saturation' : [ 0x18d, ['unsigned char']], + 'SListFaultCount' : [ 0x18e, ['unsigned short']], + 'SchedulerApc' : [ 0x190, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x190, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x191, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x190, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x193, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x190, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x194, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x190, ['array', 36, ['unsigned char']]], + 'WaitPrcb' : [ 0x1b4, ['pointer', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x190, ['array', 40, ['unsigned char']]], + 'LegoData' : [ 0x1b8, ['pointer', ['void']]], + 'SchedulerApcFill5' : [ 0x190, ['array', 47, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x1bf, ['unsigned char']], + 'UserTime' : [ 0x1c0, ['unsigned long']], + 'SuspendEvent' : [ 0x1c4, ['_KEVENT']], + 'ThreadListEntry' : [ 0x1d4, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x1dc, ['_LIST_ENTRY']], + 'AbEntrySummary' : [ 0x1e4, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x1e5, ['unsigned char']], + 'Spare20' : [ 0x1e6, ['unsigned short']], + 'LockEntries' : [ 0x1e8, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x308, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x30c, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x310, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x320, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x324, ['long']], + 'AbCompletedIoQoSBoostCount' : [ 0x328, ['long']], + 'KeReferenceCount' : [ 0x32c, ['short']], + 'AbOrphanedEntrySummary' : [ 0x32e, ['unsigned char']], + 'AbOwnedEntryCount' : [ 0x32f, ['unsigned char']], + 'ForegroundLossTime' : [ 0x330, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x334, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x334, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x338, ['unsigned long']], + 'QueuedScb' : [ 0x33c, ['pointer', ['_KSCB']]], + 'NpxState' : [ 0x340, ['unsigned long long']], +} ], + '_KSTACK_CONTROL' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long']], + 'ActualLimit' : [ 0x4, ['unsigned long']], + 'StackExpansion' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousTrapFrame' : [ 0x8, ['pointer', ['_KTRAP_FRAME']]], + 'PreviousExceptionList' : [ 0xc, ['pointer', ['void']]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '_FAST_MUTEX' : [ 0x20, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x4, ['pointer', ['void']]], + 'Contention' : [ 0x8, ['unsigned long']], + 'Event' : [ 0xc, ['_KEVENT']], + 'OldIrql' : [ 0x1c, ['unsigned long']], +} ], + '_KEVENT' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_SLIST_HEADER' : [ 0x8, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x4, ['unsigned short']], + 'CpuId' : [ 0x6, ['unsigned short']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x48, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], +} ], + '_IO_STATUS_BLOCK' : [ 0x8, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer', ['void']]], + 'Information' : [ 0x4, ['unsigned long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x10, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x8, ['pointer', ['void']]], + 'Parameter' : [ 0xc, ['pointer', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer', ['void']]], + 'DeleteContext' : [ 0xc, ['pointer', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x8, { + 'P' : [ 0x0, ['pointer', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x4, ['pointer', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0x100, { + 'IdleNonParkedCpuSet' : [ 0x0, ['unsigned long']], + 'IdleSmtSet' : [ 0x4, ['unsigned long']], + 'IdleCpuSet' : [ 0x8, ['unsigned long']], + 'DeepIdleSet' : [ 0x40, ['unsigned long']], + 'IdleConstrainedSet' : [ 0x44, ['unsigned long']], + 'NonParkedSet' : [ 0x48, ['unsigned long']], + 'ParkLock' : [ 0x4c, ['long']], + 'Seed' : [ 0x50, ['unsigned long']], + 'SiblingMask' : [ 0x80, ['unsigned long']], + 'Affinity' : [ 0x84, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x84, ['array', 6, ['unsigned char']]], + 'NodeNumber' : [ 0x8a, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x8c, ['unsigned short']], + 'Stride' : [ 0x8e, ['unsigned char']], + 'Spare0' : [ 0x8f, ['unsigned char']], + 'SharedReadyQueueLeaders' : [ 0x90, ['unsigned long']], + 'ProximityId' : [ 0x94, ['unsigned long']], + 'Lowest' : [ 0x98, ['unsigned long']], + 'Highest' : [ 0x9c, ['unsigned long']], + 'MaximumProcessors' : [ 0xa0, ['unsigned char']], + 'Flags' : [ 0xa1, ['_flags']], + 'Spare10' : [ 0xa2, ['unsigned char']], + 'HeteroSets' : [ 0xa4, ['array', 5, ['_KHETERO_PROCESSOR_SET']]], +} ], + '_ENODE' : [ 0x540, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0x100, ['array', 8, ['pointer', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x120, ['_EX_WORK_QUEUE']], + 'IoWorkQueue' : [ 0x2d8, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x490, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x4a0, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x4c8, ['_KEVENT']], + 'WaitBlocks' : [ 0x4d8, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x520, ['pointer', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x524, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x528, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x528, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x528, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x80, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long']], + 'QuotaProcess' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'HandleTableList' : [ 0x10, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'StrictFIFO' : [ 0x1c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x1c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x1c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x1c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'RaiseUMExceptionOnInvalidHandleClose' : [ 0x1c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x20, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x24, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x40, ['array', 20, ['unsigned char']]], + 'DebugInfo' : [ 0x54, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x8, { + 'AuditMask' : [ 0x0, ['unsigned long']], + 'MaxRelativeAccessMask' : [ 0x4, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x8, { + 'VolatileLowValue' : [ 0x0, ['long']], + 'LowValue' : [ 0x0, ['long']], + 'InfoTable' : [ 0x0, ['pointer', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'HighValue' : [ 0x4, ['long']], + 'NextFreeHandleEntry' : [ 0x4, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x4, ['_EXHANDLE']], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'RefCountField' : [ 0x4, ['long']], + 'GrantedAccessBits' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'ProtectFromClose' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'RefCnt' : [ 0x4, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_EX_FAST_REF' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1337' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0x74, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'AuxData' : [ 0x30, ['pointer', ['void']]], + 'Privileges' : [ 0x34, ['__unnamed_1337']], + 'AuditPrivileges' : [ 0x60, ['unsigned char']], + 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xc4, { + 'PrivilegesUsed' : [ 0x0, ['pointer', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x4, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x14, ['unsigned long']], + 'MaximumAuditMask' : [ 0x18, ['unsigned long']], + 'TransactionId' : [ 0x1c, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x30, ['pointer', ['void']]], + 'ParentSecurityDescriptor' : [ 0x34, ['pointer', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x38, ['pointer', ['void']]], + 'SDLock' : [ 0x3c, ['pointer', ['void']]], + 'AccessReasons' : [ 0x40, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xc0, ['unsigned char']], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_ETHREAD' : [ 0x460, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x348, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x350, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x350, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x358, ['pointer', ['void']]], + 'PostBlockList' : [ 0x35c, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x35c, ['pointer', ['void']]], + 'StartAddress' : [ 0x360, ['pointer', ['void']]], + 'TerminationPort' : [ 0x364, ['pointer', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x364, ['pointer', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x364, ['pointer', ['void']]], + 'ActiveTimerListLock' : [ 0x368, ['unsigned long']], + 'ActiveTimerListHead' : [ 0x36c, ['_LIST_ENTRY']], + 'Cid' : [ 0x374, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x37c, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x37c, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x390, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x394, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x39c, ['unsigned long']], + 'DeviceToVerify' : [ 0x3a0, ['pointer', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x3a4, ['pointer', ['void']]], + 'LegacyPowerObject' : [ 0x3a8, ['pointer', ['void']]], + 'ThreadListEntry' : [ 0x3ac, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x3b4, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x3b8, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x3bc, ['unsigned long']], + 'MmLockOrdering' : [ 0x3c0, ['long']], + 'CrossThreadFlags' : [ 0x3c4, ['unsigned long']], + 'Terminated' : [ 0x3c4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x3c4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x3c4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x3c4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x3c4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x3c4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x3c4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x3c4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x3c4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x3c4, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x3c4, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x3c4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x3c4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x3c4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DisableDynamicCodeOptOut' : [ 0x3c4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ExplicitCaseSensitivity' : [ 0x3c4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x3c4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x3c8, ['unsigned long']], + 'ActiveExWorker' : [ 0x3c8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x3c8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'StoreLockThread' : [ 0x3c8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'ClonedThread' : [ 0x3c8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x3c8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x3c8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'RespectIoPriority' : [ 0x3c8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ActivePageLists' : [ 0x3c8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedSameThreadPassiveFlags' : [ 0x3c8, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x3cc, ['unsigned long']], + 'OwnsProcessAddressSpaceExclusive' : [ 0x3cc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x3cc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardFaultBehavior' : [ 0x3cc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x3cc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x3cc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x3cc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Prefetching' : [ 0x3cc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x3cc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x3cd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x3cd, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x3d0, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x3d1, ['unsigned char']], + 'ActiveFaultCount' : [ 0x3d2, ['unsigned char']], + 'LockOrderState' : [ 0x3d3, ['unsigned char']], + 'AlpcMessageId' : [ 0x3d4, ['unsigned long']], + 'AlpcMessage' : [ 0x3d8, ['pointer', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x3d8, ['unsigned long']], + 'AlpcWaitListEntry' : [ 0x3dc, ['_LIST_ENTRY']], + 'ExitStatus' : [ 0x3e4, ['long']], + 'CacheManagerCount' : [ 0x3e8, ['unsigned long']], + 'IoBoostCount' : [ 0x3ec, ['unsigned long']], + 'IoQoSBoostCount' : [ 0x3f0, ['unsigned long']], + 'IoQoSThrottleCount' : [ 0x3f4, ['unsigned long']], + 'BoostList' : [ 0x3f8, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x400, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x408, ['unsigned long']], + 'IrpListLock' : [ 0x40c, ['unsigned long']], + 'ReservedForSynchTracking' : [ 0x410, ['pointer', ['void']]], + 'CmCallbackListHead' : [ 0x414, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x418, ['pointer', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x41c, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x420, ['pointer', ['void']]], + 'KernelStackReference' : [ 0x424, ['unsigned long']], + 'AdjustedClientToken' : [ 0x428, ['pointer', ['void']]], + 'WorkOnBehalfThread' : [ 0x42c, ['pointer', ['void']]], + 'PropertySet' : [ 0x430, ['_PS_PROPERTY_SET']], + 'PicoContext' : [ 0x43c, ['pointer', ['void']]], + 'UserFsBase' : [ 0x440, ['unsigned long']], + 'UserGsBase' : [ 0x444, ['unsigned long']], + 'EnergyValues' : [ 0x448, ['pointer', ['_THREAD_ENERGY_VALUES']]], + 'CmDbgInfo' : [ 0x44c, ['pointer', ['void']]], + 'SelectedCpuSets' : [ 0x450, ['unsigned long']], + 'SelectedCpuSetsIndirect' : [ 0x450, ['pointer', ['unsigned long']]], + 'Silo' : [ 0x454, ['pointer', ['_EJOB']]], + 'ThreadName' : [ 0x458, ['pointer', ['_UNICODE_STRING']]], + 'ReadyTime' : [ 0x45c, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x388, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0xa8, ['_EX_PUSH_LOCK']], + 'RundownProtect' : [ 0xac, ['_EX_RUNDOWN_REF']], + 'VdmObjects' : [ 0xb0, ['pointer', ['void']]], + 'UniqueProcessId' : [ 0xb4, ['pointer', ['void']]], + 'ActiveProcessLinks' : [ 0xb8, ['_LIST_ENTRY']], + 'Flags2' : [ 0xc0, ['unsigned long']], + 'JobNotReallyActive' : [ 0xc0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0xc0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0xc0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0xc0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0xc0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0xc0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0xc0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0xc0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0xc0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0xc0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0xc0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0xc0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0xc0, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0xc0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0xc0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0xc0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0xc0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0xc0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0xc0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0xc0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0xc0, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0xc0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0xc0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0xc0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0xc0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0xc0, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0xc0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0xc0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'CreateReported' : [ 0xc4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0xc4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0xc4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0xc4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0xc4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0xc4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0xc4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0xc4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FailFastOnCommitFail' : [ 0xc4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0xc4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0xc4, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0xc4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0xc4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0xc4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0xc4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0xc4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0xc4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0xc4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0xc4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0xc4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0xc4, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0xc4, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0xc4, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0xc4, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0xc4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0xc4, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0xc4, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0xc4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0xc4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CreateTime' : [ 0xc8, ['_LARGE_INTEGER']], + 'ProcessQuotaUsage' : [ 0xd0, ['array', 2, ['unsigned long']]], + 'ProcessQuotaPeak' : [ 0xd8, ['array', 2, ['unsigned long']]], + 'PeakVirtualSize' : [ 0xe0, ['unsigned long']], + 'VirtualSize' : [ 0xe4, ['unsigned long']], + 'SessionProcessLinks' : [ 0xe8, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0xf0, ['pointer', ['void']]], + 'ExceptionPortValue' : [ 0xf0, ['unsigned long']], + 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Token' : [ 0xf4, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0xf8, ['unsigned long']], + 'AddressCreationLock' : [ 0xfc, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x100, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x104, ['pointer', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x108, ['pointer', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x10c, ['pointer', ['_EJOB']]], + 'CloneRoot' : [ 0x110, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x114, ['unsigned long']], + 'NumberOfLockedPages' : [ 0x118, ['unsigned long']], + 'Win32Process' : [ 0x11c, ['pointer', ['void']]], + 'Job' : [ 0x120, ['pointer', ['_EJOB']]], + 'SectionObject' : [ 0x124, ['pointer', ['void']]], + 'SectionBaseAddress' : [ 0x128, ['pointer', ['void']]], + 'Cookie' : [ 0x12c, ['unsigned long']], + 'WorkingSetWatch' : [ 0x130, ['pointer', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x134, ['pointer', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x138, ['pointer', ['void']]], + 'LdtInformation' : [ 0x13c, ['pointer', ['void']]], + 'OwnerProcessId' : [ 0x140, ['unsigned long']], + 'Peb' : [ 0x144, ['pointer', ['_PEB']]], + 'Session' : [ 0x148, ['pointer', ['_MM_SESSION_SPACE']]], + 'AweInfo' : [ 0x14c, ['pointer', ['void']]], + 'QuotaBlock' : [ 0x150, ['pointer', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x154, ['pointer', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x158, ['pointer', ['void']]], + 'PaeTop' : [ 0x15c, ['pointer', ['void']]], + 'DeviceMap' : [ 0x160, ['pointer', ['void']]], + 'EtwDataSource' : [ 0x164, ['pointer', ['void']]], + 'PageDirectoryPte' : [ 0x168, ['unsigned long long']], + 'ImageFilePointer' : [ 0x170, ['pointer', ['_FILE_OBJECT']]], + 'ImageFileName' : [ 0x174, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x183, ['unsigned char']], + 'SecurityPort' : [ 0x184, ['pointer', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x188, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x18c, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x194, ['pointer', ['void']]], + 'ThreadListHead' : [ 0x198, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x1a0, ['unsigned long']], + 'ImagePathHash' : [ 0x1a4, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x1a8, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x1ac, ['long']], + 'PrefetchTrace' : [ 0x1b0, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x1b4, ['pointer', ['void']]], + 'ReadOperationCount' : [ 0x1b8, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x1c0, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x1c8, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x1d0, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x1d8, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x1e0, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x1e8, ['unsigned long']], + 'CommitCharge' : [ 0x1ec, ['unsigned long']], + 'CommitChargePeak' : [ 0x1f0, ['unsigned long']], + 'Vm' : [ 0x1f4, ['_MMSUPPORT_FULL']], + 'MmProcessLinks' : [ 0x27c, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x284, ['unsigned long']], + 'ExitStatus' : [ 0x288, ['long']], + 'VadRoot' : [ 0x28c, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x290, ['pointer', ['void']]], + 'VadCount' : [ 0x294, ['unsigned long']], + 'VadPhysicalPages' : [ 0x298, ['unsigned long']], + 'VadPhysicalPagesLimit' : [ 0x29c, ['unsigned long']], + 'AlpcContext' : [ 0x2a0, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x2b0, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x2b8, ['pointer', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x2bc, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x2c0, ['unsigned long']], + 'ExitTime' : [ 0x2c8, ['_LARGE_INTEGER']], + 'ActiveThreadsHighWatermark' : [ 0x2d0, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x2d4, ['unsigned long']], + 'ThreadListLock' : [ 0x2d8, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x2dc, ['pointer', ['void']]], + 'Spare0' : [ 0x2e0, ['unsigned long']], + 'SignatureLevel' : [ 0x2e4, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x2e5, ['unsigned char']], + 'Protection' : [ 0x2e6, ['_PS_PROTECTION']], + 'HangCount' : [ 0x2e7, ['unsigned char']], + 'Flags3' : [ 0x2e8, ['unsigned long']], + 'Minimal' : [ 0x2e8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReplacingPageRoot' : [ 0x2e8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DisableNonSystemFonts' : [ 0x2e8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AuditNonSystemFontLoading' : [ 0x2e8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Crashed' : [ 0x2e8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'JobVadsAreTracked' : [ 0x2e8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'VadTrackingDisabled' : [ 0x2e8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AuxiliaryProcess' : [ 0x2e8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SubsystemProcess' : [ 0x2e8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IndirectCpuSets' : [ 0x2e8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'InPrivate' : [ 0x2e8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProhibitRemoteImageMap' : [ 0x2e8, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProhibitLowILImageMap' : [ 0x2e8, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SignatureMitigationOptIn' : [ 0x2e8, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DisableDynamicCodeAllowOptOut' : [ 0x2e8, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'EnableFilteredWin32kAPIs' : [ 0x2e8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'AuditFilteredWin32kAPIs' : [ 0x2e8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'PreferSystem32Images' : [ 0x2e8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'RelinquishedCommit' : [ 0x2e8, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AutomaticallyOverrideChildProcessPolicy' : [ 0x2e8, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'HighGraphicsPriority' : [ 0x2e8, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CommitFailLogged' : [ 0x2e8, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ReserveFailLogged' : [ 0x2e8, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DeviceAsid' : [ 0x2ec, ['long']], + 'SvmData' : [ 0x2f0, ['pointer', ['void']]], + 'SvmProcessLock' : [ 0x2f4, ['_EX_PUSH_LOCK']], + 'SvmLock' : [ 0x2f8, ['unsigned long']], + 'SvmProcessDeviceListHead' : [ 0x2fc, ['_LIST_ENTRY']], + 'LastFreezeInterruptTime' : [ 0x308, ['unsigned long long']], + 'DiskCounters' : [ 0x310, ['pointer', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x314, ['pointer', ['void']]], + 'KeepAliveCounter' : [ 0x318, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x31c, ['unsigned long']], + 'HighPriorityFaultsAllowed' : [ 0x320, ['unsigned long']], + 'InstrumentationCallback' : [ 0x324, ['pointer', ['void']]], + 'EnergyValues' : [ 0x328, ['pointer', ['_PROCESS_ENERGY_VALUES']]], + 'VmContext' : [ 0x32c, ['pointer', ['void']]], + 'SequenceNumber' : [ 0x330, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x338, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x340, ['unsigned long long']], + 'TotalUnbiasedFrozenTime' : [ 0x348, ['unsigned long long']], + 'LastAppStateUpdateTime' : [ 0x350, ['unsigned long long']], + 'LastAppStateUptime' : [ 0x358, ['BitField', dict(start_bit = 0, end_bit = 61, native_type='unsigned long long')]], + 'LastAppState' : [ 0x358, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], + 'SharedCommitCharge' : [ 0x360, ['unsigned long']], + 'SharedCommitLock' : [ 0x364, ['_EX_PUSH_LOCK']], + 'SharedCommitLinks' : [ 0x368, ['_LIST_ENTRY']], + 'AllowedCpuSets' : [ 0x370, ['unsigned long']], + 'DefaultCpuSets' : [ 0x374, ['unsigned long']], + 'AllowedCpuSetsIndirect' : [ 0x370, ['pointer', ['unsigned long']]], + 'DefaultCpuSetsIndirect' : [ 0x374, ['pointer', ['unsigned long']]], + 'DiskIoAttribution' : [ 0x378, ['pointer', ['void']]], + 'ReadyTime' : [ 0x37c, ['unsigned long']], + 'DxgProcess' : [ 0x380, ['pointer', ['void']]], +} ], + '__unnamed_1394' : [ 0x4, { + 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_139a' : [ 0x8, { + 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer', ['void']]], + 'UserApcContext' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_139c' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_139a']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_13a5' : [ 0x2c, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], + 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x14, ['pointer', ['unsigned char']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x20, ['pointer', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x20, ['unsigned long']], + 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x28, ['pointer', ['void']]], +} ], + '__unnamed_13a7' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_13a5']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer', ['void']]], +} ], + '_IRP' : [ 0x70, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_1394']], + 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x20, ['unsigned char']], + 'PendingReturned' : [ 0x21, ['unsigned char']], + 'StackCount' : [ 0x22, ['unsigned char']], + 'CurrentLocation' : [ 0x23, ['unsigned char']], + 'Cancel' : [ 0x24, ['unsigned char']], + 'CancelIrql' : [ 0x25, ['unsigned char']], + 'ApcEnvironment' : [ 0x26, ['unsigned char']], + 'AllocationFlags' : [ 0x27, ['unsigned char']], + 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], + 'Overlay' : [ 0x30, ['__unnamed_139c']], + 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], + 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], + 'Tail' : [ 0x40, ['__unnamed_13a7']], +} ], + '__unnamed_13ae' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'FileAttributes' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'EaLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13b2' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13b6' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13b8' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_13bc' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13be' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_13c0' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], +} ], + '__unnamed_13c2' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileDispositionInformationEx', 65: 'FileRenameInformationEx', 66: 'FileRenameInformationExBypassAccessCheck', 67: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0xc, ['unsigned char']], + 'AdvanceOnly' : [ 0xd, ['unsigned char']], + 'ClusterCount' : [ 0xc, ['unsigned long']], + 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13c4' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x4, ['pointer', ['void']]], + 'EaListLength' : [ 0x8, ['unsigned long']], + 'EaIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13c6' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13ca' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMetadataSizeInformation', 14: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13cc' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'FsControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13cf' : [ 0x10, { + 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_13d1' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'IoControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13d3' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_13d5' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_13d9' : [ 0x8, { + 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_13dd' : [ 0x4, { + 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_13e1' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x4, ['pointer', ['void']]], + 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13e5' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_13e9' : [ 0x10, { + 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned short']], + 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_13ed' : [ 0x4, { + 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_13f1' : [ 0x4, { + 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_13f3' : [ 0x10, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['void']]], + 'Offset' : [ 0x8, ['unsigned long']], + 'Length' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_13f5' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_13f9' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_13fd' : [ 0x8, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1401' : [ 0x8, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_1405' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_1409' : [ 0x4, { + 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1411' : [ 0x10, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x8, ['_POWER_STATE']], + 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], +} ], + '__unnamed_1415' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1417' : [ 0x10, { + 'ProviderId' : [ 0x0, ['unsigned long']], + 'DataPath' : [ 0x4, ['pointer', ['void']]], + 'BufferSize' : [ 0x8, ['unsigned long']], + 'Buffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_1419' : [ 0x10, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_141b' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_13ae']], + 'CreatePipe' : [ 0x0, ['__unnamed_13b2']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13b6']], + 'Read' : [ 0x0, ['__unnamed_13b8']], + 'Write' : [ 0x0, ['__unnamed_13b8']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13bc']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13be']], + 'QueryFile' : [ 0x0, ['__unnamed_13c0']], + 'SetFile' : [ 0x0, ['__unnamed_13c2']], + 'QueryEa' : [ 0x0, ['__unnamed_13c4']], + 'SetEa' : [ 0x0, ['__unnamed_13c6']], + 'QueryVolume' : [ 0x0, ['__unnamed_13ca']], + 'SetVolume' : [ 0x0, ['__unnamed_13ca']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13cc']], + 'LockControl' : [ 0x0, ['__unnamed_13cf']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_13d1']], + 'QuerySecurity' : [ 0x0, ['__unnamed_13d3']], + 'SetSecurity' : [ 0x0, ['__unnamed_13d5']], + 'MountVolume' : [ 0x0, ['__unnamed_13d9']], + 'VerifyVolume' : [ 0x0, ['__unnamed_13d9']], + 'Scsi' : [ 0x0, ['__unnamed_13dd']], + 'QueryQuota' : [ 0x0, ['__unnamed_13e1']], + 'SetQuota' : [ 0x0, ['__unnamed_13c6']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_13e5']], + 'QueryInterface' : [ 0x0, ['__unnamed_13e9']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_13ed']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_13f1']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_13f3']], + 'SetLock' : [ 0x0, ['__unnamed_13f5']], + 'QueryId' : [ 0x0, ['__unnamed_13f9']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_13fd']], + 'UsageNotification' : [ 0x0, ['__unnamed_1401']], + 'WaitWake' : [ 0x0, ['__unnamed_1405']], + 'PowerSequence' : [ 0x0, ['__unnamed_1409']], + 'Power' : [ 0x0, ['__unnamed_1411']], + 'StartDevice' : [ 0x0, ['__unnamed_1415']], + 'WMI' : [ 0x0, ['__unnamed_1417']], + 'Others' : [ 0x0, ['__unnamed_1419']], +} ], + '_IO_STACK_LOCATION' : [ 0x24, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x4, ['__unnamed_141b']], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], +} ], + '__unnamed_1431' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0xb8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x14, ['pointer', ['_IRP']]], + 'Timer' : [ 0x18, ['pointer', ['_IO_TIMER']]], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Characteristics' : [ 0x20, ['unsigned long']], + 'Vpb' : [ 0x24, ['pointer', ['_VPB']]], + 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], + 'DeviceType' : [ 0x2c, ['unsigned long']], + 'StackSize' : [ 0x30, ['unsigned char']], + 'Queue' : [ 0x34, ['__unnamed_1431']], + 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], + 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0x74, ['_KDPC']], + 'ActiveThreadCount' : [ 0x94, ['unsigned long']], + 'SecurityDescriptor' : [ 0x98, ['pointer', ['void']]], + 'DeviceLock' : [ 0x9c, ['_KEVENT']], + 'SectorSize' : [ 0xac, ['unsigned short']], + 'Spare1' : [ 0xae, ['unsigned short']], + 'DeviceObjectExtension' : [ 0xb0, ['pointer', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0xb4, ['pointer', ['void']]], +} ], + '_KDPC' : [ 0x20, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x4, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x8, ['unsigned long']], + 'DeferredRoutine' : [ 0xc, ['pointer', ['void']]], + 'DeferredContext' : [ 0x10, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x14, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x18, ['pointer', ['void']]], + 'DpcData' : [ 0x1c, ['pointer', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x14, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x4, ['pointer', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x8, ['pointer', ['void']]], + 'TxnParameters' : [ 0xc, ['pointer', ['_TXN_PARAMETER_BLOCK']]], + 'SiloContext' : [ 0x10, ['pointer', ['_EJOB']]], +} ], + '_EJOB' : [ 0x358, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x10, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x18, ['_LIST_ENTRY']], + 'JobLock' : [ 0x20, ['_ERESOURCE']], + 'TotalUserTime' : [ 0x58, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0x60, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0x68, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0x70, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0x78, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0x80, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0x88, ['unsigned long']], + 'TotalProcesses' : [ 0x8c, ['unsigned long']], + 'ActiveProcesses' : [ 0x90, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0x94, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0x98, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xa0, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xa8, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0xac, ['unsigned long']], + 'LimitFlags' : [ 0xb0, ['unsigned long']], + 'ActiveProcessLimit' : [ 0xb4, ['unsigned long']], + 'Affinity' : [ 0xb8, ['_KAFFINITY_EX']], + 'AccessState' : [ 0xc4, ['pointer', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0xc8, ['pointer', ['void']]], + 'UIRestrictionsClass' : [ 0xcc, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0xd0, ['unsigned long']], + 'CompletionPort' : [ 0xd4, ['pointer', ['void']]], + 'CompletionKey' : [ 0xd8, ['pointer', ['void']]], + 'CompletionCount' : [ 0xe0, ['unsigned long long']], + 'SessionId' : [ 0xe8, ['unsigned long']], + 'SchedulingClass' : [ 0xec, ['unsigned long']], + 'ReadOperationCount' : [ 0xf0, ['unsigned long long']], + 'WriteOperationCount' : [ 0xf8, ['unsigned long long']], + 'OtherOperationCount' : [ 0x100, ['unsigned long long']], + 'ReadTransferCount' : [ 0x108, ['unsigned long long']], + 'WriteTransferCount' : [ 0x110, ['unsigned long long']], + 'OtherTransferCount' : [ 0x118, ['unsigned long long']], + 'DiskIoInfo' : [ 0x120, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x148, ['unsigned long']], + 'JobMemoryLimit' : [ 0x14c, ['unsigned long']], + 'JobTotalMemoryLimit' : [ 0x150, ['unsigned long']], + 'PeakProcessMemoryUsed' : [ 0x154, ['unsigned long']], + 'PeakJobMemoryUsed' : [ 0x158, ['unsigned long']], + 'EffectiveAffinity' : [ 0x15c, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x168, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x170, ['unsigned long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x174, ['unsigned long']], + 'EffectiveProcessMemoryLimit' : [ 0x178, ['unsigned long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x17c, ['pointer', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x180, ['pointer', ['_EJOB']]], + 'EffectiveNetIoRateLimitJob' : [ 0x184, ['pointer', ['_EJOB']]], + 'EffectiveHeapAttributionJob' : [ 0x188, ['pointer', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x18c, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x190, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x194, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x198, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x19c, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x1a0, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x1a4, ['unsigned char']], + 'PriorityClass' : [ 0x1a5, ['unsigned char']], + 'NestingDepth' : [ 0x1a6, ['unsigned char']], + 'Reserved1' : [ 0x1a7, ['array', 1, ['unsigned char']]], + 'CompletionFilter' : [ 0x1a8, ['unsigned long']], + 'WakeChannel' : [ 0x1b0, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x1b0, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x1e8, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x1f0, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x1f4, ['unsigned long']], + 'NotificationLink' : [ 0x1f8, ['pointer', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x200, ['unsigned long long']], + 'NotificationInfo' : [ 0x208, ['pointer', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x20c, ['pointer', ['void']]], + 'NotificationPacket' : [ 0x210, ['pointer', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x214, ['pointer', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x218, ['pointer', ['void']]], + 'ReadyTime' : [ 0x220, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x228, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x22c, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x234, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x23c, ['pointer', ['_EJOB']]], + 'ParentSilo' : [ 0x240, ['pointer', ['_EJOB']]], + 'RootJob' : [ 0x244, ['pointer', ['_EJOB']]], + 'IteratorListHead' : [ 0x248, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x250, ['unsigned long']], + 'Ancestors' : [ 0x254, ['pointer', ['pointer', ['_EJOB']]]], + 'SessionObject' : [ 0x254, ['pointer', ['void']]], + 'TimerListLock' : [ 0x258, ['unsigned long']], + 'TimerListHead' : [ 0x25c, ['_LIST_ENTRY']], + 'Accounting' : [ 0x268, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x2c0, ['unsigned long']], + 'ActiveAuxiliaryProcessCount' : [ 0x2c4, ['unsigned long']], + 'SequenceNumber' : [ 0x2c8, ['unsigned long']], + 'JobId' : [ 0x2cc, ['unsigned long']], + 'ContainerId' : [ 0x2d0, ['_GUID']], + 'ServerSiloGlobals' : [ 0x2e0, ['pointer', ['_ESERVERSILO_GLOBALS']]], + 'PropertySet' : [ 0x2e4, ['_PS_PROPERTY_SET']], + 'Storage' : [ 0x2f0, ['pointer', ['_PSP_STORAGE']]], + 'NetRateControl' : [ 0x2f4, ['pointer', ['_JOB_NET_RATE_CONTROL']]], + 'JobFlags' : [ 0x2f8, ['unsigned long']], + 'CloseDone' : [ 0x2f8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x2f8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x2f8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x2f8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x2f8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x2f8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x2f8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x2f8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x2f8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x2f8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x2f8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x2f8, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x2f8, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x2f8, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x2f8, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x2f8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x2f8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x2f8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x2f8, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x2f8, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x2f8, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x2f8, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x2f8, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x2f8, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x2f8, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'NetRateControlActive' : [ 0x2f8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'OwnNetRateControl' : [ 0x2f8, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IoRateControlActive' : [ 0x2f8, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'OwnIoRateControl' : [ 0x2f8, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'DisallowNewProcesses' : [ 0x2f8, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Silo' : [ 0x2f8, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare' : [ 0x2f8, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x2fc, ['unsigned long']], + 'EnergyValues' : [ 0x300, ['pointer', ['_PROCESS_ENERGY_VALUES']]], + 'SharedCommitCharge' : [ 0x304, ['unsigned long']], + 'WakeRoot' : [ 0x308, ['pointer', ['_EJOB']]], + 'DiskIoAttributionUserRefCount' : [ 0x30c, ['unsigned long']], + 'DiskIoAttributionRefCount' : [ 0x310, ['unsigned long']], + 'DiskIoAttributionContext' : [ 0x314, ['pointer', ['void']]], + 'DiskIoAttributionOwnerJob' : [ 0x314, ['pointer', ['_EJOB']]], + 'GlobalIoControl' : [ 0x318, ['_PS_IO_CONTROL_ENTRY']], + 'VolumeIoControlLock' : [ 0x334, ['long']], + 'VolumeIoControlTree' : [ 0x338, ['_RTL_RB_TREE']], + 'IoControlLock' : [ 0x340, ['_EX_PUSH_LOCK']], + 'SiloHardReferenceCount' : [ 0x344, ['unsigned long']], + 'RundownWorkItem' : [ 0x348, ['_WORK_QUEUE_ITEM']], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_MDL' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MDL']]], + 'Size' : [ 0x4, ['short']], + 'MdlFlags' : [ 0x6, ['short']], + 'Process' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0xc, ['pointer', ['void']]], + 'StartVa' : [ 0x10, ['pointer', ['void']]], + 'ByteCount' : [ 0x14, ['unsigned long']], + 'ByteOffset' : [ 0x18, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x68, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x5c, ['pointer', ['void']]], + 'UserContext' : [ 0x60, ['pointer', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0x80, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x8, ['pointer', ['_VPB']]], + 'FsContext' : [ 0xc, ['pointer', ['void']]], + 'FsContext2' : [ 0x10, ['pointer', ['void']]], + 'SectionObjectPointer' : [ 0x14, ['pointer', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x18, ['pointer', ['void']]], + 'FinalStatus' : [ 0x1c, ['long']], + 'RelatedFileObject' : [ 0x20, ['pointer', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x24, ['unsigned char']], + 'DeletePending' : [ 0x25, ['unsigned char']], + 'ReadAccess' : [ 0x26, ['unsigned char']], + 'WriteAccess' : [ 0x27, ['unsigned char']], + 'DeleteAccess' : [ 0x28, ['unsigned char']], + 'SharedRead' : [ 0x29, ['unsigned char']], + 'SharedWrite' : [ 0x2a, ['unsigned char']], + 'SharedDelete' : [ 0x2b, ['unsigned char']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x40, ['unsigned long']], + 'Busy' : [ 0x44, ['unsigned long']], + 'LastLock' : [ 0x48, ['pointer', ['void']]], + 'Lock' : [ 0x4c, ['_KEVENT']], + 'Event' : [ 0x5c, ['_KEVENT']], + 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0x70, ['unsigned long']], + 'IrpList' : [ 0x74, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0x7c, ['pointer', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x4, { + 'Count' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x38, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0x8, ['unsigned long']], + 'CurrentFileIndex' : [ 0x8, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x24, ['pointer', ['unsigned long']]], + 'FirstFileEntry' : [ 0x28, ['pointer', ['unsigned long']]], + 'Process' : [ 0x2c, ['pointer', ['_EPROCESS']]], + 'SessionId' : [ 0x30, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer', ['unsigned long']]], + 'LastPageFrameEntry' : [ 0x24, ['pointer', ['unsigned long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0xc, ['pointer', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x10, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x28, ['pointer', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x2c, ['_LIST_ENTRY']], + 'PushLock' : [ 0x34, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x38, ['pointer', ['pointer', ['void']]]], + 'Oplock' : [ 0x3c, ['pointer', ['void']]], + 'ReservedForRemote' : [ 0x3c, ['pointer', ['void']]], + 'ReservedContext' : [ 0x40, ['pointer', ['void']]], +} ], + '_iobuf' : [ 0x20, { + '_ptr' : [ 0x0, ['pointer', ['unsigned char']]], + '_cnt' : [ 0x4, ['long']], + '_base' : [ 0x8, ['pointer', ['unsigned char']]], + '_flag' : [ 0xc, ['long']], + '_file' : [ 0x10, ['long']], + '_charbuf' : [ 0x14, ['long']], + '_bufsiz' : [ 0x18, ['long']], + '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], +} ], + '_TlgProvider_t' : [ 0x30, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x4, ['pointer', ['unsigned short']]], + 'KeywordAny' : [ 0x8, ['unsigned long long']], + 'KeywordAll' : [ 0x10, ['unsigned long long']], + 'RegHandle' : [ 0x18, ['unsigned long long']], + 'EnableCallback' : [ 0x20, ['pointer', ['void']]], + 'CallbackContext' : [ 0x24, ['pointer', ['void']]], + 'AnnotationFunc' : [ 0x28, ['pointer', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '__unnamed_161c' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'HighLow' : [ 0x0, ['_MMPTE_HIGHLOW']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_161c']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND' : [ 0xc, { + 'LocalLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'State' : [ 0x4, ['_EX_PUSH_LOCK_AUTO_EXPAND_STATE']], + 'Stats' : [ 0x8, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x38, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x8, ['pointer', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0xc, ['short']], + 'Flag' : [ 0xe, ['unsigned short']], + 'ReservedLowFlags' : [ 0xe, ['unsigned char']], + 'WaiterPriority' : [ 0xf, ['unsigned char']], + 'SharedWaiters' : [ 0x10, ['_KWAIT_CHAIN']], + 'ExclusiveWaiters' : [ 0x14, ['pointer', ['_KEVENT']]], + 'OwnerEntry' : [ 0x18, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x28, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x2c, ['unsigned long']], + 'Address' : [ 0x30, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0x30, ['unsigned long']], + 'SpinLock' : [ 0x34, ['unsigned long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0xc, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x8, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x14, { + 'Total' : [ 0x0, ['unsigned long']], + 'ListName' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x8, ['unsigned long']], + 'Blink' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['unsigned long']], +} ], + '_MMCLONE_DESCRIPTOR' : [ 0x30, { + 'CloneNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Next' : [ 0x0, ['pointer', ['_MMCLONE_DESCRIPTOR']]], + 'StartingCloneBlock' : [ 0xc, ['pointer', ['_MMCLONE_BLOCK']]], + 'EndingCloneBlock' : [ 0x10, ['pointer', ['_MMCLONE_BLOCK']]], + 'NumberOfPtes' : [ 0x14, ['unsigned long']], + 'NumberOfReferences' : [ 0x18, ['unsigned long']], + 'CloneHeader' : [ 0x1c, ['pointer', ['_MMCLONE_HEADER']]], + 'NonPagedPoolQuotaCharge' : [ 0x20, ['unsigned long']], + 'NestingLevel' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_165f' : [ 0x4, { + 'Flink' : [ 0x0, ['unsigned long']], + 'WsIndex' : [ 0x0, ['unsigned long']], + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1664' : [ 0x2, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], +} ], + '__unnamed_1666' : [ 0x4, { + 'EntireField' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1668' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY1']], + 'e3' : [ 0x3, ['_MMPFNENTRY3']], + 'e2' : [ 0x0, ['__unnamed_1664']], + 'e4' : [ 0x0, ['__unnamed_1666']], +} ], + '__unnamed_166d' : [ 0x4, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'EntireField' : [ 0x0, ['unsigned long']], +} ], + '_MMPFN' : [ 0x1c, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'u1' : [ 0x0, ['__unnamed_165f']], + 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x4, ['pointer', ['void']]], + 'PteLong' : [ 0x4, ['unsigned long']], + 'OriginalPte' : [ 0x8, ['_MMPTE']], + 'u2' : [ 0x10, ['_MIPFNBLINK']], + 'u3' : [ 0x14, ['__unnamed_1668']], + 'u4' : [ 0x18, ['__unnamed_166d']], +} ], + '__unnamed_1675' : [ 0x4, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'Long' : [ 0x0, ['unsigned long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x4, { + 'u1' : [ 0x0, ['__unnamed_1675']], +} ], + '_MMWSL_SHARED' : [ 0x40, { + 'FirstFree' : [ 0x0, ['unsigned long']], + 'FirstDynamic' : [ 0x4, ['unsigned long']], + 'LastEntry' : [ 0x8, ['unsigned long']], + 'LastInitializedWsle' : [ 0xc, ['unsigned long']], + 'WsleSize' : [ 0x10, ['unsigned long']], + 'NonDirectCount' : [ 0x14, ['unsigned long']], + 'LowestPagableAddress' : [ 0x18, ['pointer', ['void']]], + 'NonDirectHash' : [ 0x1c, ['pointer', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x20, ['pointer', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x24, ['pointer', ['_MMWSLE_HASH']]], + 'Wsle' : [ 0x30, ['pointer', ['_MMWSLE']]], +} ], + '__unnamed_1688' : [ 0x4, { + 'ImageCommitment' : [ 0x0, ['unsigned long']], + 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], +} ], + '__unnamed_168c' : [ 0x4, { + 'ImageInformation' : [ 0x0, ['pointer', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x20, ['__unnamed_1688']], + 'u2' : [ 0x24, ['__unnamed_168c']], + 'PrototypePte' : [ 0x28, ['pointer', ['_MMPTE']]], +} ], + '__unnamed_1691' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_169b' : [ 0xc, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long')]], + 'SystemImage' : [ 0x4, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'StrongCode' : [ 0x4, ['BitField', dict(start_bit = 26, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_169d' : [ 0xc, { + 'e2' : [ 0x0, ['__unnamed_169b']], +} ], + '__unnamed_16a1' : [ 0x4, { + 'IoAttributionContext' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 32, native_type='unsigned long')]], + 'SpareImage' : [ 0x0, ['unsigned long']], +} ], + '_CONTROL_AREA' : [ 0x50, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'ListHead' : [ 0x4, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0xc, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x10, ['unsigned long']], + 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], + 'NumberOfUserReferences' : [ 0x18, ['unsigned long']], + 'u' : [ 0x1c, ['__unnamed_1691']], + 'FilePointer' : [ 0x20, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x24, ['long']], + 'ModifiedWriteCount' : [ 0x28, ['unsigned long']], + 'WaitList' : [ 0x2c, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x30, ['__unnamed_169d']], + 'FileObjectLock' : [ 0x3c, ['_EX_PUSH_LOCK']], + 'LockedPages' : [ 0x40, ['unsigned long long']], + 'u3' : [ 0x48, ['__unnamed_16a1']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x38, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP']], + 'BasePte' : [ 0x8, ['pointer', ['_MMPTE']]], + 'Flags' : [ 0xc, ['unsigned long']], + 'VaType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaPagedProtoPool', 15: 'MiVaMaximumType', 16: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x14, ['pointer', ['unsigned long']]], + 'PteFailures' : [ 0x18, ['unsigned long']], + 'SpinLock' : [ 0x1c, ['unsigned long']], + 'GlobalPushLock' : [ 0x1c, ['pointer', ['_EX_PUSH_LOCK']]], + 'Vm' : [ 0x20, ['pointer', ['_MMSUPPORT_INSTANCE']]], + 'TotalSystemPtes' : [ 0x24, ['unsigned long']], + 'Hint' : [ 0x28, ['unsigned long']], + 'LowestBitEverAllocated' : [ 0x2c, ['unsigned long']], + 'CachedPtes' : [ 0x30, ['pointer', ['_MI_CACHED_PTES']]], + 'TotalFreeSystemPtes' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_16c2' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_16c5' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x28, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['long']], + 'PushLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'u' : [ 0x1c, ['__unnamed_16c2']], + 'u1' : [ 0x20, ['__unnamed_16c5']], + 'EventList' : [ 0x24, ['pointer', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_MM_STORE_KEY' : [ 0x4, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28, native_type='unsigned long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'EntireKey' : [ 0x0, ['unsigned long']], +} ], + '_HHIVE' : [ 0x6f0, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x4, ['pointer', ['void']]], + 'ReleaseCellRoutine' : [ 0x8, ['pointer', ['void']]], + 'Allocate' : [ 0xc, ['pointer', ['void']]], + 'Free' : [ 0x10, ['pointer', ['void']]], + 'FileWrite' : [ 0x14, ['pointer', ['void']]], + 'FileRead' : [ 0x18, ['pointer', ['void']]], + 'HiveLoadFailure' : [ 0x1c, ['pointer', ['void']]], + 'BaseBlock' : [ 0x20, ['pointer', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x24, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x2c, ['unsigned long']], + 'DirtyAlloc' : [ 0x30, ['unsigned long']], + 'UnreconciledVector' : [ 0x34, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x3c, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x40, ['unsigned long']], + 'Cluster' : [ 0x44, ['unsigned long']], + 'Flat' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SystemCacheBacked' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x49, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x4c, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x50, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x54, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x58, ['unsigned long']], + 'HiveFlags' : [ 0x5c, ['unsigned long']], + 'CurrentLog' : [ 0x60, ['unsigned long']], + 'CurrentLogSequence' : [ 0x64, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x68, ['unsigned long']], + 'CurrentLogOffset' : [ 0x6c, ['unsigned long']], + 'MinimumLogSequence' : [ 0x70, ['unsigned long']], + 'LogFileSizeCap' : [ 0x74, ['unsigned long']], + 'LogDataPresent' : [ 0x78, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0x7a, ['unsigned char']], + 'BaseBlockDirty' : [ 0x7b, ['unsigned char']], + 'LastLogSwapTime' : [ 0x80, ['_LARGE_INTEGER']], + 'FirstLogFile' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0x88, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0x88, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0x88, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0x88, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0x88, ['unsigned short']], + 'LogEntriesRecovered' : [ 0x8a, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0x8c, ['unsigned long']], + 'StorageTypeCount' : [ 0x90, ['unsigned long']], + 'Version' : [ 0x94, ['unsigned long']], + 'ViewMap' : [ 0x98, ['_HVIEW_MAP']], + 'Storage' : [ 0x3b8, ['array', 2, ['_DUAL']]], +} ], + '_HV_GET_CELL_CONTEXT' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'BinContext' : [ 0x4, ['_HV_GET_BIN_CONTEXT']], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0xa8, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Discarded' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x8, ['_CM_PATH_HASH']], + 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0x14, ['unsigned long']], + 'KcbPushlock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x1c, ['pointer', ['_KTHREAD']]], + 'SharedCount' : [ 0x1c, ['long']], + 'DelayedDeref' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DelayedClose' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Parking' : [ 0x20, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'LayerSemantics' : [ 0x21, ['unsigned char']], + 'LayerHeight' : [ 0x22, ['short']], + 'SlotHint' : [ 0x24, ['unsigned long']], + 'ParentKcb' : [ 0x28, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x2c, ['pointer', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x30, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x34, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x3c, ['pointer', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x3c, ['unsigned long']], + 'SubKeyCount' : [ 0x3c, ['unsigned long']], + 'KeyBodyListHead' : [ 0x40, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x48, ['array', 4, ['pointer', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0x58, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0x60, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0x62, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0x64, ['unsigned long']], + 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'LayerInfo' : [ 0x6c, ['pointer', ['_CM_KCB_LAYER_INFO']]], + 'KCBUoWListHead' : [ 0x70, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0x78, ['_LIST_ENTRY']], + 'Stolen' : [ 0x78, ['pointer', ['unsigned char']]], + 'TransKCBOwner' : [ 0x80, ['pointer', ['_CM_TRANS']]], + 'KCBLock' : [ 0x84, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x8c, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x94, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x9c, ['pointer', ['_CM_TRANS']]], + 'FullKCBName' : [ 0xa0, ['pointer', ['_UNICODE_STRING']]], + 'FullKCBNameStale' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0xa0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + 'tagSWITCH_CONTEXT' : [ 0x68, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '_CM_KEY_BODY' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x8, ['pointer', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0xc, ['pointer', ['void']]], + 'KeyBodyList' : [ 0x10, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'Trans' : [ 0x1c, ['_CM_TRANS_PTR']], + 'KtmUow' : [ 0x20, ['pointer', ['_GUID']]], + 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], +} ], + '__unnamed_1730' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry', 21: '_CmpMountPreloadedHives', 22: '_CmpLoadHiveThread'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1733' : [ 0xc, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x4, ['pointer', ['void']]], + 'Status' : [ 0x8, ['long']], +} ], + '__unnamed_1735' : [ 0x4, { + 'CheckStack' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1737' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x4, ['pointer', ['_CELL_DATA']]], + 'RootPoint' : [ 0x8, ['pointer', ['void']]], + 'Index' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1739' : [ 0x10, { + 'List' : [ 0x0, ['pointer', ['_CELL_DATA']]], + 'Index' : [ 0x4, ['unsigned long']], + 'Cell' : [ 0x8, ['unsigned long']], + 'CellPoint' : [ 0xc, ['pointer', ['_CELL_DATA']]], +} ], + '__unnamed_173d' : [ 0xc, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer', ['_HBIN']]], +} ], + '__unnamed_1741' : [ 0x8, { + 'Bin' : [ 0x0, ['pointer', ['_HBIN']]], + 'CellPoint' : [ 0x4, ['pointer', ['_HCELL']]], +} ], + '__unnamed_1743' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x120, { + 'Hive' : [ 0x0, ['pointer', ['_HHIVE']]], + 'Index' : [ 0x4, ['unsigned long']], + 'RecoverableIndex' : [ 0x8, ['unsigned long']], + 'Locations' : [ 0xc, ['array', 8, ['__unnamed_1730']]], + 'RecoverableLocations' : [ 0x6c, ['array', 8, ['__unnamed_1730']]], + 'RegistryIO' : [ 0xcc, ['__unnamed_1733']], + 'CheckRegistry2' : [ 0xd8, ['__unnamed_1735']], + 'CheckKey' : [ 0xdc, ['__unnamed_1737']], + 'CheckValueList' : [ 0xec, ['__unnamed_1739']], + 'CheckHive' : [ 0xfc, ['__unnamed_173d']], + 'CheckHive1' : [ 0x108, ['__unnamed_173d']], + 'CheckBin' : [ 0x114, ['__unnamed_1741']], + 'RecoverData' : [ 0x11c, ['__unnamed_1743']], +} ], + '_CM_KCB_UOW' : [ 0x40, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x8, ['pointer', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0xc, ['pointer', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x18, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x1c, ['pointer', ['_CM_TRANS']]], + 'UoWState' : [ 0x20, ['unsigned long']], + 'ActionType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ParentUoW' : [ 0x2c, ['pointer', ['_CM_KCB_UOW']]], + 'ChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x30, ['unsigned long']], + 'OldValueCell' : [ 0x30, ['unsigned long']], + 'NewValueCell' : [ 0x34, ['unsigned long']], + 'UserFlags' : [ 0x30, ['unsigned long']], + 'LastWriteTime' : [ 0x30, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x30, ['unsigned long']], + 'OldChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x34, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x34, ['unsigned long']], + 'PrepareDataPointer' : [ 0x38, ['pointer', ['void']]], + 'SecurityData' : [ 0x38, ['pointer', ['_CM_UOW_SET_SD_DATA']]], + 'ModifyKeysData' : [ 0x38, ['pointer', ['_CM_UOW_KEY_STATE_MODIFICATION']]], + 'SetValueData' : [ 0x38, ['pointer', ['_CM_UOW_SET_VALUE_LIST_DATA']]], + 'ValueData' : [ 0x3c, ['pointer', ['_CM_UOW_SET_VALUE_KEY_DATA']]], + 'DiscardReplaceContext' : [ 0x3c, ['pointer', ['_CMP_DISCARD_AND_REPLACE_KCB_CONTEXT']]], +} ], + '_CM_TRANS' : [ 0x68, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x8, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Prepared' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Aborted' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Committed' : [ 0x18, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Initializing' : [ 0x18, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Invalid' : [ 0x18, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UseReservation' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'TmCallbacksActive' : [ 0x18, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LightWeight' : [ 0x18, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Freed1' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Freed2' : [ 0x18, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x18, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'Freed' : [ 0x18, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Spare' : [ 0x18, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long')]], + 'TransState' : [ 0x18, ['unsigned long']], + 'Trans' : [ 0x1c, ['_CM_TRANS_PTR']], + 'CmRm' : [ 0x20, ['pointer', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x24, ['pointer', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x28, ['pointer', ['void']]], + 'KtmUow' : [ 0x2c, ['_GUID']], + 'StartLsn' : [ 0x40, ['unsigned long long']], + 'HiveCount' : [ 0x48, ['unsigned long']], + 'HiveArray' : [ 0x4c, ['array', 7, ['pointer', ['_CMHIVE']]]], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x8, ['unsigned long']], + 'Counters' : [ 0xc, ['pointer', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x10, ['pointer', ['void']]], + 'CallbackContext' : [ 0x14, ['pointer', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xc0, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'ParkingStatus' : [ 0x80, ['unsigned long']], + 'CurrentFrequency' : [ 0x84, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x88, ['unsigned long']], + 'StateFlags' : [ 0x8c, ['unsigned long']], + 'NominalThroughput' : [ 0x90, ['unsigned long']], + 'ActiveThroughput' : [ 0x94, ['unsigned long']], + 'ScaledThroughput' : [ 0x98, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0xa0, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa8, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xb0, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb8, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xbc, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x8, { + 'Data' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_TEB32' : [ 0x1000, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0xcc, ['array', 16, ['unsigned long']]], + 'SystemReserved1' : [ 0x10c, ['array', 36, ['unsigned long']]], + 'WorkingOnBehalfTicket' : [ 0x19c, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'InstrumentationCallbackSp' : [ 0x1ac, ['unsigned long']], + 'InstrumentationCallbackPreviousPc' : [ 0x1b0, ['unsigned long']], + 'InstrumentationCallbackPreviousSp' : [ 0x1b4, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x1b8, ['unsigned char']], + 'SpareBytes' : [ 0x1b9, ['array', 23, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0xfca, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'WowTebOffset' : [ 0xfdc, ['long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], + 'ReservedForCrt' : [ 0xfe8, ['unsigned long long']], + 'EffectiveContainerId' : [ 0xff0, ['_GUID']], +} ], + '_TEB64' : [ 0x1838, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'ReservedForDebuggerInstrumentation' : [ 0x110, ['array', 16, ['unsigned long long']]], + 'SystemReserved1' : [ 0x190, ['array', 37, ['unsigned long long']]], + 'WorkingOnBehalfTicket' : [ 0x2b8, ['array', 8, ['unsigned char']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'InstrumentationCallbackSp' : [ 0x2d0, ['unsigned long long']], + 'InstrumentationCallbackPreviousPc' : [ 0x2d8, ['unsigned long long']], + 'InstrumentationCallbackPreviousSp' : [ 0x2e0, ['unsigned long long']], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'InstrumentationCallbackDisabled' : [ 0x2ec, ['unsigned char']], + 'Padding1' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LoadOwner' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'LoaderWorker' : [ 0x17ee, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 14, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'WowTebOffset' : [ 0x180c, ['long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], + 'ReservedForCrt' : [ 0x1820, ['unsigned long long']], + 'EffectiveContainerId' : [ 0x1828, ['_GUID']], +} ], + '_HV_X64_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState_Deprecated' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable_Deprecated' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugRegsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ExtendedGvaRangesForFlushVirtualAddressListAvailable' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'FastHypercallOutputAvailable' : [ 0xc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SvmFeaturesAvailable' : [ 0xc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'SintPollingModeAvailable' : [ 0xc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HypercallMsrLockAvailable' : [ 0xc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DirectSyntheticTimers' : [ 0xc, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeReg' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicRegs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerRegs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessIntrCtrlRegs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetReg' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsReg' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleReg' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyRegs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugRegs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'AccessReenlightenmentControls' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'AccessVpExitTracing' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'EnableExtendedGvaRangesForFlushVirtualAddressList' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 48, native_type='unsigned long long')]], + 'AccessVsm' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 49, native_type='unsigned long long')]], + 'AccessVpRegisters' : [ 0x0, ['BitField', dict(start_bit = 49, end_bit = 50, native_type='unsigned long long')]], + 'UnusedBit' : [ 0x0, ['BitField', dict(start_bit = 50, end_bit = 51, native_type='unsigned long long')]], + 'FastHypercallOutput' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'EnableExtendedHypercalls' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 53, native_type='unsigned long long')]], + 'StartVirtualProcessor' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x1840, { + 'TimerExpiry' : [ 0x0, ['array', 16, ['pointer', ['_KTIMER']]]], + 'TimerEntries' : [ 0x40, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Entry' : [ 0x4, ['_LIST_ENTRY']], + 'Time' : [ 0x10, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x20, { + 'Reserved1' : [ 0x0, ['long long']], + 'Reserved2' : [ 0x8, ['unsigned long']], + 'Prev' : [ 0xc, ['pointer', ['_XSTATE_SAVE']]], + 'Reserved3' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Thread' : [ 0x14, ['pointer', ['_KTHREAD']]], + 'Reserved4' : [ 0x18, ['pointer', ['void']]], + 'Level' : [ 0x1c, ['unsigned char']], + 'XStateContext' : [ 0x0, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x134, { + 'Lock' : [ 0x0, ['unsigned long']], + 'ReadySummary' : [ 0x4, ['unsigned long']], + 'ReadyListHead' : [ 0x8, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x108, ['array', 32, ['unsigned char']]], + 'Span' : [ 0x128, ['unsigned char']], + 'LowProcIndex' : [ 0x129, ['unsigned char']], + 'QueueIndex' : [ 0x12a, ['unsigned char']], + 'ProcCount' : [ 0x12b, ['unsigned char']], + 'ScanOwner' : [ 0x12c, ['unsigned char']], + 'Spare' : [ 0x12d, ['array', 3, ['unsigned char']]], + 'Affinity' : [ 0x130, ['unsigned long']], +} ], + '_KAFFINITY_EX' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KAFFINITY_ENUMERATION_CONTEXT' : [ 0xc, { + 'Affinity' : [ 0x0, ['pointer', ['_KAFFINITY_EX']]], + 'CurrentMask' : [ 0x4, ['unsigned long']], + 'CurrentIndex' : [ 0x8, ['unsigned short']], +} ], + '__unnamed_1880' : [ 0x4, { + 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1882' : [ 0x4, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], +} ], + '__unnamed_1886' : [ 0x10, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0xc, ['pointer', ['wchar']]], +} ], + '_DEVICE_NODE' : [ 0x1d0, { + 'Sibling' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'Child' : [ 0x4, ['pointer', ['_DEVICE_NODE']]], + 'Parent' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'LastChild' : [ 0xc, ['pointer', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x14, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x1c, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'FxDevice' : [ 0x28, ['pointer', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x2c, ['long']], + 'FxRemoveEvent' : [ 0x30, ['_KEVENT']], + 'FxActivationCount' : [ 0x40, ['long']], + 'FxSleepCount' : [ 0x44, ['long']], + 'Plugin' : [ 0x48, ['pointer', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x4c, ['unsigned long']], + 'CurrentPowerState' : [ 0x50, ['_POWER_STATE']], + 'Notify' : [ 0x54, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0x90, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0xa0, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0xa8, ['unsigned long']], + 'State' : [ 0xac, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0xb0, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0xb4, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x104, ['unsigned long']], + 'CompletionStatus' : [ 0x108, ['long']], + 'Flags' : [ 0x10c, ['unsigned long']], + 'UserFlags' : [ 0x110, ['unsigned long']], + 'Problem' : [ 0x114, ['unsigned long']], + 'ProblemStatus' : [ 0x118, ['long']], + 'ResourceList' : [ 0x11c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x120, ['pointer', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x124, ['pointer', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x128, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x130, ['unsigned long']], + 'ChildInterfaceType' : [ 0x134, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x138, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x13c, ['unsigned short']], + 'RemovalPolicy' : [ 0x13e, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x13f, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x140, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x148, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x150, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x158, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x15a, ['unsigned short']], + 'NoArbiterMask' : [ 0x15c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x15e, ['unsigned short']], + 'OverUsed1' : [ 0x160, ['__unnamed_1880']], + 'OverUsed2' : [ 0x164, ['__unnamed_1882']], + 'BootResources' : [ 0x168, ['pointer', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x16c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x170, ['unsigned long']], + 'DockInfo' : [ 0x174, ['__unnamed_1886']], + 'DisableableDepends' : [ 0x184, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x188, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x190, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x198, ['unsigned long']], + 'PreviousParent' : [ 0x19c, ['pointer', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x1a0, ['long']], + 'NumaNodeIndex' : [ 0x1a4, ['unsigned long']], + 'ContainerID' : [ 0x1a8, ['_GUID']], + 'OverrideFlags' : [ 0x1b8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x1bc, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x1c0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x1c4, ['pointer', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x1c8, ['unsigned long']], + 'RebalanceContext' : [ 0x1cc, ['pointer', ['_PNP_REBALANCE_TRACE_CONTEXT']]], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x38, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x2c, ['pointer', ['unsigned long']]], + 'EnableKeyWords' : [ 0x30, ['pointer', ['unsigned long long']]], + 'EnableLevel' : [ 0x34, ['pointer', ['unsigned char']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x8, ['unsigned long']], + 'CompletedList' : [ 0xc, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x14, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x28, ['unsigned long']], +} ], + '_KSEMAPHORE' : [ 0x14, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x10, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x38, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x8, ['unsigned long']], + 'Dope' : [ 0xc, ['pointer', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x10, ['unsigned long']], + 'DeviceNode' : [ 0x14, ['pointer', ['void']]], + 'AttachedTo' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x1c, ['long']], + 'StartIoKey' : [ 0x20, ['long']], + 'StartIoFlags' : [ 0x24, ['unsigned long']], + 'Vpb' : [ 0x28, ['pointer', ['_VPB']]], + 'DependencyNode' : [ 0x2c, ['pointer', ['void']]], + 'InterruptContext' : [ 0x30, ['pointer', ['void']]], + 'VerifierContext' : [ 0x34, ['pointer', ['void']]], +} ], + '_GROUP_AFFINITY' : [ 0xc, { + 'Mask' : [ 0x0, ['unsigned long']], + 'Group' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['array', 3, ['unsigned short']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0xc, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x28, { + 'PhysicalDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x4, ['unsigned long']], + 'AllocationType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0xc, ['unsigned long']], + 'Position' : [ 0x10, ['unsigned long']], + 'ResourceRequirements' : [ 0x14, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x18, ['pointer', ['void']]], + 'ResourceAssignment' : [ 0x1c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x20, ['pointer', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x24, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1986' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'WriteCustomBreakPoint' : [ 0x0, ['_DBGKD_WRITE_CUSTOM_BREAKPOINT']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_1986']], +} ], + '__unnamed_198d' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_198d']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_X86_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PEP_ACPI_RESOURCE' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'IoMemory' : [ 0x0, ['_PEP_ACPI_IO_MEMORY_RESOURCE']], + 'Interrupt' : [ 0x0, ['_PEP_ACPI_INTERRUPT_RESOURCE']], + 'Gpio' : [ 0x0, ['_PEP_ACPI_GPIO_RESOURCE']], + 'SpbI2c' : [ 0x0, ['_PEP_ACPI_SPB_I2C_RESOURCE']], + 'SpbSpi' : [ 0x0, ['_PEP_ACPI_SPB_SPI_RESOURCE']], + 'SpbUart' : [ 0x0, ['_PEP_ACPI_SPB_UART_RESOURCE']], + 'ExtendedAddress' : [ 0x0, ['_PEP_ACPI_EXTENDED_ADDRESS']], +} ], + '_PEP_ACPI_IO_MEMORY_RESOURCE' : [ 0x20, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Information' : [ 0x4, ['unsigned char']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Alignment' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_PEP_ACPI_INTERRUPT_RESOURCE' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'InterruptType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Flags' : [ 0xc, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'Count' : [ 0x10, ['unsigned char']], + 'Pins' : [ 0x14, ['pointer', ['unsigned long']]], +} ], + '_PEP_ACPI_GPIO_RESOURCE' : [ 0x30, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'InterruptType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'InterruptPolarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'PinConfig' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PullDefault', 1: 'PullUp', 2: 'PullDown', 3: 'PullNone'})]], + 'IoRestrictionType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'IoRestrictionNone', 1: 'IoRestrictionInputOnly', 2: 'IoRestrictionOutputOnly', 3: 'IoRestrictionNoneAndPreserve'})]], + 'DriveStrength' : [ 0x18, ['unsigned short']], + 'DebounceTimeout' : [ 0x1a, ['unsigned short']], + 'PinTable' : [ 0x1c, ['pointer', ['unsigned short']]], + 'PinCount' : [ 0x20, ['unsigned short']], + 'ResourceSourceIndex' : [ 0x22, ['unsigned char']], + 'ResourceSourceName' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x28, ['pointer', ['unsigned char']]], + 'VendorDataLength' : [ 0x2c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_I2C_RESOURCE' : [ 0x20, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x18, ['unsigned long']], + 'SlaveAddress' : [ 0x1c, ['unsigned short']], +} ], + '_PEP_ACPI_SPB_UART_RESOURCE' : [ 0x24, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'BaudRate' : [ 0x18, ['unsigned long']], + 'RxBufferSize' : [ 0x1c, ['unsigned short']], + 'TxBufferSize' : [ 0x1e, ['unsigned short']], + 'Parity' : [ 0x20, ['unsigned char']], + 'LinesInUse' : [ 0x21, ['unsigned char']], +} ], + '_PEP_ACPI_SPB_SPI_RESOURCE' : [ 0x24, { + 'SpbCommon' : [ 0x0, ['_PEP_ACPI_SPB_RESOURCE']], + 'ConnectionSpeed' : [ 0x18, ['unsigned long']], + 'DataBitLength' : [ 0x1c, ['unsigned char']], + 'Phase' : [ 0x1d, ['unsigned char']], + 'Polarity' : [ 0x1e, ['unsigned char']], + 'DeviceSelection' : [ 0x20, ['unsigned short']], +} ], + '_PEP_ACPI_EXTENDED_ADDRESS' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'ResourceFlags' : [ 0x8, ['unsigned char']], + 'GeneralFlags' : [ 0x9, ['unsigned char']], + 'TypeSpecificFlags' : [ 0xa, ['unsigned char']], + 'RevisionId' : [ 0xb, ['unsigned char']], + 'Reserved' : [ 0xc, ['unsigned char']], + 'Granularity' : [ 0x10, ['unsigned long long']], + 'MinimumAddress' : [ 0x18, ['unsigned long long']], + 'MaximumAddress' : [ 0x20, ['unsigned long long']], + 'TranslationAddress' : [ 0x28, ['unsigned long long']], + 'AddressLength' : [ 0x30, ['unsigned long long']], + 'TypeAttribute' : [ 0x38, ['unsigned long long']], + 'DescriptorName' : [ 0x40, ['pointer', ['_UNICODE_STRING']]], +} ], + '_PPM_PLATFORM_STATES' : [ 0x100, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'InterfaceVersion' : [ 0x4, ['unsigned long']], + 'ProcessorCount' : [ 0x8, ['unsigned long']], + 'CoordinatedInterface' : [ 0xc, ['unsigned char']], + 'IdleTest' : [ 0x10, ['pointer', ['void']]], + 'IdlePreExecute' : [ 0x14, ['pointer', ['void']]], + 'IdleComplete' : [ 0x18, ['pointer', ['void']]], + 'QueryPlatformStateResidency' : [ 0x1c, ['pointer', ['void']]], + 'Accounting' : [ 0x20, ['pointer', ['_PLATFORM_IDLE_ACCOUNTING']]], + 'State' : [ 0x40, ['array', 1, ['_PPM_PLATFORM_STATE']]], +} ], + '_POP_CPU_INFO' : [ 0x10, { + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_PPM_PROFILE' : [ 0x1a8, { + 'Name' : [ 0x0, ['pointer', ['wchar']]], + 'Id' : [ 0x4, ['unsigned char']], + 'Guid' : [ 0x8, ['_GUID']], + 'Flags' : [ 0x18, ['unsigned long']], + 'Priority' : [ 0x1c, ['unsigned char']], + 'Settings' : [ 0x20, ['array', 2, ['_PPM_ENGINE_SETTINGS']]], + 'StartTime' : [ 0x180, ['unsigned long long']], + 'Count' : [ 0x188, ['unsigned long long']], + 'MaxDuration' : [ 0x190, ['unsigned long long']], + 'MinDuration' : [ 0x198, ['unsigned long long']], + 'TotalDuration' : [ 0x1a0, ['unsigned long long']], +} ], + '_PPM_ENGINE_SETTINGS' : [ 0xb0, { + 'ExplicitSetting' : [ 0x0, ['array', 2, ['_PPM_POLICY_SETTINGS_MASK']]], + 'ThrottlingPolicy' : [ 0x10, ['unsigned char']], + 'PerfTimeCheck' : [ 0x14, ['unsigned long']], + 'PerfHistoryCount' : [ 0x18, ['array', 2, ['unsigned char']]], + 'PerfMinPolicy' : [ 0x1a, ['array', 2, ['unsigned char']]], + 'PerfMaxPolicy' : [ 0x1c, ['array', 2, ['unsigned char']]], + 'PerfDecreaseTime' : [ 0x1e, ['array', 2, ['unsigned char']]], + 'PerfIncreaseTime' : [ 0x20, ['array', 2, ['unsigned char']]], + 'PerfDecreasePolicy' : [ 0x22, ['array', 2, ['unsigned char']]], + 'PerfIncreasePolicy' : [ 0x24, ['array', 2, ['unsigned char']]], + 'PerfDecreaseThreshold' : [ 0x26, ['array', 2, ['unsigned char']]], + 'PerfIncreaseThreshold' : [ 0x28, ['array', 2, ['unsigned char']]], + 'PerfBoostPolicy' : [ 0x2c, ['unsigned long']], + 'PerfBoostMode' : [ 0x30, ['unsigned long']], + 'PerfReductionTolerance' : [ 0x34, ['unsigned long']], + 'EnergyPerfPreference' : [ 0x38, ['unsigned long']], + 'AutonomousActivityWindow' : [ 0x3c, ['unsigned long']], + 'AutonomousPreference' : [ 0x40, ['unsigned char']], + 'LatencyHintPerf' : [ 0x41, ['array', 2, ['unsigned char']]], + 'LatencyHintUnpark' : [ 0x43, ['array', 2, ['unsigned char']]], + 'DutyCycling' : [ 0x45, ['unsigned char']], + 'ParkingPerfState' : [ 0x46, ['array', 2, ['unsigned char']]], + 'DistributeUtility' : [ 0x48, ['unsigned char']], + 'CoreParkingOverUtilizationThreshold' : [ 0x49, ['unsigned char']], + 'CoreParkingConcurrencyThreshold' : [ 0x4a, ['unsigned char']], + 'CoreParkingHeadroomThreshold' : [ 0x4b, ['unsigned char']], + 'CoreParkingDistributionThreshold' : [ 0x4c, ['unsigned char']], + 'CoreParkingDecreasePolicy' : [ 0x4d, ['unsigned char']], + 'CoreParkingIncreasePolicy' : [ 0x4e, ['unsigned char']], + 'CoreParkingDecreaseTime' : [ 0x50, ['unsigned long']], + 'CoreParkingIncreaseTime' : [ 0x54, ['unsigned long']], + 'CoreParkingMinCores' : [ 0x58, ['array', 2, ['unsigned char']]], + 'CoreParkingMaxCores' : [ 0x5a, ['array', 2, ['unsigned char']]], + 'AllowScaling' : [ 0x5c, ['unsigned char']], + 'IdleDisabled' : [ 0x5d, ['unsigned char']], + 'IdleTimeCheck' : [ 0x60, ['unsigned long']], + 'IdleDemotePercent' : [ 0x64, ['unsigned char']], + 'IdlePromotePercent' : [ 0x65, ['unsigned char']], + 'HeteroDecreaseTime' : [ 0x66, ['unsigned char']], + 'HeteroIncreaseTime' : [ 0x67, ['unsigned char']], + 'HeteroDecreaseThreshold' : [ 0x68, ['array', 32, ['unsigned char']]], + 'HeteroIncreaseThreshold' : [ 0x88, ['array', 32, ['unsigned char']]], + 'Class0FloorPerformance' : [ 0xa8, ['unsigned char']], + 'Class1InitialPerformance' : [ 0xa9, ['unsigned char']], +} ], + '_ESERVERSILO_GLOBALS' : [ 0x288, { + 'ObSiloState' : [ 0x0, ['_OBP_SILODRIVERSTATE']], + 'SeSiloState' : [ 0x1a4, ['_SEP_SILOSTATE']], + 'SeRmSiloState' : [ 0x1b8, ['_SEP_RM_LSA_CONNECTION_STATE']], + 'EtwSiloState' : [ 0x1e8, ['pointer', ['_ETW_SILODRIVERSTATE']]], + 'MiSessionLeaderProcess' : [ 0x1ec, ['pointer', ['_EPROCESS']]], + 'ExpDefaultErrorPortProcess' : [ 0x1f0, ['pointer', ['_EPROCESS']]], + 'ExpDefaultErrorPort' : [ 0x1f4, ['pointer', ['void']]], + 'HardErrorState' : [ 0x1f8, ['unsigned long']], + 'WnfSiloState' : [ 0x200, ['_WNF_SILODRIVERSTATE']], + 'ApiSetSection' : [ 0x230, ['pointer', ['void']]], + 'ApiSetSchema' : [ 0x234, ['pointer', ['void']]], + 'OneCoreForwardersEnabled' : [ 0x238, ['unsigned char']], + 'SiloRootDirectoryName' : [ 0x23c, ['_UNICODE_STRING']], + 'Storage' : [ 0x244, ['pointer', ['_PSP_STORAGE']]], + 'State' : [ 0x248, ['Enumeration', dict(target = 'long', choices = {0: 'SERVERSILO_INITING', 1: 'SERVERSILO_STARTED', 2: 'SERVERSILO_SHUTTING_DOWN', 3: 'SERVERSILO_TERMINATING', 4: 'SERVERSILO_TERMINATED'})]], + 'ExitStatus' : [ 0x24c, ['long']], + 'DeleteEvent' : [ 0x250, ['pointer', ['_KEVENT']]], + 'UserSharedData' : [ 0x258, ['_SILO_USER_SHARED_DATA']], + 'TerminateWorkItem' : [ 0x278, ['_WORK_QUEUE_ITEM']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_PERF_FLAGS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'Progress' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 27, native_type='unsigned long')]], + 'Synchronicity' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 29, native_type='unsigned long')]], + 'RequestPepCompleted' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'RequestSucceeded' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NestedCallback' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'IrpFirstPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'IrpLastPendingIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x8, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x4, ['pointer', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0x90, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0xc, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x14, ['unsigned long']], + 'LogHandleContext' : [ 0x18, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0x80, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0x84, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0x88, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x178, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x28, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x30, ['array', 4, ['pointer', ['_VACB']]]], + 'Vacbs' : [ 0x40, ['pointer', ['pointer', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x44, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x4c, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x50, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x58, ['_LIST_ENTRY']], + 'Flags' : [ 0x60, ['unsigned long']], + 'Status' : [ 0x64, ['long']], + 'Mbcb' : [ 0x68, ['pointer', ['_MBCB']]], + 'Section' : [ 0x6c, ['pointer', ['void']]], + 'CreateEvent' : [ 0x70, ['pointer', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0x74, ['pointer', ['_KEVENT']]], + 'PagesToWrite' : [ 0x78, ['unsigned long']], + 'BeyondLastFlush' : [ 0x80, ['long long']], + 'Callbacks' : [ 0x88, ['pointer', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0x8c, ['pointer', ['void']]], + 'PrivateList' : [ 0x90, ['_LIST_ENTRY']], + 'V1' : [ 0x98, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0x98, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0xa0, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0xa8, ['unsigned long']], + 'LazyWritePassCount' : [ 0xac, ['unsigned long']], + 'UninitializeEvent' : [ 0xb0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0xb4, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0xd8, ['_LARGE_INTEGER']], + 'Event' : [ 0xe0, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0xf0, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0xf8, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x160, ['pointer', ['void']]], + 'VolumeCacheMap' : [ 0x164, ['pointer', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x168, ['unsigned long']], + 'WritesInProgress' : [ 0x16c, ['unsigned long']], + 'AsyncReadRequestCount' : [ 0x170, ['unsigned long']], +} ], + '__unnamed_1a86' : [ 0x8, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x18, { + 'BaseAddress' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x8, ['__unnamed_1a86']], + 'ArrayHead' : [ 0x10, ['pointer', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1aab' : [ 0x8, { + 'FileObject' : [ 0x0, ['pointer', ['_FILE_OBJECT']]], + 'DiskIoAttribution' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_1aad' : [ 0x4, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1aaf' : [ 0x4, { + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], +} ], + '__unnamed_1ab1' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1ab3' : [ 0x1c, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x4, ['pointer', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x8, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_1ab7' : [ 0x40, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], + 'FileOffset' : [ 0x8, ['_LARGE_INTEGER']], + 'FileObject' : [ 0x10, ['pointer', ['_FILE_OBJECT']]], + 'Length' : [ 0x14, ['unsigned long']], + 'PrefetchList' : [ 0x18, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'PrefetchPagePriority' : [ 0x1c, ['unsigned long']], + 'Mdl' : [ 0x20, ['pointer', ['_MDL']]], + 'IoStatusBlock' : [ 0x24, ['pointer', ['_IO_STATUS_BLOCK']]], + 'CallbackContext' : [ 0x28, ['pointer', ['_CC_ASYNC_READ_CONTEXT']]], + 'OriginatingProcess' : [ 0x2c, ['pointer', ['_EPROCESS']]], + 'IoIssuerThread' : [ 0x30, ['pointer', ['_ETHREAD']]], + 'DiskIoAttribution' : [ 0x34, ['pointer', ['void']]], + 'RequestorMode' : [ 0x38, ['unsigned char']], + 'NestingLevel' : [ 0x3c, ['unsigned long']], +} ], + '__unnamed_1ab9' : [ 0x40, { + 'Read' : [ 0x0, ['__unnamed_1aab']], + 'Write' : [ 0x0, ['__unnamed_1aad']], + 'Event' : [ 0x0, ['__unnamed_1aaf']], + 'Notification' : [ 0x0, ['__unnamed_1ab1']], + 'LowPriWrite' : [ 0x0, ['__unnamed_1ab3']], + 'AsyncRead' : [ 0x0, ['__unnamed_1ab7']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x50, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x8, ['__unnamed_1ab9']], + 'Function' : [ 0x48, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x18, { + 'Callback' : [ 0x0, ['pointer', ['void']]], + 'DirtyPageStatistics' : [ 0x4, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x68, { + 'LogHandle' : [ 0x0, ['pointer', ['void']]], + 'FlushToLsnRoutine' : [ 0x4, ['pointer', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x8, ['pointer', ['void']]], + 'DirtyPageStatistics' : [ 0xc, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x18, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x40, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x44, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x48, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x50, ['pointer', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x54, ['unsigned long']], + 'LastLWTimeStamp' : [ 0x58, ['_LARGE_INTEGER']], + 'Flags' : [ 0x60, ['unsigned long']], +} ], + '_MBCB' : [ 0x88, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x18, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x20, ['long long']], + 'BitmapRange1' : [ 0x28, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x48, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x68, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x20, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x8, ['long long']], + 'FirstDirtyPage' : [ 0x10, ['unsigned long']], + 'LastDirtyPage' : [ 0x14, ['unsigned long']], + 'DirtyPages' : [ 0x18, ['unsigned long']], + 'Bitmap' : [ 0x1c, ['pointer', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x10, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x8, ['pointer', ['void']]], + 'VacbLevelsAllocated' : [ 0xc, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x4, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x24, { + 'ExtendedLookup' : [ 0x0, ['pointer', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x4, ['unsigned long']], + 'ExtraItem' : [ 0x8, ['unsigned long']], + 'ItemCount' : [ 0xc, ['unsigned long']], + 'OutOfRangeItems' : [ 0x10, ['unsigned long']], + 'BaseIndex' : [ 0x14, ['unsigned long']], + 'ListHead' : [ 0x18, ['pointer', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x1c, ['pointer', ['unsigned long']]], + 'ListHints' : [ 0x20, ['pointer', ['pointer', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x248, { + 'Segment' : [ 0x0, ['_HEAP_SEGMENT']], + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], + 'Flags' : [ 0x40, ['unsigned long']], + 'ForceFlags' : [ 0x44, ['unsigned long']], + 'CompatibilityFlags' : [ 0x48, ['unsigned long']], + 'EncodeFlagMask' : [ 0x4c, ['unsigned long']], + 'Encoding' : [ 0x50, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x58, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x5c, ['unsigned long']], + 'Signature' : [ 0x60, ['unsigned long']], + 'SegmentReserve' : [ 0x64, ['unsigned long']], + 'SegmentCommit' : [ 0x68, ['unsigned long']], + 'DeCommitFreeBlockThreshold' : [ 0x6c, ['unsigned long']], + 'DeCommitTotalFreeThreshold' : [ 0x70, ['unsigned long']], + 'TotalFreeSize' : [ 0x74, ['unsigned long']], + 'MaximumAllocationSize' : [ 0x78, ['unsigned long']], + 'ProcessHeapsListIndex' : [ 0x7c, ['unsigned short']], + 'HeaderValidateLength' : [ 0x7e, ['unsigned short']], + 'HeaderValidateCopy' : [ 0x80, ['pointer', ['void']]], + 'NextAvailableTagIndex' : [ 0x84, ['unsigned short']], + 'MaximumTagIndex' : [ 0x86, ['unsigned short']], + 'TagEntries' : [ 0x88, ['pointer', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0x8c, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x94, ['unsigned long']], + 'AlignMask' : [ 0x98, ['unsigned long']], + 'VirtualAllocdBlocks' : [ 0x9c, ['_LIST_ENTRY']], + 'SegmentList' : [ 0xa4, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0xac, ['unsigned short']], + 'NonDedicatedListLength' : [ 0xb0, ['unsigned long']], + 'BlocksIndex' : [ 0xb4, ['pointer', ['void']]], + 'UCRIndex' : [ 0xb8, ['pointer', ['void']]], + 'PseudoTagEntries' : [ 0xbc, ['pointer', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0xc0, ['_LIST_ENTRY']], + 'LockVariable' : [ 0xc8, ['pointer', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0xcc, ['pointer', ['void']]], + 'StackTraceInitVar' : [ 0xd0, ['_RTL_RUN_ONCE']], + 'FrontEndHeap' : [ 0xd4, ['pointer', ['void']]], + 'FrontHeapLockCount' : [ 0xd8, ['unsigned short']], + 'FrontEndHeapType' : [ 0xda, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0xdb, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0xdc, ['pointer', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0xe0, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0xe2, ['array', 257, ['unsigned char']]], + 'Counters' : [ 0x1e4, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x240, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1b28' : [ 0x38, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x38, { + 'Lock' : [ 0x0, ['__unnamed_1b28']], +} ], + '_HEAP_ENTRY' : [ 0x8, { + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'Code234' : [ 0x4, ['unsigned long']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x40, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x20, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x8, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x10, ['unsigned long']], + 'ReserveSize' : [ 0x14, ['unsigned long']], + 'BusyBlock' : [ 0x18, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x10, { + 'HeapEntry' : [ 0x0, ['_HEAP_ENTRY']], + 'UnpackedEntry' : [ 0x0, ['_HEAP_UNPACKED_ENTRY']], + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'ExtendedEntry' : [ 0x0, ['_HEAP_EXTENDED_ENTRY']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'Code234' : [ 0x4, ['unsigned long']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], + 'FreeList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '__unnamed_1b7b' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1b7d' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b7b']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1b7f' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1b81' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1b7f']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1b7d']], + 'u2' : [ 0x4, ['__unnamed_1b81']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x20, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x14, ['pointer', ['void']]], + 'DestroyProcedure' : [ 0x18, ['pointer', ['void']]], + 'UsualSize' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_1b9e' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1ba0' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1b9e']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x18, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'u1' : [ 0x8, ['__unnamed_1ba0']], + 'ResourceId' : [ 0x9, ['unsigned char']], + 'CachedReferences' : [ 0xa, ['short']], + 'ReferenceCount' : [ 0xc, ['long']], + 'Pad' : [ 0x10, ['unsigned long']], + 'Lock' : [ 0x14, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1bb4' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1bb6' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bb4']], +} ], + '_KALPC_SECTION' : [ 0x28, { + 'SectionObject' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'HandleTable' : [ 0x8, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0xc, ['pointer', ['void']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0x14, ['pointer', ['_ALPC_PORT']]], + 'u1' : [ 0x18, ['__unnamed_1bb6']], + 'NumberOfRegions' : [ 0x1c, ['unsigned long']], + 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '__unnamed_1bbf' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1bc1' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bbf']], +} ], + '_KALPC_REGION' : [ 0x30, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x8, ['pointer', ['_KALPC_SECTION']]], + 'Offset' : [ 0xc, ['unsigned long']], + 'Size' : [ 0x10, ['unsigned long']], + 'ViewSize' : [ 0x14, ['unsigned long']], + 'u1' : [ 0x18, ['__unnamed_1bc1']], + 'NumberOfViews' : [ 0x1c, ['unsigned long']], + 'ViewListHead' : [ 0x20, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x28, ['pointer', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x2c, ['pointer', ['_KALPC_VIEW']]], +} ], + '__unnamed_1bc7' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1bc9' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1bc7']], +} ], + '_KALPC_VIEW' : [ 0x34, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x8, ['pointer', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'Address' : [ 0x14, ['pointer', ['void']]], + 'Size' : [ 0x18, ['unsigned long']], + 'SecureViewHandle' : [ 0x1c, ['pointer', ['void']]], + 'WriteAccessHandle' : [ 0x20, ['pointer', ['void']]], + 'u1' : [ 0x24, ['__unnamed_1bc9']], + 'NumberOfOwnerMessages' : [ 0x28, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x2c, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x28, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x4, ['pointer', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x8, ['pointer', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0xc, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x24, ['pointer', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1be6' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1be8' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1be6']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x11c, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'CompletionPort' : [ 0x10, ['pointer', ['void']]], + 'CompletionKey' : [ 0x14, ['pointer', ['void']]], + 'CompletionPacketLookaside' : [ 0x18, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x1c, ['pointer', ['void']]], + 'StaticSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x5c, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x60, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0x68, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0x70, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0x74, ['_LIST_ENTRY']], + 'DirectQueueLock' : [ 0x7c, ['_EX_PUSH_LOCK']], + 'DirectQueue' : [ 0x80, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0x8c, ['_LIST_ENTRY']], + 'Semaphore' : [ 0x94, ['pointer', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0x94, ['pointer', ['_KEVENT']]], + 'PortAttributes' : [ 0x98, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0xc4, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0xd0, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0xd4, ['pointer', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0xd8, ['pointer', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0xdc, ['pointer', ['void']]], + 'CanceledQueue' : [ 0xe0, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0xe8, ['long']], + 'ReferenceNo' : [ 0xec, ['long']], + 'ReferenceNoWait' : [ 0xf0, ['pointer', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0xf4, ['__unnamed_1be8']], + 'TargetQueuePort' : [ 0xf8, ['pointer', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0xfc, ['pointer', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x100, ['pointer', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x104, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x108, ['unsigned long']], + 'PendingQueueLength' : [ 0x10c, ['unsigned long']], + 'DirectQueueLength' : [ 0x110, ['unsigned long']], + 'CanceledQueueLength' : [ 0x114, ['unsigned long']], + 'WaitQueueLength' : [ 0x118, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0x58, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'CompletionListLock' : [ 0xc, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x10, ['pointer', ['_MDL']]], + 'UserVa' : [ 0x14, ['pointer', ['void']]], + 'UserLimit' : [ 0x18, ['pointer', ['void']]], + 'DataUserVa' : [ 0x1c, ['pointer', ['void']]], + 'SystemVa' : [ 0x20, ['pointer', ['void']]], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'Header' : [ 0x28, ['pointer', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x2c, ['pointer', ['void']]], + 'ListSize' : [ 0x30, ['unsigned long']], + 'Bitmap' : [ 0x34, ['pointer', ['void']]], + 'BitmapSize' : [ 0x38, ['unsigned long']], + 'Data' : [ 0x3c, ['pointer', ['void']]], + 'DataSize' : [ 0x40, ['unsigned long']], + 'BitmapLimit' : [ 0x44, ['unsigned long']], + 'BitmapNextHint' : [ 0x48, ['unsigned long']], + 'ConcurrencyCount' : [ 0x4c, ['unsigned long']], + 'AttributeFlags' : [ 0x50, ['unsigned long']], + 'AttributeSize' : [ 0x54, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ObjectName' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'Attributes' : [ 0xc, ['unsigned long']], + 'SecurityDescriptor' : [ 0x10, ['pointer', ['void']]], + 'SecurityQualityOfService' : [ 0x14, ['pointer', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0x90, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x10, ['pointer', ['void']]], + 'Index' : [ 0x14, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x18, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x1c, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x20, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x24, ['unsigned long']], + 'TypeInfo' : [ 0x28, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0x80, ['_EX_PUSH_LOCK']], + 'Key' : [ 0x84, ['unsigned long']], + 'CallbackList' : [ 0x88, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x14, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x10, ['long']], +} ], + '__unnamed_1c0b' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1c0d' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c0b']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x98, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x8, ['pointer', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x10, ['pointer', ['_ETHREAD']]], + 'u1' : [ 0x14, ['__unnamed_1c0d']], + 'SequenceNo' : [ 0x18, ['long']], + 'QuotaProcess' : [ 0x1c, ['pointer', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x1c, ['pointer', ['void']]], + 'CancelSequencePort' : [ 0x20, ['pointer', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x24, ['pointer', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x28, ['long']], + 'CancelListEntry' : [ 0x2c, ['_LIST_ENTRY']], + 'Reserve' : [ 0x34, ['pointer', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x38, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0x60, ['pointer', ['void']]], + 'CommunicationInfo' : [ 0x64, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0x68, ['pointer', ['_ALPC_PORT']]], + 'ServerThread' : [ 0x6c, ['pointer', ['_ETHREAD']]], + 'WakeReference' : [ 0x70, ['pointer', ['void']]], + 'ExtensionBuffer' : [ 0x74, ['pointer', ['void']]], + 'ExtensionBufferSize' : [ 0x78, ['unsigned long']], + 'PortMessage' : [ 0x80, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x24, { + 'PortObject' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'Message' : [ 0x4, ['pointer', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'TargetPort' : [ 0x10, ['pointer', ['_ALPC_PORT']]], + 'DirectEvent' : [ 0x14, ['_KALPC_DIRECT_EVENT']], + 'Flags' : [ 0x18, ['unsigned long']], + 'TotalLength' : [ 0x1c, ['unsigned short']], + 'Type' : [ 0x1e, ['unsigned short']], + 'DataInfoOffset' : [ 0x20, ['unsigned short']], + 'SignalCompletion' : [ 0x22, ['unsigned char']], + 'PostedToCompletionList' : [ 0x23, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x4, ['unsigned long']], + 'ViewBase' : [ 0x8, ['pointer', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x14, { + 'OwnerPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x4, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Message' : [ 0xc, ['pointer', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x10, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x24, { + 'ObjectType' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x28, { + 'ClientContext' : [ 0x0, ['pointer', ['void']]], + 'ServerContext' : [ 0x4, ['pointer', ['void']]], + 'PortContext' : [ 0x8, ['pointer', ['void']]], + 'CancelPortContext' : [ 0xc, ['pointer', ['void']]], + 'SecurityData' : [ 0x10, ['pointer', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x14, ['pointer', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], + 'DirectEvent' : [ 0x1c, ['_KALPC_DIRECT_EVENT']], + 'WorkOnBehalfData' : [ 0x20, ['_KALPC_WORK_ON_BEHALF_DATA']], +} ], + '__unnamed_1c51' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1c53' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1c51']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x50, { + 'HandleTable' : [ 0x0, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x4, ['pointer', ['void']]], + 'OwningProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x10, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x4c, ['__unnamed_1c53']], +} ], + '_KALPC_DIRECT_EVENT' : [ 0x4, { + 'Event' : [ 0x0, ['unsigned long']], + 'Referenced' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x8, ['unsigned long']], + 'KeyContext' : [ 0xc, ['pointer', ['void']]], + 'ApcContext' : [ 0x10, ['pointer', ['void']]], + 'IoStatus' : [ 0x14, ['long']], + 'IoStatusInformation' : [ 0x18, ['unsigned long']], + 'MiniPacketCallback' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], + 'Allocated' : [ 0x24, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x2c, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer', ['void']]], + 'DiskIoAttributionHandle' : [ 0xc, ['unsigned long']], + 'ActivityId' : [ 0x10, ['_GUID']], + 'Timestamp' : [ 0x20, ['_LARGE_INTEGER']], + 'ZeroingOffset' : [ 0x20, ['unsigned long']], + 'FsTrackOffsetBlob' : [ 0x20, ['pointer', ['_IO_IRP_EXT_TRACK_OFFSET_HEADER']]], + 'FsTrackedOffset' : [ 0x24, ['long long']], +} ], + '_DRIVER_OBJECT' : [ 0xa8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'DriverStart' : [ 0xc, ['pointer', ['void']]], + 'DriverSize' : [ 0x10, ['unsigned long']], + 'DriverSection' : [ 0x14, ['pointer', ['void']]], + 'DriverExtension' : [ 0x18, ['pointer', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x1c, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x28, ['pointer', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x2c, ['pointer', ['void']]], + 'DriverStartIo' : [ 0x30, ['pointer', ['void']]], + 'DriverUnload' : [ 0x34, ['pointer', ['void']]], + 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x14, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0xc, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x28, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x4, ['array', 8, ['pointer', ['void']]]], + 'FoIoPriorityHint' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0x78, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x8, ['long']], + 'Information' : [ 0xc, ['unsigned long']], + 'ParseCheck' : [ 0x10, ['unsigned long']], + 'RelatedFileObject' : [ 0x14, ['pointer', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x18, ['pointer', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x28, ['unsigned long']], + 'FileAttributes' : [ 0x2c, ['unsigned short']], + 'ShareAccess' : [ 0x2e, ['unsigned short']], + 'EaBuffer' : [ 0x30, ['pointer', ['void']]], + 'EaLength' : [ 0x34, ['unsigned long']], + 'Options' : [ 0x38, ['unsigned long']], + 'Disposition' : [ 0x3c, ['unsigned long']], + 'BasicInformation' : [ 0x40, ['pointer', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x44, ['pointer', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x4c, ['pointer', ['void']]], + 'Override' : [ 0x50, ['unsigned char']], + 'QueryOnly' : [ 0x51, ['unsigned char']], + 'DeleteOnly' : [ 0x52, ['unsigned char']], + 'FullAttributes' : [ 0x53, ['unsigned char']], + 'LocalFileObject' : [ 0x54, ['pointer', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x58, ['unsigned long']], + 'AccessMode' : [ 0x5c, ['unsigned char']], + 'DriverCreateContext' : [ 0x60, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1d1b' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x110, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1d1b']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer', ['wchar']]], + 'LogFileName' : [ 0x3c, ['pointer', ['wchar']]], + 'TimeZone' : [ 0x40, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf0, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0xf8, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x100, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x108, ['unsigned long']], + 'BuffersLost' : [ 0x10c, ['unsigned long']], +} ], + '_RTL_HASH_TABLE' : [ 0xc, { + 'EntryCount' : [ 0x0, ['unsigned long']], + 'MaskBitCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'BucketCount' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Buckets' : [ 0x8, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_HASH_ENTRY' : [ 0x8, { + 'BucketLink' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Key' : [ 0x4, ['unsigned long']], +} ], + '_RTL_HASH_TABLE_ITERATOR' : [ 0xc, { + 'Hash' : [ 0x0, ['pointer', ['_RTL_HASH_TABLE']]], + 'HashEntry' : [ 0x4, ['pointer', ['_RTL_HASH_ENTRY']]], + 'Bucket' : [ 0x8, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_CHASH_TABLE' : [ 0x10, { + 'Table' : [ 0x0, ['pointer', ['_RTL_CHASH_ENTRY']]], + 'EntrySizeShift' : [ 0x4, ['unsigned long']], + 'EntryMax' : [ 0x8, ['unsigned long']], + 'EntryCount' : [ 0xc, ['unsigned long']], +} ], + '_RTL_CHASH_ENTRY' : [ 0x4, { + 'Key' : [ 0x0, ['unsigned long']], +} ], + '_ETW_BUFFER_QUEUE' : [ 0x8, { + 'QueueTail' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x4, ['_SINGLE_LIST_ENTRY']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStatePendingCompression', 5: 'EtwBufferStateCompressed', 6: 'EtwBufferStatePlaceholder', 7: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer', ['void']]], + 'Pointer1' : [ 0x3c, ['pointer', ['void']]], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x2f0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 1, ['unsigned long']]], + 'ErrorMarker' : [ 0x18, ['unsigned long']], + 'SizeMask' : [ 0x1c, ['unsigned long']], + 'GetCpuClock' : [ 0x20, ['pointer', ['void']]], + 'LoggerThread' : [ 0x24, ['pointer', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x28, ['long']], + 'FailureReason' : [ 0x2c, ['unsigned long']], + 'BufferQueue' : [ 0x30, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x38, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x40, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x48, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x50, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x50, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x54, ['_UNICODE_STRING']], + 'LogFileName' : [ 0x5c, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0x64, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0x6c, ['_UNICODE_STRING']], + 'ClockType' : [ 0x74, ['unsigned long']], + 'LastFlushedBuffer' : [ 0x78, ['unsigned long']], + 'FlushTimer' : [ 0x7c, ['unsigned long']], + 'FlushThreshold' : [ 0x80, ['unsigned long']], + 'ByteOffset' : [ 0x88, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0x90, ['unsigned long']], + 'BuffersAvailable' : [ 0x94, ['long']], + 'NumberOfBuffers' : [ 0x98, ['long']], + 'MaximumBuffers' : [ 0x9c, ['unsigned long']], + 'EventsLost' : [ 0xa0, ['unsigned long']], + 'PeakBuffersCount' : [ 0xa4, ['long']], + 'BuffersWritten' : [ 0xa8, ['unsigned long']], + 'LogBuffersLost' : [ 0xac, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0xb0, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0xb4, ['unsigned long']], + 'SequencePtr' : [ 0xb8, ['pointer', ['long']]], + 'LocalSequence' : [ 0xbc, ['unsigned long']], + 'InstanceGuid' : [ 0xc0, ['_GUID']], + 'MaximumFileSize' : [ 0xd0, ['unsigned long']], + 'FileCounter' : [ 0xd4, ['long']], + 'PoolType' : [ 0xd8, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0xe0, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0xf0, ['long']], + 'ProviderInfoSize' : [ 0xf4, ['unsigned long']], + 'Consumers' : [ 0xf8, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x100, ['unsigned long']], + 'TransitionConsumer' : [ 0x104, ['pointer', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x108, ['pointer', ['void']]], + 'RealtimeLogfileName' : [ 0x10c, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x118, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x120, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x128, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x130, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x138, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x140, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x148, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x158, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x15c, ['_KEVENT']], + 'FlushEvent' : [ 0x16c, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x180, ['_KTIMER']], + 'LoggerDpc' : [ 0x1a8, ['_KDPC']], + 'LoggerMutex' : [ 0x1c8, ['_KMUTANT']], + 'LoggerLock' : [ 0x1e8, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x1ec, ['unsigned long']], + 'BufferListPushLock' : [ 0x1ec, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x1f0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x22c, ['pointer', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x230, ['_EX_FAST_REF']], + 'StartTime' : [ 0x238, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x240, ['pointer', ['void']]], + 'BufferSequenceNumber' : [ 0x248, ['long long']], + 'Flags' : [ 0x250, ['unsigned long']], + 'Persistent' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x250, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x250, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x250, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x250, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x250, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x250, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x250, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x250, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x250, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x250, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'StackLookasideListAllocated' : [ 0x250, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SecurityTrace' : [ 0x250, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x250, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x250, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x250, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x250, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x254, ['unsigned long']], + 'DbgRequestNewFile' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x254, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x254, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x254, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x254, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDeferredFlush' : [ 0x254, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDeferredFlushTimer' : [ 0x254, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x254, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x254, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x254, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x258, ['_RTL_BITMAP']], + 'StackCache' : [ 0x260, ['pointer', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x264, ['pointer', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x268, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x270, ['pointer', ['pointer', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x274, ['_DISALLOWED_GUIDS']], + 'SoftRestartContext' : [ 0x27c, ['pointer', ['_ETW_SOFT_RESTART_CONTEXT']]], + 'SiloState' : [ 0x280, ['pointer', ['_ETW_SILODRIVERSTATE']]], + 'CompressionWorkItem' : [ 0x284, ['_WORK_QUEUE_ITEM']], + 'CompressionWorkItemState' : [ 0x294, ['long']], + 'CompressionLock' : [ 0x298, ['_EX_PUSH_LOCK']], + 'CompressionTarget' : [ 0x29c, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'CompressionWorkspace' : [ 0x2a0, ['pointer', ['void']]], + 'CompressionOn' : [ 0x2a4, ['long']], + 'CompressionRatioGuess' : [ 0x2a8, ['unsigned long']], + 'PartialBufferCompressionLevel' : [ 0x2ac, ['unsigned long']], + 'CompressionResumptionMode' : [ 0x2b0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwCompressionModeRestart', 1: 'EtwCompressionModeNoDisable', 2: 'EtwCompressionModeNoRestart'})]], + 'PlaceholderList' : [ 0x2b4, ['_SINGLE_LIST_ENTRY']], + 'CompressionDpc' : [ 0x2b8, ['_KDPC']], + 'LastBufferSwitchTime' : [ 0x2d8, ['_LARGE_INTEGER']], + 'BufferWriteDuration' : [ 0x2e0, ['_LARGE_INTEGER']], + 'BufferCompressDuration' : [ 0x2e8, ['_LARGE_INTEGER']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x24, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_SILODRIVERSTATE' : [ 0xa80, { + 'EtwpSecurityProviderGuidEntry' : [ 0x0, ['_ETW_GUID_ENTRY']], + 'EtwpLoggerRundown' : [ 0x168, ['array', 64, ['pointer', ['_EX_RUNDOWN_REF_CACHE_AWARE']]]], + 'WmipLoggerContext' : [ 0x268, ['array', 64, ['pointer', ['_WMI_LOGGER_CONTEXT']]]], + 'EtwpGuidHashTable' : [ 0x368, ['array', 64, ['_ETW_HASH_BUCKET']]], + 'EtwpSecurityLoggers' : [ 0xa68, ['array', 8, ['unsigned short']]], + 'EtwpSecurityProviderEnableMask' : [ 0xa78, ['unsigned char']], + 'EtwpShutdownInProgress' : [ 0xa79, ['unsigned char']], + 'EtwpSecurityProviderPID' : [ 0xa7c, ['unsigned long']], +} ], + '_EX_RUNDOWN_REF_CACHE_AWARE' : [ 0x10, { + 'RunRefs' : [ 0x0, ['pointer', ['_EX_RUNDOWN_REF']]], + 'PoolToFree' : [ 0x4, ['pointer', ['void']]], + 'RunRefSize' : [ 0x8, ['unsigned long']], + 'Number' : [ 0xc, ['unsigned long']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x2a0, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x34, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x94, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0x98, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0x9c, ['pointer', ['void']]], + 'DynamicPart' : [ 0xa0, ['pointer', ['unsigned long']]], + 'DefaultDacl' : [ 0xa4, ['pointer', ['_ACL']]], + 'TokenType' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xac, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xb0, ['unsigned long']], + 'TokenInUse' : [ 0xb4, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xb8, ['unsigned long']], + 'MandatoryPolicy' : [ 0xbc, ['unsigned long']], + 'LogonSession' : [ 0xc0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xc4, ['_LUID']], + 'SidHash' : [ 0xcc, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x154, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x1dc, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x1e0, ['pointer', ['void']]], + 'Capabilities' : [ 0x1e4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x1e8, ['unsigned long']], + 'CapabilitiesHash' : [ 0x1ec, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x274, ['pointer', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x278, ['pointer', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x27c, ['pointer', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x280, ['pointer', ['void']]], + 'TrustLinkedToken' : [ 0x284, ['pointer', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x288, ['pointer', ['void']]], + 'TokenSidValues' : [ 0x28c, ['pointer', ['_SEP_SID_VALUES_BLOCK']]], + 'IndexEntry' : [ 0x290, ['pointer', ['_SEP_LUID_TO_INDEX_MAP_ENTRY']]], + 'DiagnosticInfo' : [ 0x294, ['pointer', ['_SEP_TOKEN_DIAG_TRACK_ENTRY']]], + 'VariablePart' : [ 0x298, ['unsigned long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0x6c, { + 'Next' : [ 0x0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x4, ['_LUID']], + 'BuddyLogonId' : [ 0xc, ['_LUID']], + 'ReferenceCount' : [ 0x14, ['long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'pDeviceMap' : [ 0x1c, ['pointer', ['_DEVICE_MAP']]], + 'Token' : [ 0x20, ['pointer', ['void']]], + 'AccountName' : [ 0x24, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x2c, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x34, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x3c, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x40, ['pointer', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x44, ['pointer', ['_SEP_SID_VALUES_BLOCK']]], + 'RevocationBlock' : [ 0x48, ['_OB_HANDLE_REVOCATION_BLOCK']], + 'ServerSilo' : [ 0x58, ['pointer', ['_EJOB']]], + 'SiblingAuthId' : [ 0x5c, ['_LUID']], + 'TokenList' : [ 0x64, ['_LIST_ENTRY']], +} ], + '_OBJECT_HEADER' : [ 0x20, { + 'PointerCount' : [ 0x0, ['long']], + 'HandleCount' : [ 0x4, ['long']], + 'NextToFree' : [ 0x4, ['pointer', ['void']]], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0xc, ['unsigned char']], + 'TraceFlags' : [ 0xd, ['unsigned char']], + 'DbgRefTrace' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0xd, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0xe, ['unsigned char']], + 'Flags' : [ 0xf, ['unsigned char']], + 'NewObject' : [ 0xf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0xf, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0xf, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0xf, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0xf, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0xf, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0xf, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0xf, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectCreateInfo' : [ 0x10, ['pointer', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x10, ['pointer', ['void']]], + 'SecurityDescriptor' : [ 0x14, ['pointer', ['void']]], + 'Body' : [ 0x18, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x10, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0xc, ['pointer', ['void']]], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x8, { + 'ExclusiveProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x8, { + 'HandleCountDataBase' : [ 0x0, ['pointer', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x10, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x4, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0xc, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x10, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x8, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0xc, ['unsigned short']], + 'Reserved1' : [ 0xe, ['unsigned short']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x8, { + 'SecurityDescriptor' : [ 0x0, ['pointer', ['void']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_HEADER_EXTENDED_INFO' : [ 0x8, { + 'Footer' : [ 0x0, ['pointer', ['_OBJECT_FOOTER']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_FOOTER' : [ 0x18, { + 'HandleRevocationInfo' : [ 0x0, ['_HANDLE_REVOCATION_INFO']], + 'ExtendedUserInfo' : [ 0x10, ['_OB_EXTENDED_USER_INFO']], +} ], + '_OB_EXTENDED_USER_INFO' : [ 0x8, { + 'Context1' : [ 0x0, ['pointer', ['void']]], + 'Context2' : [ 0x4, ['pointer', ['void']]], +} ], + '_HANDLE_REVOCATION_INFO' : [ 0x10, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'RevocationBlock' : [ 0x8, ['pointer', ['_OB_HANDLE_REVOCATION_BLOCK']]], + 'AllowHandleRevocation' : [ 0xc, ['unsigned char']], + 'Padding1' : [ 0xd, ['array', 3, ['unsigned char']]], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x18, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'EntryLink' : [ 0x8, ['pointer', ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0xc, ['unsigned long']], + 'HashIndex' : [ 0x10, ['unsigned short']], + 'DirectoryLocked' : [ 0x12, ['unsigned char']], + 'LockedExclusive' : [ 0x13, ['unsigned char']], + 'LockStateSignature' : [ 0x14, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0xac, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x94, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x98, ['pointer', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x9c, ['pointer', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0xa0, ['unsigned long']], + 'NamespaceEntry' : [ 0xa4, ['pointer', ['void']]], + 'Flags' : [ 0xa8, ['unsigned long']], +} ], + '_OBP_SILODRIVERSTATE' : [ 0x1a4, { + 'SystemDeviceMap' : [ 0x0, ['pointer', ['_DEVICE_MAP']]], + 'SystemDosDeviceState' : [ 0x4, ['_OBP_SYSTEM_DOS_DEVICE_STATE']], + 'DeviceMapLock' : [ 0x70, ['_EX_PUSH_LOCK']], + 'PrivateNamespaceLookupTable' : [ 0x74, ['_OBJECT_NAMESPACE_LOOKUPTABLE']], +} ], + '_WHEAP_INFO_BLOCK' : [ 0xc, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x4, ['pointer', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x8, ['pointer', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x418, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x8, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0xc, ['unsigned long']], + 'ErrorCount' : [ 0x10, ['long']], + 'RecordCount' : [ 0x14, ['unsigned long']], + 'RecordLength' : [ 0x18, ['unsigned long']], + 'PoolTag' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x24, ['pointer', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x28, ['pointer', ['void']]], + 'SectionCount' : [ 0x2c, ['unsigned long']], + 'SectionLength' : [ 0x30, ['unsigned long']], + 'TickCountAtLastError' : [ 0x38, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x40, ['unsigned long']], + 'TotalErrors' : [ 0x44, ['unsigned long']], + 'Deferred' : [ 0x48, ['unsigned char']], + 'Descriptor' : [ 0x49, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xe4, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x8, ['unsigned long']], + 'ProcessorNumber' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x14, ['long']], + 'ErrorSource' : [ 0x18, ['pointer', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x1c, ['_WHEA_ERROR_RECORD']], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x20, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ImageControlAreaOnRemovableMedia' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'SystemVaAllocated' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PreferredFsCompressionBoundary' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'UsingFileExtents' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PageSize64K' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_PEP_ACPI_SPB_RESOURCE' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PepAcpiMemory', 1: 'PepAcpiIoPort', 2: 'PepAcpiInterrupt', 3: 'PepAcpiGpioIo', 4: 'PepAcpiGpioInt', 5: 'PepAcpiSpbI2c', 6: 'PepAcpiSpbSpi', 7: 'PepAcpiSpbUart', 8: 'PepAcpiExtendedMemory', 9: 'PepAcpiExtendedIo'})]], + 'Flags' : [ 0x4, ['_PEP_ACPI_RESOURCE_FLAGS']], + 'TypeSpecificFlags' : [ 0x8, ['unsigned short']], + 'ResourceSourceIndex' : [ 0xa, ['unsigned char']], + 'ResourceSourceName' : [ 0xc, ['pointer', ['_UNICODE_STRING']]], + 'VendorData' : [ 0x10, ['pointer', ['unsigned char']]], + 'VendorDataLength' : [ 0x14, ['unsigned short']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x4, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x8, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0xc, ['long']], + 'HighWaterMark' : [ 0x10, ['unsigned long']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 7, ['pointer', ['void']]]], +} ], + '_KDPC_DATA' : [ 0x18, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x8, ['unsigned long']], + 'DpcQueueDepth' : [ 0xc, ['long']], + 'DpcCount' : [ 0x10, ['unsigned long']], + 'ActiveDpc' : [ 0x14, ['pointer', ['_KDPC']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_PLATFORM_IDLE_ACCOUNTING' : [ 0x400, { + 'ResetCount' : [ 0x0, ['unsigned long']], + 'StateCount' : [ 0x4, ['unsigned long']], + 'DeepSleepCount' : [ 0x8, ['unsigned long']], + 'TimeUnit' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'State' : [ 0x18, ['array', 1, ['_PLATFORM_IDLE_STATE_ACCOUNTING']]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '__unnamed_1edf' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x5000, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_1edf']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x18, ['unsigned long']], + 'NonPagablePages' : [ 0x1c, ['unsigned long']], + 'CommittedPages' : [ 0x20, ['unsigned long']], + 'PagedPoolStart' : [ 0x24, ['pointer', ['void']]], + 'PagedPoolEnd' : [ 0x28, ['pointer', ['void']]], + 'SessionObject' : [ 0x2c, ['pointer', ['void']]], + 'SessionObjectHandle' : [ 0x30, ['pointer', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x34, ['array', 4, ['unsigned long']]], + 'ImageTree' : [ 0x44, ['_RTL_AVL_TREE']], + 'LocaleId' : [ 0x48, ['unsigned long']], + 'AttachCount' : [ 0x4c, ['unsigned long']], + 'AttachGate' : [ 0x50, ['_KGATE']], + 'WsListEntry' : [ 0x60, ['_LIST_ENTRY']], + 'Lookaside' : [ 0x80, ['array', 24, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xc80, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xc94, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xcc0, ['_MMSUPPORT_FULL']], + 'DriverUnload' : [ 0xd48, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xd80, ['_POOL_DESCRIPTOR']], + 'PageTables' : [ 0x1ec0, ['pointer', ['_MMPTE']]], + 'PagedPoolBitBuffer' : [ 0x1ec4, ['array', 32, ['unsigned long']]], + 'SpecialPool' : [ 0x1f48, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1f90, ['_EX_PUSH_LOCK']], + 'PoolBigEntriesInUse' : [ 0x1f94, ['long']], + 'PagedPoolPdeCount' : [ 0x1f98, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1f9c, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1fa0, ['unsigned long']], + 'SystemPteInfo' : [ 0x1fa4, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1fdc, ['pointer', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1fe0, ['unsigned long']], + 'PoolTrackBigPages' : [ 0x1fe4, ['pointer', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1fe8, ['unsigned long']], + 'IoState' : [ 0x1fec, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1ff0, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1ff4, ['_KEVENT']], + 'ServerSilo' : [ 0x2004, ['pointer', ['_EJOB']]], + 'CreateTime' : [ 0x2008, ['unsigned long long']], + 'PoolTags' : [ 0x3000, ['array', 8192, ['unsigned char']]], +} ], + '_OBJECT_NAMESPACE_LOOKUPTABLE' : [ 0x130, { + 'HashBuckets' : [ 0x0, ['array', 37, ['_LIST_ENTRY']]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'NumberOfPrivateSpaces' : [ 0x12c, ['unsigned long']], +} ], + '_MI_CACHED_PTES' : [ 0x48, { + 'Bins' : [ 0x0, ['array', 8, ['_MI_CACHED_PTE']]], + 'CachedPteCount' : [ 0x40, ['long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeFlags2' : [ 0x3, ['unsigned char']], + 'UseExtendedParameters' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer', ['void']]], + 'OpenProcedure' : [ 0x34, ['pointer', ['void']]], + 'CloseProcedure' : [ 0x38, ['pointer', ['void']]], + 'DeleteProcedure' : [ 0x3c, ['pointer', ['void']]], + 'ParseProcedure' : [ 0x40, ['pointer', ['void']]], + 'ParseProcedureEx' : [ 0x40, ['pointer', ['void']]], + 'SecurityProcedure' : [ 0x44, ['pointer', ['void']]], + 'QueryNameProcedure' : [ 0x48, ['pointer', ['void']]], + 'OkayToCloseProcedure' : [ 0x4c, ['pointer', ['void']]], + 'WaitObjectFlagMask' : [ 0x50, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x54, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x56, ['unsigned short']], +} ], + '_KLOCK_ENTRY' : [ 0x30, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'EntryFlags' : [ 0xc, ['unsigned long']], + 'EntryOffset' : [ 0xc, ['unsigned char']], + 'ThreadLocalFlags' : [ 0xd, ['unsigned char']], + 'WaitingBit' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare0' : [ 0xd, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'AcquiredByte' : [ 0xe, ['unsigned char']], + 'AcquiredBit' : [ 0xe, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadFlags' : [ 0xf, ['unsigned char']], + 'HeadNodeBit' : [ 0xf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IoPriorityBit' : [ 0xf, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IoQoSWaiter' : [ 0xf, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0xf, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'StaticState' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'AllFlags' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'LockState' : [ 0x10, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x10, ['pointer', ['void']]], + 'CrossThreadReleasableAndBusyByte' : [ 0x10, ['unsigned char']], + 'Reserved' : [ 0x11, ['array', 2, ['unsigned char']]], + 'InTreeByte' : [ 0x13, ['unsigned char']], + 'SessionState' : [ 0x14, ['pointer', ['void']]], + 'SessionId' : [ 0x14, ['unsigned long']], + 'OwnerTree' : [ 0x18, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x20, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x18, ['unsigned char']], + 'EntryLock' : [ 0x28, ['unsigned long']], + 'AllBoosts' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 17, native_type='unsigned long')]], + 'CpuBoostsBitmap' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 15, native_type='unsigned short')]], + 'IoBoost' : [ 0x2c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'IoQoSBoost' : [ 0x2e, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x2e, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned short')]], + 'IoQoSWaiterCount' : [ 0x2e, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0xc, ['unsigned long']], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x40, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'TagIndex' : [ 0xc, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0xe, ['unsigned short']], + 'TagName' : [ 0x10, ['array', 24, ['wchar']]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'Arm64ControlSet' : [ 0x0, ['_ARM64_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ManySubsections' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Enclave' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PageSize64K' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], +} ], + '_HEAP_COUNTERS' : [ 0x5c, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long']], + 'TotalMemoryCommitted' : [ 0x4, ['unsigned long']], + 'TotalMemoryLargeUCR' : [ 0x8, ['unsigned long']], + 'TotalSizeInVirtualBlocks' : [ 0xc, ['unsigned long']], + 'TotalSegments' : [ 0x10, ['unsigned long']], + 'TotalUCRs' : [ 0x14, ['unsigned long']], + 'CommittOps' : [ 0x18, ['unsigned long']], + 'DeCommitOps' : [ 0x1c, ['unsigned long']], + 'LockAcquires' : [ 0x20, ['unsigned long']], + 'LockCollisions' : [ 0x24, ['unsigned long']], + 'CommitRate' : [ 0x28, ['unsigned long']], + 'DecommittRate' : [ 0x2c, ['unsigned long']], + 'CommitFailures' : [ 0x30, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x34, ['unsigned long']], + 'PollIntervalCounter' : [ 0x38, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x3c, ['unsigned long']], + 'HeapPollInterval' : [ 0x40, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x44, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x48, ['unsigned long']], + 'InBlockDeccommits' : [ 0x4c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x50, ['unsigned long']], + 'HighWatermarkSize' : [ 0x54, ['unsigned long']], + 'LastPolledSize' : [ 0x58, ['unsigned long']], +} ], + '_INTERFACE' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0xc, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x18, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'Irp' : [ 0xc, ['pointer', ['_IRP']]], + 'Device' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x14, ['unsigned char']], +} ], + '__unnamed_1f48' : [ 0x10, { + 'CallerCompletion' : [ 0x0, ['pointer', ['void']]], + 'CallerContext' : [ 0x4, ['pointer', ['void']]], + 'CallerDevice' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0xc, ['unsigned char']], +} ], + '__unnamed_1f4b' : [ 0x8, { + 'NotifyDevice' : [ 0x0, ['pointer', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x4, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0x90, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'Pdo' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x18, ['unsigned long long']], + 'WatchdogTimer' : [ 0x20, ['_KTIMER']], + 'WatchdogDpc' : [ 0x48, ['_KDPC']], + 'MinorFunction' : [ 0x68, ['unsigned char']], + 'PowerStateType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0x70, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0x74, ['unsigned char']], + 'FxDevice' : [ 0x78, ['pointer', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0x7c, ['unsigned char']], + 'NotifyPEP' : [ 0x7d, ['unsigned char']], + 'Device' : [ 0x80, ['__unnamed_1f48']], + 'System' : [ 0x80, ['__unnamed_1f4b']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x8, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x4, ['pointer', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_CLIENT_ID' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], + 'UniqueThread' : [ 0x4, ['pointer', ['void']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_POOL_TRACKER_TABLE' : [ 0x1c, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0xc, ['unsigned long']], + 'PagedAllocs' : [ 0x10, ['unsigned long']], + 'PagedFrees' : [ 0x14, ['unsigned long']], + 'PagedBytes' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_STACK_TABLE' : [ 0x8040, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x4, ['array', 16, ['pointer', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x44, ['array', 16381, ['unsigned short']]], +} ], + '_PPM_IDLE_STATES' : [ 0x140, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'UnaccountedTransition' : [ 0x5, ['unsigned char']], + 'IdleDurationLimited' : [ 0x6, ['unsigned char']], + 'IdleCheckLimited' : [ 0x7, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0x44, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x50, ['pointer', ['void']]], + 'IdlePreExecute' : [ 0x54, ['pointer', ['void']]], + 'IdleExecute' : [ 0x58, ['pointer', ['void']]], + 'IdlePreselect' : [ 0x5c, ['pointer', ['void']]], + 'IdleTest' : [ 0x60, ['pointer', ['void']]], + 'IdleAvailabilityCheck' : [ 0x64, ['pointer', ['void']]], + 'IdleComplete' : [ 0x68, ['pointer', ['void']]], + 'IdleCancel' : [ 0x6c, ['pointer', ['void']]], + 'IdleIsHalted' : [ 0x70, ['pointer', ['void']]], + 'IdleInitiateWake' : [ 0x74, ['pointer', ['void']]], + 'PrepareInfo' : [ 0x78, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'DeepIdleSnapshot' : [ 0xc8, ['_KAFFINITY_EX']], + 'Tracing' : [ 0xd4, ['pointer', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'CoordinatedTracing' : [ 0xd8, ['pointer', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'ProcessorMenu' : [ 0xdc, ['_PPM_SELECTION_MENU']], + 'CoordinatedMenu' : [ 0xe4, ['_PPM_SELECTION_MENU']], + 'CoordinatedSelection' : [ 0xec, ['_PPM_COORDINATED_SELECTION']], + 'State' : [ 0xfc, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_HASH_BUCKET' : [ 0x1c, { + 'ListHead' : [ 0x0, ['array', 3, ['_LIST_ENTRY']]], + 'BucketLock' : [ 0x18, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1f96' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], + 'GenErrDescriptorV2' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR_V2']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeGenericV2', 13: 'WheaErrSrcTypeSCIGenericV2', 14: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1f96']], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0x80, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], + 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x20, ['array', 8, ['pointer', ['void']]]], + 'LastAcquireTrace' : [ 0x40, ['array', 8, ['pointer', ['void']]]], + 'LastReleaseTrace' : [ 0x60, ['array', 8, ['pointer', ['void']]]], +} ], + '_SEP_TOKEN_DIAG_TRACK_ENTRY' : [ 0x9c, { + 'ProcessCid' : [ 0x0, ['pointer', ['void']]], + 'ThreadCid' : [ 0x4, ['pointer', ['void']]], + 'ImageFileName' : [ 0x8, ['array', 16, ['unsigned char']]], + 'CreateMethod' : [ 0x18, ['unsigned long']], + 'CreateTrace' : [ 0x1c, ['array', 30, ['unsigned long']]], + 'Count' : [ 0x94, ['long']], + 'CaptureCount' : [ 0x98, ['long']], +} ], + '_EX_PUSH_LOCK_AUTO_EXPAND_STATE' : [ 0x4, { + 'Expanded' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Transitioning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Pageable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0xa0, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x20, ['array', 128, ['unsigned char']]], +} ], + '_VF_BTS_DATA_MANAGEMENT_AREA' : [ 0x34, { + 'BTSBufferBase' : [ 0x0, ['pointer', ['void']]], + 'BTSIndex' : [ 0x4, ['pointer', ['void']]], + 'BTSMax' : [ 0x8, ['pointer', ['void']]], + 'BTSInterruptThreshold' : [ 0xc, ['pointer', ['void']]], + 'PEBSBufferBase' : [ 0x10, ['pointer', ['void']]], + 'PEBSIndex' : [ 0x14, ['pointer', ['void']]], + 'PEBSMax' : [ 0x18, ['pointer', ['void']]], + 'PEBSInterruptThreshold' : [ 0x1c, ['pointer', ['void']]], + 'PEBSCounterReset' : [ 0x20, ['array', 2, ['pointer', ['void']]]], + 'Reserved' : [ 0x28, ['array', 12, ['unsigned char']]], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_PPM_POLICY_SETTINGS_MASK' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long long']], + 'PerfDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PerfIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerfDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PerfIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PerfDecreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PerfIncreaseThreshold' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'PerfMinPolicy' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'PerfMaxPolicy' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PerfTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PerfBoostPolicy' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PerfBoostMode' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AllowThrottling' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PerfHistoryCount' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ParkingPerfState' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LatencyHintPerf' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LatencyHintUnpark' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CoreParkingMinCores' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CoreParkingMaxCores' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'CoreParkingDecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'CoreParkingIncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CoreParkingDecreaseTime' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CoreParkingIncreaseTime' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CoreParkingOverUtilizationThreshold' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'CoreParkingDistributeUtility' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CoreParkingConcurrencyThreshold' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CoreParkingHeadroomThreshold' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CoreParkingDistributionThreshold' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'IdleAllowScaling' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'IdleDisable' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'IdleTimeCheck' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'IdleDemoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'IdlePromoteThreshold' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HeteroDecreaseTime' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HeteroIncreaseTime' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HeteroDecreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HeteroIncreaseThreshold' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Class0FloorPerformance' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Class1InitialPerformance' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnergyPerfPreference' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'AutonomousActivityWindow' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AutonomousMode' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DutyCycling' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], +} ], + '_KSCHEDULING_GROUP' : [ 0x180, { + 'Policy' : [ 0x0, ['_KSCHEDULING_GROUP_POLICY']], + 'RelativeWeight' : [ 0x8, ['unsigned long']], + 'ChildMinRate' : [ 0xc, ['unsigned long']], + 'ChildMinWeight' : [ 0x10, ['unsigned long']], + 'ChildTotalWeight' : [ 0x14, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x18, ['unsigned long long']], + 'NotificationCycles' : [ 0x20, ['long long']], + 'MaxQuotaLimitCycles' : [ 0x28, ['long long']], + 'MaxQuotaCyclesRemaining' : [ 0x30, ['long long']], + 'SchedulingGroupList' : [ 0x38, ['_LIST_ENTRY']], + 'Sibling' : [ 0x38, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x40, ['pointer', ['_KDPC']]], + 'ChildList' : [ 0x44, ['_LIST_ENTRY']], + 'Parent' : [ 0x4c, ['pointer', ['_KSCHEDULING_GROUP']]], + 'PerProcessor' : [ 0x80, ['array', 1, ['_KSCB']]], +} ], + '_CM_INTENT_LOCK' : [ 0x8, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x4, ['pointer', ['pointer', ['_CM_KCB_UOW']]]], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x130, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x8, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0xc, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x10, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x98, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x120, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x124, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x128, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x12c, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_TEB_ACTIVE_FRAME' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x4, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x8, ['pointer', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_LOCK_HEADER' : [ 0x10, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x4, ['unsigned long']], + 'Lock' : [ 0x8, ['unsigned long']], + 'Valid' : [ 0xc, ['unsigned long']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_KHETERO_PROCESSOR_SET' : [ 0xc, { + 'IdealMask' : [ 0x0, ['unsigned long']], + 'PreferredMask' : [ 0x4, ['unsigned long']], + 'AvailableMask' : [ 0x8, ['unsigned long']], +} ], + '_MMSESSION' : [ 0x14, { + 'SystemSpaceViewLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'SystemSpaceViewLockPointer' : [ 0x4, ['pointer', ['_EX_PUSH_LOCK']]], + 'ViewRoot' : [ 0x8, ['_RTL_AVL_TREE']], + 'ViewCount' : [ 0xc, ['unsigned long']], + 'BitmapFailures' : [ 0x10, ['unsigned long']], +} ], + '_CC_ASYNC_READ_CONTEXT' : [ 0x14, { + 'CompletionRoutine' : [ 0x0, ['pointer', ['void']]], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'Mdl' : [ 0x8, ['pointer', ['_MDL']]], + 'RequestorMode' : [ 0xc, ['unsigned char']], + 'NestingLevel' : [ 0x10, ['unsigned long']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0xc, { + 'DirtyPages' : [ 0x0, ['unsigned long']], + 'DirtyPagesLastScan' : [ 0x4, ['unsigned long']], + 'DirtyPagesScheduledLastScan' : [ 0x8, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x58, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'ReadyTime' : [ 0x10, ['unsigned long long']], + 'CycleTime' : [ 0x18, ['unsigned long long']], + 'ContextSwitches' : [ 0x20, ['unsigned long long']], + 'ReadOperationCount' : [ 0x28, ['long long']], + 'WriteOperationCount' : [ 0x30, ['long long']], + 'OtherOperationCount' : [ 0x38, ['long long']], + 'ReadTransferCount' : [ 0x40, ['long long']], + 'WriteTransferCount' : [ 0x48, ['long long']], + 'OtherTransferCount' : [ 0x50, ['long long']], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0xc, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x8, { + 'Sid' : [ 0x0, ['pointer', ['void']]], + 'Attributes' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_MAP' : [ 0x38, { + 'DosDevicesDirectory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x4, ['pointer', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x8, ['pointer', ['void']]], + 'ReferenceCount' : [ 0xc, ['long']], + 'DriveMap' : [ 0x10, ['unsigned long']], + 'DriveType' : [ 0x14, ['array', 32, ['unsigned char']]], + 'ServerSilo' : [ 0x34, ['pointer', ['_EJOB']]], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_TRIAGE_9F_PNP' : [ 0xc, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'CompletionQueue' : [ 0x4, ['pointer', ['_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE']]], + 'DelayedWorkQueue' : [ 0x8, ['pointer', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x10, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'DeviceState' : [ 0xc, ['pointer', ['_POP_DEVICE_SYS_STATE']]], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x10, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x4, ['unsigned long']], + 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0xc, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x4, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0xc, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x8, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR_V2' : [ 0x50, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'ReadAckAddressSpaceID' : [ 0x34, ['unsigned char']], + 'ReadAckAddressBitWidth' : [ 0x35, ['unsigned char']], + 'ReadAckAddressBitOffset' : [ 0x36, ['unsigned char']], + 'ReadAckAddressAccessSize' : [ 0x37, ['unsigned char']], + 'ReadAckAddress' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAckPreserveMask' : [ 0x40, ['unsigned long long']], + 'ReadAckWriteMask' : [ 0x48, ['unsigned long long']], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x8, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x4, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x30, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x4, ['unsigned long']], + 'SenderPort' : [ 0x8, ['pointer', ['void']]], + 'RepliedToThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'PortContext' : [ 0x10, ['pointer', ['void']]], + 'Request' : [ 0x18, ['_PORT_MESSAGE']], +} ], + '_MI_SPECIAL_POOL' : [ 0x48, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long']], + 'SpecialPoolPdes' : [ 0x3c, ['_RTL_BITMAP']], +} ], + '_PCW_MASK_INFORMATION' : [ 0x20, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0xc, ['unsigned long']], + 'CollectMultiple' : [ 0x10, ['unsigned char']], + 'Buffer' : [ 0x14, ['pointer', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x18, ['pointer', ['_KEVENT']]], +} ], + '_DBGKD_WRITE_CUSTOM_BREAKPOINT' : [ 0x18, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointInstruction' : [ 0x8, ['unsigned long long']], + 'BreakPointHandle' : [ 0x10, ['unsigned long']], + 'BreakPointInstructionSize' : [ 0x14, ['unsigned char']], + 'BreakPointInstructionAlignment' : [ 0x15, ['unsigned char']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_OBJECT_REF_INFO' : [ 0x1c, { + 'ObjectHeader' : [ 0x0, ['pointer', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x4, ['pointer', ['void']]], + 'ImageFileName' : [ 0x8, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x18, ['unsigned short']], + 'MaxStacks' : [ 0x1a, ['unsigned short']], + 'StackInfo' : [ 0x1c, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x2c, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x8, ['unsigned char']], + 'Spare' : [ 0x9, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0xc, ['unsigned long']], + 'DebugId' : [ 0x10, ['_CVDD']], +} ], + '_MMWSLENTRY' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_PS_PROPERTY_SET' : [ 0xc, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x8, ['unsigned long']], +} ], + '_TRIAGE_EX_WORK_QUEUE' : [ 0x19c, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], +} ], + '_VF_BTS_RECORD' : [ 0xc, { + 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], + 'JumpedTo' : [ 0x4, ['pointer', ['void']]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x30, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'ExpectedWakeReason' : [ 0x2d, ['unsigned char']], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x2c, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long']], + 'MemoryBandwidth' : [ 0x14, ['unsigned long']], + 'MaxPoolUsage' : [ 0x18, ['unsigned long']], + 'MaxSectionSize' : [ 0x1c, ['unsigned long']], + 'MaxViewSize' : [ 0x20, ['unsigned long']], + 'MaxTotalSectionSize' : [ 0x24, ['unsigned long']], + 'DupObjectTypes' : [ 0x28, ['unsigned long']], +} ], + '_THREAD_ENERGY_VALUES' : [ 0x40, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], +} ], + '_MMWSLE_HASH' : [ 0x4, { + 'Index' : [ 0x0, ['unsigned long']], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x44, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x8, ['unsigned long']], + 'ItemCount' : [ 0xc, ['long']], + 'Dpc' : [ 0x10, ['_KDPC']], + 'WorkItem' : [ 0x30, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x40, ['pointer', ['void']]], +} ], + '_EXCEPTION_RECORD' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0xc, ['pointer', ['void']]], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_RTL_RUN_ONCE' : [ 0x4, { + 'Ptr' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], +} ], + '_CM_PATH_HASH' : [ 0x4, { + 'Hash' : [ 0x0, ['unsigned long']], +} ], + '_EXHANDLE' : [ 0x4, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['pointer', ['void']]], + 'Group' : [ 0x8, ['pointer', ['void']]], + 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], + 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x4, ['_KMUTANT']], + 'Lock' : [ 0x24, ['_FAST_MUTEX']], + 'List' : [ 0x44, ['_LIST_ENTRY']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x3c, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x8, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x10, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x1c, ['unsigned char']], + 'DeviceObject' : [ 0x20, ['pointer', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x24, ['pointer', ['wchar']]], + 'DriverName' : [ 0x28, ['pointer', ['wchar']]], + 'ChildCount' : [ 0x2c, ['unsigned long']], + 'ActiveChild' : [ 0x30, ['unsigned long']], + 'ParentCount' : [ 0x34, ['unsigned long']], + 'ActiveParent' : [ 0x38, ['unsigned long']], +} ], + '_DUAL' : [ 0x19c, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x4, ['pointer', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x8, ['pointer', ['_HMAP_TABLE']]], + 'Guard' : [ 0xc, ['unsigned long']], + 'FreeDisplay' : [ 0x10, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x190, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x198, ['unsigned long']], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x24, { + 'Next' : [ 0x0, ['pointer', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x4, ['unsigned long']], + 'Gate' : [ 0x8, ['_KGATE']], + 'SecureInfo' : [ 0x8, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x8, ['_RTL_BITMAP']], + 'InPageSupport' : [ 0x8, ['pointer', ['_MMINPAGE_SUPPORT']]], + 'LargePage' : [ 0x8, ['_MI_LARGEPAGE_IMAGE_INFO']], + 'CreatingThread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'PebTeb' : [ 0x8, ['_MI_SUB64K_FREE_RANGES']], +} ], + '__unnamed_2084' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '__unnamed_2086' : [ 0x4, { + 'NumberOfChildViews' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2088' : [ 0x4, { + 'AlignmentNoAccessPtes' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SUBSECTION' : [ 0x28, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x4, ['pointer', ['_MMPTE']]], + 'NextSubsection' : [ 0x8, ['pointer', ['_SUBSECTION']]], + 'GlobalPerSessionHead' : [ 0xc, ['_RTL_AVL_TREE']], + 'CreationWaitList' : [ 0xc, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'SessionDriverProtos' : [ 0xc, ['pointer', ['_MI_PER_SESSION_PROTOS']]], + 'u' : [ 0x10, ['__unnamed_2084']], + 'StartingSector' : [ 0x14, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x18, ['unsigned long']], + 'PtesInSubsection' : [ 0x1c, ['unsigned long']], + 'u1' : [ 0x20, ['__unnamed_2086']], + 'UnusedPtes' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'DirtyPages' : [ 0x24, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u2' : [ 0x24, ['__unnamed_2088']], +} ], + '_REQUEST_MAILBOX' : [ 0x20, { + 'Next' : [ 0x0, ['pointer', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x4, ['unsigned long']], + 'RequestPacket' : [ 0x8, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x18, ['pointer', ['long']]], + 'NodeTargetCount' : [ 0x1c, ['long']], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x18, { + 'ActiveFrame' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x4, ['_LIST_ENTRY']], + 'Flags' : [ 0xc, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x10, ['unsigned long']], + 'StackId' : [ 0x14, ['unsigned long']], +} ], + 'CMP_OFFSET_ARRAY' : [ 0xc, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x4, ['pointer', ['void']]], + 'DataLength' : [ 0x8, ['unsigned long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x8, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x18, { + 'AllocAddress' : [ 0x0, ['unsigned long']], + 'AllocTag' : [ 0x4, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x8, ['unsigned long']], + 'ReAllocTag' : [ 0xc, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x10, ['unsigned long']], + 'FreeTag' : [ 0x14, ['_HEAP_STOP_ON_TAG']], +} ], + '_SEP_RM_LSA_CONNECTION_STATE' : [ 0x30, { + 'LsaProcessHandle' : [ 0x0, ['pointer', ['void']]], + 'LsaCommandPortHandle' : [ 0x4, ['pointer', ['void']]], + 'SepRmThreadHandle' : [ 0x8, ['pointer', ['void']]], + 'RmCommandPortHandle' : [ 0xc, ['pointer', ['void']]], + 'RmCommandServerPortHandle' : [ 0x10, ['pointer', ['void']]], + 'LsaCommandPortSectionHandle' : [ 0x14, ['pointer', ['void']]], + 'LsaCommandPortSectionSize' : [ 0x18, ['_LARGE_INTEGER']], + 'LsaViewPortMemory' : [ 0x20, ['pointer', ['void']]], + 'RmViewPortMemory' : [ 0x24, ['pointer', ['void']]], + 'LsaCommandPortMemoryDelta' : [ 0x28, ['long']], + 'LsaCommandPortActive' : [ 0x2c, ['unsigned char']], +} ], + '_CM_KCB_LAYER_INFO' : [ 0x18, { + 'LayerListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Kcb' : [ 0x8, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'LowerLayer' : [ 0xc, ['pointer', ['_CM_KCB_LAYER_INFO']]], + 'UpperLayerListHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_CM_RM' : [ 0x58, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x8, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x10, ['pointer', ['void']]], + 'Tm' : [ 0x14, ['pointer', ['void']]], + 'RmHandle' : [ 0x18, ['pointer', ['void']]], + 'KtmRm' : [ 0x1c, ['pointer', ['void']]], + 'RefCount' : [ 0x20, ['unsigned long']], + 'ContainerNum' : [ 0x24, ['unsigned long']], + 'ContainerSize' : [ 0x28, ['unsigned long long']], + 'CmHive' : [ 0x30, ['pointer', ['_CMHIVE']]], + 'LogFileObject' : [ 0x34, ['pointer', ['void']]], + 'MarshallingContext' : [ 0x38, ['pointer', ['void']]], + 'RmFlags' : [ 0x3c, ['unsigned long']], + 'LogStartStatus1' : [ 0x40, ['long']], + 'LogStartStatus2' : [ 0x44, ['long']], + 'BaseLsn' : [ 0x48, ['unsigned long long']], + 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x1c, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'PagedPoolAllocationMap' : [ 0x4, ['_RTL_BITMAP']], + 'FirstPteForPagedPool' : [ 0xc, ['pointer', ['_MMPTE']]], + 'MaximumSize' : [ 0x10, ['unsigned long']], + 'PagedPoolHint' : [ 0x14, ['unsigned long']], + 'AllocatedPagedPool' : [ 0x18, ['unsigned long']], +} ], + '_PPM_IDLE_STATE' : [ 0x44, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Name' : [ 0xc, ['_UNICODE_STRING']], + 'Latency' : [ 0x14, ['unsigned long']], + 'BreakEvenDuration' : [ 0x18, ['unsigned long']], + 'Power' : [ 0x1c, ['unsigned long']], + 'StateFlags' : [ 0x20, ['unsigned long']], + 'VetoAccounting' : [ 0x24, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0x3c, ['unsigned char']], + 'InterruptsEnabled' : [ 0x3d, ['unsigned char']], + 'Interruptible' : [ 0x3e, ['unsigned char']], + 'ContextRetained' : [ 0x3f, ['unsigned char']], + 'CacheCoherent' : [ 0x40, ['unsigned char']], + 'WakesSpuriously' : [ 0x41, ['unsigned char']], + 'PlatformOnly' : [ 0x42, ['unsigned char']], + 'NoCState' : [ 0x43, ['unsigned char']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CACHED_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x4, ['unsigned long']], + 'RealKcb' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '__unnamed_20b9' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_20bb' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_20b9']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0xb0, { + 'SuspectDriverEntry' : [ 0x0, ['pointer', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x4, ['pointer', ['void']]], + 'EtwHandlesListHead' : [ 0x8, ['_LIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_20bb']], + 'Signature' : [ 0x14, ['unsigned long']], + 'PoolPageHeaders' : [ 0x18, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x20, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x28, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x2c, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x30, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x34, ['unsigned long']], + 'PagedBytes' : [ 0x38, ['unsigned long']], + 'NonPagedBytes' : [ 0x3c, ['unsigned long']], + 'PeakPagedBytes' : [ 0x40, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x44, ['unsigned long']], + 'RaiseIrqls' : [ 0x48, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x4c, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x50, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x54, ['unsigned long']], + 'AllocationsFailed' : [ 0x58, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x5c, ['unsigned long']], + 'LockedBytes' : [ 0x60, ['unsigned long']], + 'PeakLockedBytes' : [ 0x64, ['unsigned long']], + 'MappedLockedBytes' : [ 0x68, ['unsigned long']], + 'PeakMappedLockedBytes' : [ 0x6c, ['unsigned long']], + 'MappedIoSpaceBytes' : [ 0x70, ['unsigned long']], + 'PeakMappedIoSpaceBytes' : [ 0x74, ['unsigned long']], + 'PagesForMdlBytes' : [ 0x78, ['unsigned long']], + 'PeakPagesForMdlBytes' : [ 0x7c, ['unsigned long']], + 'ContiguousMemoryBytes' : [ 0x80, ['unsigned long']], + 'PeakContiguousMemoryBytes' : [ 0x84, ['unsigned long']], + 'ContiguousMemoryListHead' : [ 0x88, ['_LIST_ENTRY']], + 'ExecutePoolTypes' : [ 0x90, ['unsigned long']], + 'ExecutePageProtections' : [ 0x94, ['unsigned long']], + 'ExecutePageMappings' : [ 0x98, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x9c, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0xa0, ['unsigned long']], + 'UnsupportedRelocs' : [ 0xa4, ['unsigned long']], + 'IATInExecutableSection' : [ 0xa8, ['unsigned long']], +} ], + '_SEP_LUID_TO_INDEX_MAP_ENTRY' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'Luid' : [ 0x10, ['unsigned long long']], + 'IndexIntoGlobalSingletonTable' : [ 0x18, ['unsigned long long']], + 'MarkedForDeletion' : [ 0x20, ['unsigned char']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0xc, { + 'DynamicRelocations' : [ 0x0, ['pointer', ['void']]], + 'SecurityContext' : [ 0x4, ['_IMAGE_SECURITY_CONTEXT']], + 'StrongImageReference' : [ 0x8, ['unsigned long']], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderZero', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderVsmMemory', 30: 'LoaderFirmwareCode', 31: 'LoaderFirmwareData', 32: 'LoaderFirmwareReserved', 33: 'LoaderEnclaveMemory', 34: 'LoaderFirmwareKsr', 35: 'LoaderMaximum'})]], + 'BasePage' : [ 0xc, ['unsigned long']], + 'PageCount' : [ 0x10, ['unsigned long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_OBP_SYSTEM_DOS_DEVICE_STATE' : [ 0x6c, { + 'GlobalDeviceMap' : [ 0x0, ['unsigned long']], + 'LocalDeviceCount' : [ 0x4, ['array', 26, ['unsigned long']]], +} ], + '_WNF_SILODRIVERSTATE' : [ 0x30, { + 'ScopeMap' : [ 0x0, ['pointer', ['_WNF_SCOPE_MAP']]], + 'PermanentNameStoreRootKey' : [ 0x4, ['pointer', ['void']]], + 'PersistentNameStoreRootKey' : [ 0x8, ['pointer', ['void']]], + 'PermanentNameSequenceNumber' : [ 0x10, ['long long']], + 'PermanentNameSequenceNumberLock' : [ 0x18, ['_WNF_LOCK']], + 'PermanentNameSequenceNumberPool' : [ 0x20, ['long long']], + 'RuntimeNameSequenceNumber' : [ 0x28, ['long long']], +} ], + '_RTL_BITMAP' : [ 0x8, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '_DELAY_ACK_FO' : [ 0xc, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], +} ], + '_DISPATCHER_HEADER' : [ 0x10, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Tagged' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'EnergyProfiling' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Instrumented' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OB_HANDLE_REVOCATION_BLOCK' : [ 0x10, { + 'RevocationInfos' : [ 0x0, ['_LIST_ENTRY']], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'Rundown' : [ 0xc, ['_EX_RUNDOWN_REF']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x28, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long']], + 'DirtyPageThresholdTop' : [ 0x4, ['unsigned long']], + 'DirtyPageThresholdBottom' : [ 0x8, ['unsigned long']], + 'DirtyPageTarget' : [ 0xc, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x10, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x18, ['unsigned long long']], + 'AvailableHistory' : [ 0x20, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x4c, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0xc, ['pointer', ['_MDL']]], + 'StartVa' : [ 0x10, ['pointer', ['void']]], + 'Count' : [ 0x14, ['unsigned long']], + 'Offset' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], + 'Page' : [ 0x20, ['unsigned long']], + 'StackTrace' : [ 0x24, ['array', 8, ['pointer', ['void']]]], + 'Who' : [ 0x44, ['unsigned long']], + 'Process' : [ 0x48, ['pointer', ['_EPROCESS']]], +} ], + '_CONTEXT' : [ 0x2cc, { + 'ContextFlags' : [ 0x0, ['unsigned long']], + 'Dr0' : [ 0x4, ['unsigned long']], + 'Dr1' : [ 0x8, ['unsigned long']], + 'Dr2' : [ 0xc, ['unsigned long']], + 'Dr3' : [ 0x10, ['unsigned long']], + 'Dr6' : [ 0x14, ['unsigned long']], + 'Dr7' : [ 0x18, ['unsigned long']], + 'FloatSave' : [ 0x1c, ['_FLOATING_SAVE_AREA']], + 'SegGs' : [ 0x8c, ['unsigned long']], + 'SegFs' : [ 0x90, ['unsigned long']], + 'SegEs' : [ 0x94, ['unsigned long']], + 'SegDs' : [ 0x98, ['unsigned long']], + 'Edi' : [ 0x9c, ['unsigned long']], + 'Esi' : [ 0xa0, ['unsigned long']], + 'Ebx' : [ 0xa4, ['unsigned long']], + 'Edx' : [ 0xa8, ['unsigned long']], + 'Ecx' : [ 0xac, ['unsigned long']], + 'Eax' : [ 0xb0, ['unsigned long']], + 'Ebp' : [ 0xb4, ['unsigned long']], + 'Eip' : [ 0xb8, ['unsigned long']], + 'SegCs' : [ 0xbc, ['unsigned long']], + 'EFlags' : [ 0xc0, ['unsigned long']], + 'Esp' : [ 0xc4, ['unsigned long']], + 'SegSs' : [ 0xc8, ['unsigned long']], + 'ExtendedRegisters' : [ 0xcc, ['array', 512, ['unsigned char']]], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer', ['_MMPTE']]], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0x80, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0xc, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x2c, ['unsigned long']], + 'TraceDb' : [ 0x30, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x10, { + 'Handles' : [ 0x0, ['pointer', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], +} ], + '_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS' : [ 0x1, { + 'Trustlet' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Ntos' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'WriteHandle' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ReadHandle' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'AccessRights' : [ 0x0, ['unsigned char']], +} ], + '_KREQUEST_PACKET' : [ 0x10, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer', ['void']]]], + 'WorkerRoutine' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_2107' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2109' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2107']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2109']], +} ], + '_PROCESS_ENERGY_VALUES' : [ 0x90, { + 'Cycles' : [ 0x0, ['array', 4, ['array', 2, ['unsigned long long']]]], + 'DiskEnergy' : [ 0x40, ['unsigned long long']], + 'NetworkTailEnergy' : [ 0x48, ['unsigned long long']], + 'MBBTailEnergy' : [ 0x50, ['unsigned long long']], + 'NetworkTxRxBytes' : [ 0x58, ['unsigned long long']], + 'MBBTxRxBytes' : [ 0x60, ['unsigned long long']], + 'Foreground' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DesktopVisible' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WindowInformation' : [ 0x68, ['unsigned short']], + 'CompositorRendered' : [ 0x6a, ['unsigned short']], + 'DirtyGenerated' : [ 0x6c, ['unsigned short']], + 'DirtyPropagated' : [ 0x6e, ['unsigned short']], + 'DesktopVisibilityReportTimestamp' : [ 0x70, ['long long']], + 'DesktopVisibleTime' : [ 0x78, ['unsigned long long']], + 'ForegroundReportTimestamp' : [ 0x80, ['long long']], + 'ForegroundTime' : [ 0x88, ['unsigned long long']], +} ], + '_MMCLONE_HEADER' : [ 0xc, { + 'NumberOfPtes' : [ 0x0, ['unsigned long']], + 'NumberOfProcessReferences' : [ 0x4, ['unsigned long']], + 'ClonePtes' : [ 0x8, ['pointer', ['_MMCLONE_BLOCK']]], +} ], + '_MI_SYSTEM_INFORMATION' : [ 0x3d80, { + 'Pools' : [ 0x0, ['_MI_POOL_STATE']], + 'Sections' : [ 0x500, ['_MI_SECTION_STATE']], + 'SystemImages' : [ 0x640, ['_MI_SYSTEM_IMAGE_STATE']], + 'Sessions' : [ 0x6ac, ['_MI_SESSION_STATE']], + 'Processes' : [ 0x16f0, ['_MI_PROCESS_STATE']], + 'Hardware' : [ 0x1760, ['_MI_HARDWARE_STATE']], + 'SystemVa' : [ 0x1840, ['_MI_SYSTEM_VA_STATE']], + 'PageCombines' : [ 0x2d00, ['_MI_COMBINE_STATE']], + 'PageLists' : [ 0x2d18, ['_MI_PAGELIST_STATE']], + 'Partitions' : [ 0x2d20, ['_MI_PARTITION_STATE']], + 'Shutdowns' : [ 0x2d58, ['_MI_SHUTDOWN_STATE']], + 'Errors' : [ 0x2da0, ['_MI_ERROR_STATE']], + 'AccessLog' : [ 0x2e80, ['_MI_ACCESS_LOG_STATE']], + 'Debugger' : [ 0x2f00, ['_MI_DEBUGGER_STATE']], + 'Standby' : [ 0x2fc0, ['_MI_STANDBY_STATE']], + 'SystemPtes' : [ 0x3040, ['_MI_SYSTEM_PTE_STATE']], + 'IoPages' : [ 0x31c0, ['_MI_IO_PAGE_STATE']], + 'PagingIo' : [ 0x3200, ['_MI_PAGING_IO_STATE']], + 'CommonPages' : [ 0x3238, ['_MI_COMMON_PAGE_STATE']], + 'Trims' : [ 0x3280, ['_MI_SYSTEM_TRIM_STATE']], + 'ResTrack' : [ 0x32c0, ['_MI_RESAVAIL_TRACKER']], + 'Cookie' : [ 0x34c0, ['unsigned long']], + 'ZeroingDisabled' : [ 0x34c4, ['long']], + 'BootRegistryRuns' : [ 0x34c8, ['pointer', ['pointer', ['void']]]], + 'FullyInitialized' : [ 0x34cc, ['unsigned char']], + 'SafeBooted' : [ 0x34cd, ['unsigned char']], + 'PfnBitMap' : [ 0x34d0, ['_RTL_BITMAP']], + 'TraceLogging' : [ 0x34d8, ['pointer', ['_TlgProvider_t']]], + 'Vs' : [ 0x3500, ['_MI_VISIBLE_STATE']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x4, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x10, ['_KEVENT']], +} ], + '__unnamed_2136' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2138' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2136']], +} ], + '__unnamed_213a' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_2138']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_213a']], +} ], + '_HMAP_DIRECTORY' : [ 0x1000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer', ['_HMAP_TABLE']]]], +} ], + '__unnamed_2142' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_2142']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x8, { + 'LogHandle' : [ 0x0, ['pointer', ['void']]], + 'FlushToLsnRoutine' : [ 0x4, ['pointer', ['void']]], +} ], + '_MI_LARGEPAGE_IMAGE_INFO' : [ 0x8, { + 'LargeImageBias' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'ActualImageViewSize' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_214f' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x18, { + 'NodeRangeSize' : [ 0x0, ['unsigned long']], + 'NodeCount' : [ 0x4, ['unsigned long']], + 'Tables' : [ 0x8, ['pointer', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0xc, ['unsigned long']], + 'UseSessionId' : [ 0x10, ['unsigned char']], + 'u1' : [ 0x14, ['__unnamed_214f']], +} ], + '_SILO_USER_SHARED_DATA' : [ 0x20, { + 'ServiceSessionId' : [ 0x0, ['unsigned long']], + 'ActiveConsoleId' : [ 0x4, ['unsigned long']], + 'ConsoleSessionForegroundProcessId' : [ 0x8, ['long long']], + 'NtProductType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'SuiteMask' : [ 0x14, ['unsigned long']], + 'IsMultiSessionSku' : [ 0x18, ['unsigned char']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x10, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x4, ['pointer', ['void']]], + 'AcquireForReadAhead' : [ 0x8, ['pointer', ['void']]], + 'ReleaseFromReadAhead' : [ 0xc, ['pointer', ['void']]], +} ], + '_MMSUPPORT_FULL' : [ 0x88, { + 'Instance' : [ 0x0, ['_MMSUPPORT_INSTANCE']], + 'Shared' : [ 0x64, ['_MMSUPPORT_SHARED']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_MI_PROCESS_STATE' : [ 0x70, { + 'ColorSeed' : [ 0x0, ['unsigned long']], + 'CloneDereferenceEvent' : [ 0x4, ['_KEVENT']], + 'CloneProtosSListHead' : [ 0x18, ['_SLIST_HEADER']], + 'SystemDllBase' : [ 0x20, ['pointer', ['void']]], + 'RotatingUniprocessorNumber' : [ 0x24, ['long']], + 'CriticalSectionTimeout' : [ 0x28, ['_LARGE_INTEGER']], + 'ProcessList' : [ 0x30, ['_LIST_ENTRY']], + 'SharedUserDataPte' : [ 0x38, ['pointer', ['_MMPTE']]], + 'FreePaeEntries' : [ 0x3c, ['unsigned long']], + 'FirstFreePae' : [ 0x40, ['_PAE_ENTRY']], + 'AllocatedPaePages' : [ 0x60, ['long']], + 'PaeLock' : [ 0x64, ['unsigned long']], + 'PaeEntrySList' : [ 0x68, ['_SLIST_HEADER']], +} ], + '_KIDTENTRY' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'Access' : [ 0x4, ['unsigned short']], + 'ExtendedOffset' : [ 0x6, ['unsigned short']], +} ], + '_IO_TIMER' : [ 0x18, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x4, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Context' : [ 0x10, ['pointer', ['void']]], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_EXCEPTION_POINTERS' : [ 0x8, { + 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x4, ['pointer', ['_CONTEXT']]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long']], + 'PipelinedReadAheadRequestSize' : [ 0x54, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x58, ['unsigned long']], + 'PrivateLinks' : [ 0x5c, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x64, ['pointer', ['void']]], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x48, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_ETW_GUID_ENTRY' : [ 0x168, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x8, ['long']], + 'Guid' : [ 0xc, ['_GUID']], + 'RegListHead' : [ 0x1c, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x24, ['pointer', ['void']]], + 'LastEnable' : [ 0x28, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x28, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x38, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x58, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x158, ['pointer', ['_ETW_FILTER_HEADER']]], + 'SiloState' : [ 0x15c, ['pointer', ['_ETW_SILODRIVERSTATE']]], + 'Lock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'LockOwner' : [ 0x164, ['pointer', ['_ETHREAD']]], +} ], + '_ARBITER_INSTANCE' : [ 0xa8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x4, ['pointer', ['_KEVENT']]], + 'Name' : [ 0x8, ['pointer', ['wchar']]], + 'OrderingName' : [ 0xc, ['pointer', ['wchar']]], + 'ResourceType' : [ 0x10, ['long']], + 'Allocation' : [ 0x14, ['pointer', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x18, ['pointer', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x1c, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x24, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x2c, ['long']], + 'Interface' : [ 0x30, ['pointer', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x34, ['unsigned long']], + 'AllocationStack' : [ 0x38, ['pointer', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x3c, ['pointer', ['void']]], + 'PackResource' : [ 0x40, ['pointer', ['void']]], + 'UnpackResource' : [ 0x44, ['pointer', ['void']]], + 'ScoreRequirement' : [ 0x48, ['pointer', ['void']]], + 'TestAllocation' : [ 0x4c, ['pointer', ['void']]], + 'RetestAllocation' : [ 0x50, ['pointer', ['void']]], + 'CommitAllocation' : [ 0x54, ['pointer', ['void']]], + 'RollbackAllocation' : [ 0x58, ['pointer', ['void']]], + 'BootAllocation' : [ 0x5c, ['pointer', ['void']]], + 'QueryArbitrate' : [ 0x60, ['pointer', ['void']]], + 'QueryConflict' : [ 0x64, ['pointer', ['void']]], + 'AddReserved' : [ 0x68, ['pointer', ['void']]], + 'StartArbiter' : [ 0x6c, ['pointer', ['void']]], + 'PreprocessEntry' : [ 0x70, ['pointer', ['void']]], + 'AllocateEntry' : [ 0x74, ['pointer', ['void']]], + 'GetNextAllocationRange' : [ 0x78, ['pointer', ['void']]], + 'FindSuitableRange' : [ 0x7c, ['pointer', ['void']]], + 'AddAllocation' : [ 0x80, ['pointer', ['void']]], + 'BacktrackAllocation' : [ 0x84, ['pointer', ['void']]], + 'OverrideConflict' : [ 0x88, ['pointer', ['void']]], + 'InitializeRangeList' : [ 0x8c, ['pointer', ['void']]], + 'TransactionInProgress' : [ 0x90, ['unsigned char']], + 'TransactionEvent' : [ 0x94, ['pointer', ['_KEVENT']]], + 'Extension' : [ 0x98, ['pointer', ['void']]], + 'BusDeviceObject' : [ 0x9c, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0xa0, ['pointer', ['void']]], + 'ConflictCallback' : [ 0xa4, ['pointer', ['void']]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0xc, ['pointer', ['void']]], + 'DirectlyAccessClientToken' : [ 0x10, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x11, ['unsigned char']], + 'ServerIsRemote' : [ 0x12, ['unsigned char']], + 'ClientTokenControl' : [ 0x14, ['_TOKEN_CONTROL']], +} ], + '_VF_POOL_TRACE' : [ 0x40, { + 'Address' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0xc, ['array', 13, ['pointer', ['void']]]], +} ], + '_MI_SYSTEM_IMAGE_STATE' : [ 0x6c, { + 'FixupLock' : [ 0x0, ['long']], + 'FixupList' : [ 0x4, ['_LIST_ENTRY']], + 'LoadLock' : [ 0xc, ['_KMUTANT']], + 'FirstLoadEver' : [ 0x2c, ['unsigned char']], + 'LargePageAll' : [ 0x2d, ['unsigned char']], + 'LastPage' : [ 0x30, ['unsigned long']], + 'LargePageList' : [ 0x34, ['_LIST_ENTRY']], + 'StrongCodeLoadFailureList' : [ 0x3c, ['_LIST_ENTRY']], + 'BeingDeleted' : [ 0x44, ['pointer', ['_KLDR_DATA_TABLE_ENTRY']]], + 'MappingRangesPushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'MappingRanges' : [ 0x4c, ['array', 2, ['pointer', ['_MI_DRIVER_VA']]]], + 'PageCount' : [ 0x54, ['unsigned long']], + 'PageCounts' : [ 0x58, ['_MM_SYSTEM_PAGE_COUNTS']], + 'CollidedLock' : [ 0x68, ['_EX_PUSH_LOCK']], +} ], + '_MMPFNENTRY1' : [ 0x1, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_FAULT_TRACE' : [ 0x24, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 8, ['pointer', ['void']]]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x44, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x18, ['pointer', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x1c, ['pointer', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x20, ['pointer', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'Lock' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x2c, ['unsigned long']], + 'ProfileChangingEject' : [ 0x30, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x31, ['unsigned char']], + 'LightestSleepState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x38, ['pointer', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x3c, ['unsigned char']], + 'DeleteType' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_DEFERRED_WRITE' : [ 0x24, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x8, ['unsigned long']], + 'DeferredWriteLinks' : [ 0xc, ['_LIST_ENTRY']], + 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], + 'PostRoutine' : [ 0x18, ['pointer', ['void']]], + 'Context1' : [ 0x1c, ['pointer', ['void']]], + 'Context2' : [ 0x20, ['pointer', ['void']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x18, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x4, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0xc, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x28, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x8, ['unsigned long']], + 'SyncCallback' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ZeroMapRegisters' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x10, ['pointer', ['void']]], + 'DeviceContext' : [ 0x14, ['pointer', ['void']]], + 'NumberOfMapRegisters' : [ 0x18, ['unsigned long']], + 'DeviceObject' : [ 0x1c, ['pointer', ['void']]], + 'CurrentIrp' : [ 0x20, ['pointer', ['void']]], + 'BufferChainingDpc' : [ 0x24, ['pointer', ['_KDPC']]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'HiberFileType' : [ 0x16, ['unsigned char']], + 'AoAcConnectivitySupported' : [ 0x17, ['unsigned char']], + 'spare3' : [ 0x18, ['array', 6, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_EX_WORK_QUEUE' : [ 0x1b8, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x19c, ['pointer', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x1a0, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x1a4, ['unsigned long']], + 'ThreadCount' : [ 0x1a8, ['long']], + 'MinThreads' : [ 0x1ac, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x1ac, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x1b0, ['long']], + 'QueueIndex' : [ 0x1b4, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'IoPoolUntrusted', 2: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_KWAIT_CHAIN' : [ 0x4, { + 'Head' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'ActiveCount' : [ 0x8, ['unsigned long']], + 'PendingNullCount' : [ 0xc, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x10, ['unsigned long']], + 'PendingDelete' : [ 0x14, ['unsigned long']], + 'FreeListHead' : [ 0x18, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x1c, ['pointer', ['void']]], + 'CompletionKey' : [ 0x20, ['pointer', ['void']]], + 'Entry' : [ 0x24, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_VF_DRIVER_IO_CALLBACKS' : [ 0x80, { + 'DriverInit' : [ 0x0, ['pointer', ['void']]], + 'DriverStartIo' : [ 0x4, ['pointer', ['void']]], + 'DriverUnload' : [ 0x8, ['pointer', ['void']]], + 'AddDevice' : [ 0xc, ['pointer', ['void']]], + 'MajorFunction' : [ 0x10, ['array', 28, ['pointer', ['void']]]], +} ], + '_CM_UOW_SET_VALUE_KEY_DATA' : [ 0x10, { + 'PreparedCell' : [ 0x0, ['unsigned long']], + 'OldValueCell' : [ 0x4, ['unsigned long']], + 'NameLength' : [ 0x8, ['unsigned short']], + 'DataSize' : [ 0xc, ['unsigned long']], +} ], + '_MI_PARTITION_STATE' : [ 0x38, { + 'PartitionLock' : [ 0x0, ['unsigned long']], + 'PartitionIdLock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'InitialPartitionIdBits' : [ 0x8, ['unsigned long long']], + 'PartitionList' : [ 0x10, ['_LIST_ENTRY']], + 'PartitionIdBitmap' : [ 0x18, ['pointer', ['_RTL_BITMAP']]], + 'InitialPartitionIdBitmap' : [ 0x1c, ['_RTL_BITMAP']], + 'TempPartitionPointers' : [ 0x24, ['array', 1, ['pointer', ['_MI_PARTITION']]]], + 'Partition' : [ 0x28, ['pointer', ['pointer', ['_MI_PARTITION']]]], + 'TotalPagesInChildPartitions' : [ 0x2c, ['unsigned long']], + 'CrossPartitionDenials' : [ 0x30, ['unsigned long']], +} ], + '_POP_THERMAL_ZONE' : [ 0x2d0, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Notification' : [ 0xc, ['pointer', ['void']]], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'Device' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x1c, ['pointer', ['_IRP']]], + 'State' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], + 'Removing' : [ 0x22, ['unsigned char']], + 'Mode' : [ 0x23, ['unsigned char']], + 'PendingMode' : [ 0x24, ['unsigned char']], + 'ActivePoint' : [ 0x25, ['unsigned char']], + 'PendingActivePoint' : [ 0x26, ['unsigned char']], + 'Critical' : [ 0x27, ['unsigned char']], + 'ThermalStandby' : [ 0x28, ['unsigned char']], + 'OverThrottled' : [ 0x29, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x2c, ['long']], + 'Throttle' : [ 0x30, ['long']], + 'PendingThrottle' : [ 0x34, ['long']], + 'ThrottleReasons' : [ 0x38, ['unsigned long']], + 'LastTime' : [ 0x40, ['unsigned long long']], + 'SampleRate' : [ 0x48, ['unsigned long']], + 'LastTemp' : [ 0x4c, ['unsigned long']], + 'PassiveTimer' : [ 0x50, ['_KTIMER']], + 'PassiveDpc' : [ 0x78, ['_KDPC']], + 'Info' : [ 0x98, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0xf0, ['_LARGE_INTEGER']], + 'Policy' : [ 0xf8, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x110, ['unsigned char']], + 'LastActiveStartTime' : [ 0x118, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x120, ['unsigned long long']], + 'WorkItem' : [ 0x128, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x138, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x140, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x150, ['_KEVENT']], + 'InstanceId' : [ 0x160, ['unsigned long']], + 'TelemetryTracker' : [ 0x168, ['_POP_THERMAL_TELEMETRY_TRACKER']], + 'Description' : [ 0x2c8, ['_UNICODE_STRING']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_TRIAGE_PNP_DEVICE_COMPLETION_REQUEST' : [ 0xc, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x8, ['pointer', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_BUS_EXTENSION_LIST' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['void']]], + 'BusExtension' : [ 0x4, ['pointer', ['_PI_BUS_EXTENSION']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_MMPFNENTRY3' : [ 0x1, { + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SystemChargedPage' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x10, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'SidCount' : [ 0x8, ['unsigned long']], + 'SidValuesStart' : [ 0xc, ['unsigned long']], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x4, { + 'Function' : [ 0x0, ['pointer', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_224d' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_224f' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_224d']], + 'Private' : [ 0x0, ['__unnamed_224f']], +} ], + '_CM_TRANS_PTR' : [ 0x4, { + 'LightWeight' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'TransPtr' : [ 0x0, ['pointer', ['void']]], +} ], + '_PS_TRUSTLET_ATTRIBUTE_TYPE' : [ 0x4, { + 'Version' : [ 0x0, ['unsigned char']], + 'DataCount' : [ 0x1, ['unsigned char']], + 'SemanticType' : [ 0x2, ['unsigned char']], + 'AccessRights' : [ 0x3, ['_PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS']], + 'AttributeType' : [ 0x0, ['unsigned long']], +} ], + '_CM_KEY_HASH' : [ 0x10, { + 'ConvKey' : [ 0x0, ['_CM_PATH_HASH']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0xc, ['unsigned long']], +} ], + '_FAST_IO_DISPATCH' : [ 0x70, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x4, ['pointer', ['void']]], + 'FastIoRead' : [ 0x8, ['pointer', ['void']]], + 'FastIoWrite' : [ 0xc, ['pointer', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x10, ['pointer', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x14, ['pointer', ['void']]], + 'FastIoLock' : [ 0x18, ['pointer', ['void']]], + 'FastIoUnlockSingle' : [ 0x1c, ['pointer', ['void']]], + 'FastIoUnlockAll' : [ 0x20, ['pointer', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x24, ['pointer', ['void']]], + 'FastIoDeviceControl' : [ 0x28, ['pointer', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x2c, ['pointer', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x30, ['pointer', ['void']]], + 'FastIoDetachDevice' : [ 0x34, ['pointer', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x38, ['pointer', ['void']]], + 'AcquireForModWrite' : [ 0x3c, ['pointer', ['void']]], + 'MdlRead' : [ 0x40, ['pointer', ['void']]], + 'MdlReadComplete' : [ 0x44, ['pointer', ['void']]], + 'PrepareMdlWrite' : [ 0x48, ['pointer', ['void']]], + 'MdlWriteComplete' : [ 0x4c, ['pointer', ['void']]], + 'FastIoReadCompressed' : [ 0x50, ['pointer', ['void']]], + 'FastIoWriteCompressed' : [ 0x54, ['pointer', ['void']]], + 'MdlReadCompleteCompressed' : [ 0x58, ['pointer', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0x5c, ['pointer', ['void']]], + 'FastIoQueryOpen' : [ 0x60, ['pointer', ['void']]], + 'ReleaseForModWrite' : [ 0x64, ['pointer', ['void']]], + 'AcquireForCcFlush' : [ 0x68, ['pointer', ['void']]], + 'ReleaseForCcFlush' : [ 0x6c, ['pointer', ['void']]], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_KGATE' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_PS_IO_CONTROL_ENTRY' : [ 0x1c, { + 'VolumeTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ReservedForParentValue' : [ 0x8, ['unsigned long']], + 'VolumeKey' : [ 0xc, ['unsigned long']], + 'Rundown' : [ 0x10, ['_EX_RUNDOWN_REF']], + 'IoControl' : [ 0x14, ['pointer', ['void']]], + 'VolumeIoAttribution' : [ 0x18, ['pointer', ['void']]], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_CM_UOW_SET_VALUE_LIST_DATA' : [ 0xc, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x4, ['_CHILD_LIST']], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x8, { + 'Port' : [ 0x0, ['pointer', ['void']]], + 'Key' : [ 0x4, ['pointer', ['void']]], +} ], + '_VF_TRACKER_STAMP' : [ 0x8, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x4, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x4, ['unsigned long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'PagesAllocated' : [ 0x44, ['unsigned long']], + 'BigPagesAllocated' : [ 0x48, ['unsigned long']], + 'BytesAllocated' : [ 0x4c, ['unsigned long']], + 'RunningDeallocs' : [ 0x80, ['long']], + 'PagesDeallocated' : [ 0x84, ['unsigned long']], + 'BigPagesDeallocated' : [ 0x88, ['unsigned long']], + 'BytesDeallocated' : [ 0x8c, ['unsigned long']], + 'PoolIndex' : [ 0xc0, ['unsigned long']], + 'PoolTypeCopy' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'ThreadsProcessingDeferrals' : [ 0x104, ['long']], + 'PendingFreeDepth' : [ 0x108, ['long']], + 'ListHeads' : [ 0x140, ['array', 512, ['_LIST_ENTRY']]], +} ], + '_IMAGE_OPTIONAL_HEADER' : [ 0xe0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'ImageBase' : [ 0x1c, ['unsigned long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long']], + 'SizeOfStackCommit' : [ 0x4c, ['unsigned long']], + 'SizeOfHeapReserve' : [ 0x50, ['unsigned long']], + 'SizeOfHeapCommit' : [ 0x54, ['unsigned long']], + 'LoaderFlags' : [ 0x58, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x5c, ['unsigned long']], + 'DataDirectory' : [ 0x60, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x4, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x8, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x14, ['unsigned long']], + 'PagingCount' : [ 0x18, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x1c, ['unsigned char']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '__unnamed_22c1' : [ 0x4, { + 'PercentLevel' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_22c3' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x10, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0xc, ['__unnamed_22c1']], + 'Button' : [ 0xc, ['__unnamed_22c3']], +} ], + '_RTL_ATOM_TABLE' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0xc, ['pointer', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'NumberOfBuckets' : [ 0x14, ['unsigned long']], + 'Buckets' : [ 0x18, ['array', 1, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_KTIMER2' : [ 0x58, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'RbNodes' : [ 0x10, ['array', 2, ['_RTL_BALANCED_NODE']]], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'DueTime' : [ 0x28, ['array', 2, ['unsigned long long']]], + 'Period' : [ 0x38, ['long long']], + 'Callback' : [ 0x40, ['pointer', ['void']]], + 'CallbackContext' : [ 0x44, ['pointer', ['void']]], + 'DisableCallback' : [ 0x48, ['pointer', ['void']]], + 'DisableContext' : [ 0x4c, ['pointer', ['void']]], + 'AbsoluteSystemTime' : [ 0x50, ['unsigned char']], + 'TypeFlags' : [ 0x51, ['unsigned char']], + 'Unused' : [ 0x51, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IdleResilient' : [ 0x51, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HighResolution' : [ 0x51, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'NoWake' : [ 0x51, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Unused1' : [ 0x51, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CollectionIndex' : [ 0x52, ['array', 2, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x4, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0xc, ['unsigned long']], +} ], + '_MI_SESSION_STATE' : [ 0x1044, { + 'SystemSession' : [ 0x0, ['_MMSESSION']], + 'CodePageEdited' : [ 0x14, ['unsigned char']], + 'DynamicPoolBitBuffer' : [ 0x18, ['pointer', ['unsigned long']]], + 'VaReferenceCount' : [ 0x1c, ['array', 1024, ['long']]], + 'DynamicPtesBitBuffer' : [ 0x101c, ['pointer', ['unsigned long']]], + 'IdLock' : [ 0x1020, ['_EX_PUSH_LOCK']], + 'DetachTimeStamp' : [ 0x1024, ['unsigned long']], + 'LeaderProcess' : [ 0x1028, ['pointer', ['_EPROCESS']]], + 'InitializeLock' : [ 0x102c, ['_EX_PUSH_LOCK']], + 'WorkingSetList' : [ 0x1030, ['pointer', ['_MMWSL_FULL']]], + 'WsHashStart' : [ 0x1034, ['pointer', ['_MMWSLE_HASH']]], + 'WsHashEnd' : [ 0x1038, ['pointer', ['_MMWSLE_HASH']]], + 'SessionBase' : [ 0x103c, ['pointer', ['void']]], + 'SessionCore' : [ 0x1040, ['pointer', ['void']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x330, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'ControlFlags' : [ 0x14, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CompactionEnabled' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], + 'EnabledSupervisorFeatures' : [ 0x218, ['unsigned long long']], + 'AlignedFeatures' : [ 0x220, ['unsigned long long']], + 'AllFeatureSize' : [ 0x228, ['unsigned long']], + 'AllFeatures' : [ 0x22c, ['array', 64, ['unsigned long']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], + 'AccessMask' : [ 0x18, ['unsigned long']], +} ], + '_MI_SECTION_STATE' : [ 0x140, { + 'SectionObjectPointersLock' : [ 0x0, ['long']], + 'SectionExtendLock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'SectionExtendSetLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'SectionBasedRoot' : [ 0xc, ['_RTL_AVL_TREE']], + 'SectionBasedLock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'UnusedSubsectionPagedPool' : [ 0x14, ['unsigned long']], + 'UnusedSegmentForceFree' : [ 0x18, ['unsigned long']], + 'DataSectionProtectionMask' : [ 0x1c, ['unsigned long']], + 'HighSectionBase' : [ 0x20, ['pointer', ['void']]], + 'PhysicalSubsection' : [ 0x24, ['_MSUBSECTION']], + 'PhysicalControlArea' : [ 0x68, ['_CONTROL_AREA']], + 'DanglingExtentsPages' : [ 0xb8, ['pointer', ['_MMPFN']]], + 'DanglingExtentsLock' : [ 0xbc, ['long']], + 'DanglingExtentsWorkItem' : [ 0xc0, ['_WORK_QUEUE_ITEM']], + 'DanglingExtentsWorkerActive' : [ 0xd0, ['unsigned char']], + 'PageFileSectionHead' : [ 0xd4, ['_RTL_AVL_TREE']], + 'PageFileSectionListSpinLock' : [ 0xd8, ['long']], + 'ImageBias' : [ 0xdc, ['unsigned long']], + 'RelocateBitmapsLock' : [ 0xe0, ['_EX_PUSH_LOCK']], + 'ImageBitMap' : [ 0xe4, ['_RTL_BITMAP']], + 'ApiSetSection' : [ 0xec, ['pointer', ['void']]], + 'ApiSetSchema' : [ 0xf0, ['pointer', ['void']]], + 'ApiSetSchemaSize' : [ 0xf4, ['unsigned long']], + 'LostDataFiles' : [ 0xf8, ['unsigned long']], + 'LostDataPages' : [ 0xfc, ['unsigned long']], + 'ImageFailureReason' : [ 0x100, ['unsigned long']], + 'CfgBitMapSection32' : [ 0x104, ['pointer', ['_SECTION']]], + 'CfgBitMapControlArea32' : [ 0x108, ['pointer', ['_CONTROL_AREA']]], + 'ImageCfgFailure' : [ 0x10c, ['unsigned long']], + 'ImageValidationFailed' : [ 0x110, ['long']], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x1c, { + 'HashLink' : [ 0x0, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x4, ['unsigned short']], + 'Atom' : [ 0x6, ['unsigned short']], + 'Reference' : [ 0x8, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x18, ['unsigned char']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_UOW_KEY_STATE_MODIFICATION' : [ 0x14, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'SubKeyListCount' : [ 0x4, ['array', 2, ['unsigned long']]], + 'NewSubKeyList' : [ 0xc, ['array', 2, ['unsigned long']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x4, ['unsigned long']], + 'WaitResponse' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0xc, ['_KGATE']], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x18, { + 'DebugInfo' : [ 0x0, ['pointer', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x4, ['long']], + 'RecursionCount' : [ 0x8, ['long']], + 'OwningThread' : [ 0xc, ['pointer', ['void']]], + 'LockSemaphore' : [ 0x10, ['pointer', ['void']]], + 'SpinCount' : [ 0x14, ['unsigned long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x38, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x8, ['unsigned char']], + 'ArbiterInterface' : [ 0xc, ['pointer', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x10, ['pointer', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x1c, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x24, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x2c, ['_LIST_ENTRY']], + 'State' : [ 0x34, ['unsigned char']], + 'ResourcesChanged' : [ 0x35, ['unsigned char']], +} ], + '_ETW_FILTER_HEADER' : [ 0x28, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x4, ['pointer', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x8, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0xc, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x10, ['pointer', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x14, ['pointer', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x18, ['pointer', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x1c, ['pointer', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x20, ['pointer', ['_EVENT_FILTER_HEADER']]], + 'EventNameFilter' : [ 0x24, ['pointer', ['_ETW_FILTER_EVENT_NAME_DATA']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0x94, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long']], + 'NonPagedBytes' : [ 0x54, ['unsigned long']], + 'PeakPagedBytes' : [ 0x58, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x5c, ['unsigned long']], + 'BurstAllocationsFailedDeliberately' : [ 0x60, ['unsigned long']], + 'SessionTrims' : [ 0x64, ['unsigned long']], + 'OptionChanges' : [ 0x68, ['unsigned long']], + 'VerifyMode' : [ 0x6c, ['unsigned long']], + 'PreviousBucketName' : [ 0x70, ['_UNICODE_STRING']], + 'ExecutePoolTypes' : [ 0x78, ['unsigned long']], + 'ExecutePageProtections' : [ 0x7c, ['unsigned long']], + 'ExecutePageMappings' : [ 0x80, ['unsigned long']], + 'ExecuteWriteSections' : [ 0x84, ['unsigned long']], + 'SectionAlignmentFailures' : [ 0x88, ['unsigned long']], + 'UnsupportedRelocs' : [ 0x8c, ['unsigned long']], + 'IATInExecutableSection' : [ 0x90, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PEB' : [ 0x460, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'IsLongPathAwareProcess' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['pointer', ['void']]], + 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], + 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x10, ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x14, ['pointer', ['void']]], + 'ProcessHeap' : [ 0x18, ['pointer', ['void']]], + 'FastPebLock' : [ 0x1c, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['_SLIST_HEADER']]], + 'IFEOKey' : [ 0x24, ['pointer', ['void']]], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], + 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['pointer', ['_SLIST_HEADER']]], + 'ApiSetMap' : [ 0x38, ['pointer', ['void']]], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['pointer', ['void']]], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['pointer', ['void']]], + 'SparePvoid0' : [ 0x50, ['pointer', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x54, ['pointer', ['pointer', ['void']]]], + 'AnsiCodePageData' : [ 0x58, ['pointer', ['void']]], + 'OemCodePageData' : [ 0x5c, ['pointer', ['void']]], + 'UnicodeCaseTableData' : [ 0x60, ['pointer', ['void']]], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['pointer', ['pointer', ['void']]]], + 'GdiSharedHandleTable' : [ 0x94, ['pointer', ['void']]], + 'ProcessStarterHelper' : [ 0x98, ['pointer', ['void']]], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['pointer', ['void']]], + 'TlsExpansionBitmap' : [ 0x150, ['pointer', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['pointer', ['void']]], + 'AppCompatInfo' : [ 0x1ec, ['pointer', ['void']]], + 'CSDVersion' : [ 0x1f0, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x1f8, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x200, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x204, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['pointer', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x210, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x218, ['pointer', ['void']]], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['pointer', ['void']]], + 'WerShipAssertPtr' : [ 0x234, ['pointer', ['void']]], + 'pUnused' : [ 0x238, ['pointer', ['void']]], + 'pImageHeaderHash' : [ 0x23c, ['pointer', ['void']]], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], + 'TppWorkerpListLock' : [ 0x250, ['unsigned long']], + 'TppWorkerpList' : [ 0x254, ['_LIST_ENTRY']], + 'WaitOnAddressHashTable' : [ 0x25c, ['array', 128, ['pointer', ['void']]]], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x8, ['unsigned long']], + 'Unloads' : [ 0xc, ['unsigned long']], + 'BaseName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x10, { + 'IssueType' : [ 0x0, ['unsigned long']], + 'Address' : [ 0x4, ['pointer', ['void']]], + 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], +} ], + '_KDEVICE_QUEUE' : [ 0x14, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x4, ['_LIST_ENTRY']], + 'Lock' : [ 0xc, ['unsigned long']], + 'Busy' : [ 0x10, ['unsigned char']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x24, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x28, ['unsigned long']], + 'Alternatives' : [ 0x2c, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x30, ['unsigned short']], + 'RangeAttributes' : [ 0x32, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x33, ['unsigned char']], + 'WorkSpace' : [ 0x34, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x8, { + 'BasePage' : [ 0x0, ['unsigned long']], + 'PageCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_233f' : [ 0x4, { + 'BaseMid' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHi' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_2344' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2346' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_233f']], + 'Bits' : [ 0x0, ['__unnamed_2344']], +} ], + '_KGDTENTRY' : [ 0x8, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'HighWord' : [ 0x4, ['__unnamed_2346']], +} ], + '_MI_SUB64K_FREE_RANGES' : [ 0x1c, { + 'BitMap' : [ 0x0, ['_RTL_BITMAP']], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'Vad' : [ 0x10, ['pointer', ['_MMVAD_SHORT']]], + 'SubListIndex' : [ 0x14, ['unsigned short']], + 'Hint' : [ 0x16, ['unsigned short']], + 'SetBits' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_SEP_SILOSTATE' : [ 0x10, { + 'SystemLogonSession' : [ 0x0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'AnonymousLogonSession' : [ 0x4, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'AnonymousLogonToken' : [ 0x8, ['pointer', ['void']]], + 'AnonymousLogonTokenNoEveryone' : [ 0xc, ['pointer', ['void']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x1c, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'PackageSid' : [ 0x10, ['pointer', ['void']]], + 'HandleCount' : [ 0x14, ['unsigned long']], + 'Handles' : [ 0x18, ['pointer', ['pointer', ['void']]]], +} ], + '__unnamed_2352' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2355' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0xf8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Event' : [ 0x10, ['_KEVENT']], + 'CollidedEvent' : [ 0x20, ['_KEVENT']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ApcState' : [ 0x40, ['_KAPC_STATE']], + 'Thread' : [ 0x58, ['pointer', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0x5c, ['pointer', ['_MMPFN']]], + 'PteContents' : [ 0x60, ['_MMPTE']], + 'WaitCount' : [ 0x68, ['long']], + 'ByteCount' : [ 0x6c, ['unsigned long']], + 'u3' : [ 0x70, ['__unnamed_2352']], + 'u1' : [ 0x74, ['__unnamed_2355']], + 'FilePointer' : [ 0x78, ['pointer', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x7c, ['pointer', ['_CONTROL_AREA']]], + 'Subsection' : [ 0x7c, ['pointer', ['_SUBSECTION']]], + 'Autoboost' : [ 0x80, ['pointer', ['void']]], + 'FaultingAddress' : [ 0x84, ['pointer', ['void']]], + 'PointerPte' : [ 0x88, ['pointer', ['_MMPTE']]], + 'BasePte' : [ 0x8c, ['pointer', ['_MMPTE']]], + 'Pfn' : [ 0x90, ['pointer', ['_MMPFN']]], + 'PrefetchMdl' : [ 0x94, ['pointer', ['_MDL']]], + 'Mdl' : [ 0x98, ['_MDL']], + 'Page' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'FlowThrough' : [ 0xb4, ['_MMINPAGE_SUPPORT_FLOW_THROUGH']], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_CMP_DISCARD_AND_REPLACE_KCB_CONTEXT' : [ 0x10, { + 'BaseKcb' : [ 0x0, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'PrepareStatus' : [ 0x4, ['long']], + 'ClonedKcbListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions', 24: 'ConfigureDeviceReset'})]], + 'ReorderingBarrier' : [ 0x10, ['unsigned char']], + 'RequestArgument' : [ 0x14, ['unsigned long']], + 'CompletionEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'CompletionStatus' : [ 0x1c, ['pointer', ['long']]], + 'ActivityId' : [ 0x20, ['_GUID']], +} ], + '_PPM_PLATFORM_STATE' : [ 0xc0, { + 'Latency' : [ 0x0, ['unsigned long']], + 'BreakEvenDuration' : [ 0x4, ['unsigned long']], + 'VetoAccounting' : [ 0x8, ['_PPM_VETO_ACCOUNTING']], + 'TransitionDebugger' : [ 0x20, ['unsigned char']], + 'Platform' : [ 0x21, ['unsigned char']], + 'DependencyListCount' : [ 0x24, ['unsigned long']], + 'Processors' : [ 0x28, ['_KAFFINITY_EX']], + 'Name' : [ 0x34, ['_UNICODE_STRING']], + 'DependencyLists' : [ 0x3c, ['pointer', ['_PPM_SELECTION_DEPENDENCY']]], + 'Synchronization' : [ 0x40, ['_PPM_COORDINATED_SYNCHRONIZATION']], + 'EnterTime' : [ 0x48, ['unsigned long long']], + 'RefCount' : [ 0x80, ['long']], + 'CacheAlign0' : [ 0x80, ['array', 64, ['unsigned char']]], +} ], + '_PEB_LDR_DATA' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer', ['void']]], + 'InLoadOrderModuleList' : [ 0xc, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x14, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x1c, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x24, ['pointer', ['void']]], + 'ShutdownInProgress' : [ 0x28, ['unsigned char']], + 'ShutdownThreadId' : [ 0x2c, ['pointer', ['void']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x1c, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0xc, ['long']], + 'PackageSid' : [ 0x10, ['pointer', ['void']]], + 'LowboxNumber' : [ 0x14, ['unsigned long']], + 'AtomTable' : [ 0x18, ['pointer', ['void']]], +} ], + '_PPM_SELECTION_MENU' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'Entries' : [ 0x4, ['pointer', ['_PPM_SELECTION_MENU_ENTRY']]], +} ], + '_MI_PARTITION' : [ 0x1a00, { + 'Core' : [ 0x0, ['_MI_PARTITION_CORE']], + 'Modwriter' : [ 0xc0, ['_MI_PARTITION_MODWRITES']], + 'Store' : [ 0x290, ['_MI_PARTITION_STORES']], + 'Segments' : [ 0x300, ['_MI_PARTITION_SEGMENTS']], + 'PageLists' : [ 0x400, ['_MI_PARTITION_PAGE_LISTS']], + 'Commit' : [ 0xb80, ['_MI_PARTITION_COMMIT']], + 'Zeroing' : [ 0xc00, ['_MI_PARTITION_ZEROING']], + 'PageCombine' : [ 0xc40, ['_MI_PAGE_COMBINING_SUPPORT']], + 'WorkingSetControl' : [ 0xd18, ['pointer', ['void']]], + 'WorkingSetExpansionHead' : [ 0xd1c, ['_MMWORKING_SET_EXPANSION_HEAD']], + 'Vp' : [ 0xd40, ['_MI_VISIBLE_PARTITION']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_MMPTE_HIGHLOW' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_KINTERRUPT' : [ 0xb0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0xc, ['pointer', ['void']]], + 'MessageServiceRoutine' : [ 0x10, ['pointer', ['void']]], + 'MessageIndex' : [ 0x14, ['unsigned long']], + 'ServiceContext' : [ 0x18, ['pointer', ['void']]], + 'SpinLock' : [ 0x1c, ['unsigned long']], + 'TickCount' : [ 0x20, ['unsigned long']], + 'ActualLock' : [ 0x24, ['pointer', ['unsigned long']]], + 'DispatchAddress' : [ 0x28, ['pointer', ['void']]], + 'Vector' : [ 0x2c, ['unsigned long']], + 'Irql' : [ 0x30, ['unsigned char']], + 'SynchronizeIrql' : [ 0x31, ['unsigned char']], + 'FloatingSave' : [ 0x32, ['unsigned char']], + 'Connected' : [ 0x33, ['unsigned char']], + 'Number' : [ 0x34, ['unsigned long']], + 'ShareVector' : [ 0x38, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x39, ['unsigned char']], + 'ActiveCount' : [ 0x3a, ['unsigned short']], + 'InternalState' : [ 0x3c, ['long']], + 'Mode' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x48, ['unsigned long']], + 'DispatchCount' : [ 0x4c, ['unsigned long']], + 'PassiveEvent' : [ 0x50, ['pointer', ['_KEVENT']]], + 'DisconnectData' : [ 0x54, ['pointer', ['void']]], + 'ServiceThread' : [ 0x58, ['pointer', ['_KTHREAD']]], + 'ConnectionData' : [ 0x5c, ['pointer', ['_INTERRUPT_CONNECTION_DATA']]], + 'IntTrackEntry' : [ 0x60, ['pointer', ['void']]], + 'IsrDpcStats' : [ 0x68, ['_ISRDPCSTATS']], + 'RedirectObject' : [ 0xa8, ['pointer', ['void']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_IO_WORKITEM' : [ 0x34, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x10, ['pointer', ['void']]], + 'IoObject' : [ 0x14, ['pointer', ['void']]], + 'Context' : [ 0x18, ['pointer', ['void']]], + 'WorkOnBehalfThread' : [ 0x1c, ['pointer', ['_ETHREAD']]], + 'Type' : [ 0x20, ['unsigned long']], + 'ActivityId' : [ 0x24, ['_GUID']], +} ], + '_DISALLOWED_GUIDS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x4, ['pointer', ['_GUID']]], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_PI_BUS_EXTENSION' : [ 0x44, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer', ['unsigned char']]], + 'DataPortMapped' : [ 0xc, ['unsigned char']], + 'AddressPort' : [ 0x10, ['pointer', ['unsigned char']]], + 'AddrPortMapped' : [ 0x14, ['unsigned char']], + 'CommandPort' : [ 0x18, ['pointer', ['unsigned char']]], + 'CmdPortMapped' : [ 0x1c, ['unsigned char']], + 'NextSlotNumber' : [ 0x20, ['unsigned long']], + 'DeviceList' : [ 0x24, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x28, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x2c, ['pointer', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x30, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x34, ['pointer', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x38, ['unsigned long']], + 'SystemPowerState' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_CMHIVE' : [ 0xf20, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0x6f0, ['array', 6, ['pointer', ['void']]]], + 'NotifyList' : [ 0x708, ['_LIST_ENTRY']], + 'HiveList' : [ 0x710, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0x718, ['_LIST_ENTRY']], + 'FailedUnloadList' : [ 0x720, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0x728, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0x72c, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0x734, ['pointer', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0x738, ['unsigned long']], + 'DeletedKcbTable' : [ 0x73c, ['pointer', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0x740, ['unsigned long']], + 'Identity' : [ 0x744, ['unsigned long']], + 'HiveLock' : [ 0x748, ['pointer', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0x74c, ['pointer', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0x750, ['pointer', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0x754, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0x75c, ['unsigned long']], + 'FlushLogEntry' : [ 0x760, ['pointer', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0x764, ['unsigned long']], + 'FlushHiveTruncated' : [ 0x768, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0x76c, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0x770, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0x778, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0x77c, ['pointer', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0x780, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0x784, ['pointer', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0x788, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0x78c, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0x790, ['unsigned long']], + 'ActualFileSize' : [ 0x798, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0x7a0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0x7b0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0x7b8, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0x7c0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0x7c8, ['unsigned long']], + 'SecurityCacheSize' : [ 0x7cc, ['unsigned long']], + 'SecurityHitHint' : [ 0x7d0, ['long']], + 'SecurityCache' : [ 0x7d4, ['pointer', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0x7d8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0x9d8, ['unsigned long']], + 'UnloadEventArray' : [ 0x9dc, ['pointer', ['pointer', ['_KEVENT']]]], + 'RootKcb' : [ 0x9e0, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x9e4, ['unsigned char']], + 'UnloadWorkItem' : [ 0x9e8, ['pointer', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x9ec, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0xa00, ['unsigned char']], + 'GrowOffset' : [ 0xa04, ['unsigned long']], + 'KcbConvertListHead' : [ 0xa08, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0xa10, ['pointer', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0xa14, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0xc9c, ['unsigned long']], + 'TrustClassEntry' : [ 0xca0, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0xca8, ['unsigned long long']], + 'UnreconciledTime' : [ 0xcb0, ['unsigned long long']], + 'CmRm' : [ 0xcb8, ['pointer', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0xcbc, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0xcc0, ['long']], + 'CreatorOwner' : [ 0xcc4, ['pointer', ['_KTHREAD']]], + 'RundownThread' : [ 0xcc8, ['pointer', ['_KTHREAD']]], + 'LastWriteTime' : [ 0xcd0, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0xcd8, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0xce4, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0xcf0, ['unsigned long']], + 'FlushActive' : [ 0xcf0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0xcf0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0xcf0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0xcf0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0xcf4, ['unsigned long']], + 'ReferenceCount' : [ 0xcf8, ['long']], + 'UnloadHistoryIndex' : [ 0xcfc, ['long']], + 'UnloadHistory' : [ 0xd00, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0xf00, ['unsigned long']], + 'UnaccessedStart' : [ 0xf04, ['unsigned long']], + 'UnaccessedEnd' : [ 0xf08, ['unsigned long']], + 'LoadedKeyCount' : [ 0xf0c, ['unsigned long']], + 'HandleClosePending' : [ 0xf10, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0xf14, ['_EX_PUSH_LOCK']], + 'FinalFlushSucceeded' : [ 0xf18, ['unsigned char']], + 'FailedUnload' : [ 0xf19, ['unsigned char']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_KAPC_STATE' : [ 0x18, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x10, ['pointer', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x14, ['unsigned char']], + 'KernelApcInProgress' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x15, ['unsigned char']], + 'UserApcPending' : [ 0x16, ['unsigned char']], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x10, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x8, ['unsigned long']], + 'Inserted' : [ 0xc, ['unsigned char']], +} ], + '_PEP_ACPI_RESOURCE_FLAGS' : [ 0x4, { + 'AsULong' : [ 0x0, ['unsigned long']], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Wake' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ResourceUsage' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SlaveMode' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'AddressingMode' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SharedMode' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0xc, { + 'DataSectionObject' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['void']]], + 'ImageSectionObject' : [ 0x8, ['pointer', ['void']]], +} ], + '_MI_PARTITION_PAGE_LISTS' : [ 0x780, { + 'FreePagesByColor' : [ 0x0, ['array', 2, ['pointer', ['_MMPFNLIST']]]], + 'FreePageSlist' : [ 0x8, ['array', 2, ['pointer', ['_SLIST_HEADER']]]], + 'ZeroedPageListHead' : [ 0x40, ['_MMPFNLIST']], + 'FreePageListHead' : [ 0x80, ['_MMPFNLIST']], + 'StandbyPageListHead' : [ 0xc0, ['_MMPFNLIST']], + 'StandbyPageListByPriority' : [ 0x100, ['array', 8, ['_MMPFNLIST']]], + 'ModifiedPageListNoReservation' : [ 0x1c0, ['_MMPFNLIST']], + 'ModifiedPageListByReservation' : [ 0x200, ['array', 16, ['_MMPFNLIST']]], + 'MappedPageListHead' : [ 0x340, ['array', 16, ['_MMPFNLIST']]], + 'BadPageListHead' : [ 0x480, ['_MMPFNLIST']], + 'EnclavePageListHead' : [ 0x4c0, ['_MMPFNLIST']], + 'PageLocationList' : [ 0x4d4, ['array', 8, ['pointer', ['_MMPFNLIST']]]], + 'StandbyRepurposedByPriority' : [ 0x4f4, ['array', 8, ['unsigned long']]], + 'MappedPageListHeadEvent' : [ 0x514, ['array', 16, ['_KEVENT']]], + 'DecayClusterTimerHeads' : [ 0x614, ['array', 4, ['_MI_DECAY_TIMER_LINK']]], + 'DecayHand' : [ 0x624, ['unsigned long']], + 'LastDecayHandUpdateTime' : [ 0x628, ['unsigned long long']], + 'LastChanceLdwContext' : [ 0x630, ['_MI_LDW_WORK_CONTEXT']], + 'AvailableEventsLock' : [ 0x680, ['unsigned long']], + 'AvailablePageWaitStates' : [ 0x684, ['array', 3, ['_MI_AVAILABLE_PAGE_WAIT_STATES']]], + 'LowMemoryThreshold' : [ 0x6c0, ['unsigned long']], + 'HighMemoryThreshold' : [ 0x6c4, ['unsigned long']], + 'TransitionPrivatePages' : [ 0x700, ['unsigned long']], + 'StandbyListDiscard' : [ 0x704, ['unsigned long']], + 'FreeListDiscard' : [ 0x708, ['unsigned char']], + 'MirrorListLocks' : [ 0x70c, ['pointer', ['void']]], + 'LargePfnBitMapsReady' : [ 0x710, ['unsigned char']], + 'LargePfnBitMap' : [ 0x714, ['array', 1, ['_RTL_BITMAP']]], + 'LargePfnBitMapLock' : [ 0x740, ['unsigned long']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '__unnamed_23fd' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_23ff' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_2401' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_23fd']], + 'Interrupt' : [ 0x0, ['__unnamed_23ff']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_23ff']], + 'Sci' : [ 0x0, ['__unnamed_23ff']], + 'Nmi' : [ 0x0, ['__unnamed_23ff']], + 'Sea' : [ 0x0, ['__unnamed_23ff']], + 'Sei' : [ 0x0, ['__unnamed_23ff']], + 'Gsiv' : [ 0x0, ['__unnamed_23ff']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_2401']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'ThermalStandbyTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], + 'MinimumThrottle' : [ 0x50, ['unsigned long']], + 'OverThrottleThreshold' : [ 0x54, ['unsigned long']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x4, { + 'LogHandleContext' : [ 0x0, ['pointer', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_KPRIQUEUE' : [ 0x19c, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x110, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x190, ['unsigned long']], + 'ThreadListHead' : [ 0x194, ['_LIST_ENTRY']], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'RealRefCount' : [ 0x14, ['unsigned long']], + 'Descriptor' : [ 0x18, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_KSCB' : [ 0x100, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'MinQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'MaxQuotaCycleTarget' : [ 0x10, ['unsigned long long']], + 'RankCycleTarget' : [ 0x18, ['unsigned long long']], + 'LongTermCycles' : [ 0x20, ['unsigned long long']], + 'LastReportedCycles' : [ 0x28, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x30, ['unsigned long long']], + 'ReadyTime' : [ 0x38, ['unsigned long long']], + 'InsertTime' : [ 0x40, ['unsigned long long']], + 'PerProcessorList' : [ 0x48, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x50, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'MaxOverQuota' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'MinOverQuota' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SoftCap' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ShareRankOwner' : [ 0x5c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x5c, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Depth' : [ 0x5d, ['unsigned char']], + 'ReadySummary' : [ 0x5e, ['unsigned short']], + 'Rank' : [ 0x60, ['unsigned long']], + 'ShareRank' : [ 0x64, ['pointer', ['unsigned long']]], + 'OwnerShareRank' : [ 0x68, ['unsigned long']], + 'ReadyListHead' : [ 0x6c, ['array', 16, ['_LIST_ENTRY']]], + 'ChildScbQueue' : [ 0xec, ['_RTL_RB_TREE']], + 'Parent' : [ 0xf4, ['pointer', ['_KSCB']]], + 'Root' : [ 0xf8, ['pointer', ['_KSCB']]], +} ], + '__unnamed_241e' : [ 0x2, { + 'SignatureLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'SignatureType' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned short')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'EntireField' : [ 0x0, ['unsigned short']], +} ], + '_KLDR_DATA_TABLE_ENTRY' : [ 0x5c, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'ExceptionTable' : [ 0x8, ['pointer', ['void']]], + 'ExceptionTableSize' : [ 0xc, ['unsigned long']], + 'GpValue' : [ 0x10, ['pointer', ['void']]], + 'NonPagedDebugInfo' : [ 0x14, ['pointer', ['_NON_PAGED_DEBUG_INFO']]], + 'DllBase' : [ 0x18, ['pointer', ['void']]], + 'EntryPoint' : [ 0x1c, ['pointer', ['void']]], + 'SizeOfImage' : [ 0x20, ['unsigned long']], + 'FullDllName' : [ 0x24, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x2c, ['_UNICODE_STRING']], + 'Flags' : [ 0x34, ['unsigned long']], + 'LoadCount' : [ 0x38, ['unsigned short']], + 'u1' : [ 0x3a, ['__unnamed_241e']], + 'SectionPointer' : [ 0x3c, ['pointer', ['void']]], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'CoverageSectionSize' : [ 0x44, ['unsigned long']], + 'CoverageSection' : [ 0x48, ['pointer', ['void']]], + 'LoadedImports' : [ 0x4c, ['pointer', ['void']]], + 'Spare' : [ 0x50, ['pointer', ['void']]], + 'SizeOfImageNotRounded' : [ 0x54, ['unsigned long']], + 'TimeDateStamp' : [ 0x58, ['unsigned long']], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_KTSS' : [ 0x20ac, { + 'Backlink' : [ 0x0, ['unsigned short']], + 'Reserved0' : [ 0x2, ['unsigned short']], + 'Esp0' : [ 0x4, ['unsigned long']], + 'Ss0' : [ 0x8, ['unsigned short']], + 'Reserved1' : [ 0xa, ['unsigned short']], + 'NotUsed1' : [ 0xc, ['array', 4, ['unsigned long']]], + 'CR3' : [ 0x1c, ['unsigned long']], + 'Eip' : [ 0x20, ['unsigned long']], + 'EFlags' : [ 0x24, ['unsigned long']], + 'Eax' : [ 0x28, ['unsigned long']], + 'Ecx' : [ 0x2c, ['unsigned long']], + 'Edx' : [ 0x30, ['unsigned long']], + 'Ebx' : [ 0x34, ['unsigned long']], + 'Esp' : [ 0x38, ['unsigned long']], + 'Ebp' : [ 0x3c, ['unsigned long']], + 'Esi' : [ 0x40, ['unsigned long']], + 'Edi' : [ 0x44, ['unsigned long']], + 'Es' : [ 0x48, ['unsigned short']], + 'Reserved2' : [ 0x4a, ['unsigned short']], + 'Cs' : [ 0x4c, ['unsigned short']], + 'Reserved3' : [ 0x4e, ['unsigned short']], + 'Ss' : [ 0x50, ['unsigned short']], + 'Reserved4' : [ 0x52, ['unsigned short']], + 'Ds' : [ 0x54, ['unsigned short']], + 'Reserved5' : [ 0x56, ['unsigned short']], + 'Fs' : [ 0x58, ['unsigned short']], + 'Reserved6' : [ 0x5a, ['unsigned short']], + 'Gs' : [ 0x5c, ['unsigned short']], + 'Reserved7' : [ 0x5e, ['unsigned short']], + 'LDT' : [ 0x60, ['unsigned short']], + 'Reserved8' : [ 0x62, ['unsigned short']], + 'Flags' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], + 'IoMaps' : [ 0x68, ['array', 1, ['_KiIoAccessMap']]], + 'IntDirectionMap' : [ 0x208c, ['array', 32, ['unsigned char']]], +} ], + '_MI_SYSTEM_TRIM_STATE' : [ 0x40, { + 'ExpansionLock' : [ 0x0, ['unsigned long']], + 'TrimInProgressCount' : [ 0x4, ['long']], + 'PeriodicWorkingSetEvent' : [ 0x8, ['_KEVENT']], + 'TrimAllPageFaultCount' : [ 0x18, ['array', 3, ['unsigned long']]], +} ], + '_KMUTANT' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x18, ['pointer', ['_KTHREAD']]], + 'Abandoned' : [ 0x1c, ['unsigned char']], + 'ApcDisable' : [ 0x1d, ['unsigned char']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x4, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_MM_SYSTEM_PAGE_COUNTS' : [ 0x10, { + 'SystemCodePage' : [ 0x0, ['unsigned long']], + 'SystemDriverPage' : [ 0x4, ['unsigned long']], + 'TotalSystemCodePages' : [ 0x8, ['long']], + 'TotalSystemDriverPages' : [ 0xc, ['long']], +} ], + '_KENLISTMENT' : [ 0x168, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x4, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x18, ['_GUID']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NextSameTx' : [ 0x48, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x50, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x58, ['pointer', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0x5c, ['pointer', ['_KTRANSACTION']]], + 'State' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0x64, ['unsigned long']], + 'NotificationMask' : [ 0x68, ['unsigned long']], + 'Key' : [ 0x6c, ['pointer', ['void']]], + 'KeyRefCount' : [ 0x70, ['unsigned long']], + 'RecoveryInformation' : [ 0x74, ['pointer', ['void']]], + 'RecoveryInformationLength' : [ 0x78, ['unsigned long']], + 'DynamicNameInformation' : [ 0x7c, ['pointer', ['void']]], + 'DynamicNameInformationLength' : [ 0x80, ['unsigned long']], + 'FinalNotification' : [ 0x84, ['pointer', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0x88, ['pointer', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0x8c, ['pointer', ['void']]], + 'SubordinateTxHandle' : [ 0x90, ['pointer', ['void']]], + 'CrmEnlistmentEnId' : [ 0x94, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0xa4, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0xb4, ['_GUID']], + 'NextHistory' : [ 0xc4, ['unsigned long']], + 'History' : [ 0xc8, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_THERMAL_POLICY' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ThermalStandby' : [ 0x7, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], + 'OverThrottled' : [ 0x14, ['unsigned char']], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_MI_ACCESS_LOG_STATE' : [ 0x80, { + 'CcAccessLog' : [ 0x0, ['pointer', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'Enabled' : [ 0x4, ['unsigned long']], + 'DisableAccessLogging' : [ 0x8, ['_WORK_QUEUE_ITEM']], + 'MinLoggingPriority' : [ 0x18, ['unsigned long']], + 'AccessLoggingLock' : [ 0x40, ['unsigned long']], +} ], + '_HMAP_TABLE' : [ 0x2800, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '__unnamed_2454' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2456' : [ 0x10, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_2454']], +} ], + '_VF_TARGET_DRIVER' : [ 0x20, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE_EX']], + 'u1' : [ 0xc, ['__unnamed_2456']], + 'VerifiedData' : [ 0x1c, ['pointer', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x10, { + 'SecurityQos' : [ 0x0, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x4, ['pointer', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x8, ['unsigned long']], + 'FullCreateOptions' : [ 0xc, ['unsigned long']], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x18, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x8, ['pointer', ['void']]], + 'SessionViewVa' : [ 0x8, ['pointer', ['void']]], + 'VadsProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'Type' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Subsection' : [ 0xc, ['pointer', ['_SUBSECTION']]], + 'SubsectionType' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SectionOffset' : [ 0x10, ['unsigned long long']], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0xc, { + 'ActiveThread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'WaitList' : [ 0x4, ['pointer', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x8, ['unsigned long']], +} ], + '_MI_SYSTEM_PTE_STATE' : [ 0x180, { + 'DeadPteTrackerSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'PteTrackerLock' : [ 0x8, ['unsigned long']], + 'MdlTrackerLookaside' : [ 0x40, ['_NPAGED_LOOKASIDE_LIST']], + 'PteTrackingBitmap' : [ 0x100, ['_RTL_BITMAP']], + 'CachedPteHeads' : [ 0x108, ['pointer', ['_MI_CACHED_PTES']]], + 'SystemViewPteInfo' : [ 0x10c, ['_MI_SYSTEM_PTE_TYPE']], + 'KernelStackPages' : [ 0x144, ['unsigned char']], + 'QueuedStacks' : [ 0x148, ['_SLIST_HEADER']], + 'StackGrowthFailures' : [ 0x150, ['unsigned long']], + 'TrackPtesAborted' : [ 0x154, ['unsigned char']], + 'AdjustCounter' : [ 0x155, ['unsigned char']], + 'ReservedMappingLock' : [ 0x158, ['long']], + 'ReservedMappingTree' : [ 0x15c, ['_RTL_AVL_TREE']], + 'ReservedMappingPageTablePfns' : [ 0x160, ['pointer', ['_MMPFN']]], + 'QueuedStacksWorkItem' : [ 0x164, ['_MI_QUEUED_DEADSTACK_WORKITEM']], +} ], + '__unnamed_2468' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MI_PARTITION_FLAGS']], +} ], + '_MI_PARTITION_CORE' : [ 0xbc, { + 'PartitionId' : [ 0x0, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_2468']], + 'Signature' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'ParentPartition' : [ 0x10, ['pointer', ['_MI_PARTITION']]], + 'ListEntry' : [ 0x14, ['_LIST_ENTRY']], + 'NodeInformation' : [ 0x1c, ['pointer', ['_MI_NODE_INFORMATION']]], + 'PageRoot' : [ 0x20, ['_RTL_AVL_TREE']], + 'MemoryNodeRuns' : [ 0x24, ['pointer', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'MemoryBlockReferences' : [ 0x28, ['unsigned long']], + 'PfnUnmapWorkItem' : [ 0x2c, ['_WORK_QUEUE_ITEM']], + 'PfnUnmapActive' : [ 0x3c, ['unsigned char']], + 'PfnUnmapCount' : [ 0x40, ['unsigned long']], + 'PfnUnmapWaitList' : [ 0x44, ['pointer', ['void']]], + 'MemoryRuns' : [ 0x48, ['pointer', ['_PHYSICAL_MEMORY_DESCRIPTOR']]], + 'ExitEvent' : [ 0x4c, ['_KEVENT']], + 'SystemThreadHandles' : [ 0x5c, ['array', 5, ['pointer', ['void']]]], + 'PartitionObject' : [ 0x70, ['pointer', ['void']]], + 'PartitionObjectHandle' : [ 0x74, ['pointer', ['void']]], + 'DynamicMemoryPushLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'DynamicMemoryLock' : [ 0x7c, ['long']], + 'TemporaryMemoryEvent' : [ 0x80, ['_KEVENT']], + 'MemoryEvents' : [ 0x90, ['array', 11, ['pointer', ['_KEVENT']]]], +} ], + '__unnamed_2475' : [ 0x4, { + 'InstancedWorkingSet' : [ 0x0, ['pointer', ['void']]], +} ], + '_MMSUPPORT_INSTANCE' : [ 0x64, { + 'NextPageColor' : [ 0x0, ['unsigned short']], + 'LastTrimStamp' : [ 0x2, ['unsigned short']], + 'PageFaultCount' : [ 0x4, ['unsigned long']], + 'TrimmedPageCount' : [ 0x8, ['unsigned long']], + 'VmWorkingSetList' : [ 0xc, ['pointer', ['_MMWSL_INSTANCE']]], + 'WorkingSetExpansionLinks' : [ 0x10, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x18, ['array', 7, ['unsigned long']]], + 'ExitOutswapGate' : [ 0x34, ['pointer', ['_KGATE']]], + 'MinimumWorkingSetSize' : [ 0x38, ['unsigned long']], + 'WorkingSetLeafSize' : [ 0x3c, ['unsigned long']], + 'WorkingSetLeafPrivateSize' : [ 0x40, ['unsigned long']], + 'WorkingSetSize' : [ 0x44, ['unsigned long']], + 'WorkingSetPrivateSize' : [ 0x48, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0x4c, ['unsigned long']], + 'PeakWorkingSetSize' : [ 0x50, ['unsigned long']], + 'HardFaultCount' : [ 0x54, ['unsigned long']], + 'u1' : [ 0x58, ['__unnamed_2475']], + 'Reserved0' : [ 0x5c, ['unsigned long']], + 'Flags' : [ 0x60, ['_MMSUPPORT_FLAGS']], +} ], + '_KWAIT_BLOCK' : [ 0x18, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x8, ['unsigned char']], + 'BlockState' : [ 0x9, ['unsigned char']], + 'WaitKey' : [ 0xa, ['unsigned short']], + 'Thread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'NotificationQueue' : [ 0xc, ['pointer', ['_KQUEUE']]], + 'Object' : [ 0x10, ['pointer', ['void']]], + 'SparePtr' : [ 0x14, ['pointer', ['void']]], +} ], + '_PPM_SELECTION_MENU_ENTRY' : [ 0x10, { + 'StrictDependency' : [ 0x0, ['unsigned char']], + 'InitiatingState' : [ 0x1, ['unsigned char']], + 'DependentState' : [ 0x2, ['unsigned char']], + 'StateIndex' : [ 0x4, ['unsigned long']], + 'Dependencies' : [ 0x8, ['unsigned long']], + 'DependencyList' : [ 0xc, ['pointer', ['_PPM_SELECTION_DEPENDENCY']]], +} ], + '_VPB' : [ 0x58, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'VolumeLabel' : [ 0x18, ['array', 32, ['wchar']]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_HV_GET_BIN_CONTEXT' : [ 0x2, { + 'OutstandingReference' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredRundown' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], +} ], + '_POP_FX_PLUGIN' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned long long']], + 'WorkQueue' : [ 0x18, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x40, ['pointer', ['void']]], + 'AcceptProcessorNotification' : [ 0x44, ['pointer', ['void']]], + 'AcceptAcpiNotification' : [ 0x48, ['pointer', ['void']]], + 'WorkOrderCount' : [ 0x4c, ['unsigned long']], + 'WorkOrders' : [ 0x50, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NT_TIB' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x4, ['pointer', ['void']]], + 'StackLimit' : [ 0x8, ['pointer', ['void']]], + 'SubSystemTib' : [ 0xc, ['pointer', ['void']]], + 'FiberData' : [ 0x10, ['pointer', ['void']]], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['pointer', ['void']]], + 'Self' : [ 0x18, ['pointer', ['_NT_TIB']]], +} ], + '_ETW_REG_ENTRY' : [ 0x3c, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x8, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x10, ['pointer', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x14, ['pointer', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x18, ['pointer', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x18, ['array', 4, ['pointer', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x18, ['pointer', ['void']]], + 'SessionId' : [ 0x1c, ['unsigned long']], + 'Process' : [ 0x28, ['pointer', ['_EPROCESS']]], + 'CallbackContext' : [ 0x28, ['pointer', ['void']]], + 'Callback' : [ 0x2c, ['pointer', ['void']]], + 'Index' : [ 0x30, ['unsigned short']], + 'Flags' : [ 0x32, ['unsigned short']], + 'DbgKernelRegistration' : [ 0x32, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgUserRegistration' : [ 0x32, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgReplyRegistration' : [ 0x32, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgClassicRegistration' : [ 0x32, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgSessionSpaceRegistration' : [ 0x32, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgModernRegistration' : [ 0x32, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClosed' : [ 0x32, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgInserted' : [ 0x32, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DbgWow64' : [ 0x32, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'EnableMask' : [ 0x34, ['unsigned char']], + 'GroupEnableMask' : [ 0x35, ['unsigned char']], + 'UseDescriptorType' : [ 0x36, ['unsigned char']], + 'Traits' : [ 0x38, ['pointer', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_TERMINATION_PORT' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], + 'Port' : [ 0x4, ['pointer', ['void']]], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_MI_SYSTEM_VA_STATE' : [ 0x14c0, { + 'SystemTablesLock' : [ 0x0, ['unsigned long']], + 'SystemVaBias' : [ 0x4, ['unsigned long']], + 'SystemAvailableVaLow' : [ 0x8, ['unsigned long']], + 'VirtualBias' : [ 0xc, ['unsigned long']], + 'HyperSpaceEndPte' : [ 0x10, ['pointer', ['_MMPTE']]], + 'SystemRangeStart' : [ 0x14, ['pointer', ['void']]], + 'SystemCachePdeCount' : [ 0x18, ['array', 1024, ['unsigned char']]], + 'SystemCacheReverseMaps' : [ 0x418, ['array', 1024, ['pointer', ['void']]]], + 'HyperSpaceEnd' : [ 0x1418, ['pointer', ['void']]], + 'WorkingSetListHashStart' : [ 0x141c, ['pointer', ['_MMWSLE_HASH']]], + 'WorkingSetListHashEnd' : [ 0x1420, ['pointer', ['_MMWSLE_HASH']]], + 'WorkingSetListIndirectHashStart' : [ 0x1424, ['pointer', ['_MMWSLE_NONDIRECT_HASH']]], + 'FreeSystemCacheVa' : [ 0x1428, ['_KEVENT']], + 'SystemVaLock' : [ 0x1438, ['unsigned long']], + 'DeleteKvaLock' : [ 0x143c, ['long']], + 'FreeSystemCache' : [ 0x1440, ['_MI_PTE_CHAIN_HEAD']], + 'SystemCacheViewLock' : [ 0x1458, ['unsigned long']], + 'SystemCacheInitLock' : [ 0x145c, ['_EX_PUSH_LOCK']], + 'UnusableWsles' : [ 0x1460, ['array', 5, ['unsigned long']]], + 'PossibleWsles' : [ 0x1474, ['array', 5, ['unsigned long']]], + 'SystemWs' : [ 0x1488, ['array', 3, ['pointer', ['_MMSUPPORT_INSTANCE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x4, ['pointer', ['void']]], +} ], + '_GDI_TEB_BATCH' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_MMSUPPORT_SHARED' : [ 0x24, { + 'WorkingSetLock' : [ 0x0, ['long']], + 'ReleasedCommitDebt' : [ 0x4, ['unsigned long']], + 'ResetPagesRepurposedCount' : [ 0x8, ['unsigned long']], + 'WsSwapSupport' : [ 0xc, ['pointer', ['void']]], + 'CommitReleaseContext' : [ 0x10, ['pointer', ['void']]], + 'AccessLog' : [ 0x14, ['pointer', ['void']]], + 'ChargedWslePages' : [ 0x18, ['unsigned long']], + 'ActualWslePages' : [ 0x1c, ['unsigned long']], + 'WorkingSetSizeOverhead' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { + 'ImpersonationData' : [ 0x0, ['unsigned long']], + 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0xc, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x4, ['pointer', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x8, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_PO_IRP_MANAGER' : [ 0x10, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x8, ['_PO_IRP_QUEUE']], +} ], + '_CM_RESOURCE_LIST' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_PAE_ENTRY' : [ 0x20, { + 'PteEntry' : [ 0x0, ['array', 4, ['_MMPTE']]], + 'PaeEntry' : [ 0x0, ['_PAE_PAGEINFO']], + 'NextPae' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '_MMCLONE_BLOCK' : [ 0x10, { + 'ProtoPte' : [ 0x0, ['_MMPTE']], + 'CloneCommitCount' : [ 0x8, ['unsigned long']], + 'u1' : [ 0x8, ['_MI_CLONE_BLOCK_FLAGS']], + 'CloneRefCount' : [ 0xc, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x8, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Propagated' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_PS_TRUSTLET_TKSESSION_ID' : [ 0x20, { + 'SessionId' : [ 0x0, ['array', 4, ['unsigned long long']]], +} ], + '__unnamed_24fb' : [ 0x4, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'FileObject' : [ 0x0, ['pointer', ['_FILE_OBJECT']]], + 'RemoteImageFileObject' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RemoteDataFileObject' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '_SECTION' : [ 0x28, { + 'SectionNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'u1' : [ 0x14, ['__unnamed_24fb']], + 'SizeOfSection' : [ 0x18, ['unsigned long long']], + 'u' : [ 0x20, ['__unnamed_1691']], + 'InitialPageProtection' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'SessionId' : [ 0x24, ['BitField', dict(start_bit = 12, end_bit = 31, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x24, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'CompactionMask' : [ 0x8, ['unsigned long long']], + 'Reserved2' : [ 0x10, ['array', 6, ['unsigned long long']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0x88, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x8, ['unsigned long']], + 'ArgumentStatus' : [ 0xc, ['long']], + 'CallerEvent' : [ 0x10, ['pointer', ['_KEVENT']]], + 'Callback' : [ 0x14, ['pointer', ['void']]], + 'Context' : [ 0x18, ['pointer', ['void']]], + 'VetoType' : [ 0x1c, ['pointer', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x20, ['pointer', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x24, ['unsigned long']], + 'Lock' : [ 0x28, ['unsigned long']], + 'Cancel' : [ 0x2c, ['unsigned char']], + 'Parent' : [ 0x30, ['pointer', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'ActivityId' : [ 0x34, ['_GUID']], + 'Data' : [ 0x44, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x8, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x4, ['array', 1, ['pointer', ['void']]]], +} ], + '_MI_LDW_WORK_CONTEXT' : [ 0x20, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'FileObject' : [ 0x10, ['pointer', ['_FILE_OBJECT']]], + 'ErrorStatus' : [ 0x14, ['long']], + 'Active' : [ 0x18, ['long']], + 'FreeWhenDone' : [ 0x1c, ['unsigned char']], +} ], + '_MI_DEBUGGER_STATE' : [ 0x90, { + 'TransientWrite' : [ 0x0, ['unsigned char']], + 'CodePageEdited' : [ 0x1, ['unsigned char']], + 'DebugPte' : [ 0x4, ['pointer', ['_MMPTE']]], + 'PoisonedTb' : [ 0x8, ['unsigned long']], + 'InDebugger' : [ 0xc, ['long']], + 'Pfns' : [ 0x10, ['array', 32, ['pointer', ['void']]]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x8, { + 'CrossThreadReleasable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 31, native_type='unsigned long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'LockState' : [ 0x0, ['pointer', ['void']]], + 'SessionState' : [ 0x4, ['pointer', ['void']]], + 'SessionId' : [ 0x4, ['unsigned long']], +} ], + '_RTL_RANGE' : [ 0x20, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer', ['void']]], + 'Owner' : [ 0x14, ['pointer', ['void']]], + 'Attributes' : [ 0x18, ['unsigned char']], + 'Flags' : [ 0x19, ['unsigned char']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x10, { + 'ClientToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x8, ['pointer', ['void']]], + 'ProcessAuditId' : [ 0xc, ['pointer', ['void']]], +} ], + '_ETIMER' : [ 0xb8, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x28, ['unsigned long']], + 'TimerApc' : [ 0x2c, ['_KAPC']], + 'TimerDpc' : [ 0x5c, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0x7c, ['_LIST_ENTRY']], + 'Period' : [ 0x84, ['unsigned long']], + 'TimerFlags' : [ 0x88, ['unsigned char']], + 'ApcAssociated' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0x88, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0x88, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0x88, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0x89, ['unsigned char']], + 'Spare2' : [ 0x8a, ['unsigned short']], + 'WakeReason' : [ 0x8c, ['pointer', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x90, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x98, ['pointer', ['void']]], + 'VirtualizedTimerLinks' : [ 0x9c, ['_LIST_ENTRY']], + 'DueTime' : [ 0xa8, ['unsigned long long']], + 'CoalescingWindow' : [ 0xb0, ['unsigned long']], +} ], + '_MI_SHUTDOWN_STATE' : [ 0x48, { + 'CrashDumpInitialized' : [ 0x0, ['unsigned char']], + 'ConnectedStandbyActive' : [ 0x1, ['unsigned char']], + 'SystemShutdown' : [ 0x4, ['unsigned long']], + 'ShutdownFlushInProgress' : [ 0x8, ['long']], + 'ResumeItem' : [ 0xc, ['_MI_RESUME_WORKITEM']], + 'MirrorHoldsPfn' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'MirroringActive' : [ 0x30, ['unsigned long']], + 'MirrorBitMaps' : [ 0x34, ['array', 2, ['_RTL_BITMAP']]], + 'CrashDumpPte' : [ 0x44, ['pointer', ['_MMPTE']]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_VI_TRACK_IRQL' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'OldIrql' : [ 0x4, ['unsigned char']], + 'NewIrql' : [ 0x5, ['unsigned char']], + 'Processor' : [ 0x6, ['unsigned short']], + 'TickCount' : [ 0x8, ['unsigned long']], + 'StackTrace' : [ 0xc, ['array', 5, ['pointer', ['void']]]], +} ], + '_ARM64_DBGKD_CONTROL_SET' : [ 0x18, { + 'Continue' : [ 0x0, ['unsigned long']], + 'TraceFlag' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x10, ['unsigned long long']], +} ], + '_OWNER_ENTRY' : [ 0x8, { + 'OwnerThread' : [ 0x0, ['unsigned long']], + 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoQoSPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x4, ['unsigned long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0xc, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'Entry' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x4, { + 'ImageFileName' : [ 0x0, ['pointer', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x180, { + 'IdleStates' : [ 0x0, ['pointer', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x4, ['pointer', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x8, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x10, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x18, ['unsigned long long']], + 'IdleTimeExpiration' : [ 0x20, ['unsigned long long']], + 'NonInterruptibleTransition' : [ 0x28, ['unsigned char']], + 'PepWokenTransition' : [ 0x29, ['unsigned char']], + 'EfficiencyClass' : [ 0x2a, ['unsigned char']], + 'SchedulingClass' : [ 0x2b, ['unsigned char']], + 'TargetIdleState' : [ 0x2c, ['unsigned long']], + 'IdlePolicy' : [ 0x30, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x38, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x40, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xc8, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower', 3: 'ProcHypervisorHvCounters'})]], + 'LastSysTime' : [ 0xcc, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xd0, ['unsigned long']], + 'WmiInterfaceEnabled' : [ 0xd4, ['long']], + 'FFHThrottleStateInfo' : [ 0xd8, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0xf8, ['_KDPC']], + 'PerfActionMask' : [ 0x118, ['long']], + 'HvIdleCheck' : [ 0x120, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x130, ['pointer', ['_PROC_PERF_CHECK']]], + 'Domain' : [ 0x134, ['pointer', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x138, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x13c, ['pointer', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x140, ['pointer', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x144, ['pointer', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x148, ['unsigned char']], + 'HvTargetState' : [ 0x149, ['unsigned char']], + 'Parked' : [ 0x14a, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x14c, ['unsigned long']], + 'AveragePerformancePercent' : [ 0x150, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x154, ['unsigned long']], + 'RelativePerformance' : [ 0x158, ['unsigned long']], + 'Utility' : [ 0x15c, ['unsigned long']], + 'AffinitizedUtility' : [ 0x160, ['unsigned long']], + 'SnapTimeLast' : [ 0x168, ['unsigned long long']], + 'EnergyConsumed' : [ 0x168, ['unsigned long long']], + 'ActiveTime' : [ 0x170, ['unsigned long long']], + 'TotalTime' : [ 0x178, ['unsigned long long']], +} ], + '_MI_PARTITION_SEGMENTS' : [ 0x100, { + 'DeleteSubsectionCleanup' : [ 0x0, ['_KEVENT']], + 'UnusedSegmentCleanup' : [ 0x10, ['_KEVENT']], + 'SubsectionDeletePtes' : [ 0x20, ['unsigned long']], + 'DereferenceSegmentHeader' : [ 0x24, ['_MMDEREFERENCE_SEGMENT_HEADER']], + 'DeleteOnCloseList' : [ 0x40, ['_LIST_ENTRY']], + 'DeleteOnCloseTimer' : [ 0x48, ['_KTIMER']], + 'DeleteOnCloseTimerActive' : [ 0x70, ['unsigned char']], + 'DeleteOnCloseCount' : [ 0x74, ['unsigned long']], + 'UnusedSegmentList' : [ 0x78, ['_LIST_ENTRY']], + 'UnusedSubsectionList' : [ 0x80, ['_LIST_ENTRY']], + 'DeleteSubsectionList' : [ 0x88, ['_LIST_ENTRY']], + 'ControlAreaDeleteEvent' : [ 0x90, ['_KEVENT']], + 'ControlAreaDeleteList' : [ 0xa0, ['_SINGLE_LIST_ENTRY']], + 'SegmentListLock' : [ 0xc0, ['long']], + 'ControlAreaCount' : [ 0xc8, ['long long']], +} ], + '_KiIoAccessMap' : [ 0x2024, { + 'DirectionMap' : [ 0x0, ['array', 32, ['unsigned char']]], + 'IoMap' : [ 0x20, ['array', 8196, ['unsigned char']]], +} ], + '_MI_RESAVAIL_TRACKER' : [ 0x200, { + 'AllocateKernelStack' : [ 0x0, ['unsigned long']], + 'AllocateGrowKernelStack' : [ 0x4, ['unsigned long']], + 'FreeKernelStack' : [ 0x8, ['unsigned long']], + 'FreeKernelStackError' : [ 0xc, ['unsigned long']], + 'FreeGrowKernelStackError' : [ 0x10, ['unsigned long']], + 'AllocateCreateProcess' : [ 0x14, ['unsigned long']], + 'FreeCreateProcessError' : [ 0x18, ['unsigned long']], + 'FreeDeleteProcess' : [ 0x1c, ['unsigned long']], + 'FreeCleanProcess' : [ 0x20, ['unsigned long']], + 'FreeCleanProcessError' : [ 0x24, ['unsigned long']], + 'AllocateWsIncrease' : [ 0x28, ['unsigned long']], + 'FreeWsIncreaseError' : [ 0x2c, ['unsigned long']], + 'FreeWsIncreaseErrorMax' : [ 0x30, ['unsigned long']], + 'FreeWsDecrease' : [ 0x34, ['unsigned long']], + 'AllocateWorkingSetPage' : [ 0x38, ['unsigned long']], + 'FreeWorkingSetPageError' : [ 0x3c, ['unsigned long']], + 'FreeDeletePteRange' : [ 0x40, ['unsigned long']], + 'AllocatePageTablesForProcessMetadata' : [ 0x44, ['unsigned long']], + 'AllocatePageTablesForSystem' : [ 0x48, ['unsigned long']], + 'FreePageTablesExcess' : [ 0x4c, ['unsigned long']], + 'FreeSystemVaPageTables' : [ 0x50, ['unsigned long']], + 'FreeSessionVaPageTables' : [ 0x54, ['unsigned long']], + 'AllocateCreateSession' : [ 0x58, ['unsigned long']], + 'FreeSessionWsDereference' : [ 0x5c, ['unsigned long']], + 'FreeSessionDereference' : [ 0x60, ['unsigned long']], + 'AllocateLockedSessionImage' : [ 0x64, ['unsigned long']], + 'FreeLockedSessionImage' : [ 0x68, ['unsigned long']], + 'FreeSessionImageConversion' : [ 0x6c, ['unsigned long']], + 'AllocateWsAdjustPageTable' : [ 0x70, ['unsigned long']], + 'FreeWsAdjustPageTable' : [ 0x74, ['unsigned long']], + 'FreeWsAdjustPageTableError' : [ 0x78, ['unsigned long']], + 'AllocateNoLowMemory' : [ 0x7c, ['unsigned long']], + 'AllocatePagedPoolLockedDown' : [ 0x80, ['unsigned long']], + 'FreePagedPoolLockedDown' : [ 0x84, ['unsigned long']], + 'AllocateSystemBitmaps' : [ 0x88, ['unsigned long']], + 'FreeSystemBitmapsError' : [ 0x8c, ['unsigned long']], + 'AllocateForMdl' : [ 0x90, ['unsigned long']], + 'FreeFromMdl' : [ 0x94, ['unsigned long']], + 'AllocateForMdlPartition' : [ 0x98, ['unsigned long']], + 'FreeFromMdlPartition' : [ 0x9c, ['unsigned long']], + 'FreeMdlExcess' : [ 0xa0, ['unsigned long']], + 'AllocateExpansionNonPagedPool' : [ 0xa4, ['unsigned long']], + 'FreeExpansionNonPagedPool' : [ 0xa8, ['unsigned long']], + 'AllocateVad' : [ 0xac, ['unsigned long']], + 'RemoveVad' : [ 0xb0, ['unsigned long']], + 'FreeVad' : [ 0xb4, ['unsigned long']], + 'AllocateContiguous' : [ 0xb8, ['unsigned long']], + 'FreeContiguousPages' : [ 0xbc, ['unsigned long']], + 'FreeContiguousError' : [ 0xc0, ['unsigned long']], + 'FreeLargePageMemory' : [ 0xc4, ['unsigned long']], + 'AllocateSystemWsles' : [ 0xc8, ['unsigned long']], + 'FreeSystemWsles' : [ 0xcc, ['unsigned long']], + 'AllocateSystemInitWs' : [ 0xd0, ['unsigned long']], + 'AllocateSessionInitWs' : [ 0xd4, ['unsigned long']], + 'FreeSessionInitWsError' : [ 0xd8, ['unsigned long']], + 'AllocateSystemImage' : [ 0xdc, ['unsigned long']], + 'AllocateSystemImageLoad' : [ 0xe0, ['unsigned long']], + 'AllocateSessionSharedImage' : [ 0xe4, ['unsigned long']], + 'FreeSystemImageInitCode' : [ 0xe8, ['unsigned long']], + 'FreeSystemImageLargePageConversion' : [ 0xec, ['unsigned long']], + 'FreeSystemImageError' : [ 0xf0, ['unsigned long']], + 'FreeSystemImageLoadExcess' : [ 0xf4, ['unsigned long']], + 'FreeUnloadSystemImage' : [ 0xf8, ['unsigned long']], + 'FreeReloadBootImageLarge' : [ 0xfc, ['unsigned long']], + 'FreeIndependent' : [ 0x100, ['unsigned long']], + 'AllocateHotRemove' : [ 0x104, ['unsigned long']], + 'FreeHotAdd' : [ 0x108, ['unsigned long']], + 'AllocateBoot' : [ 0x10c, ['unsigned long']], + 'FreeLoaderBlock' : [ 0x110, ['unsigned long']], + 'AllocateNonPagedSpecialPool' : [ 0x114, ['unsigned long']], + 'FreeNonPagedSpecialPoolError' : [ 0x118, ['unsigned long']], + 'FreeNonPagedSpecialPool' : [ 0x11c, ['unsigned long']], + 'AllocateSharedSegmentPage' : [ 0x120, ['unsigned long']], + 'FreeSharedSegmentPage' : [ 0x124, ['unsigned long']], + 'AllocateZeroPage' : [ 0x128, ['unsigned long']], + 'FreeZeroPage' : [ 0x12c, ['unsigned long']], + 'AllocateForPo' : [ 0x130, ['unsigned long']], + 'AllocateForPoForce' : [ 0x134, ['unsigned long']], + 'FreeForPo' : [ 0x138, ['unsigned long']], + 'AllocateThreadHardFaultBehavior' : [ 0x13c, ['unsigned long']], + 'FreeThreadHardFaultBehavior' : [ 0x140, ['unsigned long']], + 'ObtainFaultCharges' : [ 0x144, ['unsigned long']], + 'FreeFaultCharges' : [ 0x148, ['unsigned long']], + 'AllocateStoreCharges' : [ 0x14c, ['unsigned long']], + 'FreeStoreCharges' : [ 0x150, ['unsigned long']], + 'ObtainLockedPageCharge' : [ 0x180, ['unsigned long']], + 'FreeLockedPageCharge' : [ 0x1c0, ['unsigned long']], + 'AllocateStore' : [ 0x1c4, ['unsigned long']], + 'FreeStore' : [ 0x1c8, ['unsigned long']], + 'AllocateSystemImageProtos' : [ 0x1cc, ['unsigned long']], + 'FreeSystemImageProtos' : [ 0x1d0, ['unsigned long']], + 'AllocateModWriterCharge' : [ 0x1d4, ['unsigned long']], + 'FreeModWriterCharge' : [ 0x1d8, ['unsigned long']], + 'AllocateMappedWriterCharge' : [ 0x1dc, ['unsigned long']], + 'FreeMappedWriterCharge' : [ 0x1e0, ['unsigned long']], + 'AllocateRegistryCharges' : [ 0x1e4, ['unsigned long']], + 'FreeRegistryCharges' : [ 0x1e8, ['unsigned long']], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MI_AVAILABLE_PAGE_WAIT_STATES' : [ 0x14, { + 'Event' : [ 0x0, ['_KEVENT']], + 'EventSets' : [ 0x10, ['unsigned long']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KRESOURCEMANAGER' : [ 0x154, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'State' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x1c, ['_KMUTANT']], + 'NamespaceLink' : [ 0x3c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x50, ['_GUID']], + 'NotificationQueue' : [ 0x60, ['_KQUEUE']], + 'NotificationMutex' : [ 0x88, ['_KMUTANT']], + 'EnlistmentHead' : [ 0xa8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xb0, ['unsigned long']], + 'NotificationRoutine' : [ 0xb4, ['pointer', ['void']]], + 'Key' : [ 0xb8, ['pointer', ['void']]], + 'ProtocolListHead' : [ 0xbc, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0xc4, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0xcc, ['_LIST_ENTRY']], + 'Tm' : [ 0xd4, ['pointer', ['_KTM']]], + 'Description' : [ 0xd8, ['_UNICODE_STRING']], + 'Enlistments' : [ 0xe0, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x140, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_POP_FX_DEVICE' : [ 0x188, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'IrpData' : [ 0xc, ['pointer', ['_POP_IRP_DATA']]], + 'Status' : [ 0x10, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x14, ['long']], + 'PowerNotReqCall' : [ 0x18, ['long']], + 'DevNode' : [ 0x1c, ['pointer', ['_DEVICE_NODE']]], + 'DpmContext' : [ 0x20, ['pointer', ['PEPHANDLE__']]], + 'Plugin' : [ 0x24, ['pointer', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x28, ['pointer', ['PEPHANDLE__']]], + 'AcpiPlugin' : [ 0x2c, ['pointer', ['_POP_FX_PLUGIN']]], + 'AcpiPluginHandle' : [ 0x30, ['pointer', ['PEPHANDLE__']]], + 'DeviceObject' : [ 0x34, ['pointer', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x38, ['pointer', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x3c, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0x58, ['pointer', ['void']]], + 'AcpiLink' : [ 0x5c, ['_LIST_ENTRY']], + 'DeviceId' : [ 0x64, ['_UNICODE_STRING']], + 'RemoveLock' : [ 0x6c, ['_IO_REMOVE_LOCK']], + 'AcpiRemoveLock' : [ 0x84, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0x9c, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0xb8, ['unsigned long']], + 'IdleTimer' : [ 0xc0, ['_KTIMER']], + 'IdleDpc' : [ 0xe8, ['_KDPC']], + 'IdleTimeout' : [ 0x108, ['unsigned long long']], + 'IdleStamp' : [ 0x110, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x118, ['array', 2, ['pointer', ['_DEVICE_OBJECT']]]], + 'NextIrpPowerState' : [ 0x120, ['array', 2, ['_POWER_STATE']]], + 'NextIrpCallerCompletion' : [ 0x128, ['array', 2, ['pointer', ['void']]]], + 'NextIrpCallerContext' : [ 0x130, ['array', 2, ['pointer', ['void']]]], + 'IrpCompleteEvent' : [ 0x138, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x148, ['pointer', ['void']]], + 'Accounting' : [ 0x150, ['_POP_FX_ACCOUNTING']], + 'Flags' : [ 0x178, ['unsigned long']], + 'ComponentCount' : [ 0x17c, ['unsigned long']], + 'Components' : [ 0x180, ['pointer', ['pointer', ['_POP_FX_COMPONENT']]]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_IOV_IRP_TRACE' : [ 0x40, { + 'Irp' : [ 0x0, ['pointer', ['_IRP']]], + 'Thread' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x8, ['short']], + 'SpecialApcDisable' : [ 0xa, ['short']], + 'CombinedApcDisable' : [ 0x8, ['unsigned long']], + 'Irql' : [ 0xc, ['unsigned char']], + 'StackTrace' : [ 0x10, ['array', 12, ['pointer', ['void']]]], +} ], + '_MI_CLONE_BLOCK_FLAGS' : [ 0x4, { + 'ActualCloneCommit' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 27, native_type='unsigned long')]], + 'CloneProtection' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GetExtents' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'VmLockNotNeeded' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_QUEUED_DEADSTACK_WORKITEM' : [ 0x14, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Active' : [ 0x10, ['long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x8, { + 'Key' : [ 0x0, ['pointer', ['void']]], + 'Index' : [ 0x4, ['unsigned long']], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Processors' : [ 0x4, ['unsigned long']], + 'ActiveProcessors' : [ 0x8, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x8, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x4, ['unsigned long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], +} ], + '_VF_AVL_TABLE' : [ 0x80, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x38, ['pointer', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x3c, ['pointer', ['void']]], + 'Lock' : [ 0x40, ['long']], +} ], + '_FLOATING_SAVE_AREA' : [ 0x70, { + 'ControlWord' : [ 0x0, ['unsigned long']], + 'StatusWord' : [ 0x4, ['unsigned long']], + 'TagWord' : [ 0x8, ['unsigned long']], + 'ErrorOffset' : [ 0xc, ['unsigned long']], + 'ErrorSelector' : [ 0x10, ['unsigned long']], + 'DataOffset' : [ 0x14, ['unsigned long']], + 'DataSelector' : [ 0x18, ['unsigned long']], + 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], + 'Spare0' : [ 0x6c, ['unsigned long']], +} ], + '__unnamed_25a7' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_25a9' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_25a7']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x44, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x1c, ['_LIST_ENTRY']], + 'IdleType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CoolingExtension' : [ 0x30, ['pointer', ['_POP_COOLING_EXTENSION']]], + 'Volume' : [ 0x34, ['_LIST_ENTRY']], + 'Specific' : [ 0x3c, ['__unnamed_25a9']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0xc, { + 'ChainLink' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'HashValue' : [ 0x8, ['unsigned long']], +} ], + '_CM_UOW_SET_SD_DATA' : [ 0x4, { + 'SecurityCell' : [ 0x0, ['unsigned long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x24, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'Context' : [ 0xc, ['pointer', ['void']]], + 'CompletionState' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x14, ['unsigned long']], + 'Status' : [ 0x18, ['long']], + 'Information' : [ 0x1c, ['pointer', ['void']]], + 'ReferenceCount' : [ 0x20, ['long']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { + 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_PPM_COORDINATED_SYNCHRONIZATION' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'EnterProcessor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long')]], + 'ExitProcessor' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 24, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 26, native_type='unsigned long')]], + 'Entered' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'EntryPriority' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='unsigned long')]], +} ], + '_KDPC_LIST' : [ 0x8, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x4, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0xa4, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x4, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x8, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x18, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x20, ['pointer', ['void']]], + 'ServerSectionBase' : [ 0x24, ['pointer', ['void']]], + 'PortContext' : [ 0x28, ['pointer', ['void']]], + 'ClientThread' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'SecurityQos' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x3c, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0x78, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0x80, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MappingProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0x8c, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0x8e, ['unsigned short']], + 'Flags' : [ 0x90, ['unsigned long']], + 'WaitEvent' : [ 0x94, ['_KEVENT']], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x10, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x4, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x4, ['_CM_COMPONENT_HASH']], + 'NextHash' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0xc, ['unsigned short']], + 'Name' : [ 0xe, ['array', 1, ['wchar']]], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_RTL_SRWLOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x100, { + 'Irp' : [ 0x0, ['pointer', ['_IRP']]], + 'Thread' : [ 0x4, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 62, ['pointer', ['void']]]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x10, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], + 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_THERMAL_TELEMETRY_TRACKER' : [ 0x160, { + 'AccountingDisabled' : [ 0x0, ['unsigned char']], + 'LastPassiveUpdateTime' : [ 0x8, ['unsigned long long']], + 'TotalPassiveTime' : [ 0x10, ['array', 21, ['unsigned long long']]], + 'PassiveTimeSnap' : [ 0xb8, ['array', 21, ['unsigned long long']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_MI_VISIBLE_PARTITION' : [ 0xcc0, { + 'LowestPhysicalPage' : [ 0x0, ['unsigned long']], + 'HighestPhysicalPage' : [ 0x4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x8, ['unsigned long']], + 'NumberOfPagingFiles' : [ 0xc, ['unsigned long']], + 'PagingFile' : [ 0x10, ['array', 16, ['pointer', ['_MMPAGING_FILE']]]], + 'AvailablePages' : [ 0x80, ['unsigned long']], + 'ResidentAvailablePages' : [ 0xc0, ['unsigned long']], + 'PartitionWs' : [ 0x100, ['array', 1, ['_MMSUPPORT_INSTANCE']]], + 'PartitionWorkingSetLists' : [ 0x164, ['array', 1, ['_MMWSL_INSTANCE']]], + 'SystemCacheInitialized' : [ 0x238, ['unsigned char']], + 'TotalCommittedPages' : [ 0x23c, ['unsigned long']], + 'ModifiedPageListHead' : [ 0x240, ['_MMPFNLIST']], + 'ModifiedNoWritePageListHead' : [ 0x280, ['_MMPFNLIST']], + 'TotalCommitLimit' : [ 0x294, ['unsigned long']], + 'TotalPagesForPagingFile' : [ 0x298, ['unsigned long']], + 'VadPhysicalPages' : [ 0x29c, ['unsigned long']], + 'ProcessLockedFilePages' : [ 0x2a0, ['unsigned long']], + 'ChargeCommitmentFailures' : [ 0x2a4, ['array', 4, ['unsigned long']]], + 'PageFileTraceIndex' : [ 0x2b4, ['long']], + 'PageFileTraces' : [ 0x2b8, ['array', 32, ['_MI_PAGEFILE_TRACES']]], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { + 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_FREE_DISPLAY' : [ 0x10, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x50, { + 'Context' : [ 0x0, ['pointer', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x38, ['unsigned long']], + 'DependencyUsed' : [ 0x3c, ['unsigned long']], + 'DependencyArray' : [ 0x40, ['pointer', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x44, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x48, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x4c, ['unsigned long']], +} ], + '_PNP_REBALANCE_TRACE_CONTEXT' : [ 0x50, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'RebalancePhase' : [ 0x4, ['unsigned long']], + 'Reason' : [ 0x8, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'RebalanceReasonUnknown', 1: 'RebalanceReasonRequirementsChanged', 2: 'RebalanceReasonNewDevice'})]]], + 'Failure' : [ 0x10, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'RebalanceFailureNone', 1: 'RebalanceFailureDisabled', 2: 'RebalanceFailureNoMemory', 3: 'RebalanceFailureQueryStopUnexpectedVeto', 4: 'RebalanceFailureNoRequirements', 5: 'RebalanceFailureNoCandidates', 6: 'RebalanceFailureNoConfiguration'})]]], + 'SubtreeRoot' : [ 0x18, ['pointer', ['_DEVICE_NODE']]], + 'SubtreeIncludesRoot' : [ 0x1c, ['unsigned char']], + 'TriggerRoot' : [ 0x20, ['pointer', ['_DEVICE_NODE']]], + 'RebalanceDueToDynamicPartitioning' : [ 0x24, ['unsigned char']], + 'BeginTime' : [ 0x28, ['unsigned long long']], + 'VetoNode' : [ 0x30, ['array', 2, ['pointer', ['_DEVICE_NODE']]]], + 'VetoQueryRebalanceReason' : [ 0x38, ['array', -8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceQueryRebalanceSucceeded', 1: 'DeviceQueryStopFailed', 2: 'DeviceFailedGetNewResourceRequirement', 3: 'DeviceInUnexpectedState', 4: 'DeviceNotSupportQueryRebalance'})]]], + 'ConflictContext' : [ 0x40, ['_PNP_RESOURCE_CONFLICT_TRACE_CONTEXT']], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x14, { + 'BlockOffset' : [ 0x0, ['unsigned long']], + 'PermanentBinAddress' : [ 0x4, ['unsigned long']], + 'TemporaryBinAddress' : [ 0x8, ['unsigned long']], + 'TemporaryBinRundown' : [ 0xc, ['_EX_RUNDOWN_REF']], + 'MemAlloc' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_260c' : [ 0x18, { + 'RequestedTime' : [ 0x0, ['unsigned long long']], + 'ProgrammedTime' : [ 0x8, ['unsigned long long']], + 'TimerInfo' : [ 0x10, ['pointer', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0x108, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x34, ['pointer', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x38, ['pointer', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x40, ['unsigned long long']], + 'SleepTime' : [ 0x48, ['unsigned long long']], + 'WakeFirstUnattendedTime' : [ 0x50, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x60, ['array', 3, ['__unnamed_260c']]], + 'WakeAlarmPaused' : [ 0xa8, ['unsigned char']], + 'WakeAlarmLastTime' : [ 0xb0, ['unsigned long long']], + 'FilteredCapabilities' : [ 0xb8, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_RTL_RANGE_LIST' : [ 0x14, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Count' : [ 0xc, ['unsigned long']], + 'Stamp' : [ 0x10, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_WNF_LOCK' : [ 0x4, { + 'PushLock' : [ 0x0, ['_EX_PUSH_LOCK']], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_MI_PARTITION_ZEROING' : [ 0x3c, { + 'PageEvent' : [ 0x0, ['_KEVENT']], + 'ThreadActive' : [ 0x10, ['unsigned char']], + 'ZeroFreePageSlistMinimum' : [ 0x14, ['long']], + 'RebalanceZeroFreeWorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], + 'ThreadCount' : [ 0x28, ['long']], + 'Gate' : [ 0x2c, ['_KGATE']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x10, { + 'StackBase' : [ 0x0, ['unsigned long']], + 'StackLimit' : [ 0x4, ['unsigned long']], + 'KernelStack' : [ 0x8, ['unsigned long']], + 'InitialStack' : [ 0xc, ['unsigned long']], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x1c, { + 'ComponentActive' : [ 0x0, ['pointer', ['void']]], + 'ComponentIdle' : [ 0x4, ['pointer', ['void']]], + 'ComponentIdleState' : [ 0x8, ['pointer', ['void']]], + 'DevicePowerRequired' : [ 0xc, ['pointer', ['void']]], + 'DevicePowerNotRequired' : [ 0x10, ['pointer', ['void']]], + 'PowerControl' : [ 0x14, ['pointer', ['void']]], + 'ComponentCriticalTransition' : [ 0x18, ['pointer', ['void']]], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Reserved0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'u1' : [ 0x0, ['unsigned short']], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceAge' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'NewMaximum' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CommitReleaseState' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'u2' : [ 0x3, ['unsigned char']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_WAITING_IRP' : [ 0x20, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'CompletionRoutine' : [ 0xc, ['pointer', ['void']]], + 'Context' : [ 0x10, ['pointer', ['void']]], + 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], + 'Information' : [ 0x18, ['unsigned long']], + 'BreakAllRH' : [ 0x1c, ['unsigned char']], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PLATFORM_IDLE_STATE_ACCOUNTING' : [ 0x3e8, { + 'CancelCount' : [ 0x0, ['unsigned long']], + 'FailureCount' : [ 0x4, ['unsigned long']], + 'SuccessCount' : [ 0x8, ['unsigned long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'TotalTime' : [ 0x20, ['unsigned long long']], + 'InvalidBucketIndex' : [ 0x28, ['unsigned long']], + 'SelectionStatistics' : [ 0x30, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa8, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_PROC_FEEDBACK' : [ 0x88, { + 'Lock' : [ 0x0, ['unsigned long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x20, ['unsigned long long']], + 'UnscaledTime' : [ 0x28, ['unsigned long long']], + 'UnaccountedTime' : [ 0x30, ['long long']], + 'ScaledTime' : [ 0x38, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x48, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x50, ['unsigned long long']], + 'UserTimeLast' : [ 0x58, ['unsigned long']], + 'KernelTimeLast' : [ 0x5c, ['unsigned long']], + 'IdleGenerationNumberLast' : [ 0x60, ['unsigned long long']], + 'HvActiveTimeLast' : [ 0x68, ['unsigned long long']], + 'StallCyclesLast' : [ 0x70, ['unsigned long long']], + 'StallTime' : [ 0x78, ['unsigned long long']], + 'KernelTimesIndex' : [ 0x80, ['unsigned char']], +} ], + '_KPROCESSOR_STATE' : [ 0x320, { + 'ContextFrame' : [ 0x0, ['_CONTEXT']], + 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x28, { + 'InstantaneousRead' : [ 0x0, ['pointer', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'Scaling' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x24, ['unsigned long']], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_MI_DRIVER_VA' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_MI_DRIVER_VA']]], + 'PointerPte' : [ 0x4, ['pointer', ['_MMPTE']]], + 'BitMap' : [ 0x8, ['_RTL_BITMAP']], + 'Hint' : [ 0x10, ['unsigned long']], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x58, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x8, ['pointer', ['void']]], + 'ProcessObject' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x10, ['pointer', ['void']]], + 'RealtimeConnectContext' : [ 0x14, ['pointer', ['void']]], + 'DisconnectEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x1c, ['pointer', ['_KEVENT']]], + 'UserBufferCount' : [ 0x20, ['pointer', ['unsigned long']]], + 'UserBufferListHead' : [ 0x24, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x28, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x2c, ['unsigned long']], + 'LoggerId' : [ 0x30, ['unsigned short']], + 'Flags' : [ 0x32, ['unsigned char']], + 'ShutDownRequested' : [ 0x32, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x32, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x32, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x32, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x34, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x3c, ['pointer', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x40, ['unsigned long']], + 'UserPagesAllocated' : [ 0x44, ['unsigned long']], + 'UserPagesReused' : [ 0x48, ['unsigned long']], + 'EventsLostCount' : [ 0x4c, ['pointer', ['unsigned long']]], + 'BuffersLostCount' : [ 0x50, ['pointer', ['unsigned long']]], + 'SiloState' : [ 0x54, ['pointer', ['_ETW_SILODRIVERSTATE']]], +} ], + '_PAE_PAGEINFO' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'PageFrameNumber' : [ 0x8, ['unsigned long']], + 'EntriesInUse' : [ 0xc, ['unsigned long']], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x140, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x3, ['unsigned char']], + 'InitializationFinished' : [ 0x4, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'HvCaptureReadyBarrier' : [ 0x14, ['long']], + 'HvCaptureCompletedBarrier' : [ 0x18, ['long']], + 'MapFrozen' : [ 0x1c, ['unsigned char']], + 'DiscardMap' : [ 0x20, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x20, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x28, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x30, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x38, ['unsigned long']], + 'ClonedPageCount' : [ 0x40, ['unsigned long long']], + 'CurrentMap' : [ 0x48, ['pointer', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x4c, ['pointer', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x50, ['unsigned long']], + 'LoaderMdl' : [ 0x54, ['pointer', ['_MDL']]], + 'AllocatedMdl' : [ 0x58, ['pointer', ['_MDL']]], + 'PagesOut' : [ 0x60, ['unsigned long long']], + 'IoPages' : [ 0x68, ['pointer', ['void']]], + 'IoPagesCount' : [ 0x6c, ['unsigned long']], + 'CurrentMcb' : [ 0x70, ['pointer', ['void']]], + 'DumpStack' : [ 0x74, ['pointer', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0x78, ['pointer', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0x7c, ['unsigned long']], + 'Status' : [ 0x80, ['long']], + 'GraphicsProc' : [ 0x84, ['unsigned long']], + 'MemoryImage' : [ 0x88, ['pointer', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0x8c, ['pointer', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0x90, ['pointer', ['_MDL']]], + 'SiLogOffset' : [ 0x94, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0x98, ['pointer', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0x9c, ['pointer', ['void']]], + 'ResumeContext' : [ 0xa0, ['pointer', ['void']]], + 'ResumeContextPages' : [ 0xa4, ['unsigned long']], + 'ProcessorCount' : [ 0xa8, ['unsigned long']], + 'ProcessorContext' : [ 0xac, ['pointer', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0xb0, ['pointer', ['unsigned char']]], + 'ProdConsSize' : [ 0xb4, ['unsigned long']], + 'MaxDataPages' : [ 0xb8, ['unsigned long']], + 'ExtraBuffer' : [ 0xbc, ['pointer', ['void']]], + 'ExtraBufferSize' : [ 0xc0, ['unsigned long']], + 'ExtraMapVa' : [ 0xc4, ['pointer', ['void']]], + 'BitlockerKeyPFN' : [ 0xc8, ['unsigned long']], + 'IoInfo' : [ 0xd0, ['_POP_IO_INFO']], + 'IoChecksums' : [ 0x130, ['pointer', ['unsigned short']]], + 'IoChecksumsSize' : [ 0x134, ['unsigned long']], + 'HardwareConfigurationSignature' : [ 0x138, ['unsigned long']], +} ], + '__unnamed_2673' : [ 0x4, { + 'Long' : [ 0x0, ['unsigned long']], + 'e1' : [ 0x0, ['_MI_DECAY_TIMER_LINKAGE']], +} ], + '_MI_DECAY_TIMER_LINK' : [ 0x4, { + 'u1' : [ 0x0, ['__unnamed_2673']], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '__unnamed_267a' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0x6c, { + 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x4, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0xc, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], + 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x24, ['__unnamed_267a']], + 'ChildrenCount' : [ 0x28, ['long']], + 'StackTrace' : [ 0x2c, ['array', 8, ['pointer', ['void']]]], + 'ParentStackTrace' : [ 0x4c, ['array', 8, ['pointer', ['void']]]], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x8, { + 'p' : [ 0x0, ['pointer', ['void']]], + 'RangeSize' : [ 0x4, ['unsigned long']], +} ], + '_MI_PARTITION_COMMIT' : [ 0x80, { + 'PeakCommitment' : [ 0x0, ['unsigned long']], + 'TotalCommitLimitMaximum' : [ 0x4, ['unsigned long']], + 'Popups' : [ 0x8, ['array', 2, ['long']]], + 'LowCommitThreshold' : [ 0x10, ['unsigned long']], + 'HighCommitThreshold' : [ 0x14, ['unsigned long']], + 'EventLock' : [ 0x18, ['unsigned long']], + 'SystemCommitReserve' : [ 0x1c, ['unsigned long']], + 'OverCommit' : [ 0x40, ['unsigned long']], +} ], + '_TRIAGE_DEVICE_NODE' : [ 0x2c, { + 'Sibling' : [ 0x0, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'Child' : [ 0x4, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'Parent' : [ 0x8, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'LastChild' : [ 0xc, ['pointer', ['_TRIAGE_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x14, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x1c, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'FxDevice' : [ 0x28, ['pointer', ['_TRIAGE_POP_FX_DEVICE']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned long']], + 'CallerType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x8, ['unsigned long']], + 'DevicePathOffset' : [ 0xc, ['unsigned long']], + 'ReasonOffset' : [ 0x14, ['unsigned long']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x38, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x24, { + 'InitiatingThread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'ThreadId' : [ 0x8, ['pointer', ['void']]], + 'ProcessId' : [ 0xc, ['pointer', ['void']]], + 'Code' : [ 0x10, ['unsigned long']], + 'Parameter1' : [ 0x14, ['unsigned long']], + 'Parameter2' : [ 0x18, ['unsigned long']], + 'Parameter3' : [ 0x1c, ['unsigned long']], + 'Parameter4' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x2c, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ProbeMode' : [ 0x8, ['unsigned char']], + 'PagedPoolCharge' : [ 0xc, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x10, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x14, ['unsigned long']], + 'SecurityDescriptor' : [ 0x18, ['pointer', ['void']]], + 'SecurityQos' : [ 0x1c, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x20, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x4, ['pointer', ['wchar']]], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x40f0, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x14, ['unsigned long']], + 'ResourceAddressRange' : [ 0x18, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x2010, ['pointer', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x2014, ['unsigned long']], + 'ThreadAddressRange' : [ 0x2018, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x4010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x4014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x4018, ['unsigned long']], + 'NodesSearched' : [ 0x401c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x4020, ['unsigned long']], + 'SequenceNumber' : [ 0x4024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x4028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x402c, ['unsigned long']], + 'DepthLimitHits' : [ 0x4030, ['unsigned long']], + 'SearchLimitHits' : [ 0x4034, ['unsigned long']], + 'StackLimitHits' : [ 0x4038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x403c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x4040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x4044, ['unsigned long']], + 'TotalReleases' : [ 0x4048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x404c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x4050, ['unsigned long']], + 'Instigator' : [ 0x4054, ['pointer', ['void']]], + 'NumberOfParticipants' : [ 0x4058, ['unsigned long']], + 'Participant' : [ 0x405c, ['array', 32, ['pointer', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x40dc, ['long']], + 'StackType' : [ 0x40e0, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x40e4, ['unsigned long']], + 'StackHighLimit' : [ 0x40e8, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ProfileDepartureSetMode' : [ 0x10, ['pointer', ['void']]], + 'ProfileDepartureUpdate' : [ 0x14, ['pointer', ['void']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x328, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long']], + 'PageSize' : [ 0x14, ['unsigned long']], + 'SystemTime' : [ 0x18, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x20, ['unsigned long long']], + 'FeatureFlags' : [ 0x28, ['unsigned long long']], + 'HiberFlags' : [ 0x30, ['unsigned char']], + 'spare' : [ 0x31, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x34, ['unsigned long']], + 'HiberVa' : [ 0x38, ['unsigned long']], + 'NoFreePages' : [ 0x3c, ['unsigned long']], + 'FreeMapCheck' : [ 0x40, ['unsigned long']], + 'WakeCheck' : [ 0x44, ['unsigned long']], + 'NumPagesForLoader' : [ 0x48, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x50, ['unsigned long']], + 'FirstKernelRestorePage' : [ 0x54, ['unsigned long']], + 'FirstChecksumRestorePage' : [ 0x58, ['unsigned long']], + 'NoChecksumEntries' : [ 0x60, ['unsigned long long']], + 'PerfInfo' : [ 0x68, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x250, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x254, ['array', 1, ['unsigned long']]], + 'SiLogOffset' : [ 0x258, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x25c, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x260, ['array', 24, ['unsigned long']]], + 'NotUsed' : [ 0x2c0, ['unsigned long']], + 'ResumeContextCheck' : [ 0x2c4, ['unsigned long']], + 'ResumeContextPages' : [ 0x2c8, ['unsigned long']], + 'Hiberboot' : [ 0x2cc, ['unsigned char']], + 'HvCr3' : [ 0x2d0, ['unsigned long long']], + 'HvEntryPoint' : [ 0x2d8, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x2e0, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x2e8, ['unsigned long long']], + 'BootFlags' : [ 0x2f0, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x2f8, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x300, ['unsigned long']], + 'BitlockerKeyPfns' : [ 0x304, ['array', 4, ['unsigned long']]], + 'HardwareSignature' : [ 0x314, ['unsigned long']], + 'SMBiosTablePhysicalAddress' : [ 0x318, ['_LARGE_INTEGER']], + 'SMBiosTableLength' : [ 0x320, ['unsigned long']], + 'SMBiosMajorVersion' : [ 0x324, ['unsigned char']], + 'SMBiosMinorVersion' : [ 0x325, ['unsigned char']], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject', 8: 'PowerActionDisplayOff'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_KTIMER' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x10, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Dpc' : [ 0x20, ['pointer', ['_KDPC']]], + 'Period' : [ 0x24, ['unsigned long']], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { + 'PageHashes' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x8, ['unsigned long']], + 'Alternatives' : [ 0xc, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'WorkSpace' : [ 0x1c, ['long']], + 'InterfaceType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x24, ['unsigned long']], + 'BusNumber' : [ 0x28, ['unsigned long']], + 'Assignment' : [ 0x2c, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x30, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_MI_PAGING_IO_STATE' : [ 0x38, { + 'PageFileHead' : [ 0x0, ['_RTL_AVL_TREE']], + 'PageFileHeadSpinLock' : [ 0x4, ['long']], + 'PrefetchSeekThreshold' : [ 0x8, ['long']], + 'InPageSupportSListHead' : [ 0x10, ['array', 2, ['_SLIST_HEADER']]], + 'InPageSupportSListMinimum' : [ 0x20, ['array', 2, ['unsigned char']]], + 'InPageSinglePages' : [ 0x24, ['unsigned long']], + 'DelayPageFaults' : [ 0x28, ['long']], + 'FileCompressionBoundary' : [ 0x2c, ['unsigned long']], + 'MdlsAdjusted' : [ 0x30, ['unsigned char']], +} ], + '_MI_STANDBY_STATE' : [ 0x80, { + 'TransitionSharedPages' : [ 0x0, ['unsigned long']], + 'TransitionSharedPagesPeak' : [ 0x4, ['array', 3, ['unsigned long']]], + 'FirstDecayPage' : [ 0x10, ['unsigned long']], + 'PfnDecayFreeSList' : [ 0x18, ['_SLIST_HEADER']], + 'PfnRepurposeLog' : [ 0x20, ['pointer', ['_MM_PAGE_ACCESS_INFO_HEADER']]], + 'AllocatePfnRepurposeDpc' : [ 0x24, ['_KDPC']], +} ], + '_MI_DECAY_TIMER_LINKAGE' : [ 0x4, { + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NextDecayPfn' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x128, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x104, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x124, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_TRIAGE_9F_POWER' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'IrpList' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], + 'ThreadList' : [ 0x8, ['pointer', ['_LIST_ENTRY']]], + 'DelayedWorkQueue' : [ 0xc, ['pointer', ['_TRIAGE_EX_WORK_QUEUE']]], +} ], + '_MMINPAGE_SUPPORT_FLOW_THROUGH' : [ 0x1c, { + 'Page' : [ 0x0, ['array', 1, ['unsigned long']]], + 'InitialInPageSupport' : [ 0x4, ['pointer', ['_MMINPAGE_SUPPORT']]], + 'PagingFile' : [ 0x8, ['pointer', ['_MMPAGING_FILE']]], + 'PageFileOffset' : [ 0xc, ['unsigned long']], + 'Node' : [ 0x10, ['_RTL_BALANCED_NODE']], +} ], + '_MI_COMBINE_STATE' : [ 0x18, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'CombiningThreadCount' : [ 0x4, ['unsigned long']], + 'ActiveThreadTree' : [ 0x8, ['_RTL_AVL_TREE']], + 'ZeroPageHashValue' : [ 0x10, ['unsigned long long']], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0x50, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Type' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 16, ['pointer', ['void']]]], +} ], + '_PTE_TRACKER' : [ 0x44, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x8, ['pointer', ['_MDL']]], + 'Count' : [ 0xc, ['unsigned long']], + 'SystemVa' : [ 0x10, ['pointer', ['void']]], + 'StartVa' : [ 0x14, ['pointer', ['void']]], + 'Offset' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], + 'Page' : [ 0x20, ['unsigned long']], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'GuardPte' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x28, ['array', 7, ['pointer', ['void']]]], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_HIVE_WAIT_PACKET' : [ 0x18, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x10, ['long']], + 'Next' : [ 0x14, ['pointer', ['_HIVE_WAIT_PACKET']]], +} ], + '_VF_AVL_TREE_NODE_EX' : [ 0xc, { + 'Base' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'SessionId' : [ 0x8, ['unsigned long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_CM_INDEX' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'NameHint' : [ 0x4, ['array', 4, ['unsigned char']]], + 'HashKey' : [ 0x4, ['_CM_COMPONENT_HASH']], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_MMPAGING_FILE' : [ 0xa8, { + 'Size' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'MinimumSize' : [ 0x8, ['unsigned long']], + 'FreeSpace' : [ 0xc, ['unsigned long']], + 'PeakUsage' : [ 0x10, ['unsigned long']], + 'HighestPage' : [ 0x14, ['unsigned long']], + 'FreeReservationSpace' : [ 0x18, ['unsigned long']], + 'File' : [ 0x1c, ['pointer', ['_FILE_OBJECT']]], + 'Entry' : [ 0x20, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x28, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x30, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x38, ['pointer', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x3c, ['unsigned long']], + 'LargestAllocationCluster' : [ 0x40, ['unsigned long']], + 'RefreshAllocationCluster' : [ 0x44, ['unsigned long']], + 'LastRefreshAllocationCluster' : [ 0x48, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x4c, ['unsigned long']], + 'MaximumRunLengthInBitmaps' : [ 0x50, ['unsigned long']], + 'BitmapsCacheLengthTree' : [ 0x54, ['_RTL_RB_TREE']], + 'BitmapsCacheLocationTree' : [ 0x5c, ['_RTL_RB_TREE']], + 'BitmapsCacheFreeList' : [ 0x64, ['_LIST_ENTRY']], + 'BitmapsCacheEntries' : [ 0x6c, ['pointer', ['_MI_PAGEFILE_BITMAPS_CACHE_ENTRY']]], + 'ToBeEvictedCount' : [ 0x70, ['unsigned long']], + 'HybridPriority' : [ 0x70, ['unsigned long']], + 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'NoReservations' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'VirtualStorePagefile' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SwapSupported' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'NodeInserted' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'StackNotified' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 15, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'IgnoreReservations' : [ 0x77, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare2' : [ 0x77, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0x78, ['unsigned long']], + 'PageHashPagesPeak' : [ 0x7c, ['unsigned long']], + 'PageHash' : [ 0x80, ['pointer', ['unsigned long']]], + 'FileHandle' : [ 0x84, ['pointer', ['void']]], + 'Lock' : [ 0x88, ['unsigned long']], + 'LockOwner' : [ 0x8c, ['pointer', ['_ETHREAD']]], + 'FlowThroughReadRoot' : [ 0x90, ['_RTL_AVL_TREE']], + 'Partition' : [ 0x94, ['pointer', ['_MI_PARTITION']]], + 'FileObjectNode' : [ 0x98, ['_RTL_BALANCED_NODE']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x8, ['array', 32, ['unsigned long']]], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_HVIEW_MAP' : [ 0x320, { + 'MappedLength' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x4, ['_EX_PUSH_LOCK']], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'Directory' : [ 0xc, ['pointer', ['_HVIEW_MAP_DIRECTORY']]], + 'PagesCharged' : [ 0x10, ['unsigned long']], + 'PinLog' : [ 0x18, ['_HVIEW_MAP_PIN_LOG']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x1c, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x10, ['long']], + 'Context' : [ 0x14, ['pointer', ['void']]], + 'WatchdogTimerInfo' : [ 0x18, ['pointer', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x10, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['unsigned short']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_PAGELIST_STATE' : [ 0x8, { + 'ActiveSpinLock' : [ 0x0, ['long']], + 'ActiveThreadTree' : [ 0x4, ['_RTL_AVL_TREE']], +} ], + '_CRITICAL_PROCESS_EXCEPTION_DATA' : [ 0x28, { + 'ReportId' : [ 0x0, ['_GUID']], + 'ModuleName' : [ 0x10, ['_UNICODE_STRING']], + 'ModuleTimestamp' : [ 0x18, ['unsigned long']], + 'ModuleSize' : [ 0x1c, ['unsigned long']], + 'Offset' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_2721' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2723' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_2721']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2723']], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x204, { + 'SpinLock' : [ 0x0, ['unsigned long']], + 'HashTable' : [ 0x4, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_RELATION_LIST' : [ 0x8, { + 'DeviceObjectList' : [ 0x0, ['pointer', ['_DEVICE_OBJECT_LIST']]], + 'Sorted' : [ 0x4, ['unsigned char']], +} ], + '_IO_IRP_EXT_TRACK_OFFSET_HEADER' : [ 0x8, { + 'Validation' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'TrackedOffsetCallback' : [ 0x4, ['pointer', ['void']]], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x50, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ulTargetPlatform' : [ 0x8, ['unsigned long']], + 'ullContextMinimum' : [ 0x10, ['unsigned long long']], + 'guPlatform' : [ 0x18, ['_GUID']], + 'guMinPlatform' : [ 0x28, ['_GUID']], + 'ulContextSource' : [ 0x38, ['unsigned long']], + 'ulElementCount' : [ 0x3c, ['unsigned long']], + 'guElements' : [ 0x40, ['array', 1, ['_GUID']]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'LowboxMap' : [ 0xc, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_POP_IO_INFO' : [ 0x60, { + 'DumpMdl' : [ 0x0, ['pointer', ['_MDL']]], + 'IoStatus' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x8, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x10, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x18, ['unsigned long long']], + 'RequestSize' : [ 0x20, ['unsigned long long']], + 'IoLocation' : [ 0x28, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x30, ['unsigned long long']], + 'Buffer' : [ 0x38, ['pointer', ['void']]], + 'AsyncCapable' : [ 0x3c, ['unsigned char']], + 'BytesToRead' : [ 0x40, ['unsigned long long']], + 'Pages' : [ 0x48, ['unsigned long']], + 'HighestChecksumIndex' : [ 0x50, ['unsigned long long']], + 'PreviousChecksum' : [ 0x58, ['unsigned short']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x38, { + 'SidHash' : [ 0x0, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x8, ['pointer', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0xc, ['_LUID']], + 'TokenType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x1c, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x20, ['unsigned long']], + 'AppContainerNumber' : [ 0x24, ['unsigned long']], + 'PackageSid' : [ 0x28, ['pointer', ['void']]], + 'CapabilitiesHash' : [ 0x2c, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x30, ['pointer', ['void']]], + 'SecurityAttributes' : [ 0x34, ['pointer', ['void']]], +} ], + '_MMWSL_INSTANCE' : [ 0xd4, { + 'NextSlot' : [ 0x0, ['unsigned long']], + 'NextAgingSlot' : [ 0x4, ['unsigned long']], + 'NextAccessClearingSlot' : [ 0x8, ['unsigned long']], + 'LastAccessClearingRemainder' : [ 0xc, ['unsigned long']], + 'LastAgingRemainder' : [ 0x10, ['unsigned long']], + 'ActiveWsleCounts' : [ 0x14, ['array', 16, ['unsigned long']]], + 'ActiveWsles' : [ 0x54, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], +} ], + '_MIPFNBLINK' : [ 0x4, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'PageBlinkDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'PageBlinkLockBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ShareCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'PageShareCountDeleteBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PageShareCountLockBit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'EntireField' : [ 0x0, ['unsigned long']], + 'Lock' : [ 0x0, ['long']], + 'LockNotUsed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'DeleteBit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'LockBit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x1c, { + 'SourceProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'SourceHandle' : [ 0x4, ['pointer', ['void']]], + 'Object' : [ 0x8, ['pointer', ['void']]], + 'TargetAccess' : [ 0xc, ['unsigned long']], + 'ObjectInfo' : [ 0x10, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x18, ['unsigned long']], +} ], + '_PPM_COORDINATED_SELECTION' : [ 0x10, { + 'MaximumStates' : [ 0x0, ['unsigned long']], + 'SelectedStates' : [ 0x4, ['unsigned long']], + 'DefaultSelection' : [ 0x8, ['unsigned long']], + 'Selection' : [ 0xc, ['pointer', ['unsigned long']]], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x14, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x8, ['pointer', ['void']]], + 'Key' : [ 0xc, ['unsigned long']], + 'BindingProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], +} ], + '__unnamed_275f' : [ 0x20, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x1c, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x50, { + 'Status' : [ 0x0, ['long']], + 'PartitionId' : [ 0x4, ['unsigned short']], + 'Priority' : [ 0x6, ['unsigned char']], + 'IrpPriority' : [ 0x7, ['unsigned char']], + 'ReservationWrite' : [ 0x8, ['unsigned char']], + 'CurrentTime' : [ 0x10, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x18, ['unsigned long']], + 'ModifiedPagesTotal' : [ 0x1c, ['unsigned long']], + 'ModifiedPagefilePages' : [ 0x20, ['unsigned long']], + 'ModifiedNoWritePages' : [ 0x24, ['unsigned long']], + 'ModifiedPagefileNoReservationPages' : [ 0x28, ['unsigned long']], + 'MdlHack' : [ 0x2c, ['__unnamed_275f']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { + 'Va' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x4, ['unsigned long']], + 'Pattern' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolType' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 20, native_type='unsigned long')]], + 'SlushSize' : [ 0x8, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'NumberOfBytes' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_276c' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_276c']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x30, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'LastTotalAllocates' : [ 0x1c, ['unsigned long']], + 'LastAllocateMisses' : [ 0x20, ['unsigned long']], + 'Counters' : [ 0x24, ['array', 2, ['unsigned long']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x4, ['pointer', ['void']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'UtilityTotal' : [ 0x8, ['unsigned long']], + 'AffinitizedUtilityTotal' : [ 0xc, ['unsigned long']], + 'FrequencyTotal' : [ 0x10, ['unsigned long']], + 'TaggedPercentTotal' : [ 0x14, ['array', 2, ['unsigned long']]], + 'HistoryList' : [ 0x1c, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_DEVICE_RELATIONS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x4, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '__unnamed_277d' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_2780' : [ 0x4, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x4c, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x28, ['__unnamed_277d']], + 'Subsection' : [ 0x2c, ['pointer', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x30, ['pointer', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x34, ['pointer', ['_MMPTE']]], + 'ViewLinks' : [ 0x38, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x40, ['pointer', ['_EPROCESS']]], + 'u4' : [ 0x44, ['__unnamed_2780']], + 'FileObject' : [ 0x48, ['pointer', ['_FILE_OBJECT']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1f, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1e, ['unsigned char']], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x408, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_KTM' : [ 0x238, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x4, ['_KMUTANT']], + 'State' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x28, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x3c, ['_GUID']], + 'Flags' : [ 0x4c, ['unsigned long']], + 'VolatileFlags' : [ 0x50, ['unsigned long']], + 'LogFileName' : [ 0x54, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x5c, ['pointer', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0x60, ['pointer', ['void']]], + 'LogManagementContext' : [ 0x64, ['pointer', ['void']]], + 'Transactions' : [ 0x68, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0xc8, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x128, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x148, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x150, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x158, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x178, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x180, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x188, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x190, ['pointer', ['void']]], + 'TmRm' : [ 0x194, ['pointer', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x198, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x1a8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x1b8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x1c0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x1d0, ['_ERESOURCE']], + 'LogFlags' : [ 0x208, ['unsigned long']], + 'LogFullStatus' : [ 0x20c, ['long']], + 'RecoveryStatus' : [ 0x210, ['long']], + 'LastCheckBaseLsn' : [ 0x218, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x220, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x228, ['_WORK_QUEUE_ITEM']], +} ], + '_PO_IRP_QUEUE' : [ 0x8, { + 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], +} ], + '_KALPC_WORK_ON_BEHALF_DATA' : [ 0x8, { + 'Ticket' : [ 0x0, ['_ALPC_WORK_ON_BEHALF_TICKET']], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x2c, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x8, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0xa8, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x8, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DllBase' : [ 0x18, ['pointer', ['void']]], + 'EntryPoint' : [ 0x1c, ['pointer', ['void']]], + 'SizeOfImage' : [ 0x20, ['unsigned long']], + 'FullDllName' : [ 0x24, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x2c, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x34, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x34, ['unsigned long']], + 'PackagedBinary' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x34, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x34, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x34, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x34, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x34, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x34, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x34, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x34, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LoadConfigProcessed' : [ 0x34, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x34, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x34, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x34, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x34, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x34, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x34, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x34, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x34, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x34, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x34, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x34, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x38, ['unsigned short']], + 'TlsIndex' : [ 0x3a, ['unsigned short']], + 'HashLinks' : [ 0x3c, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x44, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x48, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x4c, ['pointer', ['void']]], + 'DdagNode' : [ 0x50, ['pointer', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0x54, ['_LIST_ENTRY']], + 'LoadContext' : [ 0x5c, ['pointer', ['_LDRP_LOAD_CONTEXT']]], + 'ParentDllBase' : [ 0x60, ['pointer', ['void']]], + 'SwitchBackContext' : [ 0x64, ['pointer', ['void']]], + 'BaseAddressIndexNode' : [ 0x68, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0x74, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0x80, ['unsigned long']], + 'LoadTime' : [ 0x88, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x90, ['unsigned long']], + 'LoadReason' : [ 0x94, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x98, ['unsigned long']], + 'ReferenceCount' : [ 0x9c, ['unsigned long']], + 'DependentLoadFlags' : [ 0xa0, ['unsigned long']], +} ], + '_KTIMER2_COLLECTION' : [ 0x10, { + 'Tree' : [ 0x0, ['_RTL_RB_TREE']], + 'NextDueTime' : [ 0x8, ['unsigned long long']], +} ], + '_VF_WATCHDOG_IRP' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'DueTickCount' : [ 0xc, ['unsigned long']], + 'Inserted' : [ 0x10, ['unsigned char']], + 'TrackedStackLocation' : [ 0x11, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x12, ['unsigned short']], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PrivateDemandZero' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 32, native_type='unsigned long')]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_MI_PARTITION_MODWRITES' : [ 0x1d0, { + 'AttemptForCantExtend' : [ 0x0, ['_MMPAGE_FILE_EXPANSION']], + 'PageFileContract' : [ 0x38, ['_MMPAGE_FILE_EXPANSION']], + 'NumberOfMappedMdls' : [ 0x70, ['unsigned long']], + 'NumberOfMappedMdlsInUse' : [ 0x74, ['long']], + 'NumberOfMappedMdlsInUsePeak' : [ 0x78, ['unsigned long']], + 'MappedFileHeader' : [ 0x7c, ['_MMMOD_WRITER_LISTHEAD']], + 'NeedMappedMdl' : [ 0x94, ['unsigned char']], + 'NeedPageFileMdl' : [ 0x95, ['unsigned char']], + 'TransitionInserted' : [ 0x96, ['unsigned char']], + 'LastModifiedWriteError' : [ 0x98, ['long']], + 'LastMappedWriteError' : [ 0x9c, ['long']], + 'MappedFileWriteSucceeded' : [ 0xa0, ['unsigned long']], + 'MappedWriteBurstCount' : [ 0xa4, ['unsigned long']], + 'LowPriorityModWritesOutstanding' : [ 0xa8, ['unsigned long']], + 'BoostModWriteIoPriorityEvent' : [ 0xac, ['_KEVENT']], + 'ModifiedWriterThreadPriority' : [ 0xbc, ['long']], + 'ModifiedPagesLowPriorityGoal' : [ 0xc0, ['unsigned long']], + 'ModifiedPageWriterEvent' : [ 0xc4, ['_KEVENT']], + 'ModifiedWriterExitedEvent' : [ 0xd4, ['_KEVENT']], + 'WriteAllPagefilePages' : [ 0xe4, ['long']], + 'WriteAllMappedPages' : [ 0xe8, ['long']], + 'MappedPageWriterEvent' : [ 0xec, ['_KEVENT']], + 'ModWriteData' : [ 0x100, ['_MI_MODWRITE_DATA']], + 'RescanPageFilesEvent' : [ 0x130, ['_KEVENT']], + 'PagingFileHeader' : [ 0x140, ['_MMMOD_WRITER_LISTHEAD']], + 'ModifiedPageWriterThread' : [ 0x158, ['pointer', ['_ETHREAD']]], + 'ModifiedPageWriterRundown' : [ 0x15c, ['_EX_RUNDOWN_REF']], + 'PagefileScanWorkItem' : [ 0x160, ['_WORK_QUEUE_ITEM']], + 'PagefileScanCount' : [ 0x170, ['unsigned long']], + 'ClusterWritesDisabled' : [ 0x174, ['array', 2, ['long']]], + 'NotifyStoreMemoryConditions' : [ 0x17c, ['_KEVENT']], + 'DelayMappedWrite' : [ 0x18c, ['unsigned char']], + 'PagefileReservationsEnabled' : [ 0x190, ['unsigned long']], + 'PageFileCreationLock' : [ 0x194, ['_EX_PUSH_LOCK']], + 'TrimPagefileWorkItem' : [ 0x198, ['_WORK_QUEUE_ITEM']], + 'LastTrimPagefileTime' : [ 0x1a8, ['unsigned long long']], + 'WsSwapPagefileContractWorkItem' : [ 0x1b0, ['_WORK_QUEUE_ITEM']], + 'WsSwapPageFileContractionInProgress' : [ 0x1c0, ['long']], + 'WorkingSetSwapLock' : [ 0x1c4, ['_EX_PUSH_LOCK']], + 'WorkingSetInswapLock' : [ 0x1c8, ['long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_OB_EXTENDED_PARSE_PARAMETERS' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned short']], + 'RestrictedAccessMask' : [ 0x4, ['unsigned long']], + 'Silo' : [ 0x8, ['pointer', ['_EJOB']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SubsectionMappedDirect' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_RTL_AVL_TABLE' : [ 0x38, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x10, ['pointer', ['void']]], + 'WhichOrderedElement' : [ 0x14, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x18, ['unsigned long']], + 'DepthOfTree' : [ 0x1c, ['unsigned long']], + 'RestartKey' : [ 0x20, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x24, ['unsigned long']], + 'CompareRoutine' : [ 0x28, ['pointer', ['void']]], + 'AllocateRoutine' : [ 0x2c, ['pointer', ['void']]], + 'FreeRoutine' : [ 0x30, ['pointer', ['void']]], + 'TableContext' : [ 0x34, ['pointer', ['void']]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x4, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x8, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x10, ['unsigned long']], + 'ContentionCount' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x1c, ['unsigned short']], + 'SpareUSHORT' : [ 0x1e, ['unsigned short']], +} ], + '_MMWORKING_SET_EXPANSION_HEAD' : [ 0x8, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['unsigned char']], + 'DripsRequiredState' : [ 0x8, ['unsigned long']], + 'Level' : [ 0xc, ['long']], + 'ActiveStamp' : [ 0x10, ['long long']], + 'CsActiveTime' : [ 0x18, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x20, ['long long']], +} ], + '_KSCHEDULING_GROUP_POLICY' : [ 0x8, { + 'Value' : [ 0x0, ['unsigned long']], + 'Weight' : [ 0x0, ['unsigned short']], + 'MinRate' : [ 0x0, ['unsigned short']], + 'MaxRate' : [ 0x2, ['unsigned short']], + 'AllFlags' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare1' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_POLICY_DEVICE' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyImmediateDozeS4Predicted', 12: 'PolicyImmediateDozeS4PredictedNoWake', 13: 'PolicyImmediateDozeS4AdaptiveBudget', 14: 'PolicyImmediateDozeS4AdaptiveReserveNoWake', 15: 'PolicyDeviceMax'})]], + 'Notification' : [ 0xc, ['pointer', ['void']]], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'Device' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x1c, ['pointer', ['_IRP']]], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x30, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x78, { + 'SelectedCount' : [ 0x0, ['unsigned long long']], + 'VetoCount' : [ 0x8, ['unsigned long long']], + 'PreVetoCount' : [ 0x10, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'IdleDurationCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'PlatformOnlyCount' : [ 0x40, ['unsigned long long']], + 'InterruptibleCount' : [ 0x48, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x50, ['unsigned long long']], + 'CstateCheckCount' : [ 0x58, ['unsigned long long']], + 'NoCStateCount' : [ 0x60, ['unsigned long long']], + 'CoordinatedDependencyCount' : [ 0x68, ['unsigned long long']], + 'PreVetoAccounting' : [ 0x70, ['pointer', ['_PPM_VETO_ACCOUNTING']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '__unnamed_2800' : [ 0x4, { + 'FlushCompleting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'FlushInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='long')]], + 'Long' : [ 0x0, ['long']], +} ], + '_MI_PARTITION_STORES' : [ 0x58, { + 'WriteAllStoreHintedPages' : [ 0x0, ['__unnamed_2800']], + 'VirtualPageFileNumber' : [ 0x4, ['unsigned long']], + 'Registered' : [ 0x8, ['unsigned long']], + 'ReadClusterSizeMax' : [ 0xc, ['unsigned long']], + 'EvictFlushRequestCount' : [ 0x10, ['unsigned long']], + 'ModifiedWriteDisableCount' : [ 0x14, ['unsigned long']], + 'WriteIssueFailures' : [ 0x18, ['unsigned long']], + 'EvictionThread' : [ 0x1c, ['pointer', ['_ETHREAD']]], + 'EvictEvent' : [ 0x20, ['_KEVENT']], + 'EvictFlushCompleteEvent' : [ 0x30, ['_KEVENT']], + 'WriteSupportSListHead' : [ 0x40, ['_SLIST_HEADER']], + 'EvictFlushLock' : [ 0x48, ['long']], + 'ModifiedWriteFailedBitmap' : [ 0x4c, ['pointer', ['_RTL_BITMAP']]], + 'StoreProcess' : [ 0x50, ['pointer', ['_EPROCESS']]], +} ], + '_POP_FX_COMPONENT' : [ 0xc0, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x14, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x30, ['pointer', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x34, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x3c, ['long']], + 'ActiveEvent' : [ 0x40, ['_KEVENT']], + 'IdleLock' : [ 0x50, ['unsigned long']], + 'IdleConditionComplete' : [ 0x54, ['long']], + 'IdleStateComplete' : [ 0x58, ['long']], + 'IdleStamp' : [ 0x60, ['unsigned long long']], + 'CurrentIdleState' : [ 0x68, ['unsigned long']], + 'IdleStateCount' : [ 0x6c, ['unsigned long']], + 'IdleStates' : [ 0x70, ['pointer', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0x74, ['unsigned long']], + 'ProviderCount' : [ 0x78, ['unsigned long']], + 'Providers' : [ 0x7c, ['pointer', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0x80, ['unsigned long']], + 'DependentCount' : [ 0x84, ['unsigned long']], + 'Dependents' : [ 0x88, ['pointer', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0x90, ['_POP_FX_ACCOUNTING']], + 'Performance' : [ 0xb8, ['pointer', ['_POP_FX_PERF_INFO']]], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 8, ['_M128A']]], + 'Reserved4' : [ 0x120, ['array', 224, ['unsigned char']]], +} ], + '_MMPAGE_FILE_EXPANSION' : [ 0x38, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'DereferenceList' : [ 0x4, ['_LIST_ENTRY']], + 'Partition' : [ 0xc, ['pointer', ['_MI_PARTITION']]], + 'RequestedExpansionSize' : [ 0x10, ['unsigned long']], + 'ActualExpansion' : [ 0x14, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'InProgress' : [ 0x28, ['long']], + 'u' : [ 0x2c, ['_MMPAGE_FILE_EXPANSION_FLAGS']], + 'ActiveEntry' : [ 0x30, ['pointer', ['pointer', ['void']]]], + 'AttemptForCantExtend' : [ 0x34, ['unsigned char']], + 'PageFileContract' : [ 0x35, ['unsigned char']], +} ], + '_LAZY_WRITER' : [ 0x50, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x20, ['_KTIMER']], + 'ScanActive' : [ 0x48, ['unsigned char']], + 'OtherWork' : [ 0x49, ['unsigned char']], + 'PendingTeardownScan' : [ 0x4a, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x4b, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x4c, ['unsigned char']], + 'PendingPowerScan' : [ 0x4d, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x4e, ['unsigned char']], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'Unused' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ForceCollision' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Reserved2' : [ 0x14, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer', ['void']]], + 'Reserved3' : [ 0x1c, ['unsigned long']], +} ], + '_HVIEW_MAP_PIN_LOG' : [ 0x308, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Entries' : [ 0x8, ['array', 16, ['_HVIEW_MAP_PIN_LOG_ENTRY']]], +} ], + '_IO_REMOVE_LOCK' : [ 0x18, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x8, { + 'Stream' : [ 0x0, ['pointer', ['void']]], + 'Detail' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_282e' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_282e']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_MI_POOL_STATE' : [ 0x4e8, { + 'MaximumNonPagedPoolThreshold' : [ 0x0, ['unsigned long']], + 'NonPagedPoolSListMaximum' : [ 0x4, ['array', 3, ['unsigned long']]], + 'AllocatedNonPagedPool' : [ 0x10, ['unsigned long']], + 'BadPoolHead' : [ 0x14, ['_SINGLE_LIST_ENTRY']], + 'HighEventSets' : [ 0x18, ['unsigned long']], + 'HighEventSetsValid' : [ 0x1c, ['unsigned char']], + 'PoolFailures' : [ 0x20, ['array', 3, ['array', 3, ['unsigned long']]]], + 'PoolFailureReasons' : [ 0x44, ['_MI_POOL_FAILURE_REASONS']], + 'LowPagedPoolThreshold' : [ 0x70, ['unsigned long']], + 'HighPagedPoolThreshold' : [ 0x74, ['unsigned long']], + 'SpecialPoolPdesMax' : [ 0x78, ['long']], + 'NonPagedPoolNodes' : [ 0x7c, ['array', 1024, ['unsigned char']]], + 'PagedProtoPoolInfo' : [ 0x47c, ['_MM_PAGED_POOL_INFO']], + 'PagedPoolSListMaximum' : [ 0x498, ['unsigned long']], + 'PreemptiveTrims' : [ 0x49c, ['array', 4, ['unsigned long']]], + 'SpecialPagesInUsePeak' : [ 0x4ac, ['unsigned long']], + 'SpecialPoolRejected' : [ 0x4b0, ['array', 9, ['unsigned long']]], + 'SpecialPagesNonPaged' : [ 0x4d4, ['unsigned long']], + 'SpecialPoolPdes' : [ 0x4d8, ['long']], + 'SessionSpecialPoolPdesMax' : [ 0x4dc, ['unsigned long']], + 'TotalPagedPoolQuota' : [ 0x4e0, ['unsigned long']], + 'TotalNonPagedPoolQuota' : [ 0x4e4, ['unsigned long']], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x30, { + 'TransferAddress' : [ 0x0, ['pointer', ['void']]], + 'ZeroBits' : [ 0x4, ['unsigned long']], + 'MaximumStackSize' : [ 0x8, ['unsigned long']], + 'CommittedStackSize' : [ 0xc, ['unsigned long']], + 'SubSystemType' : [ 0x10, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x14, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x16, ['unsigned short']], + 'SubSystemVersion' : [ 0x14, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x18, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x1a, ['unsigned short']], + 'OperatingSystemVersion' : [ 0x18, ['unsigned long']], + 'ImageCharacteristics' : [ 0x1c, ['unsigned short']], + 'DllCharacteristics' : [ 0x1e, ['unsigned short']], + 'Machine' : [ 0x20, ['unsigned short']], + 'ImageContainsCode' : [ 0x22, ['unsigned char']], + 'ImageFlags' : [ 0x23, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ComPlusPrefer32bit' : [ 0x23, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x24, ['unsigned long']], + 'ImageFileSize' : [ 0x28, ['unsigned long']], + 'CheckSum' : [ 0x2c, ['unsigned long']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x1c, { + 'SpinLock' : [ 0x0, ['unsigned long']], + 'ConnectLock' : [ 0x4, ['_KEVENT']], + 'LineMasked' : [ 0x14, ['unsigned char']], + 'InterruptList' : [ 0x18, ['pointer', ['_KINTERRUPT']]], +} ], + '_PPM_SELECTION_DEPENDENCY' : [ 0xc, { + 'Processor' : [ 0x0, ['unsigned long']], + 'Menu' : [ 0x4, ['_PPM_SELECTION_MENU']], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_CM_WORKITEM' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x8, ['unsigned long']], + 'WorkerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Parameter' : [ 0x10, ['pointer', ['void']]], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x4, ['pointer', ['_ARBITER_ORDERING']]], +} ], + '_MI_HARDWARE_STATE' : [ 0xc8, { + 'NodeMask' : [ 0x0, ['unsigned long']], + 'NodeGraph' : [ 0x4, ['pointer', ['unsigned short']]], + 'SystemNodeInformation' : [ 0x8, ['pointer', ['_MI_SYSTEM_NODE_INFORMATION']]], + 'NumaLastRangeIndex' : [ 0xc, ['unsigned long']], + 'NumaMemoryRanges' : [ 0x10, ['pointer', ['_HAL_NODE_RANGE']]], + 'NumaTableCaptured' : [ 0x14, ['unsigned char']], + 'NodeShift' : [ 0x15, ['unsigned char']], + 'ChannelMemoryRanges' : [ 0x18, ['pointer', ['_HAL_CHANNEL_MEMORY_RANGES']]], + 'ChannelShift' : [ 0x1c, ['unsigned char']], + 'SecondLevelCacheSize' : [ 0x20, ['unsigned long']], + 'FirstLevelCacheSize' : [ 0x24, ['unsigned long']], + 'PhysicalAddressBits' : [ 0x28, ['unsigned long']], + 'AllMainMemoryMustBeCached' : [ 0x2c, ['unsigned char']], + 'TotalPagesAllowed' : [ 0x30, ['unsigned long']], + 'SecondaryColorMask' : [ 0x34, ['unsigned long']], + 'SecondaryColors' : [ 0x38, ['unsigned long']], + 'FlushTbForAttributeChange' : [ 0x3c, ['unsigned long']], + 'FlushCacheForAttributeChange' : [ 0x40, ['unsigned long']], + 'FlushCacheForPageAttributeChange' : [ 0x44, ['unsigned long']], + 'CacheFlushPromoteThreshold' : [ 0x48, ['unsigned long']], + 'FlushTbThreshold' : [ 0x4c, ['unsigned long']], + 'OptimalZeroingAttribute' : [ 0x50, ['array', 4, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'MiNonCached', 1: 'MiCached', 2: 'MiWriteCombined', 3: 'MiNotMapped'})]]]], + 'AttributeChangeRequiresReZero' : [ 0x90, ['unsigned char']], + 'ZeroCostCounts' : [ 0x98, ['array', 2, ['_MI_ZERO_COST_COUNTS']]], + 'HighestPossiblePhysicalPage' : [ 0xb8, ['unsigned long']], + 'EnclaveRegions' : [ 0xbc, ['_RTL_AVL_TREE']], + 'VsmKernelPageCount' : [ 0xc0, ['unsigned long']], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x18, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x4, ['_LIST_ENTRY']], + 'CsAccountingBlocks' : [ 0xc, ['unsigned char']], + 'BlocksDrips' : [ 0xd, ['unsigned char']], + 'PreallocatedVetoCount' : [ 0x10, ['unsigned long']], + 'PreallocatedVetoList' : [ 0x14, ['pointer', ['_PPM_VETO_ENTRY']]], +} ], + '__unnamed_2859' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_2859']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_SYSPTES_HEADER' : [ 0x8c, { + 'ListHead' : [ 0x0, ['array', 16, ['_LIST_ENTRY']]], + 'Count' : [ 0x80, ['unsigned long']], + 'NumberOfEntries' : [ 0x84, ['unsigned long']], + 'NumberOfEntriesPeak' : [ 0x88, ['unsigned long']], +} ], + '_MI_ERROR_STATE' : [ 0xa8, { + 'BadMemoryEventEntry' : [ 0x0, ['_MI_BAD_MEMORY_EVENT_ENTRY']], + 'ProbeRaises' : [ 0x28, ['_MI_PROBE_RAISE_TRACKER']], + 'ForcedCommits' : [ 0x68, ['_MI_FORCED_COMMITS']], + 'WsleFailures' : [ 0x70, ['array', 2, ['unsigned long']]], + 'WsLinear' : [ 0x78, ['unsigned long']], + 'PageHashErrors' : [ 0x7c, ['unsigned long']], + 'CheckZeroCount' : [ 0x80, ['unsigned long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x84, ['long']], + 'BadPagesDetected' : [ 0x88, ['long']], + 'ScrubPasses' : [ 0x8c, ['long']], + 'ScrubBadPagesFound' : [ 0x90, ['long']], + 'UserViewFailures' : [ 0x94, ['unsigned long']], + 'UserViewCollisionFailures' : [ 0x98, ['unsigned long']], + 'ResavailFailures' : [ 0x9c, ['_MI_RESAVAIL_FAILURES']], + 'PendingBadPages' : [ 0xa4, ['unsigned char']], + 'InitFailure' : [ 0xa5, ['unsigned char']], + 'StopBadMaps' : [ 0xa6, ['unsigned char']], +} ], + '_PROC_PERF_DOMAIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x8, ['pointer', ['_KPRCB']]], + 'Members' : [ 0xc, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0x18, ['unsigned long']], + 'EfficiencyClass' : [ 0x1c, ['unsigned char']], + 'NominalPerformanceClass' : [ 0x1d, ['unsigned char']], + 'HighestPerformanceClass' : [ 0x1e, ['unsigned char']], + 'Spare' : [ 0x1f, ['unsigned char']], + 'Processors' : [ 0x20, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0x24, ['pointer', ['void']]], + 'TimeWindowHandler' : [ 0x28, ['pointer', ['void']]], + 'BoostPolicyHandler' : [ 0x2c, ['pointer', ['void']]], + 'BoostModeHandler' : [ 0x30, ['pointer', ['void']]], + 'EnergyPerfPreferenceHandler' : [ 0x34, ['pointer', ['void']]], + 'AutonomousActivityWindowHandler' : [ 0x38, ['pointer', ['void']]], + 'AutonomousModeHandler' : [ 0x3c, ['pointer', ['void']]], + 'ReinitializeHandler' : [ 0x40, ['pointer', ['void']]], + 'PerfSelectionHandler' : [ 0x44, ['pointer', ['void']]], + 'PerfControlHandler' : [ 0x48, ['pointer', ['void']]], + 'MaxFrequency' : [ 0x4c, ['unsigned long']], + 'NominalFrequency' : [ 0x50, ['unsigned long']], + 'MaxPercent' : [ 0x54, ['unsigned long']], + 'MinPerfPercent' : [ 0x58, ['unsigned long']], + 'MinThrottlePercent' : [ 0x5c, ['unsigned long']], + 'MinimumRelativePerformance' : [ 0x60, ['unsigned long long']], + 'NominalRelativePerformance' : [ 0x68, ['unsigned long long']], + 'Coordination' : [ 0x70, ['unsigned char']], + 'HardPlatformCap' : [ 0x71, ['unsigned char']], + 'AffinitizeControl' : [ 0x72, ['unsigned char']], + 'EfficientThrottle' : [ 0x73, ['unsigned char']], + 'AutonomousMode' : [ 0x74, ['unsigned char']], + 'SelectedPercent' : [ 0x78, ['unsigned long']], + 'SelectedFrequency' : [ 0x7c, ['unsigned long']], + 'DesiredPercent' : [ 0x80, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x84, ['unsigned long']], + 'MinPolicyPercent' : [ 0x88, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x8c, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x90, ['unsigned long']], + 'GuaranteedPercent' : [ 0x94, ['unsigned long']], + 'TolerancePercent' : [ 0x98, ['unsigned long']], + 'SelectedState' : [ 0xa0, ['unsigned long long']], + 'PerfChangeTime' : [ 0xa8, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0xb0, ['unsigned long']], + 'Force' : [ 0xb4, ['unsigned char']], + 'ProvideGuidance' : [ 0xb5, ['unsigned char']], +} ], + '_MI_COMMON_PAGE_STATE' : [ 0x40, { + 'PageOfOnesPfn' : [ 0x0, ['pointer', ['_MMPFN']]], + 'PageOfOnes' : [ 0x4, ['unsigned long']], + 'DummyPagePfn' : [ 0x8, ['pointer', ['_MMPFN']]], + 'DummyPage' : [ 0xc, ['unsigned long']], + 'PageOfZeroes' : [ 0x10, ['unsigned long']], + 'ZeroMapping' : [ 0x14, ['pointer', ['void']]], + 'OnesMapping' : [ 0x18, ['pointer', ['void']]], + 'ZeroCrc' : [ 0x20, ['unsigned long long']], + 'OnesCrc' : [ 0x28, ['unsigned long long']], + 'BitmapGapFrames' : [ 0x30, ['array', 2, ['unsigned long']]], + 'PfnGapFrames' : [ 0x38, ['array', 2, ['unsigned long']]], +} ], + '_RTL_BALANCED_LINKS' : [ 0x10, { + 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x4, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x8, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0xc, ['unsigned char']], + 'Reserved' : [ 0xd, ['array', 3, ['unsigned char']]], +} ], + '_HEAP_EXTENDED_ENTRY' : [ 0x8, { + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x20, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'IoTracker' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 38, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_POP_COOLING_EXTENSION' : [ 0x48, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'RequestListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x10, ['_POP_RW_LOCK']], + 'DeviceObject' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'NotificationEntry' : [ 0x1c, ['pointer', ['void']]], + 'Enabled' : [ 0x20, ['unsigned char']], + 'ActiveEngaged' : [ 0x21, ['unsigned char']], + 'ThrottleLimit' : [ 0x22, ['unsigned char']], + 'UpdatingToCurrent' : [ 0x23, ['unsigned char']], + 'RemovalFlushEvent' : [ 0x24, ['pointer', ['_KEVENT']]], + 'PnpFlushEvent' : [ 0x28, ['pointer', ['_KEVENT']]], + 'Interface' : [ 0x2c, ['_THERMAL_COOLING_INTERFACE']], +} ], + '__unnamed_2890' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x54, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x4, ['__unnamed_2890']], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x14, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x10, ['unsigned char']], +} ], + '_POOL_HEADER' : [ 0x8, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], + 'PoolTagHash' : [ 0x6, ['unsigned short']], +} ], + '_POP_POWER_SETTING_VALUES' : [ 0x13c, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'PopPolicy' : [ 0x4, ['_SYSTEM_POWER_POLICY']], + 'CurrentAcDcPowerState' : [ 0xec, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'AwayModeEnabled' : [ 0xf0, ['unsigned char']], + 'AwayModeEngaged' : [ 0xf1, ['unsigned char']], + 'AwayModePolicyAllowed' : [ 0xf2, ['unsigned char']], + 'AwayModeIgnoreUserPresent' : [ 0xf4, ['long']], + 'AwayModeIgnoreAction' : [ 0xf8, ['long']], + 'DisableFastS4' : [ 0xfc, ['unsigned char']], + 'DisableStandbyStates' : [ 0xfd, ['unsigned char']], + 'UnattendSleepTimeout' : [ 0x100, ['unsigned long']], + 'DiskIgnoreTime' : [ 0x104, ['unsigned long']], + 'DeviceIdlePolicy' : [ 0x108, ['unsigned long']], + 'VideoDimTimeout' : [ 0x10c, ['unsigned long']], + 'VideoNormalBrightness' : [ 0x110, ['unsigned long']], + 'VideoDimBrightness' : [ 0x114, ['unsigned long']], + 'AlsOffset' : [ 0x118, ['unsigned long']], + 'AlsEnabled' : [ 0x11c, ['unsigned long']], + 'EsBrightness' : [ 0x120, ['unsigned long']], + 'SwitchShutdownForced' : [ 0x124, ['unsigned char']], + 'SystemCoolingPolicy' : [ 0x128, ['unsigned long']], + 'MediaBufferingEngaged' : [ 0x12c, ['unsigned char']], + 'OffloadedAudio' : [ 0x12d, ['unsigned char']], + 'NonOffloadedAudio' : [ 0x12e, ['unsigned char']], + 'FullscreenVideoPlayback' : [ 0x12f, ['unsigned char']], + 'EsBatteryThreshold' : [ 0x130, ['unsigned long']], + 'EsAggressive' : [ 0x134, ['unsigned char']], + 'EsUserAwaySetting' : [ 0x135, ['unsigned char']], + 'ConnectivityInStandby' : [ 0x138, ['unsigned long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x8, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'TaggedPercent' : [ 0x5, ['array', 2, ['unsigned char']]], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '__unnamed_28a3' : [ 0x4, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_28a3']], + 'EndVa' : [ 0x4, ['pointer', ['void']]], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_MI_ZERO_COST_COUNTS' : [ 0x10, { + 'NativeSum' : [ 0x0, ['unsigned long long']], + 'CachedSum' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x50, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x28, ['_KDPC']], + 'WorkOrder' : [ 0x48, ['pointer', ['_POP_FX_WORK_ORDER']]], +} ], + '_ARBITER_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ArbiterHandler' : [ 0x10, ['pointer', ['void']]], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_28b8' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x10, { + 'Parameters' : [ 0x0, ['__unnamed_28b8']], +} ], + '__unnamed_28bc' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_28c0' : [ 0x14, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_28c2' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_28c4' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_28c6' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_28c8' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_28ca' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_28cc' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_28ce' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_28d0' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_28d2' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_28d4' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_28bc']], + 'Memory' : [ 0x0, ['__unnamed_28bc']], + 'Interrupt' : [ 0x0, ['__unnamed_28c0']], + 'Dma' : [ 0x0, ['__unnamed_28c2']], + 'DmaV3' : [ 0x0, ['__unnamed_28c4']], + 'Generic' : [ 0x0, ['__unnamed_28bc']], + 'DevicePrivate' : [ 0x0, ['__unnamed_28c6']], + 'BusNumber' : [ 0x0, ['__unnamed_28c8']], + 'ConfigData' : [ 0x0, ['__unnamed_28ca']], + 'Memory40' : [ 0x0, ['__unnamed_28cc']], + 'Memory48' : [ 0x0, ['__unnamed_28ce']], + 'Memory64' : [ 0x0, ['__unnamed_28d0']], + 'Connection' : [ 0x0, ['__unnamed_28d2']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_28d4']], +} ], + '_HEAP_UNPACKED_ENTRY' : [ 0x8, { + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['unsigned long']], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x8, ['_LIST_ENTRY']], + 'Address' : [ 0x10, ['pointer', ['void']]], + 'Size' : [ 0x14, ['unsigned long']], +} ], + '_DRIVER_EXTENSION' : [ 0x28, { + 'DriverObject' : [ 0x0, ['pointer', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x4, ['pointer', ['void']]], + 'Count' : [ 0x8, ['unsigned long']], + 'ServiceKeyName' : [ 0xc, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x14, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x1c, ['pointer', ['void']]], + 'DvCallbacks' : [ 0x20, ['pointer', ['void']]], + 'VerifierContext' : [ 0x24, ['pointer', ['void']]], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x14, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'Traits' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x8, ['pointer', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0xc, ['pointer', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x10, ['pointer', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x14, ['pointer', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned short']], + 'ReplyIndex' : [ 0x1a, ['unsigned short']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_MI_PARTITION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PageListsInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StoreReservedPagesCharged' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PureHoldingPartition' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0x58, { + 'Count' : [ 0x0, ['unsigned long']], + 'Vectors' : [ 0x8, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_NON_PAGED_DEBUG_INFO' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Machine' : [ 0x8, ['unsigned short']], + 'Characteristics' : [ 0xa, ['unsigned short']], + 'TimeDateStamp' : [ 0xc, ['unsigned long']], + 'CheckSum' : [ 0x10, ['unsigned long']], + 'SizeOfImage' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x4, { + 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_MMMOD_WRITER_LISTHEAD' : [ 0x18, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Gate' : [ 0x8, ['_KGATE']], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '__unnamed_28f8' : [ 0x8, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0xa0, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x8, ['__unnamed_28f8']], + 'Irp' : [ 0x10, ['pointer', ['_IRP']]], + 'u1' : [ 0x14, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x18, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x1c, ['_KAPC']], + 'ByteCount' : [ 0x4c, ['unsigned long']], + 'ChargedPages' : [ 0x50, ['unsigned long']], + 'PagingFile' : [ 0x54, ['pointer', ['_MMPAGING_FILE']]], + 'File' : [ 0x58, ['pointer', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x5c, ['pointer', ['_CONTROL_AREA']]], + 'FileResource' : [ 0x60, ['pointer', ['_ERESOURCE']]], + 'WriteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0x70, ['_LARGE_INTEGER']], + 'Partition' : [ 0x78, ['pointer', ['_MI_PARTITION']]], + 'PointerMdl' : [ 0x7c, ['pointer', ['_MDL']]], + 'Mdl' : [ 0x80, ['_MDL']], + 'Page' : [ 0x9c, ['array', 1, ['unsigned long']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0x50, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer', ['_IRP']]], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x10, ['unsigned char']], + 'IrpOplocksR' : [ 0x14, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x1c, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x24, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x2c, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x34, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x3c, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x44, ['pointer', ['_GUID']]], + 'OplockState' : [ 0x48, ['unsigned long']], + 'FastMutex' : [ 0x4c, ['pointer', ['_FAST_MUTEX']]], +} ], + '__unnamed_2901' : [ 0x8, { + 'UserData' : [ 0x0, ['pointer', ['void']]], + 'Owner' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_2902' : [ 0x8, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_2901']], + 'Merged' : [ 0x10, ['__unnamed_2902']], + 'Attributes' : [ 0x18, ['unsigned char']], + 'PublicFlags' : [ 0x19, ['unsigned char']], + 'PrivateFlags' : [ 0x1a, ['unsigned short']], + 'ListEntry' : [ 0x1c, ['_LIST_ENTRY']], +} ], + '__unnamed_2906' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2908' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_290a' : [ 0xc, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_290c' : [ 0xc, { + 'Raw' : [ 0x0, ['__unnamed_290a']], + 'Translated' : [ 0x0, ['__unnamed_2908']], +} ], + '__unnamed_290e' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2910' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_2912' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2914' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2916' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2918' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_291a' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_291c' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_2906']], + 'Port' : [ 0x0, ['__unnamed_2906']], + 'Interrupt' : [ 0x0, ['__unnamed_2908']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_290c']], + 'Memory' : [ 0x0, ['__unnamed_2906']], + 'Dma' : [ 0x0, ['__unnamed_290e']], + 'DmaV3' : [ 0x0, ['__unnamed_2910']], + 'DevicePrivate' : [ 0x0, ['__unnamed_28c6']], + 'BusNumber' : [ 0x0, ['__unnamed_2912']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_2914']], + 'Memory40' : [ 0x0, ['__unnamed_2916']], + 'Memory48' : [ 0x0, ['__unnamed_2918']], + 'Memory64' : [ 0x0, ['__unnamed_291a']], + 'Connection' : [ 0x0, ['__unnamed_28d2']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_291c']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x40, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer', ['void']]]], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_ETW_FILTER_EVENT_NAME_DATA' : [ 0x28, { + 'FilterIn' : [ 0x0, ['unsigned char']], + 'Level' : [ 0x1, ['unsigned char']], + 'MatchAnyKeyword' : [ 0x8, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x10, ['unsigned long long']], + 'NameTable' : [ 0x18, ['_RTL_HASH_TABLE']], +} ], + '_MI_VISIBLE_STATE' : [ 0x880, { + 'SpecialPool' : [ 0x0, ['_MI_SPECIAL_POOL']], + 'SessionWsList' : [ 0x48, ['_LIST_ENTRY']], + 'SessionIdBitmap' : [ 0x50, ['pointer', ['_RTL_BITMAP']]], + 'PagedPoolInfo' : [ 0x54, ['_MM_PAGED_POOL_INFO']], + 'MaximumNonPagedPoolInPages' : [ 0x70, ['unsigned long']], + 'SizeOfPagedPoolInPages' : [ 0x74, ['unsigned long']], + 'SystemPteInfo' : [ 0x78, ['_MI_SYSTEM_PTE_TYPE']], + 'NonPagedPoolCommit' : [ 0xb0, ['unsigned long']], + 'BootCommit' : [ 0xb4, ['unsigned long']], + 'MdlPagesAllocated' : [ 0xb8, ['unsigned long']], + 'SystemPageTableCommit' : [ 0xbc, ['unsigned long']], + 'SpecialPagesInUse' : [ 0xc0, ['unsigned long']], + 'WsOverheadPages' : [ 0xc4, ['unsigned long']], + 'VadBitmapPages' : [ 0xc8, ['unsigned long']], + 'ProcessCommit' : [ 0xcc, ['unsigned long']], + 'SharedCommit' : [ 0xd0, ['unsigned long']], + 'DriverCommit' : [ 0xd4, ['long']], + 'SystemWs' : [ 0x100, ['array', 3, ['_MMSUPPORT_FULL']]], + 'SystemCacheShared' : [ 0x2c0, ['_MMSUPPORT_SHARED']], + 'MapCacheFailures' : [ 0x2e4, ['unsigned long']], + 'PagefileHashPages' : [ 0x2e8, ['unsigned long']], + 'PteHeader' : [ 0x2ec, ['_SYSPTES_HEADER']], + 'SessionSpecialPool' : [ 0x378, ['pointer', ['_MI_SPECIAL_POOL']]], + 'SystemVaTypeCount' : [ 0x37c, ['array', 15, ['unsigned long']]], + 'SystemVaType' : [ 0x3b8, ['array', 1024, ['unsigned char']]], + 'SystemVaTypeCountFailures' : [ 0x7b8, ['array', 15, ['unsigned long']]], + 'SystemVaTypeCountLimit' : [ 0x7f4, ['array', 15, ['unsigned long']]], + 'SystemVaTypeCountPeak' : [ 0x830, ['array', 15, ['unsigned long']]], + 'SystemAvailableVa' : [ 0x86c, ['unsigned long']], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_CM_COMPONENT_HASH' : [ 0x4, { + 'Hash' : [ 0x0, ['unsigned long']], +} ], + '_KSPECIAL_REGISTERS' : [ 0x54, { + 'Cr0' : [ 0x0, ['unsigned long']], + 'Cr2' : [ 0x4, ['unsigned long']], + 'Cr3' : [ 0x8, ['unsigned long']], + 'Cr4' : [ 0xc, ['unsigned long']], + 'KernelDr0' : [ 0x10, ['unsigned long']], + 'KernelDr1' : [ 0x14, ['unsigned long']], + 'KernelDr2' : [ 0x18, ['unsigned long']], + 'KernelDr3' : [ 0x1c, ['unsigned long']], + 'KernelDr6' : [ 0x20, ['unsigned long']], + 'KernelDr7' : [ 0x24, ['unsigned long']], + 'Gdtr' : [ 0x28, ['_DESCRIPTOR']], + 'Idtr' : [ 0x30, ['_DESCRIPTOR']], + 'Tr' : [ 0x38, ['unsigned short']], + 'Ldtr' : [ 0x3a, ['unsigned short']], + 'Xcr0' : [ 0x3c, ['unsigned long long']], + 'ExceptionList' : [ 0x44, ['unsigned long']], + 'Reserved' : [ 0x48, ['array', 3, ['unsigned long']]], +} ], + '_RH_OP_CONTEXT' : [ 0x24, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x8, ['pointer', ['_IRP']]], + 'OplockRequestFileObject' : [ 0xc, ['pointer', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x14, ['pointer', ['_ETHREAD']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'AtomicLinks' : [ 0x1c, ['_LIST_ENTRY']], +} ], + '_MSUBSECTION' : [ 0x44, { + 'Core' : [ 0x0, ['_SUBSECTION']], + 'SubsectionNode' : [ 0x28, ['_RTL_BALANCED_NODE']], + 'DereferenceList' : [ 0x34, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x3c, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x40, ['unsigned long']], +} ], + '_PROC_PERF_CHECK' : [ 0xc0, { + 'LastActive' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'LastStall' : [ 0x10, ['unsigned long long']], + 'Snap' : [ 0x18, ['_PROC_PERF_CHECK_SNAP']], + 'TempSnap' : [ 0x68, ['_PROC_PERF_CHECK_SNAP']], + 'TaggedThreadPercent' : [ 0xb8, ['array', 2, ['unsigned char']]], + 'Class0FloorPerfSelection' : [ 0xba, ['unsigned char']], + 'Class1MinimumPerfSelection' : [ 0xbb, ['unsigned char']], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_MMWSL_FULL' : [ 0x120, { + 'Instance' : [ 0x0, ['_MMWSL_INSTANCE']], + 'Shared' : [ 0xe0, ['_MMWSL_SHARED']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x104, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long']], + 'Thread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'AbortEvent' : [ 0x10, ['pointer', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x14, ['pointer', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x18, ['pointer', ['_KSEMAPHORE']]], + 'Order' : [ 0x1c, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0xec, ['_LIST_ENTRY']], + 'Status' : [ 0xf4, ['long']], + 'FailedDevice' : [ 0xf8, ['pointer', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0xfc, ['unsigned char']], + 'Cancelled' : [ 0xfd, ['unsigned char']], + 'IgnoreErrors' : [ 0xfe, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0xff, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x100, ['unsigned char']], +} ], + '_THERMAL_INFORMATION' : [ 0x4c, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0xc, ['unsigned long']], + 'SamplingPeriod' : [ 0x10, ['unsigned long']], + 'CurrentTemperature' : [ 0x14, ['unsigned long']], + 'PassiveTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x60, { + 'FileName' : [ 0x0, ['pointer', ['wchar']]], + 'BaseName' : [ 0x4, ['pointer', ['wchar']]], + 'RegRootName' : [ 0x8, ['pointer', ['wchar']]], + 'CmHive' : [ 0xc, ['pointer', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x10, ['unsigned long']], + 'CmHiveFlags' : [ 0x14, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x18, ['unsigned long']], + 'CmHive2' : [ 0x1c, ['pointer', ['_CMHIVE']]], + 'HiveMounted' : [ 0x20, ['unsigned char']], + 'ThreadFinished' : [ 0x21, ['unsigned char']], + 'ThreadStarted' : [ 0x22, ['unsigned char']], + 'Allocate' : [ 0x23, ['unsigned char']], + 'WinPERequired' : [ 0x24, ['unsigned char']], + 'StartEvent' : [ 0x28, ['_KEVENT']], + 'FinishedEvent' : [ 0x38, ['_KEVENT']], + 'MountLock' : [ 0x48, ['_KEVENT']], + 'FilePath' : [ 0x58, ['_UNICODE_STRING']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0xd0, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x4, ['pointer', ['pointer', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x8, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_PPM_VETO_ENTRY' : [ 0x38, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'VetoReason' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'HitCount' : [ 0x10, ['unsigned long long']], + 'LastActivationTime' : [ 0x18, ['unsigned long long']], + 'TotalActiveTime' : [ 0x20, ['unsigned long long']], + 'CsActivationTime' : [ 0x28, ['unsigned long long']], + 'CsActiveTime' : [ 0x30, ['unsigned long long']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_BAD_MEMORY_EVENT_ENTRY' : [ 0x28, { + 'BugCheckCode' : [ 0x0, ['unsigned long']], + 'Active' : [ 0x4, ['long']], + 'Data' : [ 0x8, ['unsigned long']], + 'PhysicalAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'WorkItem' : [ 0x18, ['_WORK_QUEUE_ITEM']], +} ], + '_KWAIT_CHAIN_ENTRY' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Event' : [ 0x4, ['_KEVENT']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned char']], + 'LayerSemantics' : [ 0xd, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Spare1' : [ 0xd, ['BitField', dict(start_bit = 2, end_bit = 7, native_type='unsigned char')]], + 'InheritClass' : [ 0xd, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0xe, ['unsigned short']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x14, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x4, ['_RTL_BITMAP']], + 'HashTable' : [ 0xc, ['pointer', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x10, ['unsigned char']], +} ], + '_MMDEREFERENCE_SEGMENT_HEADER' : [ 0x1c, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'ListHead' : [ 0x14, ['_LIST_ENTRY']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2978' : [ 0x4, { + 'ChannelsHotCold' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_NODE_INFORMATION' : [ 0xbc, { + 'LargePageFreeCount' : [ 0x0, ['array', 2, ['array', 2, ['unsigned long']]]], + 'LargePages' : [ 0x10, ['array', 2, ['array', 2, ['array', 2, ['array', 1, ['_LIST_ENTRY']]]]]], + 'LargePagesCount' : [ 0x50, ['array', 2, ['array', 2, ['array', 2, ['array', 1, ['unsigned long']]]]]], + 'LargePageRebuildTimer' : [ 0x70, ['_MI_REBUILD_LARGE_PAGE_TIMER']], + 'FreeCount' : [ 0x8c, ['array', 2, ['unsigned long']]], + 'TotalPages' : [ 0x94, ['array', 1, ['unsigned long']]], + 'TotalPagesEntireNode' : [ 0x98, ['unsigned long']], + 'MmShiftedColor' : [ 0x9c, ['unsigned long']], + 'Color' : [ 0xa0, ['unsigned long']], + 'ChannelFreeCount' : [ 0xa4, ['array', 1, ['array', 2, ['unsigned long']]]], + 'Flags' : [ 0xac, ['__unnamed_2978']], + 'NodeLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'ChannelStatus' : [ 0xb4, ['unsigned char']], + 'ChannelOrdering' : [ 0xb5, ['array', 1, ['unsigned char']]], + 'LockedChannelOrdering' : [ 0xb6, ['array', 1, ['unsigned char']]], + 'PowerAttribute' : [ 0xb7, ['array', 1, ['unsigned char']]], + 'LargePageLock' : [ 0xb8, ['unsigned long']], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_TRIAGE_POP_FX_DEVICE' : [ 0x20, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'IrpData' : [ 0xc, ['pointer', ['_TRIAGE_POP_IRP_DATA']]], + 'Status' : [ 0x10, ['long']], + 'PowerReqCall' : [ 0x14, ['long']], + 'PowerNotReqCall' : [ 0x18, ['long']], + 'DeviceNode' : [ 0x1c, ['pointer', ['_TRIAGE_DEVICE_NODE']]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_LPCP_PORT_QUEUE' : [ 0x10, { + 'NonPagedPortQueue' : [ 0x0, ['pointer', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x4, ['pointer', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x40, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0xc, ['_KEVENT']], + 'AccessBufferMax' : [ 0x1c, ['unsigned long']], + 'AccessBufferList' : [ 0x20, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x28, ['long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x30, ['long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x8, ['pointer', ['void']]], + 'CallersCaller' : [ 0xc, ['pointer', ['void']]], + 'CallCount' : [ 0x10, ['unsigned long']], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0xc, { + 'Previous' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x4, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x10, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0xc, ['unsigned long']], +} ], + '_MI_SYSTEM_NODE_INFORMATION' : [ 0xb0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x8, ['array', 3, ['_SLIST_HEADER']]], + 'NonPagedPoolSListHeadNx' : [ 0x20, ['array', 3, ['_SLIST_HEADER']]], + 'CachedKernelStacks' : [ 0x38, ['array', 2, ['_CACHED_KSTACK_LIST']]], + 'NonPagedPoolLowestPage' : [ 0x68, ['unsigned long']], + 'NonPagedPoolHighestPage' : [ 0x6c, ['unsigned long']], + 'AllocatedNonPagedPool' : [ 0x70, ['unsigned long']], + 'PartialLargePoolRegions' : [ 0x74, ['unsigned long']], + 'PagesInPartialLargePoolRegions' : [ 0x78, ['unsigned long']], + 'CachedNonPagedPoolCount' : [ 0x7c, ['unsigned long']], + 'NonPagedPoolSpinLock' : [ 0x80, ['unsigned long']], + 'CachedNonPagedPool' : [ 0x84, ['pointer', ['_MMPFN']]], + 'NonPagedPoolFirstVa' : [ 0x88, ['pointer', ['void']]], + 'NonPagedPoolLastVa' : [ 0x8c, ['pointer', ['void']]], + 'NonPagedBitMap' : [ 0x90, ['array', 3, ['_RTL_BITMAP']]], + 'NonPagedHint' : [ 0xa8, ['array', 2, ['unsigned long']]], +} ], + '_MI_PAGE_COMBINING_SUPPORT' : [ 0xd8, { + 'Partition' : [ 0x0, ['pointer', ['_MI_PARTITION']]], + 'ArbitraryPfnMapList' : [ 0x4, ['_LIST_ENTRY']], + 'FreeCombinePoolItem' : [ 0xc, ['_MI_COMBINE_WORKITEM']], + 'CombiningThreadCount' : [ 0x20, ['unsigned long']], + 'CombinePageFreeList' : [ 0x24, ['_LIST_ENTRY']], + 'CombineFreeListLock' : [ 0x2c, ['unsigned long']], + 'CombinePageListHeads' : [ 0x30, ['array', 16, ['_MI_COMBINE_PAGE_LISTHEAD']]], + 'PageCombineStats' : [ 0xb0, ['_MI_PAGE_COMBINE_STATISTICS']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x38, { + 'BadPageCount' : [ 0x0, ['unsigned long']], + 'BadPagesDetected' : [ 0x4, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0x8, ['long']], + 'ScrubPasses' : [ 0xc, ['long']], + 'ScrubBadPagesFound' : [ 0x10, ['long']], + 'PageHashErrors' : [ 0x14, ['unsigned long']], + 'FeatureBits' : [ 0x18, ['unsigned long long']], + 'TimeZoneId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['_MI_FLAGS']], + 'VsmConnection' : [ 0x28, ['pointer', ['void']]], + 'ExceptionChainTerminator' : [ 0x2c, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'ExceptionChainTerminatorRecord' : [ 0x30, ['_EXCEPTION_REGISTRATION_RECORD']], +} ], + '_MI_FORCED_COMMITS' : [ 0x8, { + 'Regular' : [ 0x0, ['unsigned long']], + 'Wrap' : [ 0x4, ['unsigned long']], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x10, { + 'SharedExportThunks' : [ 0x0, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x4, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x8, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0xc, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_MI_REBUILD_LARGE_PAGE_TIMER' : [ 0x1c, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'SecondsLeft' : [ 0x10, ['unsigned char']], + 'RebuildActive' : [ 0x11, ['unsigned char']], + 'NextPassDelta' : [ 0x12, ['unsigned char']], + 'LargeSubPagesActive' : [ 0x13, ['unsigned char']], + 'SequenceNumber' : [ 0x14, ['unsigned long']], + 'WaitList' : [ 0x18, ['pointer', ['_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK']]], +} ], + '_MI_IO_PAGE_STATE' : [ 0x40, { + 'IoPfnLock' : [ 0x0, ['unsigned long']], + 'IoPfnRoot' : [ 0x4, ['array', 3, ['_RTL_AVL_TREE']]], + 'UnusedCachedMaps' : [ 0x10, ['_LIST_ENTRY']], + 'OldestCacheFlushTimeStamp' : [ 0x18, ['unsigned long']], + 'IoCacheStats' : [ 0x1c, ['_MI_IO_CACHE_STATS']], + 'InvariantIoSpace' : [ 0x3c, ['_RTL_AVL_TREE']], +} ], + '_ETW_REPLY_QUEUE' : [ 0x2c, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x28, ['long']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_29b8' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned long']], + 'NumberOfPtesToFree' : [ 0x0, ['unsigned long']], +} ], + '_MI_PER_SESSION_PROTOS' : [ 0x18, { + 'SessionProtoNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeList' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'DriverAddress' : [ 0x0, ['pointer', ['void']]], + 'SessionId' : [ 0xc, ['unsigned long']], + 'Subsection' : [ 0xc, ['pointer', ['_SUBSECTION']]], + 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], + 'u2' : [ 0x14, ['__unnamed_29b8']], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_MI_MODWRITE_DATA' : [ 0x30, { + 'PagesLoad' : [ 0x0, ['long']], + 'PagesAverage' : [ 0x4, ['unsigned long']], + 'AverageAvailablePages' : [ 0x8, ['unsigned long']], + 'PagesWritten' : [ 0xc, ['unsigned long']], + 'WritesIssued' : [ 0x10, ['unsigned long']], + 'IgnoredReservationsCount' : [ 0x14, ['unsigned long']], + 'FreedReservationsCount' : [ 0x18, ['unsigned long']], + 'WriteBurstCount' : [ 0x1c, ['unsigned long']], + 'IgnoreReservationsStartTime' : [ 0x20, ['unsigned long long']], + 'ReservationClusterInfo' : [ 0x28, ['_MI_RESERVATION_CLUSTER_INFO']], + 'IgnoreReservations' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'Spare1' : [ 0x2e, ['unsigned short']], +} ], + '_PROC_IDLE_POLICY' : [ 0x6, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], + 'ForceLightIdle' : [ 0x5, ['unsigned char']], +} ], + '_MI_RESAVAIL_FAILURES' : [ 0x8, { + 'Wrap' : [ 0x0, ['unsigned long']], + 'NoCharge' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_WORK_ON_BEHALF_TICKET' : [ 0x8, { + 'ThreadId' : [ 0x0, ['unsigned long']], + 'ThreadCreationTimeLow' : [ 0x4, ['unsigned long']], +} ], + '_PO_HIBER_PERF' : [ 0x1e8, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'HiberChecksumTicks' : [ 0x30, ['unsigned long long']], + 'HiberChecksumIoTicks' : [ 0x38, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x40, ['_LARGE_INTEGER']], + 'HibernateCompleteTimestamp' : [ 0x48, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x50, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x54, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x58, ['unsigned long']], + 'ResumeAppTicks' : [ 0x60, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x68, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x70, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x78, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x80, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x88, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x90, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x98, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0xa8, ['unsigned long long']], + 'ResumeMapTicks' : [ 0xb0, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xb8, ['unsigned long long']], + 'ResumeChecksumTicks' : [ 0xc0, ['unsigned long long']], + 'ResumeChecksumIoTicks' : [ 0xc8, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xd0, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xd8, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xe0, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xe8, ['unsigned long long']], + 'HalTscOffset' : [ 0xf0, ['unsigned long long']], + 'HvlTscOffset' : [ 0xf8, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0x100, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0x108, ['unsigned long long']], + 'IoBoundedness' : [ 0x110, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0x118, ['unsigned long long']], + 'KernelIoTicks' : [ 0x120, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x128, ['unsigned long long']], + 'ReadCheckCount' : [ 0x130, ['unsigned long long']], + 'KernelInitTicks' : [ 0x138, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x140, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x148, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x150, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x158, ['unsigned long long']], + 'KernelChecksumTicks' : [ 0x160, ['unsigned long long']], + 'KernelChecksumIoTicks' : [ 0x168, ['unsigned long long']], + 'AnimationStart' : [ 0x170, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x178, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x180, ['unsigned long']], + 'SecurePagesProcessed' : [ 0x188, ['unsigned long long']], + 'BootPagesProcessed' : [ 0x190, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x198, ['unsigned long long']], + 'BootBytesWritten' : [ 0x1a0, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x1a8, ['unsigned long long']], + 'BootPagesWritten' : [ 0x1b0, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x1b8, ['unsigned long long']], + 'BytesWritten' : [ 0x1c0, ['unsigned long long']], + 'PagesWritten' : [ 0x1c8, ['unsigned long']], + 'FileRuns' : [ 0x1cc, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x1d0, ['unsigned long']], + 'MaxHuffRatio' : [ 0x1d4, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x1d8, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1e0, ['unsigned long long']], +} ], + '_KTRANSACTION' : [ 0x1e0, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'Mutex' : [ 0x14, ['_KMUTANT']], + 'TreeTx' : [ 0x34, ['pointer', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x38, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x4c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0x60, ['_GUID']], + 'State' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0x74, ['unsigned long']], + 'EnlistmentHead' : [ 0x78, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x80, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0x84, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0x88, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0x8c, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0x90, ['unsigned long']], + 'PendingResponses' : [ 0x94, ['unsigned long']], + 'SuperiorEnlistment' : [ 0x98, ['pointer', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xa0, ['_CLS_LSN']], + 'PromotedEntry' : [ 0xa8, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0xb0, ['pointer', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0xb4, ['pointer', ['void']]], + 'IsolationLevel' : [ 0xb8, ['unsigned long']], + 'IsolationFlags' : [ 0xbc, ['unsigned long']], + 'Timeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'Description' : [ 0xc8, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0xd0, ['pointer', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0xd4, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0xe4, ['_KDPC']], + 'RollbackTimer' : [ 0x108, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x130, ['_LIST_ENTRY']], + 'Outcome' : [ 0x138, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x13c, ['pointer', ['_KTM']]], + 'CommitReservation' : [ 0x140, ['long long']], + 'TransactionHistory' : [ 0x148, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x198, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x19c, ['pointer', ['void']]], + 'DTCPrivateInformationLength' : [ 0x1a0, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x1a4, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x1c4, ['pointer', ['void']]], + 'PendingPromotionCount' : [ 0x1c8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1e, { + 'PerUserPolicy' : [ 0x0, ['array', 30, ['unsigned char']]], +} ], + '_MI_PROBE_RAISE_TRACKER' : [ 0x40, { + 'UserRangeInKernel' : [ 0x0, ['unsigned long']], + 'FaultFailed' : [ 0x4, ['unsigned long']], + 'WriteFaultFailed' : [ 0x8, ['unsigned long']], + 'LargePageFailed' : [ 0xc, ['unsigned long']], + 'UserAccessToKernelPte' : [ 0x10, ['unsigned long']], + 'BadPageLocation' : [ 0x14, ['unsigned long']], + 'InsufficientCharge' : [ 0x18, ['unsigned long']], + 'PageTableCharge' : [ 0x1c, ['unsigned long']], + 'NoPhysicalMapping' : [ 0x20, ['unsigned long']], + 'NoIoReference' : [ 0x24, ['unsigned long']], + 'ProbeFailed' : [ 0x28, ['unsigned long']], + 'PteIsZero' : [ 0x2c, ['unsigned long']], + 'StrongCodeWrite' : [ 0x30, ['unsigned long']], + 'ReducedCloneCommitChargeFailed' : [ 0x34, ['unsigned long']], + 'CopyOnWriteAtDispatchNoPages' : [ 0x38, ['unsigned long']], + 'EnclavePageFailed' : [ 0x3c, ['unsigned long']], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0x60, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x38, ['_KMUTANT']], + 'LinksOffset' : [ 0x58, ['unsigned short']], + 'GuidOffset' : [ 0x5a, ['unsigned short']], + 'Expired' : [ 0x5c, ['unsigned char']], +} ], + '__unnamed_29de' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_29e0' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_29e3' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_29e7' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x50, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x14, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x20, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x30, ['__unnamed_29de']], + 'HvDeviceId' : [ 0x38, ['unsigned long long']], + 'XapicMessage' : [ 0x40, ['__unnamed_29e0']], + 'Hypertransport' : [ 0x40, ['__unnamed_29e3']], + 'GenericMessage' : [ 0x40, ['__unnamed_29e0']], + 'MessageRequest' : [ 0x40, ['__unnamed_29e7']], +} ], + '_CM_NAME_HASH' : [ 0xc, { + 'ConvKey' : [ 0x0, ['_CM_COMPONENT_HASH']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x8, ['unsigned short']], + 'Name' : [ 0xa, ['array', 1, ['wchar']]], +} ], + '_LDR_DDAG_NODE' : [ 0x2c, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x8, ['pointer', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0xc, ['unsigned long']], + 'LoadWhileUnloadingCount' : [ 0x10, ['unsigned long']], + 'LowestLink' : [ 0x14, ['unsigned long']], + 'Dependencies' : [ 0x18, ['_LDRP_CSLIST']], + 'IncomingDependencies' : [ 0x1c, ['_LDRP_CSLIST']], + 'State' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x24, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x28, ['unsigned long']], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x100, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0xc0, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0xc8, ['pointer', ['void']]], + 'PointersLength' : [ 0xcc, ['unsigned long']], + 'ModulePrefix' : [ 0xd0, ['pointer', ['wchar']]], + 'DriverList' : [ 0xd4, ['_LIST_ENTRY']], + 'InitMsg' : [ 0xdc, ['_STRING']], + 'ProgMsg' : [ 0xe4, ['_STRING']], + 'DoneMsg' : [ 0xec, ['_STRING']], + 'FileObject' : [ 0xf4, ['pointer', ['void']]], + 'UsageType' : [ 0xf8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_HAL_NODE_RANGE' : [ 0x8, { + 'PageFrameIndex' : [ 0x0, ['unsigned long']], + 'Node' : [ 0x4, ['unsigned long']], +} ], + '_KQUEUE' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x10, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x18, ['unsigned long']], + 'MaximumCount' : [ 0x1c, ['unsigned long']], + 'ThreadListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '_MI_PAGEFILE_BITMAPS_CACHE_ENTRY' : [ 0x20, { + 'LengthTreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'LocationTreeNode' : [ 0xc, ['_RTL_BALANCED_NODE']], + 'StartingIndex' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], +} ], + '_MI_RESUME_WORKITEM' : [ 0x20, { + 'ResumeCompleteEvent' : [ 0x0, ['_KEVENT']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], +} ], + '_DESCRIPTOR' : [ 0x8, { + 'Pad' : [ 0x0, ['unsigned short']], + 'Limit' : [ 0x2, ['unsigned short']], + 'Base' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a08' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a0a' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a0c' : [ 0x8, { + 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], + 'DeviceId' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a0e' : [ 0x4, { + 'Notification' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_2a10' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a12' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a14' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2a16' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2a18' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_2a1a' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_2a08']], + 'TargetDevice' : [ 0x0, ['__unnamed_2a0a']], + 'InstallDevice' : [ 0x0, ['__unnamed_2a0a']], + 'CustomNotification' : [ 0x0, ['__unnamed_2a0c']], + 'ProfileNotification' : [ 0x0, ['__unnamed_2a0e']], + 'PowerNotification' : [ 0x0, ['__unnamed_2a10']], + 'VetoNotification' : [ 0x0, ['__unnamed_2a12']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_2a14']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_2a16']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_2a18']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_2a0a']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_2a0a']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x44, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x14, ['pointer', ['unsigned long']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'TotalSize' : [ 0x1c, ['unsigned long']], + 'DeviceObject' : [ 0x20, ['pointer', ['void']]], + 'u' : [ 0x24, ['__unnamed_2a1a']], +} ], + '_CM_KEY_REFERENCE' : [ 0x8, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x4, ['pointer', ['_HHIVE']]], +} ], + '_HVIEW_MAP_DIRECTORY' : [ 0x200, { + 'Tables' : [ 0x0, ['array', 128, ['pointer', ['_HVIEW_MAP_TABLE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x18, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x8, ['long']], + 'Misses' : [ 0xc, ['unsigned long']], + 'MissesLast' : [ 0x10, ['unsigned long']], + 'AllStacksInUse' : [ 0x14, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x4, { + 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '_HAL_CHANNEL_MEMORY_RANGES' : [ 0xc, { + 'PageFrameIndex' : [ 0x0, ['unsigned long']], + 'MpnId' : [ 0x4, ['unsigned short']], + 'Node' : [ 0x6, ['unsigned short']], + 'Channel' : [ 0x8, ['unsigned short']], + 'IsPowerManageable' : [ 0xa, ['unsigned char']], + 'DeepPowerState' : [ 0xb, ['unsigned char']], +} ], + '_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_MI_LARGE_PAGE_REBUILD_WAIT_BLOCK']]], + 'Gate' : [ 0x4, ['_KGATE']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x10, ['long']], + 'Link' : [ 0x14, ['_LIST_ENTRY']], + 'Trigger' : [ 0x1c, ['pointer', ['_POP_ACTION_TRIGGER']]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x50, { + 'Prcb' : [ 0x0, ['pointer', ['_KPRCB']]], + 'PerfContext' : [ 0x4, ['unsigned long']], + 'ProcCap' : [ 0x8, ['unsigned long']], + 'ProcFloor' : [ 0xc, ['unsigned long']], + 'PlatformCap' : [ 0x10, ['unsigned long']], + 'ThermalCap' : [ 0x14, ['unsigned long']], + 'LimitReasons' : [ 0x18, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x20, ['unsigned long long']], + 'TargetPercent' : [ 0x28, ['unsigned long']], + 'SelectedPercent' : [ 0x2c, ['unsigned long']], + 'SelectedFrequency' : [ 0x30, ['unsigned long']], + 'PreviousFrequency' : [ 0x34, ['unsigned long']], + 'PreviousPercent' : [ 0x38, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x3c, ['unsigned long']], + 'SelectedState' : [ 0x40, ['unsigned long long']], + 'Force' : [ 0x48, ['unsigned char']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3e0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0xa0, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x18, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x8, { + 'DeviceHandle' : [ 0x0, ['pointer', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x4, ['pointer', ['void']]], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x288, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x2a4, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer', ['void']]], + 'ConsoleFlags' : [ 0x14, ['unsigned long']], + 'StandardInput' : [ 0x18, ['pointer', ['void']]], + 'StandardOutput' : [ 0x1c, ['pointer', ['void']]], + 'StandardError' : [ 0x20, ['pointer', ['void']]], + 'CurrentDirectory' : [ 0x24, ['_CURDIR']], + 'DllPath' : [ 0x30, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x38, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x40, ['_UNICODE_STRING']], + 'Environment' : [ 0x48, ['pointer', ['void']]], + 'StartingX' : [ 0x4c, ['unsigned long']], + 'StartingY' : [ 0x50, ['unsigned long']], + 'CountX' : [ 0x54, ['unsigned long']], + 'CountY' : [ 0x58, ['unsigned long']], + 'CountCharsX' : [ 0x5c, ['unsigned long']], + 'CountCharsY' : [ 0x60, ['unsigned long']], + 'FillAttribute' : [ 0x64, ['unsigned long']], + 'WindowFlags' : [ 0x68, ['unsigned long']], + 'ShowWindowFlags' : [ 0x6c, ['unsigned long']], + 'WindowTitle' : [ 0x70, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0x78, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0x80, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0x88, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0x90, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x290, ['unsigned long']], + 'EnvironmentVersion' : [ 0x294, ['unsigned long']], + 'PackageDependencyData' : [ 0x298, ['pointer', ['void']]], + 'ProcessGroupId' : [ 0x29c, ['unsigned long']], + 'LoaderThreads' : [ 0x2a0, ['unsigned long']], +} ], + '_MI_IO_CACHE_STATS' : [ 0x20, { + 'UnusedBlocks' : [ 0x0, ['unsigned long']], + 'ActiveCacheMatch' : [ 0x4, ['unsigned long']], + 'ActiveCacheOverride' : [ 0x8, ['unsigned long']], + 'UnmappedCacheFlush' : [ 0xc, ['unsigned long']], + 'UnmappedCacheMatch' : [ 0x10, ['unsigned long']], + 'UnmappedCacheConflict' : [ 0x14, ['unsigned long']], + 'PermanentIoAttributeConflict' : [ 0x18, ['unsigned long']], + 'PermanentIoNodeConflict' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_2a60' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a62' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2a64' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2a60']], + 'Gpt' : [ 0x0, ['__unnamed_2a62']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0xc0, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer', ['void']]], + 'CommonBuffer' : [ 0xc, ['array', 2, ['pointer', ['void']]]], + 'PhysicalAddress' : [ 0x18, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x28, ['pointer', ['void']]], + 'OpenRoutine' : [ 0x2c, ['pointer', ['void']]], + 'WriteRoutine' : [ 0x30, ['pointer', ['void']]], + 'FinishRoutine' : [ 0x34, ['pointer', ['void']]], + 'AdapterObject' : [ 0x38, ['pointer', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x3c, ['pointer', ['void']]], + 'PortConfiguration' : [ 0x40, ['pointer', ['void']]], + 'CrashDump' : [ 0x44, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x45, ['unsigned char']], + 'HiberResume' : [ 0x46, ['unsigned char']], + 'Reserved1' : [ 0x47, ['unsigned char']], + 'MaximumTransferSize' : [ 0x48, ['unsigned long']], + 'CommonBufferSize' : [ 0x4c, ['unsigned long']], + 'TargetAddress' : [ 0x50, ['pointer', ['void']]], + 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], + 'PartitionStyle' : [ 0x58, ['unsigned long']], + 'DiskInfo' : [ 0x5c, ['__unnamed_2a64']], + 'ReadRoutine' : [ 0x6c, ['pointer', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0x70, ['pointer', ['void']]], + 'LogSectionTruncateSize' : [ 0x74, ['unsigned long']], + 'Parameters' : [ 0x78, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xb8, ['pointer', ['void']]], + 'DumpNotifyRoutine' : [ 0xbc, ['pointer', ['void']]], +} ], + '_THERMAL_COOLING_INTERFACE' : [ 0x1c, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ActiveCooling' : [ 0x14, ['pointer', ['void']]], + 'PassiveCooling' : [ 0x18, ['pointer', ['void']]], +} ], + '_VF_ADDRESS_RANGE' : [ 0x8, { + 'Start' : [ 0x0, ['pointer', ['unsigned char']]], + 'End' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_POP_FX_PERF_INFO' : [ 0x60, { + 'Component' : [ 0x0, ['pointer', ['_POP_FX_COMPONENT']]], + 'CompletedEvent' : [ 0x4, ['_KEVENT']], + 'ComponentPerfState' : [ 0x14, ['pointer', ['void']]], + 'Flags' : [ 0x18, ['_POP_FX_PERF_FLAGS']], + 'LastChange' : [ 0x1c, ['pointer', ['_PO_FX_PERF_STATE_CHANGE']]], + 'LastChangeCount' : [ 0x20, ['unsigned long']], + 'LastChangeStamp' : [ 0x28, ['unsigned long long']], + 'LastChangeNominal' : [ 0x30, ['unsigned char']], + 'PepRegistered' : [ 0x31, ['unsigned char']], + 'QueryOnIdleStates' : [ 0x32, ['unsigned char']], + 'RequestDriverContext' : [ 0x34, ['pointer', ['void']]], + 'WorkOrder' : [ 0x38, ['_POP_FX_WORK_ORDER']], + 'SetsCount' : [ 0x54, ['unsigned long']], + 'Sets' : [ 0x58, ['pointer', ['_POP_FX_PERF_SET']]], +} ], + '_MMPAGE_FILE_EXPANSION_FLAGS' : [ 0x4, { + 'PageFileNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'IgnoreCurrentCommit' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreaseMinimumSize' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Spare3' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x4, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 11, native_type='unsigned long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], +} ], + '_TRIAGE_POP_IRP_DATA' : [ 0x10, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'Pdo' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_2a8e' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a90' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a92' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2a94' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_2a8e']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_2a90']], + 'Raw' : [ 0x0, ['__unnamed_2a92']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x28, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'Operation' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0x8, ['__unnamed_2a94']], + 'Stack' : [ 0x10, ['array', 6, ['pointer', ['void']]]], +} ], + '_MI_COMBINE_PAGE_LISTHEAD' : [ 0x8, { + 'Table' : [ 0x0, ['_RTL_AVL_TREE']], + 'Lock' : [ 0x4, ['long']], +} ], + '_VI_POOL_ENTRY' : [ 0x10, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x14, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x4, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0xc, ['_RTL_BITMAP']], + 'EvictedBitmap' : [ 0xc, ['_RTL_BITMAP']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2aa2' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2aa4' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2aa2']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2aa7' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2aa9' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2aa7']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_2aa4']], + 'HighPart' : [ 0x4, ['__unnamed_2aa9']], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x70, { + 'UncompressedData' : [ 0x0, ['pointer', ['unsigned char']]], + 'MappingVa' : [ 0x4, ['pointer', ['void']]], + 'XpressEncodeWorkspace' : [ 0x8, ['pointer', ['void']]], + 'CompressedDataBuffer' : [ 0xc, ['pointer', ['unsigned char']]], + 'CopyTicks' : [ 0x10, ['unsigned long long']], + 'CompressTicks' : [ 0x18, ['unsigned long long']], + 'BytesCopied' : [ 0x20, ['unsigned long long']], + 'PagesProcessed' : [ 0x28, ['unsigned long long']], + 'DecompressTicks' : [ 0x30, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x38, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x40, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x48, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x68, ['unsigned long']], + 'HuffCompressCount' : [ 0x6c, ['unsigned long']], +} ], + '_PROC_PERF_CHECK_SNAP' : [ 0x50, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned long long']], + 'Stall' : [ 0x10, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x18, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledKernelActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], + 'TaggedThreadCycles' : [ 0x40, ['array', 2, ['unsigned long long']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_HVIEW_MAP_PIN_LOG_ENTRY' : [ 0x30, { + 'ViewOffset' : [ 0x0, ['unsigned long']], + 'Pinned' : [ 0x4, ['unsigned char']], + 'PinMask' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer', ['_KTHREAD']]], + 'Stack' : [ 0x14, ['array', 6, ['pointer', ['void']]]], +} ], + '_MI_COMBINE_WORKITEM' : [ 0x14, { + 'NextEntry' : [ 0x0, ['pointer', ['void']]], + 'WorkItem' : [ 0x4, ['_WORK_QUEUE_ITEM']], +} ], + '_PNP_RESOURCE_CONFLICT_TRACE_CONTEXT' : [ 0x10, { + 'ResourceType' : [ 0x0, ['unsigned char']], + 'AlternativeCount' : [ 0x4, ['unsigned long']], + 'ResourceRequests' : [ 0x8, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ArbiterInstance' : [ 0xc, ['pointer', ['void']]], +} ], + '_MI_POOL_FAILURE_REASONS' : [ 0x2c, { + 'NonPagedNoPtes' : [ 0x0, ['unsigned long']], + 'PriorityTooLow' : [ 0x4, ['unsigned long']], + 'NonPagedNoPagesAvailable' : [ 0x8, ['unsigned long']], + 'PagedNoPtes' : [ 0xc, ['unsigned long']], + 'SessionPagedNoPtes' : [ 0x10, ['unsigned long']], + 'PagedNoPagesAvailable' : [ 0x14, ['unsigned long']], + 'SessionPagedNoPagesAvailable' : [ 0x18, ['unsigned long']], + 'PagedNoCommit' : [ 0x1c, ['unsigned long']], + 'SessionPagedNoCommit' : [ 0x20, ['unsigned long']], + 'NonPagedNoResidentAvailable' : [ 0x24, ['unsigned long']], + 'NonPagedNoCommit' : [ 0x28, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x10, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'CallingAddress' : [ 0x4, ['pointer', ['void']]], + 'NumberOfBytes' : [ 0x8, ['unsigned long']], + 'Tag' : [ 0xc, ['unsigned long']], +} ], + '_MI_PAGE_COMBINE_STATISTICS' : [ 0x28, { + 'PagesScannedActive' : [ 0x0, ['unsigned long long']], + 'PagesScannedStandby' : [ 0x8, ['unsigned long long']], + 'PagesCombined' : [ 0x10, ['unsigned long long']], + 'CombineScanCount' : [ 0x18, ['unsigned long']], + 'CombinedBlocksInUse' : [ 0x1c, ['long']], + 'SumCombinedBlocksReferenceCount' : [ 0x20, ['long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x8, { + 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x4, ['pointer', ['void']]], +} ], + '_HVIEW_MAP_TABLE' : [ 0x600, { + 'Entries' : [ 0x0, ['array', 64, ['_HVIEW_MAP_ENTRY']]], +} ], + '_LDRP_CSLIST' : [ 0x4, { + 'Tail' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MI_RESERVATION_CLUSTER_INFO' : [ 0x4, { + 'ClusterSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'EntireInfo' : [ 0x0, ['long']], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0xc, { + 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'VerifierEntry' : [ 0x4, ['pointer', ['void']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_MI_FLAGS' : [ 0x4, { + 'EntireFlags' : [ 0x0, ['long']], + 'VerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'KernelVerifierEnabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LargePageKernel' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'StopOn4d' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'InitializationPhase' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'PageKernelStacks' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CheckZeroPages' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ProcessorPrewalks' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ProcessorPostwalks' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'CoverageBuild' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'AccessBitReplacementDisabled' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CheckExecute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ProtectedPagesEnabled' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'StrongCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HardCodeGuarantees' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ExecutePagePrivilegeRequired' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StrongPageIdentity' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'FullHvci' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'SecureRelocations' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SlatKernelCodeProtected' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'BootDebuggerActive' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x28, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x10, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x18, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x38, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0xc, ['pointer', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x10, ['pointer', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x14, ['pointer', ['void']]], + 'PreAcquireForCcFlush' : [ 0x18, ['pointer', ['void']]], + 'PostAcquireForCcFlush' : [ 0x1c, ['pointer', ['void']]], + 'PreReleaseForCcFlush' : [ 0x20, ['pointer', ['void']]], + 'PostReleaseForCcFlush' : [ 0x24, ['pointer', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x28, ['pointer', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x2c, ['pointer', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x30, ['pointer', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x34, ['pointer', ['void']]], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x18, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x14, ['pointer', ['_LPCP_PORT_OBJECT']]], +} ], + '_POP_FX_PERF_SET' : [ 0x20, { + 'PerfSet' : [ 0x0, ['pointer', ['_PO_FX_COMPONENT_PERF_SET']]], + 'CurrentPerf' : [ 0x8, ['unsigned long long']], + 'CurrentPerfStamp' : [ 0x10, ['unsigned long long']], + 'CurrentPerfNominal' : [ 0x18, ['unsigned char']], +} ], + '_PO_FX_PERF_STATE_CHANGE' : [ 0x10, { + 'Set' : [ 0x0, ['unsigned long']], + 'StateIndex' : [ 0x8, ['unsigned long']], + 'StateValue' : [ 0x8, ['unsigned long long']], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x4, ['unsigned long']], +} ], + '_HVIEW_MAP_ENTRY' : [ 0x18, { + 'ViewStart' : [ 0x0, ['pointer', ['void']]], + 'IsPinned' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Bcb' : [ 0x4, ['pointer', ['void']]], + 'PinnedPages' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x24, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0xc, ['pointer', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x10, ['_FS_FILTER_PARAMETERS']], +} ], + '__unnamed_2b01' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x4, ['pointer', ['_PO_FX_PERF_STATE']]], +} ], + '__unnamed_2b03' : [ 0x10, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], +} ], + '_PO_FX_COMPONENT_PERF_SET' : [ 0x28, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], + 'Flags' : [ 0x8, ['unsigned long long']], + 'Unit' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateUnitOther', 1: 'PoFxPerfStateUnitFrequency', 2: 'PoFxPerfStateUnitBandwidth', 3: 'PoFxPerfStateUnitMaximum'})]], + 'Type' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PoFxPerfStateTypeDiscrete', 1: 'PoFxPerfStateTypeRange', 2: 'PoFxPerfStateTypeMaximum'})]], + 'Discrete' : [ 0x18, ['__unnamed_2b01']], + 'Range' : [ 0x18, ['__unnamed_2b03']], +} ], + '_CURDIR' : [ 0xc, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x8, ['pointer', ['void']]], +} ], + '__unnamed_2b09' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_2b0b' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_2b09']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_2b0b']], +} ], + '_PO_FX_PERF_STATE' : [ 0x10, { + 'Value' : [ 0x0, ['unsigned long long']], + 'Context' : [ 0x8, ['pointer', ['void']]], +} ], + '__unnamed_2b11' : [ 0x8, { + 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], +} ], + '__unnamed_2b13' : [ 0x4, { + 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], +} ], + '__unnamed_2b19' : [ 0xc, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], + 'OutputInformation' : [ 0x8, ['pointer', ['_FS_FILTER_SECTION_SYNC_OUTPUT']]], +} ], + '__unnamed_2b1d' : [ 0x8, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x4, ['unsigned char']], +} ], + '__unnamed_2b1f' : [ 0x14, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], + 'Argument5' : [ 0x10, ['pointer', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x14, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_2b11']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2b13']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2b19']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_2b1d']], + 'Others' : [ 0x0, ['__unnamed_2b1f']], +} ], + '_FS_FILTER_SECTION_SYNC_OUTPUT' : [ 0x10, { + 'StructureSize' : [ 0x0, ['unsigned long']], + 'SizeReturned' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DesiredReadAlignment' : [ 0xc, ['unsigned long']], +} ], +} From 52adfcbee678f3f94c742851aff3b0b1556b25c4 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sat, 10 Sep 2016 23:59:33 -0400 Subject: [PATCH 027/304] win10.py: new kdbgsize for build 14393 --- volatility/plugins/overlays/windows/win10.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index cb8f9b748..7c6ea2020 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -86,6 +86,17 @@ def modification(self, profile): 'DTBSignature' : [ None, ['VolatilityMagic', dict(value = "\x03\x00\x2A\x00")]], }]}) +class Win10KDBG(windows.AbstractKDBGMod): + """The Windows 10 KDBG signatures""" + + before = ['Win8KDBG'] + conditions = {'os': lambda x: x == 'windows', + 'major': lambda x: x == 6, + 'minor': lambda x: x == 4, + 'build': lambda x: x >= 14393} + + kdbgsize = 0x368 + class ObHeaderCookieStore(object): """A class for finding and storing the nt!ObHeaderCookie value""" From 5093fa26a782bd692e08efd729d0252d72a83ec7 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sun, 11 Sep 2016 00:33:19 -0400 Subject: [PATCH 028/304] win10.py: fix _OBJECT_HEADER for win10 build 14393 --- volatility/plugins/overlays/windows/win10.py | 67 +++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index 7c6ea2020..bc2259479 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -385,6 +385,69 @@ class _OBJECT_HEADER_10_1AC738FB(_OBJECT_HEADER_10): 53: 'DxgkSharedSwapChainObject', } +class _OBJECT_HEADER_10_DD08DD42(_OBJECT_HEADER_10): + + type_map = { + 2: 'Type', + 3: 'Directory', + 4: 'SymbolicLink', + 5: 'Token', + 6: 'Job', + 7: 'Process', + 8: 'Thread', + 9: 'UserApcReserve', + 10: 'IoCompletionReserve', + 11: 'PsSiloContextPaged', + 12: 'PsSiloContextNonPaged', + 13: 'DebugObject', + 14: 'Event', + 15: 'Mutant', + 16: 'Callback', + 17: 'Semaphore', + 18: 'Timer', + 19: 'IRTimer', + 20: 'Profile', + 21: 'KeyedEvent', + 22: 'WindowStation', + 23: 'Desktop', + 24: 'Composition', + 25: 'RawInputManager', + 26: 'CoreMessaging', + 27: 'TpWorkerFactory', + 28: 'Adapter', + 29: 'Controller', + 30: 'Device', + 31: 'Driver', + 32: 'IoCompletion', + 33: 'WaitCompletionPacket', + 34: 'File', + 35: 'TmTm', + 36: 'TmTx', + 37: 'TmRm', + 38: 'TmEn', + 39: 'Section', + 40: 'Session', + 41: 'Partition', + 42: 'Key', + 43: 'RegistryTransaction', + 44: 'ALPC', + 45: 'PowerRequest', + 46: 'WmiGuid', + 47: 'EtwRegistration', + 48: 'EtwConsumer', + 49: 'DmaAdapter', + 50: 'DmaDomain', + 51: 'PcwObject', + 52: 'FilterConnectionPort', + 53: 'FilterCommunicationPort', + 54: 'NdisCmState', + 55: 'DxgkSharedResource', + 56: 'DxgkSharedSyncObject', + 57: 'DxgkSharedSwapChainObject', + 58: 'VRegConfigurationContext', + 59: 'VirtualKey', + } + class Win10ObjectHeader(obj.ProfileModification): before = ["Win8ObjectClasses"] conditions = {'os': lambda x: x == 'windows', @@ -396,7 +459,9 @@ def modification(self, profile): metadata = profile.metadata build = metadata.get("build", 0) - if build >= 10240: + if build >= 14393: + header = _OBJECT_HEADER_10_DD08DD42 + elif build >= 10240: header = _OBJECT_HEADER_10_1AC738FB else: header = _OBJECT_HEADER_10 From 190798076bc360f9221255cbc1b343158553e830 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sun, 11 Sep 2016 05:58:19 -0400 Subject: [PATCH 029/304] README.txt: added win10 profiles for 14393 --- README.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.txt b/README.txt index 51ea50816..80ea6add7 100644 --- a/README.txt +++ b/README.txt @@ -168,8 +168,10 @@ VistaSP2x64 - A Profile for Windows Vista SP2 x64 VistaSP2x86 - A Profile for Windows Vista SP2 x86 Win10x64 - A Profile for Windows 10 x64 Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB +Win10x64_DD08DD42 - A Profile for Windows 10 x64 from PDB DD08DD42 Win10x86 - A Profile for Windows 10 x86 Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA +Win10x86_9619274A - A Profile for Windows 10 x86 from PDB 9619274A Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 From fc0cb6387e7b9cccc0226c6353a02069c2b298b5 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Mon, 12 Sep 2016 11:47:08 -0400 Subject: [PATCH 030/304] bigpagepools.py: new magic values for win10 14393 --- volatility/plugins/bigpagepools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/bigpagepools.py b/volatility/plugins/bigpagepools.py index bf12ee0d9..2a31d073c 100644 --- a/volatility/plugins/bigpagepools.py +++ b/volatility/plugins/bigpagepools.py @@ -68,7 +68,7 @@ def modification(self, profile): (6, 2, '32bit') : [[92, 88]], (6, 2, '64bit') : [[-5200, -5224]], (6, 3, '32bit') : [[116, 120]], - (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168]], + (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40]], (6, 4, '32bit') : [[-168, -164]], } From 20d56c9588bdf300a5670b41762d08e53f0679aa Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Mon, 12 Sep 2016 15:18:29 -0400 Subject: [PATCH 031/304] bigpagepools.py: new magic values for win10 14393.103 --- volatility/plugins/bigpagepools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/bigpagepools.py b/volatility/plugins/bigpagepools.py index 2a31d073c..3536db992 100644 --- a/volatility/plugins/bigpagepools.py +++ b/volatility/plugins/bigpagepools.py @@ -68,7 +68,7 @@ def modification(self, profile): (6, 2, '32bit') : [[92, 88]], (6, 2, '64bit') : [[-5200, -5224]], (6, 3, '32bit') : [[116, 120]], - (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40]], + (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40], [32, 24]], (6, 4, '32bit') : [[-168, -164]], } From 69142099447a5248ebdb9e3ba636738d509b7055 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Thu, 15 Sep 2016 10:54:41 -0500 Subject: [PATCH 032/304] fix two (potential) issues when finding win10 cookies. first, don't assume get_kdbg() will succeed. this /can/ return None, so check the return value. second, avoid calling list(kdbg.modules()) just to find NT, when we know NT is always first - it wastes cycles --- volatility/plugins/overlays/windows/win10.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index bc2259479..168e83537 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -139,7 +139,20 @@ def findcookie(self, kernel_space): return False kdbg = tasks.get_kdbg(kernel_space) - nt_mod = list(kdbg.modules())[0] + + if not kdbg: + debug.warning("Cannot find KDBG") + return False + + nt_mod = None + + for mod in kdbg.modules(): + nt_mod = mod + break + + if nt_mod == None: + debug.warning("Cannot find NT module") + return False addr = nt_mod.getprocaddress("ObGetObjectType") if addr == None: From a9136d70243af045033695f5f7fd774b3b411696 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Tue, 13 Sep 2016 14:52:45 -0400 Subject: [PATCH 033/304] win7: added profiles for the recent versions. Fixes psscan. --- volatility/plugins/overlays/windows/win7.py | 21 + .../windows/win7_sp1_x64_632B36E0_vtypes.py | 9232 +++++++++++++++++ .../windows/win7_sp1_x86_BBA98F40_vtypes.py | 8842 ++++++++++++++++ 3 files changed, 18095 insertions(+) create mode 100755 volatility/plugins/overlays/windows/win7_sp1_x64_632B36E0_vtypes.py create mode 100755 volatility/plugins/overlays/windows/win7_sp1_x86_BBA98F40_vtypes.py diff --git a/volatility/plugins/overlays/windows/win7.py b/volatility/plugins/overlays/windows/win7.py index 789cd65c8..f6828f1e9 100644 --- a/volatility/plugins/overlays/windows/win7.py +++ b/volatility/plugins/overlays/windows/win7.py @@ -207,6 +207,15 @@ class Win7SP1x86(obj.Profile): _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x86_vtypes' +class Win7SP1x86_BBA98F40(obj.Profile): + """ A Profile for Windows 7 SP1 x86 from PDB BBA98F40""" + _md_memory_model = '32bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 1 + _md_build = 7601 + _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x86_BBA98F40_vtypes' + class Win7SP0x64(obj.Profile): """ A Profile for Windows 7 SP0 x64 """ _md_memory_model = '64bit' @@ -225,8 +234,20 @@ class Win7SP1x64(obj.Profile): _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x64_vtypes' +class Win7SP1x64_632B36E0(obj.Profile): + """ A Profile for Windows 7 SP1 x64 from PDB 632B36E0""" + _md_memory_model = '64bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 1 + _md_build = 7601 + _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x64_632B36E0_vtypes' + class Win2008R2SP0x64(Win7SP0x64): """ A Profile for Windows 2008 R2 SP0 x64 """ class Win2008R2SP1x64(Win7SP1x64): """ A Profile for Windows 2008 R2 SP1 x64 """ + +class Win2008R2SP1x64_632B36E0(Win7SP1x64_632B36E0): + """ A Profile for Windows 2008 R2 SP1 x64 from PDB 632B36E0""" diff --git a/volatility/plugins/overlays/windows/win7_sp1_x64_632B36E0_vtypes.py b/volatility/plugins/overlays/windows/win7_sp1_x64_632B36E0_vtypes.py new file mode 100755 index 000000000..1489d0130 --- /dev/null +++ b/volatility/plugins/overlays/windows/win7_sp1_x64_632B36E0_vtypes.py @@ -0,0 +1,9232 @@ +ntkrnlmp_types = { + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { + 'ClientToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], + 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], +} ], + '_KBUGCHECK_ACTIVE_STATE' : [ 0x4, { + 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['long']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x60, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], + 'AccessBufferMax' : [ 0x28, ['unsigned long']], + 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x50, ['long']], + 'Flags' : [ 0x54, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x58, ['long']], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POP_SYSTEM_IDLE' : [ 0x38, { + 'AverageIdleness' : [ 0x0, ['long']], + 'LowestIdleness' : [ 0x4, ['long']], + 'Time' : [ 0x8, ['unsigned long']], + 'Timeout' : [ 0xc, ['unsigned long']], + 'LastUserInput' : [ 0x10, ['unsigned long']], + 'Action' : [ 0x14, ['POWER_ACTION_POLICY']], + 'MinState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SystemRequired' : [ 0x24, ['unsigned char']], + 'IdleWorker' : [ 0x25, ['unsigned char']], + 'Sampling' : [ 0x26, ['unsigned char']], + 'LastTick' : [ 0x28, ['unsigned long long']], + 'LastSystemRequiredTime' : [ 0x30, ['unsigned long']], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x18, { + 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { + 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], + 'Object' : [ 0x10, ['pointer64', ['void']]], + 'TargetAccess' : [ 0x18, ['unsigned long']], + 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x20, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_EFI_FIRMWARE_INFORMATION' : [ 0x18, { + 'FirmwareVersion' : [ 0x0, ['unsigned long']], + 'VirtualEfiRuntimeServices' : [ 0x8, ['pointer64', ['_VIRTUAL_EFI_RUNTIME_SERVICES']]], + 'SetVirtualAddressMapStatus' : [ 0x10, ['long']], + 'MissedMappingsCount' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_202c' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_202e' : [ 0x10, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2030' : [ 0x10, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2032' : [ 0x10, { + 'Raw' : [ 0x0, ['__unnamed_2030']], + 'Translated' : [ 0x0, ['__unnamed_202e']], +} ], + '__unnamed_2034' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2036' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2038' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_203a' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_203c' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_203e' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2040' : [ 0x10, { + 'Generic' : [ 0x0, ['__unnamed_202c']], + 'Port' : [ 0x0, ['__unnamed_202c']], + 'Interrupt' : [ 0x0, ['__unnamed_202e']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_2032']], + 'Memory' : [ 0x0, ['__unnamed_202c']], + 'Dma' : [ 0x0, ['__unnamed_2034']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1eff']], + 'BusNumber' : [ 0x0, ['__unnamed_2036']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_2038']], + 'Memory40' : [ 0x0, ['__unnamed_203a']], + 'Memory48' : [ 0x0, ['__unnamed_203c']], + 'Memory64' : [ 0x0, ['__unnamed_203e']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_2040']], +} ], + '__unnamed_2045' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_2045']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { + 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_204f' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x58, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x8, ['__unnamed_204f']], +} ], + '_CONFIGURATION_COMPONENT_DATA' : [ 0x48, { + 'Parent' : [ 0x0, ['pointer64', ['_CONFIGURATION_COMPONENT_DATA']]], + 'Child' : [ 0x8, ['pointer64', ['_CONFIGURATION_COMPONENT_DATA']]], + 'Sibling' : [ 0x10, ['pointer64', ['_CONFIGURATION_COMPONENT_DATA']]], + 'ComponentEntry' : [ 0x18, ['_CONFIGURATION_COMPONENT']], + 'ConfigurationData' : [ 0x40, ['pointer64', ['void']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2059' : [ 0x8, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], + 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], +} ], + '_MMSUBSECTION_NODE' : [ 0x28, { + 'u' : [ 0x0, ['__unnamed_1fb7']], + 'StartingSector' : [ 0x4, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x8, ['unsigned long']], + 'u1' : [ 0x10, ['__unnamed_2059']], + 'LeftChild' : [ 0x18, ['pointer64', ['_MMSUBSECTION_NODE']]], + 'RightChild' : [ 0x20, ['pointer64', ['_MMSUBSECTION_NODE']]], +} ], + '_VF_AVL_TREE_NODE' : [ 0x10, { + 'p' : [ 0x0, ['pointer64', ['void']]], + 'RangeSize' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2061' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2063' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_2061']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x58, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x20, ['_LIST_ENTRY']], + 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'Volume' : [ 0x40, ['_LIST_ENTRY']], + 'Specific' : [ 0x50, ['__unnamed_2063']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x68, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], + 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], + 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], + 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], + 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KENLISTMENT' : [ 0x1e0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x30, ['_GUID']], + 'Mutex' : [ 0x40, ['_KMUTANT']], + 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], + 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0xac, ['unsigned long']], + 'NotificationMask' : [ 0xb0, ['unsigned long']], + 'Key' : [ 0xb8, ['pointer64', ['void']]], + 'KeyRefCount' : [ 0xc0, ['unsigned long']], + 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], + 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], + 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], + 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], + 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], + 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], + 'NextHistory' : [ 0x138, ['unsigned long']], + 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['unsigned long']], +} ], + '_KAPC_STATE' : [ 0x30, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], + 'KernelApcInProgress' : [ 0x28, ['unsigned char']], + 'KernelApcPending' : [ 0x29, ['unsigned char']], + 'UserApcPending' : [ 0x2a, ['unsigned char']], +} ], + '_IA64_LOADER_BLOCK' : [ 0x4, { + 'PlaceHolder' : [ 0x0, ['unsigned long']], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x300, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x80, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x88, ['unsigned long']], + 'LastCallbackId' : [ 0x8c, ['unsigned long']], + 'PostCount' : [ 0x100, ['unsigned long']], + 'ReturnCount' : [ 0x180, ['unsigned long']], + 'LogSequenceNumber' : [ 0x200, ['unsigned long']], + 'UserLock' : [ 0x280, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x288, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_DEVICE_MAP' : [ 0x40, { + 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'DriveMap' : [ 0x1c, ['unsigned long']], + 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], +} ], + '_HEAP_DEBUGGING_INFORMATION' : [ 0x30, { + 'InterceptorFunction' : [ 0x0, ['pointer64', ['void']]], + 'InterceptorValue' : [ 0x8, ['unsigned short']], + 'ExtendedOptions' : [ 0xc, ['unsigned long']], + 'StackTraceDepth' : [ 0x10, ['unsigned long']], + 'MinTotalBlockSize' : [ 0x18, ['unsigned long long']], + 'MaxTotalBlockSize' : [ 0x20, ['unsigned long long']], + 'HeapLeakEnumerationRoutine' : [ 0x28, ['pointer64', ['void']]], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_MMBANKED_SECTION' : [ 0x38, { + 'BasePhysicalPage' : [ 0x0, ['unsigned long long']], + 'BasedPte' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'BankSize' : [ 0x10, ['unsigned long']], + 'BankShift' : [ 0x14, ['unsigned long']], + 'BankedRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'CurrentMappedPte' : [ 0x28, ['pointer64', ['_MMPTE']]], + 'BankTemplate' : [ 0x30, ['array', 1, ['_MMPTE']]], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['array', 7, ['unsigned long long']]], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x20, ['unsigned long long']], + 'ReserveSize' : [ 0x28, ['unsigned long long']], + 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x68, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'Context' : [ 0x18, ['pointer64', ['void']]], + 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x24, ['unsigned long']], + 'Status' : [ 0x28, ['long']], + 'Information' : [ 0x30, ['pointer64', ['void']]], + 'WorkItem' : [ 0x38, ['_WORK_QUEUE_ITEM']], + 'FailingDriver' : [ 0x58, ['pointer64', ['_DRIVER_OBJECT']]], + 'ReferenceCount' : [ 0x60, ['long']], +} ], + '_KTSS64' : [ 0x68, { + 'Reserved0' : [ 0x0, ['unsigned long']], + 'Rsp0' : [ 0x4, ['unsigned long long']], + 'Rsp1' : [ 0xc, ['unsigned long long']], + 'Rsp2' : [ 0x14, ['unsigned long long']], + 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], + 'Reserved1' : [ 0x5c, ['unsigned long long']], + 'Reserved2' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x48, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], + 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], + 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], + 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], + 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], +} ], + '_SECTION_OBJECT' : [ 0x30, { + 'StartingVa' : [ 0x0, ['pointer64', ['void']]], + 'EndingVa' : [ 0x8, ['pointer64', ['void']]], + 'Parent' : [ 0x10, ['pointer64', ['void']]], + 'LeftChild' : [ 0x18, ['pointer64', ['void']]], + 'RightChild' : [ 0x20, ['pointer64', ['void']]], + 'Segment' : [ 0x28, ['pointer64', ['_SEGMENT_OBJECT']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x8, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0x18, ['unsigned short']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_20e2' : [ 0x4, { + 'AsULONG' : [ 0x0, ['unsigned long']], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_PERF_STATES' : [ 0xb0, { + 'Count' : [ 0x0, ['unsigned long']], + 'MaxFrequency' : [ 0x4, ['unsigned long']], + 'PStateCap' : [ 0x8, ['unsigned long']], + 'TStateCap' : [ 0xc, ['unsigned long']], + 'MaxPerfState' : [ 0x10, ['unsigned long']], + 'MinPerfState' : [ 0x14, ['unsigned long']], + 'LowestPState' : [ 0x18, ['unsigned long']], + 'IncreaseTime' : [ 0x1c, ['unsigned long']], + 'DecreaseTime' : [ 0x20, ['unsigned long']], + 'BusyAdjThreshold' : [ 0x24, ['unsigned char']], + 'Reserved' : [ 0x25, ['unsigned char']], + 'ThrottleStatesOnly' : [ 0x26, ['unsigned char']], + 'PolicyType' : [ 0x27, ['unsigned char']], + 'TimerInterval' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['__unnamed_20e2']], + 'TargetProcessors' : [ 0x30, ['_KAFFINITY_EX']], + 'PStateHandler' : [ 0x58, ['pointer64', ['void']]], + 'PStateContext' : [ 0x60, ['unsigned long long']], + 'TStateHandler' : [ 0x68, ['pointer64', ['void']]], + 'TStateContext' : [ 0x70, ['unsigned long long']], + 'FeedbackHandler' : [ 0x78, ['pointer64', ['void']]], + 'GetFFHThrottleState' : [ 0x80, ['pointer64', ['void']]], + 'State' : [ 0x88, ['array', 1, ['_PPM_PERF_STATE']]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x40, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'LastTotalAllocates' : [ 0x24, ['unsigned long']], + 'LastAllocateMisses' : [ 0x28, ['unsigned long']], + 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], +} ], + '_WMI_TRACE_PACKET' : [ 0x4, { + 'Size' : [ 0x0, ['unsigned short']], + 'HookId' : [ 0x2, ['unsigned short']], + 'Type' : [ 0x2, ['unsigned char']], + 'Group' : [ 0x3, ['unsigned char']], +} ], + '_KTIMER' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], + 'Processor' : [ 0x38, ['unsigned long']], + 'Period' : [ 0x3c, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x70, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CriticalSection' : [ 0x8, ['_RTL_CRITICAL_SECTION']], + 'RtlHandleTable' : [ 0x30, ['_RTL_HANDLE_TABLE']], + 'NumberOfBuckets' : [ 0x60, ['unsigned long']], + 'Buckets' : [ 0x68, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '_POP_POWER_ACTION' : [ 0xc0, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x48, ['unsigned long long']], + 'SleepTime' : [ 0x50, ['unsigned long long']], + 'ProgrammedRTCTime' : [ 0x58, ['unsigned long long']], + 'WakeOnRTC' : [ 0x60, ['unsigned char']], + 'WakeTimerInfo' : [ 0x68, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], + 'FilteredCapabilities' : [ 0x70, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x38, ['unsigned char']], + 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x48, ['pointer64', ['unsigned short']]], + 'DriverName' : [ 0x50, ['pointer64', ['unsigned short']]], + 'ChildCount' : [ 0x58, ['unsigned long']], + 'ActiveChild' : [ 0x5c, ['unsigned long']], + 'ParentCount' : [ 0x60, ['unsigned long']], + 'ActiveParent' : [ 0x64, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x228, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTransitions' : [ 0x8, ['unsigned long']], + 'FailedTransitions' : [ 0xc, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x10, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'IdleTimeBuckets' : [ 0x28, ['array', 16, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { + 'PageHashes' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2124' : [ 0x4, { + 'Level' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2126' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0x10, ['__unnamed_2124']], + 'Button' : [ 0x10, ['__unnamed_2126']], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0xe0, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], + 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], + 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], + 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], + 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], + 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], + 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], + 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], + 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], + 'MdlRead' : [ 0x80, ['pointer64', ['void']]], + 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], + 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], + 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], + 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], + 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], + 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], + 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], + 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], + 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], + 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], +} ], + '_KIDTENTRY64' : [ 0x10, { + 'OffsetLow' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'OffsetMiddle' : [ 0x6, ['unsigned short']], + 'OffsetHigh' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { + 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], +} ], + '_LOADER_PARAMETER_EXTENSION' : [ 0x148, { + 'Size' : [ 0x0, ['unsigned long']], + 'Profile' : [ 0x4, ['_PROFILE_PARAMETER_BLOCK']], + 'EmInfFileImage' : [ 0x18, ['pointer64', ['void']]], + 'EmInfFileSize' : [ 0x20, ['unsigned long']], + 'TriageDumpBlock' : [ 0x28, ['pointer64', ['void']]], + 'LoaderPagesSpanned' : [ 0x30, ['unsigned long long']], + 'HeadlessLoaderBlock' : [ 0x38, ['pointer64', ['_HEADLESS_LOADER_BLOCK']]], + 'SMBiosEPSHeader' : [ 0x40, ['pointer64', ['_SMBIOS_TABLE_HEADER']]], + 'DrvDBImage' : [ 0x48, ['pointer64', ['void']]], + 'DrvDBSize' : [ 0x50, ['unsigned long']], + 'NetworkLoaderBlock' : [ 0x58, ['pointer64', ['_NETWORK_LOADER_BLOCK']]], + 'FirmwareDescriptorListHead' : [ 0x60, ['_LIST_ENTRY']], + 'AcpiTable' : [ 0x70, ['pointer64', ['void']]], + 'AcpiTableSize' : [ 0x78, ['unsigned long']], + 'LastBootSucceeded' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'LoaderPerformanceData' : [ 0x80, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], + 'BootApplicationPersistentData' : [ 0x88, ['_LIST_ENTRY']], + 'WmdTestResult' : [ 0x98, ['pointer64', ['void']]], + 'BootIdentifier' : [ 0xa0, ['_GUID']], + 'ResumePages' : [ 0xb0, ['unsigned long']], + 'DumpHeader' : [ 0xb8, ['pointer64', ['void']]], + 'BgContext' : [ 0xc0, ['pointer64', ['void']]], + 'NumaLocalityInfo' : [ 0xc8, ['pointer64', ['void']]], + 'NumaGroupAssignment' : [ 0xd0, ['pointer64', ['void']]], + 'AttachedHives' : [ 0xd8, ['_LIST_ENTRY']], + 'MemoryCachingRequirementsCount' : [ 0xe8, ['unsigned long']], + 'MemoryCachingRequirements' : [ 0xf0, ['pointer64', ['void']]], + 'TpmBootEntropyResult' : [ 0xf8, ['_TPM_BOOT_ENTROPY_LDR_RESULT']], + 'ProcessorCounterFrequency' : [ 0x140, ['unsigned long long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x10, ['unsigned char']], + 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], + 'State' : [ 0x68, ['unsigned char']], + 'ResourcesChanged' : [ 0x69, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x28, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Group' : [ 0x10, ['pointer64', ['void']]], + 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], + 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], +} ], + '_KUMS_CONTEXT_HEADER' : [ 0x70, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'StackTop' : [ 0x20, ['pointer64', ['void']]], + 'StackSize' : [ 0x28, ['unsigned long long']], + 'RspOffset' : [ 0x30, ['unsigned long long']], + 'Rip' : [ 0x38, ['unsigned long long']], + 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], + 'Flags' : [ 0x48, ['unsigned long long']], + 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], + 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], + 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], + 'Return' : [ 0x68, ['unsigned long long']], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x400, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], + 'ConsoleFlags' : [ 0x18, ['unsigned long']], + 'StandardInput' : [ 0x20, ['pointer64', ['void']]], + 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], + 'StandardError' : [ 0x30, ['pointer64', ['void']]], + 'CurrentDirectory' : [ 0x38, ['_CURDIR']], + 'DllPath' : [ 0x50, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], + 'Environment' : [ 0x80, ['pointer64', ['void']]], + 'StartingX' : [ 0x88, ['unsigned long']], + 'StartingY' : [ 0x8c, ['unsigned long']], + 'CountX' : [ 0x90, ['unsigned long']], + 'CountY' : [ 0x94, ['unsigned long']], + 'CountCharsX' : [ 0x98, ['unsigned long']], + 'CountCharsY' : [ 0x9c, ['unsigned long']], + 'FillAttribute' : [ 0xa0, ['unsigned long']], + 'WindowFlags' : [ 0xa4, ['unsigned long']], + 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], + 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], + 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x10, { + 'BasePage' : [ 0x0, ['unsigned long long']], + 'PageCount' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_SRWLOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_ALPC_MESSAGE_ZONE' : [ 0x30, { + 'Mdl' : [ 0x0, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x8, ['pointer64', ['void']]], + 'UserLimit' : [ 0x10, ['pointer64', ['void']]], + 'SystemVa' : [ 0x18, ['pointer64', ['void']]], + 'SystemLimit' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x20, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], + 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], + 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_PROC_HISTORY_ENTRY' : [ 0x4, { + 'Utility' : [ 0x0, ['unsigned short']], + 'Frequency' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer64', ['void']]], + 'Owner' : [ 0x18, ['pointer64', ['void']]], + 'Attributes' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], +} ], + '_KSPECIAL_REGISTERS' : [ 0xd8, { + 'Cr0' : [ 0x0, ['unsigned long long']], + 'Cr2' : [ 0x8, ['unsigned long long']], + 'Cr3' : [ 0x10, ['unsigned long long']], + 'Cr4' : [ 0x18, ['unsigned long long']], + 'KernelDr0' : [ 0x20, ['unsigned long long']], + 'KernelDr1' : [ 0x28, ['unsigned long long']], + 'KernelDr2' : [ 0x30, ['unsigned long long']], + 'KernelDr3' : [ 0x38, ['unsigned long long']], + 'KernelDr6' : [ 0x40, ['unsigned long long']], + 'KernelDr7' : [ 0x48, ['unsigned long long']], + 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], + 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], + 'Tr' : [ 0x70, ['unsigned short']], + 'Ldtr' : [ 0x72, ['unsigned short']], + 'MxCsr' : [ 0x74, ['unsigned long']], + 'DebugControl' : [ 0x78, ['unsigned long long']], + 'LastBranchToRip' : [ 0x80, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], + 'Cr8' : [ 0xa0, ['unsigned long long']], + 'MsrGsBase' : [ 0xa8, ['unsigned long long']], + 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], + 'MsrStar' : [ 0xb8, ['unsigned long long']], + 'MsrLStar' : [ 0xc0, ['unsigned long long']], + 'MsrCStar' : [ 0xc8, ['unsigned long long']], + 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_POOL_HEADER' : [ 0x10, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'AllocatorBackTraceIndex' : [ 0x8, ['unsigned short']], + 'PoolTagHash' : [ 0xa, ['unsigned short']], +} ], + '_ETW_PROVIDER_TABLE_ENTRY' : [ 0x18, { + 'RefCount' : [ 0x0, ['long']], + 'State' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'EtwProviderStateFree', 1: 'EtwProviderStateTransition', 2: 'EtwProviderStateActive', 3: 'EtwProviderStateMax'})]], + 'RegEntry' : [ 0x8, ['pointer64', ['_ETW_REG_ENTRY']]], + 'Caller' : [ 0x10, ['pointer64', ['void']]], +} ], + '_PEB64' : [ 0x380, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x8, ['unsigned long long']], + 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], + 'Ldr' : [ 0x18, ['unsigned long long']], + 'ProcessParameters' : [ 0x20, ['unsigned long long']], + 'SubSystemData' : [ 0x28, ['unsigned long long']], + 'ProcessHeap' : [ 0x30, ['unsigned long long']], + 'FastPebLock' : [ 0x38, ['unsigned long long']], + 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], + 'IFEOKey' : [ 0x48, ['unsigned long long']], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], + 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['unsigned long long']], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'TlsBitmap' : [ 0x78, ['unsigned long long']], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], + 'HotpatchInformation' : [ 0x90, ['unsigned long long']], + 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], + 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], + 'OemCodePageData' : [ 0xa8, ['unsigned long long']], + 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], + 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], + 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'LoaderLock' : [ 0x110, ['unsigned long long']], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], + 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['unsigned long long']], + 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], + 'CSDVersion' : [ 0x2e8, ['_STRING64']], + 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], + 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], + 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], + 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['unsigned long long']], + 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], + 'FlsBitmap' : [ 0x338, ['unsigned long long']], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['unsigned long long']], + 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], + 'pContextData' : [ 0x368, ['unsigned long long']], + 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { + 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x10, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x8, ['unsigned long long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], + 'ZeroInit1' : [ 0x8, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x80, { + 'Address' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '__unnamed_21ca' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x1f80, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_21ca']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'LastProcessSwappedOutTime' : [ 0x20, ['_LARGE_INTEGER']], + 'SessionPageDirectoryIndex' : [ 0x28, ['unsigned long long']], + 'NonPagablePages' : [ 0x30, ['unsigned long long']], + 'CommittedPages' : [ 0x38, ['unsigned long long']], + 'PagedPoolStart' : [ 0x40, ['pointer64', ['void']]], + 'PagedPoolEnd' : [ 0x48, ['pointer64', ['void']]], + 'SessionObject' : [ 0x50, ['pointer64', ['void']]], + 'SessionObjectHandle' : [ 0x58, ['pointer64', ['void']]], + 'ResidentProcessCount' : [ 0x60, ['long']], + 'SessionPoolAllocationFailures' : [ 0x64, ['array', 4, ['unsigned long']]], + 'ImageList' : [ 0x78, ['_LIST_ENTRY']], + 'LocaleId' : [ 0x88, ['unsigned long']], + 'AttachCount' : [ 0x8c, ['unsigned long']], + 'AttachGate' : [ 0x90, ['_KGATE']], + 'WsListEntry' : [ 0xa8, ['_LIST_ENTRY']], + 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xb40, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xb98, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xc00, ['_MMSUPPORT']], + 'Wsle' : [ 0xc88, ['pointer64', ['_MMWSLE']]], + 'DriverUnload' : [ 0xc90, ['pointer64', ['void']]], + 'PagedPool' : [ 0xcc0, ['_POOL_DESCRIPTOR']], + 'PageDirectory' : [ 0x1e00, ['_MMPTE']], + 'SessionVaLock' : [ 0x1e08, ['_KGUARDED_MUTEX']], + 'DynamicVaBitMap' : [ 0x1e40, ['_RTL_BITMAP']], + 'DynamicVaHint' : [ 0x1e50, ['unsigned long']], + 'SpecialPool' : [ 0x1e58, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1ea0, ['_KGUARDED_MUTEX']], + 'PoolBigEntriesInUse' : [ 0x1ed8, ['long']], + 'PagedPoolPdeCount' : [ 0x1edc, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1ee0, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1ee4, ['unsigned long']], + 'SystemPteInfo' : [ 0x1ee8, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1f30, ['pointer64', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1f38, ['unsigned long long']], + 'PoolTrackBigPages' : [ 0x1f40, ['pointer64', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1f48, ['unsigned long long']], + 'IoState' : [ 0x1f50, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1f54, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1f58, ['_KEVENT']], + 'CreateTime' : [ 0x1f70, ['unsigned long long']], + 'CpuQuotaBlock' : [ 0x1f78, ['pointer64', ['_PS_CPU_QUOTA_BLOCK']]], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { + 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_CLIENT_ID' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], + 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], + 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], + 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], + 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0x10, ['pointer64', ['void']]], + 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], + 'ServerIsRemote' : [ 0x1a, ['unsigned char']], + 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x68, { + 'Mutex' : [ 0x0, ['_KGUARDED_MUTEX']], + 'PagedPoolAllocationMap' : [ 0x38, ['_RTL_BITMAP']], + 'FirstPteForPagedPool' : [ 0x48, ['pointer64', ['_MMPTE']]], + 'PagedPoolHint' : [ 0x50, ['unsigned long']], + 'PagedPoolCommit' : [ 0x58, ['unsigned long long']], + 'AllocatedPagedPool' : [ 0x60, ['unsigned long long']], +} ], + '_BITMAP_RANGE' : [ 0x30, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x10, ['long long']], + 'FirstDirtyPage' : [ 0x18, ['unsigned long']], + 'LastDirtyPage' : [ 0x1c, ['unsigned long']], + 'DirtyPages' : [ 0x20, ['unsigned long']], + 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x18, { + 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x10, ['unsigned long']], + 'FullCreateOptions' : [ 0x14, ['unsigned long']], +} ], + '_PROC_PERF_DOMAIN' : [ 0xb8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], + 'Members' : [ 0x18, ['_KAFFINITY_EX']], + 'FeedbackHandler' : [ 0x40, ['pointer64', ['void']]], + 'GetFFHThrottleState' : [ 0x48, ['pointer64', ['void']]], + 'BoostPolicyHandler' : [ 0x50, ['pointer64', ['void']]], + 'PerfSelectionHandler' : [ 0x58, ['pointer64', ['void']]], + 'PerfHandler' : [ 0x60, ['pointer64', ['void']]], + 'Processors' : [ 0x68, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'PerfChangeTime' : [ 0x70, ['unsigned long long']], + 'ProcessorCount' : [ 0x78, ['unsigned long']], + 'PreviousFrequencyMhz' : [ 0x7c, ['unsigned long']], + 'CurrentFrequencyMhz' : [ 0x80, ['unsigned long']], + 'PreviousFrequency' : [ 0x84, ['unsigned long']], + 'CurrentFrequency' : [ 0x88, ['unsigned long']], + 'CurrentPerfContext' : [ 0x8c, ['unsigned long']], + 'DesiredFrequency' : [ 0x90, ['unsigned long']], + 'MaxFrequency' : [ 0x94, ['unsigned long']], + 'MinPerfPercent' : [ 0x98, ['unsigned long']], + 'MinThrottlePercent' : [ 0x9c, ['unsigned long']], + 'MaxPercent' : [ 0xa0, ['unsigned long']], + 'MinPercent' : [ 0xa4, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0xa8, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0xac, ['unsigned long']], + 'Coordination' : [ 0xb0, ['unsigned char']], + 'PerfChangeIntervalCount' : [ 0xb4, ['long']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Type' : [ 0x18, ['unsigned long']], + 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], +} ], + '_DUMMY_FILE_OBJECT' : [ 0x110, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], +} ], + '_POP_TRIGGER_WAIT' : [ 0x38, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Link' : [ 0x20, ['_LIST_ENTRY']], + 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], +} ], + '_RELATION_LIST' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'TagCount' : [ 0x4, ['unsigned long']], + 'FirstLevel' : [ 0x8, ['unsigned long']], + 'MaxLevel' : [ 0xc, ['unsigned long']], + 'Entries' : [ 0x10, ['array', 1, ['pointer64', ['_RELATION_LIST_ENTRY']]]], +} ], + '_IO_TIMER' : [ 0x30, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x8, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x48, { + 'PteBase' : [ 0x0, ['pointer64', ['_MMPTE']]], + 'Lock' : [ 0x8, ['unsigned long long']], + 'Paged' : [ 0x10, ['_MI_SPECIAL_POOL_PTE_LIST']], + 'NonPaged' : [ 0x20, ['_MI_SPECIAL_POOL_PTE_LIST']], + 'PagesInUse' : [ 0x30, ['long long']], + 'SpecialPoolPdes' : [ 0x38, ['_RTL_BITMAP']], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], + 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x8, ['unsigned long long']], + 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '__unnamed_2240' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHigh' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_2244' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_KGDTENTRY64' : [ 0x10, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'Bytes' : [ 0x4, ['__unnamed_2240']], + 'Bits' : [ 0x4, ['__unnamed_2244']], + 'BaseUpper' : [ 0x8, ['unsigned long']], + 'MustBeZero' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], + 'Lock' : [ 0x40, ['_KGUARDED_MUTEX']], + 'List' : [ 0x78, ['_LIST_ENTRY']], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x20, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], +} ], + '_PPM_PERF_STATE' : [ 0x28, { + 'Frequency' : [ 0x0, ['unsigned long']], + 'Power' : [ 0x4, ['unsigned long']], + 'PercentFrequency' : [ 0x8, ['unsigned char']], + 'IncreaseLevel' : [ 0x9, ['unsigned char']], + 'DecreaseLevel' : [ 0xa, ['unsigned char']], + 'Type' : [ 0xb, ['unsigned char']], + 'Control' : [ 0x10, ['unsigned long long']], + 'Status' : [ 0x18, ['unsigned long long']], + 'TotalHitCount' : [ 0x20, ['unsigned long']], + 'DesiredCount' : [ 0x24, ['unsigned long']], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '_KDPC_DATA' : [ 0x20, { + 'DpcListHead' : [ 0x0, ['_LIST_ENTRY']], + 'DpcLock' : [ 0x10, ['unsigned long long']], + 'DpcQueueDepth' : [ 0x18, ['long']], + 'DpcCount' : [ 0x1c, ['unsigned long']], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2260' : [ 0x10, { + 'UserData' : [ 0x0, ['pointer64', ['void']]], + 'Owner' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_2262' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_2260']], + 'Merged' : [ 0x10, ['__unnamed_2262']], + 'Attributes' : [ 0x20, ['unsigned char']], + 'PublicFlags' : [ 0x21, ['unsigned char']], + 'PrivateFlags' : [ 0x22, ['unsigned short']], + 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '__unnamed_226a' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_226a']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { + 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], + 'StackId' : [ 0x20, ['unsigned long']], +} ], + '_MSUBSECTION' : [ 0x70, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'NextMappedSubsection' : [ 0x10, ['pointer64', ['_MSUBSECTION']]], + 'PtesInSubsection' : [ 0x18, ['unsigned long']], + 'UnusedPtes' : [ 0x20, ['unsigned long']], + 'GlobalPerSessionHead' : [ 0x20, ['pointer64', ['_MM_AVL_TABLE']]], + 'u' : [ 0x28, ['__unnamed_1fb7']], + 'StartingSector' : [ 0x2c, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x30, ['unsigned long']], + 'u1' : [ 0x38, ['__unnamed_2059']], + 'LeftChild' : [ 0x40, ['pointer64', ['_MMSUBSECTION_NODE']]], + 'RightChild' : [ 0x48, ['pointer64', ['_MMSUBSECTION_NODE']]], + 'DereferenceList' : [ 0x50, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x60, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x68, ['unsigned long long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_VIRTUAL_EFI_RUNTIME_SERVICES' : [ 0x70, { + 'GetTime' : [ 0x0, ['unsigned long long']], + 'SetTime' : [ 0x8, ['unsigned long long']], + 'GetWakeupTime' : [ 0x10, ['unsigned long long']], + 'SetWakeupTime' : [ 0x18, ['unsigned long long']], + 'SetVirtualAddressMap' : [ 0x20, ['unsigned long long']], + 'ConvertPointer' : [ 0x28, ['unsigned long long']], + 'GetVariable' : [ 0x30, ['unsigned long long']], + 'GetNextVariableName' : [ 0x38, ['unsigned long long']], + 'SetVariable' : [ 0x40, ['unsigned long long']], + 'GetNextHighMonotonicCount' : [ 0x48, ['unsigned long long']], + 'ResetSystem' : [ 0x50, ['unsigned long long']], + 'UpdateCapsule' : [ 0x58, ['unsigned long long']], + 'QueryCapsuleCapabilities' : [ 0x60, ['unsigned long long']], + 'QueryVariableInfo' : [ 0x68, ['unsigned long long']], +} ], + '_MI_SPECIAL_POOL_PTE_LIST' : [ 0x10, { + 'FreePteHead' : [ 0x0, ['_MMPTE']], + 'FreePteTail' : [ 0x8, ['_MMPTE']], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'spare2' : [ 0x12, ['array', 3, ['unsigned char']]], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'spare3' : [ 0x16, ['array', 8, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_2280' : [ 0x8, { + 'ImageCommitment' : [ 0x0, ['unsigned long long']], + 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_2284' : [ 0x8, { + 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_SEGMENT' : [ 0x50, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x30, ['__unnamed_2280']], + 'u2' : [ 0x38, ['__unnamed_2284']], + 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], + 'ThePtes' : [ 0x48, ['array', 1, ['_MMPTE']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x20, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0x18, ['unsigned long long']], +} ], + '__unnamed_228d' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_228f' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_228d']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x100, { + 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x8, ['pointer64', ['void']]], + 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], + 'u1' : [ 0x20, ['__unnamed_228f']], + 'Signature' : [ 0x28, ['unsigned long long']], + 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], + 'PagedBytes' : [ 0x60, ['unsigned long long']], + 'NonPagedBytes' : [ 0x68, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], + 'RaiseIrqls' : [ 0x80, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], + 'AllocationsFailed' : [ 0x90, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], + 'LockedBytes' : [ 0x98, ['unsigned long long']], + 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], + 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], + 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], + 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], + 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], + 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], + 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], + 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], + 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], + 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], +} ], + '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { + 'PlaceHolder' : [ 0x0, ['unsigned long']], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'UlongFlags' : [ 0x0, ['unsigned long']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'ReadAheadSpinLock' : [ 0x48, ['unsigned long long']], + 'PrivateLinks' : [ 0x50, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x60, ['pointer64', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'Spare' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_TPM_BOOT_ENTROPY_LDR_RESULT' : [ 0x48, { + 'Policy' : [ 0x0, ['unsigned long long']], + 'ResultCode' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'TpmBootEntropyStructureUninitialized', 1: 'TpmBootEntropyDisabledByPolicy', 2: 'TpmBootEntropyNoTpmFound', 3: 'TpmBootEntropyTpmError', 4: 'TpmBootEntropySuccess'})]], + 'ResultStatus' : [ 0xc, ['long']], + 'Time' : [ 0x10, ['unsigned long long']], + 'EntropyLength' : [ 0x18, ['unsigned long']], + 'EntropyData' : [ 0x1c, ['array', 40, ['unsigned char']]], +} ], + '_RTL_HANDLE_TABLE' : [ 0x30, { + 'MaximumNumberOfHandles' : [ 0x0, ['unsigned long']], + 'SizeOfHandleTableEntry' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['array', 2, ['unsigned long']]], + 'FreeHandles' : [ 0x10, ['pointer64', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'CommittedHandles' : [ 0x18, ['pointer64', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'UnCommittedHandles' : [ 0x20, ['pointer64', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'MaxReservedHandles' : [ 0x28, ['pointer64', ['_RTL_HANDLE_TABLE_ENTRY']]], +} ], + '_PTE_TRACKER' : [ 0x58, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'Count' : [ 0x18, ['unsigned long long']], + 'SystemVa' : [ 0x20, ['pointer64', ['void']]], + 'StartVa' : [ 0x28, ['pointer64', ['void']]], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'CallingAddress' : [ 0x48, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x50, ['pointer64', ['void']]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ContextSwitches' : [ 0x14, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_HMAP_ENTRY' : [ 0x20, { + 'BlockAddress' : [ 0x0, ['unsigned long long']], + 'BinAddress' : [ 0x8, ['unsigned long long']], + 'CmView' : [ 0x10, ['pointer64', ['_CM_VIEW_OF_FILE']]], + 'MemAlloc' : [ 0x18, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x18, { + 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x8, ['unsigned short']], + 'Atom' : [ 0xa, ['unsigned short']], + 'ReferenceCount' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['unsigned char']], + 'NameLength' : [ 0xf, ['unsigned char']], + 'Name' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], +} ], + '_LOADER_PERFORMANCE_DATA' : [ 0x10, { + 'StartTime' : [ 0x0, ['unsigned long long']], + 'EndTime' : [ 0x8, ['unsigned long long']], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1'})]], + 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], + 'RequestArgument' : [ 0x20, ['unsigned long long']], + 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MMSESSION' : [ 0x58, { + 'SystemSpaceViewLock' : [ 0x0, ['_KGUARDED_MUTEX']], + 'SystemSpaceViewLockPointer' : [ 0x38, ['pointer64', ['_KGUARDED_MUTEX']]], + 'SystemSpaceViewTable' : [ 0x40, ['pointer64', ['_MMVIEW']]], + 'SystemSpaceHashSize' : [ 0x48, ['unsigned long']], + 'SystemSpaceHashEntries' : [ 0x4c, ['unsigned long']], + 'SystemSpaceHashKey' : [ 0x50, ['unsigned long']], + 'BitmapFailures' : [ 0x54, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x70, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'Index' : [ 0x30, ['unsigned short']], + 'Flags' : [ 0x32, ['unsigned short']], + 'EnableMask' : [ 0x34, ['unsigned char']], + 'GroupEnableMask' : [ 0x35, ['unsigned char']], + 'UseDescriptorType' : [ 0x36, ['unsigned char']], + 'SessionId' : [ 0x38, ['unsigned long']], + 'ReplyQueue' : [ 0x38, ['pointer64', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x38, ['array', 4, ['pointer64', ['_ETW_REG_ENTRY']]]], + 'Process' : [ 0x58, ['pointer64', ['_EPROCESS']]], + 'Callback' : [ 0x58, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x60, ['pointer64', ['void']]], + 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0x100, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x30, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], + 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], + 'PortContext' : [ 0x50, ['pointer64', ['void']]], + 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0xe0, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], + 'Flags' : [ 0xe4, ['unsigned long']], + 'WaitEvent' : [ 0xe8, ['_KEVENT']], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x60, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x10, ['unsigned long']], + 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x2c, ['unsigned long']], + 'WorkSpace' : [ 0x30, ['long long']], + 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x3c, ['unsigned long']], + 'BusNumber' : [ 0x40, ['unsigned long']], + 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x20, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x2f8, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], + 'GetNewDeviceList' : [ 0x30, ['unsigned char']], + 'Order' : [ 0x38, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x2d0, ['_LIST_ENTRY']], + 'Status' : [ 0x2e0, ['long']], + 'FailedDevice' : [ 0x2e8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x2f0, ['unsigned char']], + 'Cancelled' : [ 0x2f1, ['unsigned char']], + 'IgnoreErrors' : [ 0x2f2, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x2f3, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x2f4, ['unsigned char']], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x28, { + 'Size' : [ 0x0, ['unsigned long long']], + 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], + 'ProcessId' : [ 0x18, ['unsigned long']], + 'ServiceTag' : [ 0x1c, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], + 'DevicePathOffset' : [ 0x18, ['unsigned long long']], + 'ReasonOffset' : [ 0x20, ['unsigned long long']], +} ], + '_EX_WORK_QUEUE' : [ 0x58, { + 'WorkerQueue' : [ 0x0, ['_KQUEUE']], + 'DynamicThreadCount' : [ 0x40, ['unsigned long']], + 'WorkItemsProcessed' : [ 0x44, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x48, ['unsigned long']], + 'QueueDepthLastPass' : [ 0x4c, ['unsigned long']], + 'Info' : [ 0x50, ['EX_QUEUE_WORKER_INFO']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_TEB32' : [ 0xfe4, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'SystemReserved1' : [ 0xcc, ['array', 54, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'SpareBytes' : [ 0x1ac, ['array', 36, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'EtwLocalData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'SpareUlong0' : [ 0xfdc, ['unsigned long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x28, ['unsigned long']], + 'PagingCount' : [ 0x2c, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0x60, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'IdleCheck' : [ 0x28, ['pointer64', ['void']]], + 'IdleHandler' : [ 0x30, ['pointer64', ['void']]], + 'HvConfig' : [ 0x38, ['unsigned long long']], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Latency' : [ 0x48, ['unsigned long']], + 'Power' : [ 0x4c, ['unsigned long']], + 'TimeCheck' : [ 0x50, ['unsigned long']], + 'StateFlags' : [ 0x54, ['unsigned long']], + 'PromotePercent' : [ 0x58, ['unsigned char']], + 'DemotePercent' : [ 0x59, ['unsigned char']], + 'PromotePercentBase' : [ 0x5a, ['unsigned char']], + 'DemotePercentBase' : [ 0x5b, ['unsigned char']], + 'StateType' : [ 0x5c, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x250, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x20, ['unsigned long']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x88, ['_GUID']], + 'NotificationQueue' : [ 0x98, ['_KQUEUE']], + 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], + 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x120, ['unsigned long']], + 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], + 'Key' : [ 0x130, ['pointer64', ['void']]], + 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], + 'Description' : [ 0x170, ['_UNICODE_STRING']], + 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '__unnamed_2318' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x40, { + 'Lock' : [ 0x0, ['long']], + 'NodeToFree' : [ 0x8, ['pointer64', ['void']]], + 'NodeRangeSize' : [ 0x10, ['unsigned long long']], + 'NodeCount' : [ 0x18, ['unsigned long long']], + 'Tables' : [ 0x20, ['pointer64', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x28, ['unsigned long']], + 'u1' : [ 0x2c, ['__unnamed_2318']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_RELATION_LIST_ENTRY' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'MaxCount' : [ 0x4, ['unsigned long']], + 'Devices' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x8168, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], + 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], + 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x8010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], + 'NodesSearched' : [ 0x801c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], + 'SequenceNumber' : [ 0x8024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], + 'DepthLimitHits' : [ 0x8030, ['unsigned long']], + 'SearchLimitHits' : [ 0x8034, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x8038, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x803c, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x8040, ['unsigned long']], + 'TotalReleases' : [ 0x8044, ['unsigned long']], + 'RootNodesDeleted' : [ 0x8048, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x804c, ['unsigned long']], + 'Instigator' : [ 0x8050, ['pointer64', ['void']]], + 'NumberOfParticipants' : [ 0x8058, ['unsigned long']], + 'Participant' : [ 0x8060, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x8160, ['long']], +} ], + '_KTM' : [ 0x3c0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x8, ['_KMUTANT']], + 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x70, ['_GUID']], + 'Flags' : [ 0x80, ['unsigned long']], + 'VolatileFlags' : [ 0x84, ['unsigned long']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], + 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], + 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x288, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], + 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], + 'LogFlags' : [ 0x378, ['unsigned long']], + 'LogFullStatus' : [ 0x37c, ['long']], + 'RecoveryStatus' : [ 0x380, ['long']], + 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], +} ], + '_CONFIGURATION_COMPONENT' : [ 0x28, { + 'Class' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SystemClass', 1: 'ProcessorClass', 2: 'CacheClass', 3: 'AdapterClass', 4: 'ControllerClass', 5: 'PeripheralClass', 6: 'MemoryClass', 7: 'MaximumClass'})]], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'ArcSystem', 1: 'CentralProcessor', 2: 'FloatingPointProcessor', 3: 'PrimaryIcache', 4: 'PrimaryDcache', 5: 'SecondaryIcache', 6: 'SecondaryDcache', 7: 'SecondaryCache', 8: 'EisaAdapter', 9: 'TcAdapter', 10: 'ScsiAdapter', 11: 'DtiAdapter', 12: 'MultiFunctionAdapter', 13: 'DiskController', 14: 'TapeController', 15: 'CdromController', 16: 'WormController', 17: 'SerialController', 18: 'NetworkController', 19: 'DisplayController', 20: 'ParallelController', 21: 'PointerController', 22: 'KeyboardController', 23: 'AudioController', 24: 'OtherController', 25: 'DiskPeripheral', 26: 'FloppyDiskPeripheral', 27: 'TapePeripheral', 28: 'ModemPeripheral', 29: 'MonitorPeripheral', 30: 'PrinterPeripheral', 31: 'PointerPeripheral', 32: 'KeyboardPeripheral', 33: 'TerminalPeripheral', 34: 'OtherPeripheral', 35: 'LinePeripheral', 36: 'NetworkPeripheral', 37: 'SystemMemory', 38: 'DockingInformation', 39: 'RealModeIrqRoutingTable', 40: 'RealModePCIEnumeration', 41: 'MaximumType'})]], + 'Flags' : [ 0x8, ['_DEVICE_FLAGS']], + 'Version' : [ 0xc, ['unsigned short']], + 'Revision' : [ 0xe, ['unsigned short']], + 'Key' : [ 0x10, ['unsigned long']], + 'AffinityMask' : [ 0x14, ['unsigned long']], + 'Group' : [ 0x14, ['unsigned short']], + 'GroupIndex' : [ 0x16, ['unsigned short']], + 'ConfigurationDataLength' : [ 0x18, ['unsigned long']], + 'IdentifierLength' : [ 0x1c, ['unsigned long']], + 'Identifier' : [ 0x20, ['pointer64', ['unsigned char']]], +} ], + '_KTRANSACTION' : [ 0x2d8, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x20, ['_KMUTANT']], + 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0xb0, ['_GUID']], + 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xd8, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], + 'PendingResponses' : [ 0xec, ['unsigned long']], + 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xf8, ['_CLS_LSN']], + 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], + 'IsolationLevel' : [ 0x120, ['unsigned long']], + 'IsolationFlags' : [ 0x124, ['unsigned long']], + 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], + 'Description' : [ 0x130, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0x168, ['_KDPC']], + 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], + 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], + 'CommitReservation' : [ 0x208, ['long long']], + 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], + 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], + 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x60, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], + 'UoWState' : [ 0x40, ['unsigned long']], + 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x50, ['unsigned long']], + 'OldValueCell' : [ 0x50, ['unsigned long']], + 'NewValueCell' : [ 0x54, ['unsigned long']], + 'UserFlags' : [ 0x50, ['unsigned long']], + 'LastWriteTime' : [ 0x50, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x50, ['unsigned long']], + 'OldChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KREQUEST_PACKET' : [ 0x20, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], +} ], + '_VF_WATCHDOG_IRP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'DueTickCount' : [ 0x18, ['unsigned long']], + 'Inserted' : [ 0x1c, ['unsigned char']], + 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_2367' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_2369' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_2367']], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_2369']], +} ], + '_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA' : [ 0x8, { + 'CapturedCpuShareWeight' : [ 0x0, ['unsigned long']], + 'CapturedTotalWeight' : [ 0x4, ['unsigned long']], + 'CombinedData' : [ 0x0, ['long long']], +} ], + '_CM_NAME_HASH' : [ 0x18, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x10, ['unsigned short']], + 'Name' : [ 0x12, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], +} ], + '_PO_IRP_QUEUE' : [ 0x10, { + 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], +} ], + '__unnamed_237c' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0xd0, { + 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x48, ['__unnamed_237c']], + 'ChildrenCount' : [ 0x4c, ['long']], + 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], + 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0xa8, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x68, ['_KMUTANT']], + 'LinksOffset' : [ 0xa0, ['unsigned short']], + 'GuidOffset' : [ 0xa2, ['unsigned short']], + 'Expired' : [ 0xa4, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x20, { + 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x10, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x10, { + 'Stream' : [ 0x0, ['pointer64', ['void']]], + 'Detail' : [ 0x8, ['unsigned long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x10, { + 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], + 'End' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x10, ['pointer64', ['void']]], + 'Key' : [ 0x18, ['unsigned long long']], + 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x408, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x40, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_HEAP_USERDATA_HEADER' : [ 0x20, { + 'SFreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'SubSegment' : [ 0x0, ['pointer64', ['_HEAP_SUBSEGMENT']]], + 'Reserved' : [ 0x8, ['pointer64', ['void']]], + 'SizeIndex' : [ 0x10, ['unsigned long long']], + 'Signature' : [ 0x18, ['unsigned long long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_STACK_TABLE' : [ 0x8088, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_DEFERRED_WRITE' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x10, ['unsigned long']], + 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Context1' : [ 0x38, ['pointer64', ['void']]], + 'Context2' : [ 0x40, ['pointer64', ['void']]], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x40, { + 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], + 'ZeroBits' : [ 0x8, ['unsigned long']], + 'MaximumStackSize' : [ 0x10, ['unsigned long long']], + 'CommittedStackSize' : [ 0x18, ['unsigned long long']], + 'SubSystemType' : [ 0x20, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], + 'SubSystemVersion' : [ 0x24, ['unsigned long']], + 'GpValue' : [ 0x28, ['unsigned long']], + 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], + 'DllCharacteristics' : [ 0x2e, ['unsigned short']], + 'Machine' : [ 0x30, ['unsigned short']], + 'ImageContainsCode' : [ 0x32, ['unsigned char']], + 'ImageFlags' : [ 0x33, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x34, ['unsigned long']], + 'ImageFileSize' : [ 0x38, ['unsigned long']], + 'CheckSum' : [ 0x3c, ['unsigned long']], +} ], + '_VF_AVL_TABLE' : [ 0x70, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1b, { + 'PerUserPolicy' : [ 0x0, ['array', 27, ['unsigned char']]], +} ], + '__unnamed_23d4' : [ 0x10, { + 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], +} ], + '__unnamed_23d6' : [ 0x8, { + 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], +} ], + '__unnamed_23da' : [ 0x8, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_23de' : [ 0x10, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x8, ['unsigned char']], +} ], + '__unnamed_23e0' : [ 0x28, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], + 'Argument5' : [ 0x20, ['pointer64', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x28, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_23d4']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_23d6']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_23da']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_23de']], + 'Others' : [ 0x0, ['__unnamed_23e0']], +} ], + '_PROFILE_PARAMETER_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'DockingState' : [ 0x4, ['unsigned short']], + 'Capabilities' : [ 0x6, ['unsigned short']], + 'DockID' : [ 0x8, ['unsigned long']], + 'SerialNumber' : [ 0xc, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_POP_HIBER_CONTEXT' : [ 0x110, { + 'WriteToFile' : [ 0x0, ['unsigned char']], + 'ReserveLoaderMemory' : [ 0x1, ['unsigned char']], + 'ReserveFreeMemory' : [ 0x2, ['unsigned char']], + 'Reset' : [ 0x3, ['unsigned char']], + 'HiberFlags' : [ 0x4, ['unsigned char']], + 'WroteHiberFile' : [ 0x5, ['unsigned char']], + 'MapFrozen' : [ 0x6, ['unsigned char']], + 'MemoryMap' : [ 0x8, ['_RTL_BITMAP']], + 'DiscardedMemoryPages' : [ 0x18, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x28, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x38, ['unsigned long']], + 'NextCloneRange' : [ 0x40, ['pointer64', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x48, ['unsigned long long']], + 'LoaderMdl' : [ 0x50, ['pointer64', ['_MDL']]], + 'AllocatedMdl' : [ 0x58, ['pointer64', ['_MDL']]], + 'PagesOut' : [ 0x60, ['unsigned long long']], + 'IoPages' : [ 0x68, ['pointer64', ['void']]], + 'IoPagesCount' : [ 0x70, ['unsigned long']], + 'CurrentMcb' : [ 0x78, ['pointer64', ['void']]], + 'DumpStack' : [ 0x80, ['pointer64', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0x88, ['pointer64', ['_KPROCESSOR_STATE']]], + 'PreferredIoWriteSize' : [ 0x90, ['unsigned long']], + 'IoProgress' : [ 0x94, ['unsigned long']], + 'HiberVa' : [ 0x98, ['unsigned long long']], + 'HiberPte' : [ 0xa0, ['_LARGE_INTEGER']], + 'Status' : [ 0xa8, ['long']], + 'MemoryImage' : [ 0xb0, ['pointer64', ['PO_MEMORY_IMAGE']]], + 'CompressionWorkspace' : [ 0xb8, ['pointer64', ['void']]], + 'CompressedWriteBuffer' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'CompressedWriteBufferSize' : [ 0xc8, ['unsigned long']], + 'MaxCompressedOutputSize' : [ 0xcc, ['unsigned long']], + 'PerformanceStats' : [ 0xd0, ['pointer64', ['unsigned long']]], + 'CompressionBlock' : [ 0xd8, ['pointer64', ['void']]], + 'DmaIO' : [ 0xe0, ['pointer64', ['void']]], + 'TemporaryHeap' : [ 0xe8, ['pointer64', ['void']]], + 'BootLoaderLogMdl' : [ 0xf0, ['pointer64', ['_MDL']]], + 'FirmwareRuntimeInformationMdl' : [ 0xf8, ['pointer64', ['_MDL']]], + 'ResumeContext' : [ 0x100, ['pointer64', ['void']]], + 'ResumeContextPages' : [ 0x108, ['unsigned long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x80, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x10, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_KDESCRIPTOR' : [ 0x10, { + 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], + 'Limit' : [ 0x6, ['unsigned short']], + 'Base' : [ 0x8, ['pointer64', ['void']]], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x110, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0xa0, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0xa8, ['pointer64', ['void']]], + 'PointersLength' : [ 0xb0, ['unsigned long']], + 'ModulePrefix' : [ 0xb8, ['pointer64', ['unsigned short']]], + 'DriverList' : [ 0xc0, ['_LIST_ENTRY']], + 'InitMsg' : [ 0xd0, ['_STRING']], + 'ProgMsg' : [ 0xe0, ['_STRING']], + 'DoneMsg' : [ 0xf0, ['_STRING']], + 'FileObject' : [ 0x100, ['pointer64', ['void']]], + 'UsageType' : [ 0x108, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x40, { + 'ThreadHandle' : [ 0x0, ['pointer64', ['void']]], + 'ThreadId' : [ 0x8, ['pointer64', ['void']]], + 'ProcessId' : [ 0x10, ['pointer64', ['void']]], + 'Code' : [ 0x18, ['unsigned long']], + 'Parameter1' : [ 0x20, ['unsigned long long']], + 'Parameter2' : [ 0x28, ['unsigned long long']], + 'Parameter3' : [ 0x30, ['unsigned long long']], + 'Parameter4' : [ 0x38, ['unsigned long long']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_PCW_MASK_INFORMATION' : [ 0x28, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0x10, ['unsigned long']], + 'CollectMultiple' : [ 0x14, ['unsigned char']], + 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], +} ], + '_RTL_HANDLE_TABLE_ENTRY' : [ 0x8, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NextFree' : [ 0x0, ['pointer64', ['_RTL_HANDLE_TABLE_ENTRY']]], +} ], + '__unnamed_2406' : [ 0x20, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x20, { + 'Parameters' : [ 0x0, ['__unnamed_2406']], +} ], + '__unnamed_240a' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_240a']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + 'PO_MEMORY_IMAGE' : [ 0x128, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long long']], + 'PageSize' : [ 0x18, ['unsigned long']], + 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x28, ['unsigned long long']], + 'FeatureFlags' : [ 0x30, ['unsigned long']], + 'HiberFlags' : [ 0x34, ['unsigned char']], + 'spare' : [ 0x35, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x38, ['unsigned long']], + 'HiberVa' : [ 0x40, ['unsigned long long']], + 'HiberPte' : [ 0x48, ['_LARGE_INTEGER']], + 'NoFreePages' : [ 0x50, ['unsigned long']], + 'FreeMapCheck' : [ 0x54, ['unsigned long']], + 'WakeCheck' : [ 0x58, ['unsigned long']], + 'FirstTablePage' : [ 0x60, ['unsigned long long']], + 'PerfInfo' : [ 0x68, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0xc0, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0xc8, ['array', 1, ['unsigned long long']]], + 'NoBootLoaderLogPages' : [ 0xd0, ['unsigned long']], + 'BootLoaderLogPages' : [ 0xd8, ['array', 8, ['unsigned long long']]], + 'NotUsed' : [ 0x118, ['unsigned long']], + 'ResumeContextCheck' : [ 0x11c, ['unsigned long']], + 'ResumeContextPages' : [ 0x120, ['unsigned long']], +} ], + 'EX_QUEUE_WORKER_INFO' : [ 0x4, { + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'QueueWorkerInfo' : [ 0x0, ['long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_CURDIR' : [ 0x18, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x58, { + 'IoTicks' : [ 0x0, ['unsigned long long']], + 'InitTicks' : [ 0x8, ['unsigned long long']], + 'CopyTicks' : [ 0x10, ['unsigned long long']], + 'ElapsedTicks' : [ 0x18, ['unsigned long long']], + 'CompressTicks' : [ 0x20, ['unsigned long long']], + 'ResumeAppTime' : [ 0x28, ['unsigned long long']], + 'HiberFileResumeTime' : [ 0x30, ['unsigned long long']], + 'BytesCopied' : [ 0x38, ['unsigned long long']], + 'PagesProcessed' : [ 0x40, ['unsigned long long']], + 'PagesWritten' : [ 0x48, ['unsigned long']], + 'DumpCount' : [ 0x4c, ['unsigned long']], + 'FileRuns' : [ 0x50, ['unsigned long']], +} ], + '_DEVICE_FLAGS' : [ 0x4, { + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], +} ], + '_RTL_BALANCED_LINKS' : [ 0x20, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0x18, ['unsigned char']], + 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], +} ], + '_MMVIEW' : [ 0x30, { + 'Entry' : [ 0x0, ['unsigned long long']], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], + 'ViewLinks' : [ 0x10, ['_LIST_ENTRY']], + 'SessionViewVa' : [ 0x20, ['pointer64', ['void']]], + 'SessionId' : [ 0x28, ['unsigned long']], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], +} ], + '_HEADLESS_LOADER_BLOCK' : [ 0x40, { + 'UsedBiosSettings' : [ 0x0, ['unsigned char']], + 'DataBits' : [ 0x1, ['unsigned char']], + 'StopBits' : [ 0x2, ['unsigned char']], + 'Parity' : [ 0x3, ['unsigned char']], + 'BaudRate' : [ 0x4, ['unsigned long']], + 'PortNumber' : [ 0x8, ['unsigned long']], + 'PortAddress' : [ 0x10, ['pointer64', ['unsigned char']]], + 'PciDeviceId' : [ 0x18, ['unsigned short']], + 'PciVendorId' : [ 0x1a, ['unsigned short']], + 'PciBusNumber' : [ 0x1c, ['unsigned char']], + 'PciBusSegment' : [ 0x1e, ['unsigned short']], + 'PciSlotNumber' : [ 0x20, ['unsigned char']], + 'PciFunctionNumber' : [ 0x21, ['unsigned char']], + 'PciFlags' : [ 0x24, ['unsigned long']], + 'SystemGUID' : [ 0x28, ['_GUID']], + 'IsMMIODevice' : [ 0x38, ['unsigned char']], + 'TerminalType' : [ 0x39, ['unsigned char']], +} ], + '__unnamed_2434' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2436' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2438' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_2434']], + 'Gpt' : [ 0x0, ['__unnamed_2436']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0xa0, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], + 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], + 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], + 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], + 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], + 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], + 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], + 'CrashDump' : [ 0x68, ['unsigned char']], + 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], + 'CommonBufferSize' : [ 0x70, ['unsigned long']], + 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], + 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], + 'PartitionStyle' : [ 0x88, ['unsigned long']], + 'DiskInfo' : [ 0x8c, ['__unnamed_2438']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x48, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Hint' : [ 0x14, ['unsigned long']], + 'BasePte' : [ 0x18, ['pointer64', ['_MMPTE']]], + 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], + 'Vm' : [ 0x28, ['pointer64', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x30, ['long']], + 'TotalFreeSystemPtes' : [ 0x34, ['long']], + 'CachedPteCount' : [ 0x38, ['long']], + 'PteFailures' : [ 0x3c, ['unsigned long']], + 'SpinLock' : [ 0x40, ['unsigned long long']], + 'GlobalMutex' : [ 0x40, ['pointer64', ['_KGUARDED_MUTEX']]], +} ], + '_NETWORK_LOADER_BLOCK' : [ 0x20, { + 'DHCPServerACK' : [ 0x0, ['pointer64', ['unsigned char']]], + 'DHCPServerACKLength' : [ 0x8, ['unsigned long']], + 'BootServerReplyPacket' : [ 0x10, ['pointer64', ['unsigned char']]], + 'BootServerReplyPacketLength' : [ 0x18, ['unsigned long']], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x298, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x10, ['array', 9, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x48, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x40, ['long']], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { + 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_AVL_TABLE' : [ 0x68, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], + 'WhichOrderedElement' : [ 0x28, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], + 'DepthOfTree' : [ 0x30, ['unsigned long']], + 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x40, ['unsigned long']], + 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], + 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], + 'TableContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x5f0, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'Reserved2' : [ 0x248, ['array', 7, ['unsigned long']]], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'AltArchitecturePad' : [ 0x2c4, ['array', 1, ['unsigned long']]], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['unsigned char']], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'TscQpcData' : [ 0x2ed, ['unsigned char']], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'SystemCall' : [ 0x300, ['unsigned long']], + 'SystemCallReturn' : [ 0x304, ['unsigned long']], + 'SystemCallPad' : [ 0x308, ['array', 3, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'DEPRECATED_Wow64SharedInformation' : [ 0x340, ['array', 16, ['unsigned long']]], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved5' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'TscQpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned short']], + 'Reserved4' : [ 0x3c6, ['unsigned short']], + 'AitSamplingValue' : [ 0x3c8, ['unsigned long']], + 'AppCompatFlag' : [ 0x3cc, ['unsigned long']], + 'DEPRECATED_SystemDllNativeRelocation' : [ 0x3d0, ['unsigned long long']], + 'DEPRECATED_SystemDllWowRelocation' : [ 0x3d8, ['unsigned long']], + 'XStatePad' : [ 0x3dc, ['array', 1, ['unsigned long']]], + 'XState' : [ 0x3e0, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_1043' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_1043']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1047' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1047']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '__unnamed_105f' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1061' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_105f']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], + 'RaceDll' : [ 0x20, ['pointer64', ['void']]], + 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], + 'u' : [ 0x38, ['__unnamed_1061']], + 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_INVALID'})]], + 'Size' : [ 0x40, ['unsigned long']], +} ], + '_TP_TASK' : [ 0x20, { + 'Callbacks' : [ 0x0, ['pointer64', ['_TP_TASK_CALLBACKS']]], + 'NumaNode' : [ 0x8, ['unsigned long']], + 'IdealProcessor' : [ 0xc, ['unsigned char']], + 'ListEntry' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_TP_TASK_CALLBACKS' : [ 0x10, { + 'ExecuteCallback' : [ 0x0, ['pointer64', ['void']]], + 'Unposted' : [ 0x8, ['pointer64', ['void']]], +} ], + '_TP_DIRECT' : [ 0x10, { + 'Callback' : [ 0x0, ['pointer64', ['void']]], + 'NumaNode' : [ 0x8, ['unsigned long']], + 'IdealProcessor' : [ 0xc, ['unsigned char']], +} ], + '_TEB' : [ 0x1818, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], + 'ClientId' : [ 0x40, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], + 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'SystemReserved1' : [ 0x110, ['array', 54, ['pointer64', ['void']]]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], + 'SpareBytes' : [ 0x2d0, ['array', 24, ['unsigned char']]], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], + 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], + 'glSection' : [ 0x1230, ['pointer64', ['void']]], + 'glTable' : [ 0x1238, ['pointer64', ['void']]], + 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], + 'glContext' : [ 0x1248, ['pointer64', ['void']]], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], + 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], + 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], + 'Vdm' : [ 0x1690, ['pointer64', ['void']]], + 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], + 'EtwLocalData' : [ 0x1728, ['pointer64', ['void']]], + 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], + 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], + 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], + 'SoftPatchPtr1' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], + 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], + 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], + 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], + 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], + 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], + 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], + 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], + 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], + 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], + 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'SpareUlong0' : [ 0x180c, ['unsigned long']], + 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], +} ], + '_LIST_ENTRY' : [ 0x10, { + 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x8, { + 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { + 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer64', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_RTL_BITMAP' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS64' : [ 0x108, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_KPCR' : [ 0x4e80, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], + 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], + 'UserRsp' : [ 0x10, ['unsigned long long']], + 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], + 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], + 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Used_Self' : [ 0x30, ['pointer64', ['void']]], + 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], + 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'Irql' : [ 0x50, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], + 'ObsoleteNumber' : [ 0x52, ['unsigned char']], + 'Fill0' : [ 0x53, ['unsigned char']], + 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], + 'MajorVersion' : [ 0x60, ['unsigned short']], + 'MinorVersion' : [ 0x62, ['unsigned short']], + 'StallScaleFactor' : [ 0x64, ['unsigned long']], + 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], + 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], + 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], + 'Unused2' : [ 0x100, ['unsigned long']], + 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], + 'Unused3' : [ 0x110, ['pointer64', ['void']]], + 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], + 'Prcb' : [ 0x180, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x4d00, { + 'MxCsr' : [ 0x0, ['unsigned long']], + 'LegacyNumber' : [ 0x4, ['unsigned char']], + 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], + 'InterruptRequest' : [ 0x6, ['unsigned char']], + 'IdleHalt' : [ 0x7, ['unsigned char']], + 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NestingLevel' : [ 0x20, ['unsigned char']], + 'PrcbPad00' : [ 0x21, ['array', 3, ['unsigned char']]], + 'Number' : [ 0x24, ['unsigned long']], + 'RspBase' : [ 0x28, ['unsigned long long']], + 'PrcbLock' : [ 0x30, ['unsigned long long']], + 'PrcbPad01' : [ 0x38, ['unsigned long long']], + 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], + 'CpuType' : [ 0x5f0, ['unsigned char']], + 'CpuID' : [ 0x5f1, ['unsigned char']], + 'CpuStep' : [ 0x5f2, ['unsigned short']], + 'CpuStepping' : [ 0x5f2, ['unsigned char']], + 'CpuModel' : [ 0x5f3, ['unsigned char']], + 'MHz' : [ 0x5f4, ['unsigned long']], + 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], + 'MinorVersion' : [ 0x638, ['unsigned short']], + 'MajorVersion' : [ 0x63a, ['unsigned short']], + 'BuildType' : [ 0x63c, ['unsigned char']], + 'CpuVendor' : [ 0x63d, ['unsigned char']], + 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], + 'ApicMask' : [ 0x640, ['unsigned long']], + 'CFlushSize' : [ 0x644, ['unsigned long']], + 'AcpiReserved' : [ 0x648, ['pointer64', ['void']]], + 'InitialApicId' : [ 0x650, ['unsigned long']], + 'Stride' : [ 0x654, ['unsigned long']], + 'Group' : [ 0x658, ['unsigned short']], + 'GroupSetMember' : [ 0x660, ['unsigned long long']], + 'GroupIndex' : [ 0x668, ['unsigned char']], + 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PacketBarrier' : [ 0x2080, ['long']], + 'DeferredReadyListHead' : [ 0x2088, ['_SINGLE_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x2090, ['long']], + 'MmCopyOnWriteCount' : [ 0x2094, ['long']], + 'MmTransitionCount' : [ 0x2098, ['long']], + 'MmDemandZeroCount' : [ 0x209c, ['long']], + 'MmPageReadCount' : [ 0x20a0, ['long']], + 'MmPageReadIoCount' : [ 0x20a4, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x20a8, ['long']], + 'MmDirtyWriteIoCount' : [ 0x20ac, ['long']], + 'MmMappedPagesWriteCount' : [ 0x20b0, ['long']], + 'MmMappedWriteIoCount' : [ 0x20b4, ['long']], + 'KeSystemCalls' : [ 0x20b8, ['unsigned long']], + 'KeContextSwitches' : [ 0x20bc, ['unsigned long']], + 'CcFastReadNoWait' : [ 0x20c0, ['unsigned long']], + 'CcFastReadWait' : [ 0x20c4, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x20c8, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x20cc, ['unsigned long']], + 'CcCopyReadWait' : [ 0x20d0, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x20d4, ['unsigned long']], + 'LookasideIrpFloat' : [ 0x20d8, ['long']], + 'IoReadOperationCount' : [ 0x20dc, ['long']], + 'IoWriteOperationCount' : [ 0x20e0, ['long']], + 'IoOtherOperationCount' : [ 0x20e4, ['long']], + 'IoReadTransferCount' : [ 0x20e8, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x20f0, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x20f8, ['_LARGE_INTEGER']], + 'TargetCount' : [ 0x2100, ['long']], + 'IpiFrozen' : [ 0x2104, ['unsigned long']], + 'DpcData' : [ 0x2180, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x21c0, ['pointer64', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x21c8, ['long']], + 'DpcRequestRate' : [ 0x21cc, ['unsigned long']], + 'MinimumDpcRate' : [ 0x21d0, ['unsigned long']], + 'DpcLastCount' : [ 0x21d4, ['unsigned long']], + 'ThreadDpcEnable' : [ 0x21d8, ['unsigned char']], + 'QuantumEnd' : [ 0x21d9, ['unsigned char']], + 'DpcRoutineActive' : [ 0x21da, ['unsigned char']], + 'IdleSchedule' : [ 0x21db, ['unsigned char']], + 'DpcRequestSummary' : [ 0x21dc, ['long']], + 'DpcRequestSlot' : [ 0x21dc, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x21dc, ['short']], + 'DpcThreadActive' : [ 0x21de, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ThreadDpcState' : [ 0x21de, ['short']], + 'TimerHand' : [ 0x21e0, ['unsigned long']], + 'MasterOffset' : [ 0x21e4, ['long']], + 'LastTick' : [ 0x21e8, ['unsigned long']], + 'UnusedPad' : [ 0x21ec, ['unsigned long']], + 'PrcbPad50' : [ 0x21f0, ['array', 2, ['unsigned long long']]], + 'TimerTable' : [ 0x2200, ['_KTIMER_TABLE']], + 'DpcGate' : [ 0x4400, ['_KGATE']], + 'PrcbPad52' : [ 0x4418, ['pointer64', ['void']]], + 'CallDpc' : [ 0x4420, ['_KDPC']], + 'ClockKeepAlive' : [ 0x4460, ['long']], + 'ClockCheckSlot' : [ 0x4464, ['unsigned char']], + 'ClockPollCycle' : [ 0x4465, ['unsigned char']], + 'NmiActive' : [ 0x4466, ['unsigned short']], + 'DpcWatchdogPeriod' : [ 0x4468, ['long']], + 'DpcWatchdogCount' : [ 0x446c, ['long']], + 'TickOffset' : [ 0x4470, ['unsigned long long']], + 'KeSpinLockOrdering' : [ 0x4478, ['long']], + 'PrcbPad70' : [ 0x447c, ['unsigned long']], + 'WaitListHead' : [ 0x4480, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x4490, ['unsigned long long']], + 'ReadySummary' : [ 0x4498, ['unsigned long']], + 'QueueIndex' : [ 0x449c, ['unsigned long']], + 'TimerExpirationDpc' : [ 0x44a0, ['_KDPC']], + 'PrcbPad72' : [ 0x44e0, ['array', 4, ['unsigned long long']]], + 'DispatcherReadyListHead' : [ 0x4500, ['array', 32, ['_LIST_ENTRY']]], + 'InterruptCount' : [ 0x4700, ['unsigned long']], + 'KernelTime' : [ 0x4704, ['unsigned long']], + 'UserTime' : [ 0x4708, ['unsigned long']], + 'DpcTime' : [ 0x470c, ['unsigned long']], + 'InterruptTime' : [ 0x4710, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x4714, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x4718, ['unsigned char']], + 'PrcbPad80' : [ 0x4719, ['array', 7, ['unsigned char']]], + 'DpcTimeCount' : [ 0x4720, ['unsigned long']], + 'DpcTimeLimit' : [ 0x4724, ['unsigned long']], + 'PeriodicCount' : [ 0x4728, ['unsigned long']], + 'PeriodicBias' : [ 0x472c, ['unsigned long']], + 'AvailableTime' : [ 0x4730, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x4734, ['unsigned long']], + 'ParentNode' : [ 0x4738, ['pointer64', ['_KNODE']]], + 'StartCycles' : [ 0x4740, ['unsigned long long']], + 'PrcbPad82' : [ 0x4748, ['array', 3, ['unsigned long long']]], + 'MmSpinLockOrdering' : [ 0x4760, ['long']], + 'PageColor' : [ 0x4764, ['unsigned long']], + 'NodeColor' : [ 0x4768, ['unsigned long']], + 'NodeShiftedColor' : [ 0x476c, ['unsigned long']], + 'SecondaryColorMask' : [ 0x4770, ['unsigned long']], + 'PrcbPad83' : [ 0x4774, ['unsigned long']], + 'CycleTime' : [ 0x4778, ['unsigned long long']], + 'CcFastMdlReadNoWait' : [ 0x4780, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x4784, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x4788, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x478c, ['unsigned long']], + 'CcMapDataWait' : [ 0x4790, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x4794, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x4798, ['unsigned long']], + 'CcPinReadWait' : [ 0x479c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x47a0, ['unsigned long']], + 'CcMdlReadWait' : [ 0x47a4, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x47a8, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x47ac, ['unsigned long']], + 'CcLazyWritePages' : [ 0x47b0, ['unsigned long']], + 'CcDataFlushes' : [ 0x47b4, ['unsigned long']], + 'CcDataPages' : [ 0x47b8, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x47bc, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x47c0, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x47c4, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x47c8, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x47cc, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x47d0, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x47d4, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x47d8, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x47dc, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x47e0, ['unsigned long']], + 'CcReadAheadIos' : [ 0x47e4, ['unsigned long']], + 'MmCacheTransitionCount' : [ 0x47e8, ['long']], + 'MmCacheReadCount' : [ 0x47ec, ['long']], + 'MmCacheIoCount' : [ 0x47f0, ['long']], + 'PrcbPad91' : [ 0x47f4, ['array', 1, ['unsigned long']]], + 'RuntimeAccumulation' : [ 0x47f8, ['unsigned long long']], + 'PowerState' : [ 0x4800, ['_PROCESSOR_POWER_STATE']], + 'PrcbPad92' : [ 0x4900, ['array', 16, ['unsigned char']]], + 'KeAlignmentFixupCount' : [ 0x4910, ['unsigned long']], + 'DpcWatchdogDpc' : [ 0x4918, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x4958, ['_KTIMER']], + 'Cache' : [ 0x4998, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x49d4, ['unsigned long']], + 'CachedCommit' : [ 0x49d8, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x49dc, ['unsigned long']], + 'HyperPte' : [ 0x49e0, ['pointer64', ['void']]], + 'WheaInfo' : [ 0x49e8, ['pointer64', ['void']]], + 'EtwSupport' : [ 0x49f0, ['pointer64', ['void']]], + 'InterruptObjectPool' : [ 0x4a00, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x4a10, ['_SLIST_HEADER']], + 'HypercallPageVirtual' : [ 0x4a20, ['pointer64', ['void']]], + 'VirtualApicAssist' : [ 0x4a28, ['pointer64', ['void']]], + 'StatisticsPage' : [ 0x4a30, ['pointer64', ['unsigned long long']]], + 'RateControl' : [ 0x4a38, ['pointer64', ['void']]], + 'CacheProcessorMask' : [ 0x4a40, ['array', 5, ['unsigned long long']]], + 'PackageProcessorSet' : [ 0x4a68, ['_KAFFINITY_EX']], + 'CoreProcessorSet' : [ 0x4a90, ['unsigned long long']], + 'PebsIndexAddress' : [ 0x4a98, ['pointer64', ['void']]], + 'PrcbPad93' : [ 0x4aa0, ['array', 12, ['unsigned long long']]], + 'SpinLockAcquireCount' : [ 0x4b00, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4b04, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x4b08, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0x4b0c, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x4b10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x4b14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x4b18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x4b1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x4b20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x4b24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x4b28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x4b2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x4b30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x4b34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x4b38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x4b3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x4b40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x4b44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x4b48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4b4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x4b50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x4b54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x4b58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x4b5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x4b60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x4b64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x4b68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x4b6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x4b70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x4b74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x4b78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x4b7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x4b80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x4b84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x4b88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x4b8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x4b90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x4b94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x4b98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x4b9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0x4ba0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0x4ba4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0x4ba8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0x4bac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0x4bb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0x4bb4, ['unsigned long']], + 'VendorString' : [ 0x4bb8, ['array', 13, ['unsigned char']]], + 'PrcbPad10' : [ 0x4bc5, ['array', 3, ['unsigned char']]], + 'FeatureBits' : [ 0x4bc8, ['unsigned long']], + 'UpdateSignature' : [ 0x4bd0, ['_LARGE_INTEGER']], + 'Context' : [ 0x4bd8, ['pointer64', ['_CONTEXT']]], + 'ContextFlags' : [ 0x4be0, ['unsigned long']], + 'ExtendedState' : [ 0x4be8, ['pointer64', ['_XSAVE_AREA']]], + 'Mailbox' : [ 0x4c00, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestMailbox' : [ 0x4c80, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_SINGLE_LIST_ENTRY32' : [ 0x4, { + 'Next' : [ 0x0, ['unsigned long']], +} ], + '_KTHREAD' : [ 0x368, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'CycleTime' : [ 0x18, ['unsigned long long']], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer64', ['void']]], + 'StackLimit' : [ 0x30, ['pointer64', ['void']]], + 'KernelStack' : [ 0x38, ['pointer64', ['void']]], + 'ThreadLock' : [ 0x40, ['unsigned long long']], + 'WaitRegister' : [ 0x48, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x49, ['unsigned char']], + 'Alerted' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'KernelStackResident' : [ 0x4c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x4c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x4c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x4c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x4c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x4c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x4c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x4c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x4c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x4c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x4c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x4c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x4c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SystemThread' : [ 0x4c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Reserved' : [ 0x4c, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x4c, ['long']], + 'ApcState' : [ 0x50, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x50, ['array', 43, ['unsigned char']]], + 'Priority' : [ 0x7b, ['unsigned char']], + 'NextProcessor' : [ 0x7c, ['unsigned long']], + 'DeferredProcessor' : [ 0x80, ['unsigned long']], + 'ApcQueueLock' : [ 0x88, ['unsigned long long']], + 'WaitStatus' : [ 0x90, ['long long']], + 'WaitBlockList' : [ 0x98, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0xa0, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0xa0, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xb0, ['pointer64', ['_KQUEUE']]], + 'Teb' : [ 0xb8, ['pointer64', ['void']]], + 'Timer' : [ 0xc0, ['_KTIMER']], + 'AutoAlignment' : [ 0x100, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x100, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0x100, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0x100, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0x100, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x100, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x100, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0x100, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x100, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'VdmSafe' : [ 0x100, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'UmsDispatched' : [ 0x100, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x100, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x100, ['long']], + 'Spare0' : [ 0x104, ['unsigned long']], + 'WaitBlock' : [ 0x108, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill4' : [ 0x108, ['array', 44, ['unsigned char']]], + 'ContextSwitches' : [ 0x134, ['unsigned long']], + 'WaitBlockFill5' : [ 0x108, ['array', 92, ['unsigned char']]], + 'State' : [ 0x164, ['unsigned char']], + 'NpxState' : [ 0x165, ['unsigned char']], + 'WaitIrql' : [ 0x166, ['unsigned char']], + 'WaitMode' : [ 0x167, ['unsigned char']], + 'WaitBlockFill6' : [ 0x108, ['array', 140, ['unsigned char']]], + 'WaitTime' : [ 0x194, ['unsigned long']], + 'WaitBlockFill7' : [ 0x108, ['array', 168, ['unsigned char']]], + 'TebMappedLowVa' : [ 0x1b0, ['pointer64', ['void']]], + 'Ucb' : [ 0x1b8, ['pointer64', ['_UMS_CONTROL_BLOCK']]], + 'WaitBlockFill8' : [ 0x108, ['array', 188, ['unsigned char']]], + 'KernelApcDisable' : [ 0x1c4, ['short']], + 'SpecialApcDisable' : [ 0x1c6, ['short']], + 'CombinedApcDisable' : [ 0x1c4, ['unsigned long']], + 'QueueListEntry' : [ 0x1c8, ['_LIST_ENTRY']], + 'TrapFrame' : [ 0x1d8, ['pointer64', ['_KTRAP_FRAME']]], + 'FirstArgument' : [ 0x1e0, ['pointer64', ['void']]], + 'CallbackStack' : [ 0x1e8, ['pointer64', ['void']]], + 'CallbackDepth' : [ 0x1e8, ['unsigned long long']], + 'ApcStateIndex' : [ 0x1f0, ['unsigned char']], + 'BasePriority' : [ 0x1f1, ['unsigned char']], + 'PriorityDecrement' : [ 0x1f2, ['unsigned char']], + 'ForegroundBoost' : [ 0x1f2, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x1f2, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x1f3, ['unsigned char']], + 'AdjustReason' : [ 0x1f4, ['unsigned char']], + 'AdjustIncrement' : [ 0x1f5, ['unsigned char']], + 'PreviousMode' : [ 0x1f6, ['unsigned char']], + 'Saturation' : [ 0x1f7, ['unsigned char']], + 'SystemCallNumber' : [ 0x1f8, ['unsigned long']], + 'FreezeCount' : [ 0x1fc, ['unsigned long']], + 'UserAffinity' : [ 0x200, ['_GROUP_AFFINITY']], + 'Process' : [ 0x210, ['pointer64', ['_KPROCESS']]], + 'Affinity' : [ 0x218, ['_GROUP_AFFINITY']], + 'IdealProcessor' : [ 0x228, ['unsigned long']], + 'UserIdealProcessor' : [ 0x22c, ['unsigned long']], + 'ApcStatePointer' : [ 0x230, ['array', 2, ['pointer64', ['_KAPC_STATE']]]], + 'SavedApcState' : [ 0x240, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x240, ['array', 43, ['unsigned char']]], + 'WaitReason' : [ 0x26b, ['unsigned char']], + 'SuspendCount' : [ 0x26c, ['unsigned char']], + 'Spare1' : [ 0x26d, ['unsigned char']], + 'CodePatchInProgress' : [ 0x26e, ['unsigned char']], + 'Win32Thread' : [ 0x270, ['pointer64', ['void']]], + 'StackBase' : [ 0x278, ['pointer64', ['void']]], + 'SuspendApc' : [ 0x280, ['_KAPC']], + 'SuspendApcFill0' : [ 0x280, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x281, ['unsigned char']], + 'SuspendApcFill1' : [ 0x280, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x283, ['unsigned char']], + 'SuspendApcFill2' : [ 0x280, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x284, ['unsigned long']], + 'SuspendApcFill3' : [ 0x280, ['array', 64, ['unsigned char']]], + 'WaitPrcb' : [ 0x2c0, ['pointer64', ['_KPRCB']]], + 'SuspendApcFill4' : [ 0x280, ['array', 72, ['unsigned char']]], + 'LegoData' : [ 0x2c8, ['pointer64', ['void']]], + 'SuspendApcFill5' : [ 0x280, ['array', 83, ['unsigned char']]], + 'LargeStack' : [ 0x2d3, ['unsigned char']], + 'UserTime' : [ 0x2d4, ['unsigned long']], + 'SuspendSemaphore' : [ 0x2d8, ['_KSEMAPHORE']], + 'SuspendSemaphorefill' : [ 0x2d8, ['array', 28, ['unsigned char']]], + 'SListFaultCount' : [ 0x2f4, ['unsigned long']], + 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], + 'SListFaultAddress' : [ 0x318, ['pointer64', ['void']]], + 'ReadOperationCount' : [ 0x320, ['long long']], + 'WriteOperationCount' : [ 0x328, ['long long']], + 'OtherOperationCount' : [ 0x330, ['long long']], + 'ReadTransferCount' : [ 0x338, ['long long']], + 'WriteTransferCount' : [ 0x340, ['long long']], + 'OtherTransferCount' : [ 0x348, ['long long']], + 'ThreadCounters' : [ 0x350, ['pointer64', ['_KTHREAD_COUNTERS']]], + 'StateSaveArea' : [ 0x358, ['pointer64', ['_XSAVE_FORMAT']]], + 'XStateSave' : [ 0x360, ['pointer64', ['_XSTATE_SAVE']]], +} ], + '_KERNEL_STACK_CONTROL' : [ 0x50, { + 'Current' : [ 0x0, ['_KERNEL_STACK_SEGMENT']], + 'Previous' : [ 0x28, ['_KERNEL_STACK_SEGMENT']], +} ], + '_UMS_CONTROL_BLOCK' : [ 0x98, { + 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], + 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], + 'UmsQueue' : [ 0x20, ['_KQUEUE']], + 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], + 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], + 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], + 'PrimaryFlags' : [ 0x88, ['unsigned long']], + 'UmsContextHeaderReady' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], + 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], + 'UmsContextHeader' : [ 0x30, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], + 'UmsWaitGate' : [ 0x38, ['_KGATE']], + 'StagingArea' : [ 0x50, ['pointer64', ['void']]], + 'Flags' : [ 0x58, ['long']], + 'UmsForceQueueTermination' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsPrimaryDeliveredContext' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UmsPerformingSingleStep' : [ 0x58, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'TebSelector' : [ 0x90, ['unsigned short']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_FAST_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'OldIrql' : [ 0x30, ['unsigned long']], +} ], + '_KEVENT' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '__unnamed_11c8' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_11cd' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_11d0' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SLIST_HEADER' : [ 0x10, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Region' : [ 0x8, ['unsigned long long']], + 'Header8' : [ 0x0, ['__unnamed_11c8']], + 'Header16' : [ 0x0, ['__unnamed_11cd']], + 'HeaderX64' : [ 0x0, ['__unnamed_11d0']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x60, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_SLIST_ENTRY' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_IO_STATUS_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer64', ['void']]], + 'Information' : [ 0x8, ['unsigned long long']], +} ], + '_IO_STATUS_BLOCK32' : [ 0x8, { + 'Status' : [ 0x0, ['long']], + 'Information' : [ 0x4, ['unsigned long']], +} ], + '_EX_PUSH_LOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x100, { + 'Locks' : [ 0x0, ['array', 32, ['pointer64', ['_EX_PUSH_LOCK']]]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x10, { + 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_EX_FAST_REF' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Next' : [ 0x18, ['pointer64', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'Last' : [ 0x20, ['pointer64', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'Previous' : [ 0x28, ['pointer64', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'ShareCount' : [ 0x30, ['long']], + 'Flags' : [ 0x34, ['long']], +} ], + '_ETHREAD' : [ 0x4a8, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x368, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x370, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x370, ['_LIST_ENTRY']], + 'ExitStatus' : [ 0x380, ['long']], + 'PostBlockList' : [ 0x388, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x388, ['pointer64', ['void']]], + 'StartAddress' : [ 0x390, ['pointer64', ['void']]], + 'TerminationPort' : [ 0x398, ['pointer64', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x398, ['pointer64', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x398, ['pointer64', ['void']]], + 'ActiveTimerListLock' : [ 0x3a0, ['unsigned long long']], + 'ActiveTimerListHead' : [ 0x3a8, ['_LIST_ENTRY']], + 'Cid' : [ 0x3b8, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x3c8, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x3c8, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x3e8, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x3f0, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x400, ['unsigned long long']], + 'DeviceToVerify' : [ 0x408, ['pointer64', ['_DEVICE_OBJECT']]], + 'CpuQuotaApc' : [ 0x410, ['pointer64', ['_PSP_CPU_QUOTA_APC']]], + 'Win32StartAddress' : [ 0x418, ['pointer64', ['void']]], + 'LegacyPowerObject' : [ 0x420, ['pointer64', ['void']]], + 'ThreadListEntry' : [ 0x428, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x438, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x440, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x448, ['unsigned long']], + 'MmLockOrdering' : [ 0x44c, ['long']], + 'CrossThreadFlags' : [ 0x450, ['unsigned long']], + 'Terminated' : [ 0x450, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x450, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x450, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x450, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x450, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x450, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x450, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x450, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x450, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x450, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x450, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x450, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x450, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x450, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x454, ['unsigned long']], + 'ActiveExWorker' : [ 0x454, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x454, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x454, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x454, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x454, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x454, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x454, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x458, ['unsigned long']], + 'Spare' : [ 0x458, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x458, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x458, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x458, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x458, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x458, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x458, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x458, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x459, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x459, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x459, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x459, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x459, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x459, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x459, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x459, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x45a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x45a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x45a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x45a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x45a, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x45a, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'PriorityRegionActive' : [ 0x45b, ['unsigned char']], + 'CacheManagerActive' : [ 0x45c, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x45d, ['unsigned char']], + 'ActiveFaultCount' : [ 0x45e, ['unsigned char']], + 'LockOrderState' : [ 0x45f, ['unsigned char']], + 'AlpcMessageId' : [ 0x460, ['unsigned long long']], + 'AlpcMessage' : [ 0x468, ['pointer64', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x468, ['unsigned long']], + 'AlpcWaitListEntry' : [ 0x470, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x480, ['unsigned long']], + 'IoBoostCount' : [ 0x484, ['unsigned long']], + 'IrpListLock' : [ 0x488, ['unsigned long long']], + 'ReservedForSynchTracking' : [ 0x490, ['pointer64', ['void']]], + 'CmCallbackListHead' : [ 0x498, ['_SINGLE_LIST_ENTRY']], + 'KernelStackReference' : [ 0x4a0, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x4e8, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x160, ['_EX_PUSH_LOCK']], + 'CreateTime' : [ 0x168, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x170, ['_LARGE_INTEGER']], + 'RundownProtect' : [ 0x178, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0x180, ['pointer64', ['void']]], + 'ActiveProcessLinks' : [ 0x188, ['_LIST_ENTRY']], + 'ProcessQuotaUsage' : [ 0x198, ['array', 2, ['unsigned long long']]], + 'ProcessQuotaPeak' : [ 0x1a8, ['array', 2, ['unsigned long long']]], + 'CommitCharge' : [ 0x1b8, ['unsigned long long']], + 'QuotaBlock' : [ 0x1c0, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], + 'CpuQuotaBlock' : [ 0x1c8, ['pointer64', ['_PS_CPU_QUOTA_BLOCK']]], + 'PeakVirtualSize' : [ 0x1d0, ['unsigned long long']], + 'VirtualSize' : [ 0x1d8, ['unsigned long long']], + 'SessionProcessLinks' : [ 0x1e0, ['_LIST_ENTRY']], + 'DebugPort' : [ 0x1f0, ['pointer64', ['void']]], + 'ExceptionPortData' : [ 0x1f8, ['pointer64', ['void']]], + 'ExceptionPortValue' : [ 0x1f8, ['unsigned long long']], + 'ExceptionPortState' : [ 0x1f8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'ObjectTable' : [ 0x200, ['pointer64', ['_HANDLE_TABLE']]], + 'Token' : [ 0x208, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0x210, ['unsigned long long']], + 'AddressCreationLock' : [ 0x218, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x220, ['pointer64', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x228, ['pointer64', ['_ETHREAD']]], + 'HardwareTrigger' : [ 0x230, ['unsigned long long']], + 'PhysicalVadRoot' : [ 0x238, ['pointer64', ['_MM_AVL_TABLE']]], + 'CloneRoot' : [ 0x240, ['pointer64', ['void']]], + 'NumberOfPrivatePages' : [ 0x248, ['unsigned long long']], + 'NumberOfLockedPages' : [ 0x250, ['unsigned long long']], + 'Win32Process' : [ 0x258, ['pointer64', ['void']]], + 'Job' : [ 0x260, ['pointer64', ['_EJOB']]], + 'SectionObject' : [ 0x268, ['pointer64', ['void']]], + 'SectionBaseAddress' : [ 0x270, ['pointer64', ['void']]], + 'Cookie' : [ 0x278, ['unsigned long']], + 'UmsScheduledThreads' : [ 0x27c, ['unsigned long']], + 'WorkingSetWatch' : [ 0x280, ['pointer64', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x288, ['pointer64', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x290, ['pointer64', ['void']]], + 'LdtInformation' : [ 0x298, ['pointer64', ['void']]], + 'Spare' : [ 0x2a0, ['pointer64', ['void']]], + 'ConsoleHostProcess' : [ 0x2a8, ['unsigned long long']], + 'DeviceMap' : [ 0x2b0, ['pointer64', ['void']]], + 'EtwDataSource' : [ 0x2b8, ['pointer64', ['void']]], + 'FreeTebHint' : [ 0x2c0, ['pointer64', ['void']]], + 'FreeUmsTebHint' : [ 0x2c8, ['pointer64', ['void']]], + 'PageDirectoryPte' : [ 0x2d0, ['_HARDWARE_PTE']], + 'Filler' : [ 0x2d0, ['unsigned long long']], + 'Session' : [ 0x2d8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x2e0, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x2ef, ['unsigned char']], + 'JobLinks' : [ 0x2f0, ['_LIST_ENTRY']], + 'LockedPagesList' : [ 0x300, ['pointer64', ['void']]], + 'ThreadListHead' : [ 0x308, ['_LIST_ENTRY']], + 'SecurityPort' : [ 0x318, ['pointer64', ['void']]], + 'Wow64Process' : [ 0x320, ['pointer64', ['void']]], + 'ActiveThreads' : [ 0x328, ['unsigned long']], + 'ImagePathHash' : [ 0x32c, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x330, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x334, ['long']], + 'Peb' : [ 0x338, ['pointer64', ['_PEB']]], + 'PrefetchTrace' : [ 0x340, ['_EX_FAST_REF']], + 'ReadOperationCount' : [ 0x348, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x350, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x358, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x360, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x368, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x370, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x378, ['unsigned long long']], + 'CommitChargePeak' : [ 0x380, ['unsigned long long']], + 'AweInfo' : [ 0x388, ['pointer64', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x390, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'Vm' : [ 0x398, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x420, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x430, ['pointer64', ['void']]], + 'ModifiedPageCount' : [ 0x438, ['unsigned long']], + 'Flags2' : [ 0x43c, ['unsigned long']], + 'JobNotReallyActive' : [ 0x43c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x43c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x43c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x43c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x43c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x43c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x43c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x43c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x43c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x43c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x43c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x43c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x43c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x43c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x43c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x43c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x43c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x43c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Spare1' : [ 0x43c, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x43c, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x43c, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'LowVaAccessible' : [ 0x43c, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Flags' : [ 0x440, ['unsigned long']], + 'CreateReported' : [ 0x440, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x440, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x440, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x440, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x440, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x440, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x440, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x440, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x440, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x440, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x440, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x440, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x440, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x440, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x440, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x440, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x440, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x440, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x440, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x440, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x440, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x440, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x440, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x440, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x440, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x440, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x440, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ExitStatus' : [ 0x444, ['long']], + 'VadRoot' : [ 0x448, ['_MM_AVL_TABLE']], + 'AlpcContext' : [ 0x488, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x4a8, ['_LIST_ENTRY']], + 'RequestedTimerResolution' : [ 0x4b8, ['unsigned long']], + 'ActiveThreadsHighWatermark' : [ 0x4bc, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x4c0, ['unsigned long']], + 'TimerResolutionStackRecord' : [ 0x4c8, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], + 'SequenceNumber' : [ 0x4d0, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x4d8, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x4e0, ['unsigned long long']], +} ], + '_KPROCESS' : [ 0x160, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x40, ['unsigned long long']], + 'Affinity' : [ 0x48, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0x70, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x80, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x88, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0xb0, ['long']], + 'BasePriority' : [ 0xb4, ['unsigned char']], + 'QuantumReset' : [ 0xb5, ['unsigned char']], + 'Visited' : [ 0xb6, ['unsigned char']], + 'Unused3' : [ 0xb7, ['unsigned char']], + 'ThreadSeed' : [ 0xb8, ['array', 4, ['unsigned long']]], + 'IdealNode' : [ 0xc8, ['array', 4, ['unsigned short']]], + 'IdealGlobalNode' : [ 0xd0, ['unsigned short']], + 'Flags' : [ 0xd2, ['_KEXECUTE_OPTIONS']], + 'Unused1' : [ 0xd3, ['unsigned char']], + 'Unused2' : [ 0xd4, ['unsigned long']], + 'Unused4' : [ 0xd8, ['unsigned long']], + 'StackCount' : [ 0xdc, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0xe0, ['_LIST_ENTRY']], + 'CycleTime' : [ 0xf0, ['unsigned long long']], + 'KernelTime' : [ 0xf8, ['unsigned long']], + 'UserTime' : [ 0xfc, ['unsigned long']], + 'InstrumentationCallback' : [ 0x100, ['pointer64', ['void']]], + 'LdtSystemDescriptor' : [ 0x108, ['_KGDTENTRY64']], + 'LdtBaseAddress' : [ 0x118, ['pointer64', ['void']]], + 'LdtProcessLock' : [ 0x120, ['_KGUARDED_MUTEX']], + 'LdtFreeSelectorHint' : [ 0x158, ['unsigned short']], + 'LdtTableLength' : [ 0x15a, ['unsigned short']], +} ], + '__unnamed_12d4' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0xa0, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'AuxData' : [ 0x48, ['pointer64', ['void']]], + 'Privileges' : [ 0x50, ['__unnamed_12d4']], + 'AuditPrivileges' : [ 0x7c, ['unsigned char']], + 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xd8, { + 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x18, ['unsigned long']], + 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], + 'TransactionId' : [ 0x20, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], + 'SDLock' : [ 0x50, ['pointer64', ['void']]], + 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], +} ], + '__unnamed_12e3' : [ 0x8, { + 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_12e8' : [ 0x10, { + 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], + 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_12ea' : [ 0x10, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_12e8']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_12f5' : [ 0x50, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], + 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x40, ['unsigned long']], + 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], +} ], + '__unnamed_12f7' : [ 0x58, { + 'Overlay' : [ 0x0, ['__unnamed_12f5']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IRP' : [ 0xd0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'AssociatedIrp' : [ 0x18, ['__unnamed_12e3']], + 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x40, ['unsigned char']], + 'PendingReturned' : [ 0x41, ['unsigned char']], + 'StackCount' : [ 0x42, ['unsigned char']], + 'CurrentLocation' : [ 0x43, ['unsigned char']], + 'Cancel' : [ 0x44, ['unsigned char']], + 'CancelIrql' : [ 0x45, ['unsigned char']], + 'ApcEnvironment' : [ 0x46, ['unsigned char']], + 'AllocationFlags' : [ 0x47, ['unsigned char']], + 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Overlay' : [ 0x58, ['__unnamed_12ea']], + 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], + 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], + 'Tail' : [ 0x78, ['__unnamed_12f7']], +} ], + '__unnamed_12fe' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'FileAttributes' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'EaLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1302' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_1306' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_1308' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_130c' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_130e' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1310' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], +} ], + '__unnamed_1312' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0x18, ['unsigned char']], + 'AdvanceOnly' : [ 0x19, ['unsigned char']], + 'ClusterCount' : [ 0x18, ['unsigned long']], + 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1314' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x8, ['pointer64', ['void']]], + 'EaListLength' : [ 0x10, ['unsigned long']], + 'EaIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1316' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_131a' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_131c' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'FsControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_131e' : [ 0x18, { + 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1320' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'IoControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1322' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1324' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_1328' : [ 0x10, { + 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_132c' : [ 0x8, { + 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_1330' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x8, ['pointer64', ['void']]], + 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1334' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_133a' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Version' : [ 0xa, ['unsigned short']], + 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_133e' : [ 0x8, { + 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_1342' : [ 0x8, { + 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_1344' : [ 0x20, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['void']]], + 'Offset' : [ 0x10, ['unsigned long']], + 'Length' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1346' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_134a' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_134e' : [ 0x10, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1352' : [ 0x10, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], +} ], + '__unnamed_1356' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_135a' : [ 0x8, { + 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1362' : [ 0x20, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x10, ['_POWER_STATE']], + 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], +} ], + '__unnamed_1366' : [ 0x10, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1368' : [ 0x20, { + 'ProviderId' : [ 0x0, ['unsigned long long']], + 'DataPath' : [ 0x8, ['pointer64', ['void']]], + 'BufferSize' : [ 0x10, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_136a' : [ 0x20, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_136c' : [ 0x20, { + 'Create' : [ 0x0, ['__unnamed_12fe']], + 'CreatePipe' : [ 0x0, ['__unnamed_1302']], + 'CreateMailslot' : [ 0x0, ['__unnamed_1306']], + 'Read' : [ 0x0, ['__unnamed_1308']], + 'Write' : [ 0x0, ['__unnamed_1308']], + 'QueryDirectory' : [ 0x0, ['__unnamed_130c']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_130e']], + 'QueryFile' : [ 0x0, ['__unnamed_1310']], + 'SetFile' : [ 0x0, ['__unnamed_1312']], + 'QueryEa' : [ 0x0, ['__unnamed_1314']], + 'SetEa' : [ 0x0, ['__unnamed_1316']], + 'QueryVolume' : [ 0x0, ['__unnamed_131a']], + 'SetVolume' : [ 0x0, ['__unnamed_131a']], + 'FileSystemControl' : [ 0x0, ['__unnamed_131c']], + 'LockControl' : [ 0x0, ['__unnamed_131e']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1320']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1322']], + 'SetSecurity' : [ 0x0, ['__unnamed_1324']], + 'MountVolume' : [ 0x0, ['__unnamed_1328']], + 'VerifyVolume' : [ 0x0, ['__unnamed_1328']], + 'Scsi' : [ 0x0, ['__unnamed_132c']], + 'QueryQuota' : [ 0x0, ['__unnamed_1330']], + 'SetQuota' : [ 0x0, ['__unnamed_1316']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1334']], + 'QueryInterface' : [ 0x0, ['__unnamed_133a']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_133e']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1342']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1344']], + 'SetLock' : [ 0x0, ['__unnamed_1346']], + 'QueryId' : [ 0x0, ['__unnamed_134a']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_134e']], + 'UsageNotification' : [ 0x0, ['__unnamed_1352']], + 'WaitWake' : [ 0x0, ['__unnamed_1356']], + 'PowerSequence' : [ 0x0, ['__unnamed_135a']], + 'Power' : [ 0x0, ['__unnamed_1362']], + 'StartDevice' : [ 0x0, ['__unnamed_1366']], + 'WMI' : [ 0x0, ['__unnamed_1368']], + 'Others' : [ 0x0, ['__unnamed_136a']], +} ], + '_IO_STACK_LOCATION' : [ 0x48, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x8, ['__unnamed_136c']], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_1382' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], + 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'Characteristics' : [ 0x34, ['unsigned long']], + 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], + 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], + 'DeviceType' : [ 0x48, ['unsigned long']], + 'StackSize' : [ 0x4c, ['unsigned char']], + 'Queue' : [ 0x50, ['__unnamed_1382']], + 'AlignmentRequirement' : [ 0x98, ['unsigned long']], + 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0xc8, ['_KDPC']], + 'ActiveThreadCount' : [ 0x108, ['unsigned long']], + 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], + 'DeviceLock' : [ 0x118, ['_KEVENT']], + 'SectorSize' : [ 0x130, ['unsigned short']], + 'Spare1' : [ 0x132, ['unsigned short']], + 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0x140, ['pointer64', ['void']]], +} ], + '_KDPC' : [ 0x40, { + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], + 'DpcData' : [ 0x38, ['pointer64', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x20, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], + 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'Attributes' : [ 0x18, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0xd8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], + 'FsContext' : [ 0x18, ['pointer64', ['void']]], + 'FsContext2' : [ 0x20, ['pointer64', ['void']]], + 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], + 'FinalStatus' : [ 0x38, ['long']], + 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x48, ['unsigned char']], + 'DeletePending' : [ 0x49, ['unsigned char']], + 'ReadAccess' : [ 0x4a, ['unsigned char']], + 'WriteAccess' : [ 0x4b, ['unsigned char']], + 'DeleteAccess' : [ 0x4c, ['unsigned char']], + 'SharedRead' : [ 0x4d, ['unsigned char']], + 'SharedWrite' : [ 0x4e, ['unsigned char']], + 'SharedDelete' : [ 0x4f, ['unsigned char']], + 'Flags' : [ 0x50, ['unsigned long']], + 'FileName' : [ 0x58, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x70, ['unsigned long']], + 'Busy' : [ 0x74, ['unsigned long']], + 'LastLock' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['_KEVENT']], + 'Event' : [ 0x98, ['_KEVENT']], + 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0xb8, ['unsigned long long']], + 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], + 'CurrentFileIndex' : [ 0xc, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], + 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], + 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], + 'SessionId' : [ 0x40, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], + 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x58, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], + 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], +} ], + '_iobuf' : [ 0x30, { + '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], + '_cnt' : [ 0x8, ['long']], + '_base' : [ 0x10, ['pointer64', ['unsigned char']]], + '_flag' : [ 0x18, ['long']], + '_file' : [ 0x1c, ['long']], + '_charbuf' : [ 0x20, ['long']], + '_bufsiz' : [ 0x24, ['long']], + '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], +} ], + '__unnamed_14ee' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_14ee']], +} ], + '__unnamed_14ff' : [ 0x10, { + 'I386' : [ 0x0, ['_I386_LOADER_BLOCK']], + 'Ia64' : [ 0x0, ['_IA64_LOADER_BLOCK']], +} ], + '_LOADER_PARAMETER_BLOCK' : [ 0xf0, { + 'OsMajorVersion' : [ 0x0, ['unsigned long']], + 'OsMinorVersion' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'LoadOrderListHead' : [ 0x10, ['_LIST_ENTRY']], + 'MemoryDescriptorListHead' : [ 0x20, ['_LIST_ENTRY']], + 'BootDriverListHead' : [ 0x30, ['_LIST_ENTRY']], + 'KernelStack' : [ 0x40, ['unsigned long long']], + 'Prcb' : [ 0x48, ['unsigned long long']], + 'Process' : [ 0x50, ['unsigned long long']], + 'Thread' : [ 0x58, ['unsigned long long']], + 'RegistryLength' : [ 0x60, ['unsigned long']], + 'RegistryBase' : [ 0x68, ['pointer64', ['void']]], + 'ConfigurationRoot' : [ 0x70, ['pointer64', ['_CONFIGURATION_COMPONENT_DATA']]], + 'ArcBootDeviceName' : [ 0x78, ['pointer64', ['unsigned char']]], + 'ArcHalDeviceName' : [ 0x80, ['pointer64', ['unsigned char']]], + 'NtBootPathName' : [ 0x88, ['pointer64', ['unsigned char']]], + 'NtHalPathName' : [ 0x90, ['pointer64', ['unsigned char']]], + 'LoadOptions' : [ 0x98, ['pointer64', ['unsigned char']]], + 'NlsData' : [ 0xa0, ['pointer64', ['_NLS_DATA_BLOCK']]], + 'ArcDiskInformation' : [ 0xa8, ['pointer64', ['_ARC_DISK_INFORMATION']]], + 'OemFontFile' : [ 0xb0, ['pointer64', ['void']]], + 'Extension' : [ 0xb8, ['pointer64', ['_LOADER_PARAMETER_EXTENSION']]], + 'u' : [ 0xc0, ['__unnamed_14ff']], + 'FirmwareInformation' : [ 0xd0, ['_FIRMWARE_INFORMATION_LOADER_BLOCK']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0x18, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x10, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x28, { + 'Total' : [ 0x0, ['unsigned long long']], + 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x10, ['unsigned long long']], + 'Blink' : [ 0x18, ['unsigned long long']], + 'Lock' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_152e' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'WsIndex' : [ 0x0, ['unsigned long']], + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_1530' : [ 0x8, { + 'Blink' : [ 0x0, ['unsigned long long']], + 'ImageProtoPte' : [ 0x0, ['pointer64', ['_MMPTE']]], + 'ShareCount' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1533' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'VolatileReferenceCount' : [ 0x0, ['short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_1535' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_1533']], +} ], + '__unnamed_153d' : [ 0x8, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MMPFN' : [ 0x30, { + 'u1' : [ 0x0, ['__unnamed_152e']], + 'u2' : [ 0x8, ['__unnamed_1530']], + 'PteAddress' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x10, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['long']], + 'PteLong' : [ 0x10, ['unsigned long long']], + 'u3' : [ 0x18, ['__unnamed_1535']], + 'UsedPageTableEntries' : [ 0x1c, ['unsigned short']], + 'VaType' : [ 0x1e, ['unsigned char']], + 'ViewCount' : [ 0x1f, ['unsigned char']], + 'OriginalPte' : [ 0x20, ['_MMPTE']], + 'AweReferenceCount' : [ 0x20, ['long']], + 'u4' : [ 0x28, ['__unnamed_153d']], +} ], + '_MI_COLOR_BASE' : [ 0x10, { + 'ColorPointer' : [ 0x0, ['pointer64', ['unsigned short']]], + 'ColorMask' : [ 0x8, ['unsigned short']], + 'ColorNode' : [ 0xa, ['unsigned short']], +} ], + '_MMSUPPORT' : [ 0x88, { + 'WorkingSetMutex' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ExitGate' : [ 0x8, ['pointer64', ['_KGATE']]], + 'AccessLog' : [ 0x10, ['pointer64', ['void']]], + 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long']]], + 'MinimumWorkingSetSize' : [ 0x44, ['unsigned long']], + 'WorkingSetSize' : [ 0x48, ['unsigned long']], + 'WorkingSetPrivateSize' : [ 0x4c, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0x50, ['unsigned long']], + 'ChargedWslePages' : [ 0x54, ['unsigned long']], + 'ActualWslePages' : [ 0x58, ['unsigned long']], + 'WorkingSetSizeOverhead' : [ 0x5c, ['unsigned long']], + 'PeakWorkingSetSize' : [ 0x60, ['unsigned long']], + 'HardFaultCount' : [ 0x64, ['unsigned long']], + 'VmWorkingSetList' : [ 0x68, ['pointer64', ['_MMWSL']]], + 'NextPageColor' : [ 0x70, ['unsigned short']], + 'LastTrimStamp' : [ 0x72, ['unsigned short']], + 'PageFaultCount' : [ 0x74, ['unsigned long']], + 'RepurposeCount' : [ 0x78, ['unsigned long']], + 'Spare' : [ 0x7c, ['array', 2, ['unsigned long']]], + 'Flags' : [ 0x84, ['_MMSUPPORT_FLAGS']], +} ], + '_MMWSL' : [ 0x488, { + 'FirstFree' : [ 0x0, ['unsigned long']], + 'FirstDynamic' : [ 0x4, ['unsigned long']], + 'LastEntry' : [ 0x8, ['unsigned long']], + 'NextSlot' : [ 0xc, ['unsigned long']], + 'Wsle' : [ 0x10, ['pointer64', ['_MMWSLE']]], + 'LowestPagableAddress' : [ 0x18, ['pointer64', ['void']]], + 'LastInitializedWsle' : [ 0x20, ['unsigned long']], + 'NextAgingSlot' : [ 0x24, ['unsigned long']], + 'NumberOfCommittedPageTables' : [ 0x28, ['unsigned long']], + 'VadBitMapHint' : [ 0x2c, ['unsigned long']], + 'NonDirectCount' : [ 0x30, ['unsigned long']], + 'LastVadBit' : [ 0x34, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x38, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0x3c, ['unsigned long']], + 'LastAllocationSize' : [ 0x40, ['unsigned long']], + 'NonDirectHash' : [ 0x48, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x50, ['pointer64', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x58, ['pointer64', ['_MMWSLE_HASH']]], + 'MaximumUserPageTablePages' : [ 0x60, ['unsigned long']], + 'MaximumUserPageDirectoryPages' : [ 0x64, ['unsigned long']], + 'CommittedPageTables' : [ 0x68, ['pointer64', ['unsigned long']]], + 'NumberOfCommittedPageDirectories' : [ 0x70, ['unsigned long']], + 'CommittedPageDirectories' : [ 0x78, ['array', 128, ['unsigned long long']]], + 'NumberOfCommittedPageDirectoryParents' : [ 0x478, ['unsigned long']], + 'CommittedPageDirectoryParents' : [ 0x480, ['array', 1, ['unsigned long long']]], +} ], + '__unnamed_156b' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_156b']], +} ], + '__unnamed_1577' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_1581' : [ 0x10, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], + 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_1583' : [ 0x10, { + 'e2' : [ 0x0, ['__unnamed_1581']], +} ], + '_CONTROL_AREA' : [ 0x80, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'DereferenceList' : [ 0x8, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], + 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], + 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_1577']], + 'FlushInProgressCount' : [ 0x3c, ['unsigned long']], + 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x48, ['long']], + 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], + 'StartingFrame' : [ 0x4c, ['unsigned long']], + 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x58, ['__unnamed_1583']], + 'LockedPages' : [ 0x68, ['unsigned long long']], + 'ViewList' : [ 0x70, ['_LIST_ENTRY']], +} ], + '_MM_STORE_KEY' : [ 0x8, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'EntireKey' : [ 0x0, ['unsigned long long']], +} ], + '_MMPAGING_FILE' : [ 0x90, { + 'Size' : [ 0x0, ['unsigned long long']], + 'MaximumSize' : [ 0x8, ['unsigned long long']], + 'MinimumSize' : [ 0x10, ['unsigned long long']], + 'FreeSpace' : [ 0x18, ['unsigned long long']], + 'PeakUsage' : [ 0x20, ['unsigned long long']], + 'HighestPage' : [ 0x28, ['unsigned long long']], + 'File' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'Entry' : [ 0x38, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PageFileName' : [ 0x48, ['_UNICODE_STRING']], + 'Bitmap' : [ 0x58, ['pointer64', ['_RTL_BITMAP']]], + 'EvictStoreBitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], + 'BitmapHint' : [ 0x68, ['unsigned long']], + 'LastAllocationSize' : [ 0x6c, ['unsigned long']], + 'ToBeEvictedCount' : [ 0x70, ['unsigned long']], + 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'FileHandle' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['unsigned long long']], + 'LockOwner' : [ 0x88, ['pointer64', ['_ETHREAD']]], +} ], + '_MM_AVL_TABLE' : [ 0x40, { + 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], + 'NodeHint' : [ 0x30, ['pointer64', ['void']]], + 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], +} ], + '__unnamed_15bf' : [ 0x8, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], + 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], +} ], + '__unnamed_15c2' : [ 0x8, { + 'LongFlags' : [ 0x0, ['unsigned long long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_15c5' : [ 0x8, { + 'LongFlags3' : [ 0x0, ['unsigned long long']], + 'VadFlags3' : [ 0x0, ['_MMVAD_FLAGS3']], +} ], + '_MMVAD_SHORT' : [ 0x40, { + 'u1' : [ 0x0, ['__unnamed_15bf']], + 'LeftChild' : [ 0x8, ['pointer64', ['_MMVAD']]], + 'RightChild' : [ 0x10, ['pointer64', ['_MMVAD']]], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u' : [ 0x28, ['__unnamed_15c2']], + 'PushLock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x38, ['__unnamed_15c5']], +} ], + '__unnamed_15cd' : [ 0x8, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], + 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], +} ], + '_MMADDRESS_NODE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_15cd']], + 'LeftChild' : [ 0x8, ['pointer64', ['_MMADDRESS_NODE']]], + 'RightChild' : [ 0x10, ['pointer64', ['_MMADDRESS_NODE']]], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_15d2' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '_MMVAD' : [ 0x78, { + 'u1' : [ 0x0, ['__unnamed_15bf']], + 'LeftChild' : [ 0x8, ['pointer64', ['_MMVAD']]], + 'RightChild' : [ 0x10, ['pointer64', ['_MMVAD']]], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u' : [ 0x28, ['__unnamed_15c2']], + 'PushLock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x38, ['__unnamed_15c5']], + 'u2' : [ 0x40, ['__unnamed_15d2']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'MappedSubsection' : [ 0x48, ['pointer64', ['_MSUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_15dd' : [ 0x38, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x30, ['array', 1, ['unsigned long long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x68, { + 'Status' : [ 0x0, ['long']], + 'Priority' : [ 0x4, ['unsigned char']], + 'IrpPriority' : [ 0x5, ['unsigned char']], + 'CurrentTime' : [ 0x8, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x10, ['unsigned long long']], + 'ModifiedPagesTotal' : [ 0x18, ['unsigned long long']], + 'ModifiedPagefilePages' : [ 0x20, ['unsigned long long']], + 'ModifiedNoWritePages' : [ 0x28, ['unsigned long long']], + 'MdlHack' : [ 0x30, ['__unnamed_15dd']], +} ], + '__unnamed_15e3' : [ 0x10, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '__unnamed_15e5' : [ 0x8, { + 'KeepForever' : [ 0x0, ['unsigned long long']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0xa0, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x10, ['__unnamed_15e3']], + 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], + 'u1' : [ 0x28, ['__unnamed_15e5']], + 'PagingFile' : [ 0x30, ['pointer64', ['_MMPAGING_FILE']]], + 'File' : [ 0x38, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x40, ['pointer64', ['_CONTROL_AREA']]], + 'FileResource' : [ 0x48, ['pointer64', ['_ERESOURCE']]], + 'WriteOffset' : [ 0x50, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0x58, ['_LARGE_INTEGER']], + 'PointerMdl' : [ 0x60, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0x68, ['_MDL']], + 'Page' : [ 0x98, ['array', 1, ['unsigned long long']]], +} ], + '_MDL' : [ 0x30, { + 'Next' : [ 0x0, ['pointer64', ['_MDL']]], + 'Size' : [ 0x8, ['short']], + 'MdlFlags' : [ 0xa, ['short']], + 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'ByteCount' : [ 0x28, ['unsigned long']], + 'ByteOffset' : [ 0x2c, ['unsigned long']], +} ], + '_HHIVE' : [ 0x598, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], + 'ReleaseCellRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Allocate' : [ 0x18, ['pointer64', ['void']]], + 'Free' : [ 0x20, ['pointer64', ['void']]], + 'FileSetSize' : [ 0x28, ['pointer64', ['void']]], + 'FileWrite' : [ 0x30, ['pointer64', ['void']]], + 'FileRead' : [ 0x38, ['pointer64', ['void']]], + 'FileFlush' : [ 0x40, ['pointer64', ['void']]], + 'HiveLoadFailure' : [ 0x48, ['pointer64', ['void']]], + 'BaseBlock' : [ 0x50, ['pointer64', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x58, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x68, ['unsigned long']], + 'DirtyAlloc' : [ 0x6c, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x70, ['unsigned long']], + 'Cluster' : [ 0x74, ['unsigned long']], + 'Flat' : [ 0x78, ['unsigned char']], + 'ReadOnly' : [ 0x79, ['unsigned char']], + 'DirtyFlag' : [ 0x7a, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x7c, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x80, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x84, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x88, ['unsigned long']], + 'HiveFlags' : [ 0x8c, ['unsigned long']], + 'CurrentLog' : [ 0x90, ['unsigned long']], + 'LogSize' : [ 0x94, ['array', 2, ['unsigned long']]], + 'RefreshCount' : [ 0x9c, ['unsigned long']], + 'StorageTypeCount' : [ 0xa0, ['unsigned long']], + 'Version' : [ 0xa4, ['unsigned long']], + 'Storage' : [ 0xa8, ['array', 2, ['_DUAL']]], +} ], + '_CM_VIEW_OF_FILE' : [ 0x58, { + 'MappedViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'PinnedViewLinks' : [ 0x10, ['_LIST_ENTRY']], + 'FlushedViewLinks' : [ 0x20, ['_LIST_ENTRY']], + 'CmHive' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'Bcb' : [ 0x38, ['pointer64', ['void']]], + 'ViewAddress' : [ 0x40, ['pointer64', ['void']]], + 'FileOffset' : [ 0x48, ['unsigned long']], + 'Size' : [ 0x4c, ['unsigned long']], + 'UseCount' : [ 0x50, ['unsigned long']], +} ], + '_CMHIVE' : [ 0xbe8, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0x598, ['array', 6, ['pointer64', ['void']]]], + 'NotifyList' : [ 0x5c8, ['_LIST_ENTRY']], + 'HiveList' : [ 0x5d8, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0x5e8, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0x5f8, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0x600, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0x610, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0x618, ['unsigned long']], + 'Identity' : [ 0x61c, ['unsigned long']], + 'HiveLock' : [ 0x620, ['pointer64', ['_FAST_MUTEX']]], + 'ViewLock' : [ 0x628, ['_EX_PUSH_LOCK']], + 'ViewLockOwner' : [ 0x630, ['pointer64', ['_KTHREAD']]], + 'ViewLockLast' : [ 0x638, ['unsigned long']], + 'ViewUnLockLast' : [ 0x63c, ['unsigned long']], + 'WriterLock' : [ 0x640, ['pointer64', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0x648, ['pointer64', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0x650, ['_RTL_BITMAP']], + 'FlushOffsetArray' : [ 0x660, ['pointer64', ['CMP_OFFSET_ARRAY']]], + 'FlushOffsetArrayCount' : [ 0x668, ['unsigned long']], + 'FlushHiveTruncated' : [ 0x66c, ['unsigned long']], + 'FlushLock2' : [ 0x670, ['pointer64', ['_FAST_MUTEX']]], + 'SecurityLock' : [ 0x678, ['_EX_PUSH_LOCK']], + 'MappedViewList' : [ 0x680, ['_LIST_ENTRY']], + 'PinnedViewList' : [ 0x690, ['_LIST_ENTRY']], + 'FlushedViewList' : [ 0x6a0, ['_LIST_ENTRY']], + 'MappedViewCount' : [ 0x6b0, ['unsigned short']], + 'PinnedViewCount' : [ 0x6b2, ['unsigned short']], + 'UseCount' : [ 0x6b4, ['unsigned long']], + 'ViewsPerHive' : [ 0x6b8, ['unsigned long']], + 'FileObject' : [ 0x6c0, ['pointer64', ['_FILE_OBJECT']]], + 'LastShrinkHiveSize' : [ 0x6c8, ['unsigned long']], + 'ActualFileSize' : [ 0x6d0, ['_LARGE_INTEGER']], + 'FileFullPath' : [ 0x6d8, ['_UNICODE_STRING']], + 'FileUserName' : [ 0x6e8, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0x6f8, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0x708, ['unsigned long']], + 'SecurityCacheSize' : [ 0x70c, ['unsigned long']], + 'SecurityHitHint' : [ 0x710, ['long']], + 'SecurityCache' : [ 0x718, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0x720, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0xb20, ['unsigned long']], + 'UnloadEventArray' : [ 0xb28, ['pointer64', ['pointer64', ['_KEVENT']]]], + 'RootKcb' : [ 0xb30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0xb38, ['unsigned char']], + 'UnloadWorkItem' : [ 0xb40, ['pointer64', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0xb48, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0xb70, ['unsigned char']], + 'GrowOffset' : [ 0xb74, ['unsigned long']], + 'KcbConvertListHead' : [ 0xb78, ['_LIST_ENTRY']], + 'KnodeConvertListHead' : [ 0xb88, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0xb98, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], + 'Flags' : [ 0xba0, ['unsigned long']], + 'TrustClassEntry' : [ 0xba8, ['_LIST_ENTRY']], + 'FlushCount' : [ 0xbb8, ['unsigned long']], + 'CmRm' : [ 0xbc0, ['pointer64', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0xbc8, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0xbcc, ['long']], + 'CreatorOwner' : [ 0xbd0, ['pointer64', ['_KTHREAD']]], + 'RundownThread' : [ 0xbd8, ['pointer64', ['_KTHREAD']]], + 'LastWriteTime' : [ 0xbe0, ['_LARGE_INTEGER']], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x10, ['unsigned long']], + 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x20, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x28, ['unsigned long']], + 'KcbPushlock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x38, ['pointer64', ['_KTHREAD']]], + 'SharedCount' : [ 0x38, ['long']], + 'SlotHint' : [ 0x40, ['unsigned long']], + 'ParentKcb' : [ 0x48, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x50, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x58, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x60, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x70, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x70, ['unsigned long']], + 'SubKeyCount' : [ 0x70, ['unsigned long']], + 'KeyBodyListHead' : [ 0x78, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x88, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], + 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], + 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], +} ], + '__unnamed_1669' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapAndCopy', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpReadFileImageAndBuildMap', 8: '_HvpRecoverData', 9: '_HvpRecoverWholeHive', 10: '_HvpMapFileImageAndBuildMap', 11: '_CmpValidateHiveSecurityDescriptors', 12: '_HvpEnlistBinInMap', 13: '_CmCheckRegistry', 14: '_CmRegistryIO', 15: '_CmCheckRegistry2', 16: '_CmpCheckKey', 17: '_CmpCheckValueList', 18: '_HvCheckHive', 19: '_HvCheckBin'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_166c' : [ 0x18, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x8, ['pointer64', ['void']]], + 'Status' : [ 0x10, ['long']], +} ], + '__unnamed_166e' : [ 0x8, { + 'CheckStack' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1670' : [ 0x20, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], + 'RootPoint' : [ 0x10, ['pointer64', ['void']]], + 'Index' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1672' : [ 0x18, { + 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], + 'Index' : [ 0x8, ['unsigned long']], + 'Cell' : [ 0xc, ['unsigned long']], + 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], +} ], + '__unnamed_1676' : [ 0x10, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], +} ], + '__unnamed_167a' : [ 0x10, { + 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], + 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], +} ], + '__unnamed_167c' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x160, { + 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], + 'Index' : [ 0x8, ['unsigned long']], + 'RecoverableIndex' : [ 0xc, ['unsigned long']], + 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1669']]], + 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1669']]], + 'RegistryIO' : [ 0xd0, ['__unnamed_166c']], + 'CheckRegistry2' : [ 0xe8, ['__unnamed_166e']], + 'CheckKey' : [ 0xf0, ['__unnamed_1670']], + 'CheckValueList' : [ 0x110, ['__unnamed_1672']], + 'CheckHive' : [ 0x128, ['__unnamed_1676']], + 'CheckHive1' : [ 0x138, ['__unnamed_1676']], + 'CheckBin' : [ 0x148, ['__unnamed_167a']], + 'RecoverData' : [ 0x158, ['__unnamed_167c']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x10, ['unsigned long']], + 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0x80, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'DpcCount' : [ 0x38, ['unsigned long']], + 'DpcRate' : [ 0x3c, ['unsigned long']], + 'C1Time' : [ 0x40, ['unsigned long long']], + 'C2Time' : [ 0x48, ['unsigned long long']], + 'C3Time' : [ 0x50, ['unsigned long long']], + 'C1Transitions' : [ 0x58, ['unsigned long long']], + 'C2Transitions' : [ 0x60, ['unsigned long long']], + 'C3Transitions' : [ 0x68, ['unsigned long long']], + 'ParkingStatus' : [ 0x70, ['unsigned long']], + 'CurrentFrequency' : [ 0x74, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x78, ['unsigned long']], + 'StateFlags' : [ 0x7c, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x10, { + 'Data' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_CONTEXT32_UPDATE' : [ 0x4, { + 'NumberEntries' : [ 0x0, ['unsigned long']], +} ], + '_KTIMER_TABLE' : [ 0x2200, { + 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], + 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x20, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['_LIST_ENTRY']], + 'Time' : [ 0x18, ['_ULARGE_INTEGER']], +} ], + '_KAFFINITY_EX' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 4, ['unsigned long long']]], +} ], + '_KAFFINITY_ENUMERATION_CONTEXT' : [ 0x18, { + 'Affinity' : [ 0x0, ['pointer64', ['_KAFFINITY_EX']]], + 'CurrentMask' : [ 0x8, ['unsigned long long']], + 'CurrentIndex' : [ 0x10, ['unsigned short']], +} ], + '_GROUP_AFFINITY' : [ 0x10, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Group' : [ 0x8, ['unsigned short']], + 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], +} ], + '_KTRAP_FRAME' : [ 0x190, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'PreviousMode' : [ 0x28, ['unsigned char']], + 'PreviousIrql' : [ 0x29, ['unsigned char']], + 'FaultIndicator' : [ 0x2a, ['unsigned char']], + 'ExceptionActive' : [ 0x2b, ['unsigned char']], + 'MxCsr' : [ 0x2c, ['unsigned long']], + 'Rax' : [ 0x30, ['unsigned long long']], + 'Rcx' : [ 0x38, ['unsigned long long']], + 'Rdx' : [ 0x40, ['unsigned long long']], + 'R8' : [ 0x48, ['unsigned long long']], + 'R9' : [ 0x50, ['unsigned long long']], + 'R10' : [ 0x58, ['unsigned long long']], + 'R11' : [ 0x60, ['unsigned long long']], + 'GsBase' : [ 0x68, ['unsigned long long']], + 'GsSwap' : [ 0x68, ['unsigned long long']], + 'Xmm0' : [ 0x70, ['_M128A']], + 'Xmm1' : [ 0x80, ['_M128A']], + 'Xmm2' : [ 0x90, ['_M128A']], + 'Xmm3' : [ 0xa0, ['_M128A']], + 'Xmm4' : [ 0xb0, ['_M128A']], + 'Xmm5' : [ 0xc0, ['_M128A']], + 'FaultAddress' : [ 0xd0, ['unsigned long long']], + 'ContextRecord' : [ 0xd0, ['unsigned long long']], + 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], + 'Dr0' : [ 0xd8, ['unsigned long long']], + 'Dr1' : [ 0xe0, ['unsigned long long']], + 'Dr2' : [ 0xe8, ['unsigned long long']], + 'Dr3' : [ 0xf0, ['unsigned long long']], + 'Dr6' : [ 0xf8, ['unsigned long long']], + 'Dr7' : [ 0x100, ['unsigned long long']], + 'DebugControl' : [ 0x108, ['unsigned long long']], + 'LastBranchToRip' : [ 0x110, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], + 'LastBranchControl' : [ 0x108, ['unsigned long long']], + 'LastBranchMSR' : [ 0x110, ['unsigned long']], + 'SegDs' : [ 0x130, ['unsigned short']], + 'SegEs' : [ 0x132, ['unsigned short']], + 'SegFs' : [ 0x134, ['unsigned short']], + 'SegGs' : [ 0x136, ['unsigned short']], + 'TrapFrame' : [ 0x138, ['unsigned long long']], + 'Rbx' : [ 0x140, ['unsigned long long']], + 'Rdi' : [ 0x148, ['unsigned long long']], + 'Rsi' : [ 0x150, ['unsigned long long']], + 'Rbp' : [ 0x158, ['unsigned long long']], + 'ErrorCode' : [ 0x160, ['unsigned long long']], + 'ExceptionFrame' : [ 0x160, ['unsigned long long']], + 'TimeStampKlog' : [ 0x160, ['unsigned long long']], + 'Rip' : [ 0x168, ['unsigned long long']], + 'SegCs' : [ 0x170, ['unsigned short']], + 'Fill0' : [ 0x172, ['unsigned char']], + 'Logging' : [ 0x173, ['unsigned char']], + 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], + 'EFlags' : [ 0x178, ['unsigned long']], + 'Fill2' : [ 0x17c, ['unsigned long']], + 'Rsp' : [ 0x180, ['unsigned long long']], + 'SegSs' : [ 0x188, ['unsigned short']], + 'Fill3' : [ 0x18a, ['unsigned short']], + 'CodePatchCycle' : [ 0x18c, ['long']], +} ], + '_XSTATE_SAVE' : [ 0x38, { + 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Level' : [ 0x10, ['unsigned char']], + 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KEXCEPTION_FRAME' : [ 0x140, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['unsigned long long']], + 'Xmm6' : [ 0x30, ['_M128A']], + 'Xmm7' : [ 0x40, ['_M128A']], + 'Xmm8' : [ 0x50, ['_M128A']], + 'Xmm9' : [ 0x60, ['_M128A']], + 'Xmm10' : [ 0x70, ['_M128A']], + 'Xmm11' : [ 0x80, ['_M128A']], + 'Xmm12' : [ 0x90, ['_M128A']], + 'Xmm13' : [ 0xa0, ['_M128A']], + 'Xmm14' : [ 0xb0, ['_M128A']], + 'Xmm15' : [ 0xc0, ['_M128A']], + 'TrapFrame' : [ 0xd0, ['unsigned long long']], + 'CallbackStack' : [ 0xd8, ['unsigned long long']], + 'OutputBuffer' : [ 0xe0, ['unsigned long long']], + 'OutputLength' : [ 0xe8, ['unsigned long long']], + 'MxCsr' : [ 0xf0, ['unsigned long long']], + 'Rbp' : [ 0xf8, ['unsigned long long']], + 'Rbx' : [ 0x100, ['unsigned long long']], + 'Rdi' : [ 0x108, ['unsigned long long']], + 'Rsi' : [ 0x110, ['unsigned long long']], + 'R12' : [ 0x118, ['unsigned long long']], + 'R13' : [ 0x120, ['unsigned long long']], + 'R14' : [ 0x128, ['unsigned long long']], + 'R15' : [ 0x130, ['unsigned long long']], + 'Return' : [ 0x138, ['unsigned long long']], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x10, ['unsigned long']], + 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x48, ['unsigned long long']], +} ], + '_KSEMAPHORE' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x18, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x70, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x10, ['unsigned long']], + 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x20, ['unsigned long']], + 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], + 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x38, ['long']], + 'StartIoKey' : [ 0x3c, ['long']], + 'StartIoFlags' : [ 0x40, ['unsigned long']], + 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], + 'DependentList' : [ 0x50, ['_LIST_ENTRY']], + 'ProviderList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '__unnamed_1763' : [ 0x8, { + 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1765' : [ 0x8, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], +} ], + '__unnamed_1769' : [ 0x20, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0x18, ['pointer64', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x268, { + 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Level' : [ 0x50, ['unsigned long']], + 'Notify' : [ 0x58, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0xc0, ['_PO_IRP_MANAGER']], + 'State' : [ 0xe0, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0xe4, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0xe8, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x138, ['unsigned long']], + 'CompletionStatus' : [ 0x13c, ['long']], + 'Flags' : [ 0x140, ['unsigned long']], + 'UserFlags' : [ 0x144, ['unsigned long']], + 'Problem' : [ 0x148, ['unsigned long']], + 'ResourceList' : [ 0x150, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x158, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x160, ['pointer64', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x168, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x174, ['unsigned long']], + 'ChildInterfaceType' : [ 0x178, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x17c, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x180, ['unsigned short']], + 'RemovalPolicy' : [ 0x182, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x183, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x188, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x198, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x1a8, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x1b8, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x1ba, ['unsigned short']], + 'NoArbiterMask' : [ 0x1bc, ['unsigned short']], + 'QueryArbiterMask' : [ 0x1be, ['unsigned short']], + 'OverUsed1' : [ 0x1c0, ['__unnamed_1763']], + 'OverUsed2' : [ 0x1c8, ['__unnamed_1765']], + 'BootResources' : [ 0x1d0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x1d8, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x1e0, ['unsigned long']], + 'DockInfo' : [ 0x1e8, ['__unnamed_1769']], + 'DisableableDepends' : [ 0x208, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x210, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x220, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x230, ['unsigned long']], + 'PreviousParent' : [ 0x238, ['pointer64', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x240, ['unsigned long']], + 'NumaNodeIndex' : [ 0x244, ['unsigned long']], + 'ContainerID' : [ 0x248, ['_GUID']], + 'OverrideFlags' : [ 0x258, ['unsigned char']], + 'RequiresUnloadedDriver' : [ 0x259, ['unsigned char']], + 'PendingEjectRelations' : [ 0x260, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], +} ], + '_KNODE' : [ 0xc0, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x10, ['array', 3, ['_SLIST_HEADER']]], + 'Affinity' : [ 0x40, ['_GROUP_AFFINITY']], + 'ProximityId' : [ 0x50, ['unsigned long']], + 'NodeNumber' : [ 0x54, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x56, ['unsigned short']], + 'MaximumProcessors' : [ 0x58, ['unsigned char']], + 'Color' : [ 0x59, ['unsigned char']], + 'Flags' : [ 0x5a, ['_flags']], + 'NodePad0' : [ 0x5b, ['unsigned char']], + 'Seed' : [ 0x5c, ['unsigned long']], + 'MmShiftedColor' : [ 0x60, ['unsigned long']], + 'FreeCount' : [ 0x68, ['array', 2, ['unsigned long long']]], + 'Right' : [ 0x78, ['unsigned long']], + 'Left' : [ 0x7c, ['unsigned long']], + 'CachedKernelStacks' : [ 0x80, ['_CACHED_KSTACK_LIST']], + 'ParkLock' : [ 0xa0, ['long']], + 'NodePad1' : [ 0xa4, ['unsigned long']], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x40, { + 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0x10, ['unsigned long']], + 'Position' : [ 0x14, ['unsigned long']], + 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x20, ['pointer64', ['void']]], + 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x38, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1811' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_1811']], +} ], + '__unnamed_1818' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_1818']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_CPU_INFO' : [ 0x10, { + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_VOLUME_CACHE_MAP' : [ 0x38, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], + 'Flags' : [ 0x20, ['unsigned long']], + 'DirtyPages' : [ 0x28, ['unsigned long long']], + 'PagesQueuedToDisk' : [ 0x30, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x1f8, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], + 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x70, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], + 'Flags' : [ 0x98, ['unsigned long']], + 'Status' : [ 0x9c, ['long']], + 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], + 'Section' : [ 0xa8, ['pointer64', ['void']]], + 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], + 'PagesToWrite' : [ 0xc0, ['unsigned long']], + 'BeyondLastFlush' : [ 0xc8, ['long long']], + 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], + 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], + 'LogHandle' : [ 0xf0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0xf8, ['pointer64', ['void']]], + 'DirtyPageThreshold' : [ 0x100, ['unsigned long']], + 'LazyWritePassCount' : [ 0x104, ['unsigned long']], + 'UninitializeEvent' : [ 0x108, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0x110, ['_KGUARDED_MUTEX']], + 'LastUnmapBehindOffset' : [ 0x148, ['_LARGE_INTEGER']], + 'Event' : [ 0x150, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0x168, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0x170, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x1d8, ['pointer64', ['void']]], + 'VolumeCacheMap' : [ 0x1e0, ['pointer64', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x1e8, ['unsigned long']], + 'WritesInProgress' : [ 0x1ec, ['unsigned long']], + 'PipelinedReadAheadSize' : [ 0x1f0, ['unsigned long']], +} ], + '__unnamed_188a' : [ 0x8, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], +} ], + '_VACB' : [ 0x30, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x10, ['__unnamed_188a']], + 'Links' : [ 0x18, ['_LIST_ENTRY']], + 'ArrayHead' : [ 0x28, ['pointer64', ['_VACB_ARRAY_HEADER']]], +} ], + '_KGUARDED_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Gate' : [ 0x18, ['_KGATE']], + 'KernelApcDisable' : [ 0x30, ['short']], + 'SpecialApcDisable' : [ 0x32, ['short']], + 'CombinedApcDisable' : [ 0x30, ['unsigned long']], +} ], + '__unnamed_18a8' : [ 0x8, { + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], +} ], + '__unnamed_18aa' : [ 0x8, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_18ac' : [ 0x8, { + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], +} ], + '__unnamed_18ae' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_18b0' : [ 0x8, { + 'Read' : [ 0x0, ['__unnamed_18a8']], + 'Write' : [ 0x0, ['__unnamed_18aa']], + 'Event' : [ 0x0, ['__unnamed_18ac']], + 'Notification' : [ 0x0, ['__unnamed_18ae']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x20, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x10, ['__unnamed_18b0']], + 'Function' : [ 0x18, ['unsigned char']], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], + 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x38, { + 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x8, ['unsigned long']], + 'ExtraItem' : [ 0xc, ['unsigned long']], + 'ItemCount' : [ 0x10, ['unsigned long']], + 'OutOfRangeItems' : [ 0x14, ['unsigned long']], + 'BaseIndex' : [ 0x18, ['unsigned long']], + 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], + 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x208, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], + 'Flags' : [ 0x70, ['unsigned long']], + 'ForceFlags' : [ 0x74, ['unsigned long']], + 'CompatibilityFlags' : [ 0x78, ['unsigned long']], + 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], + 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], + 'PointerKey' : [ 0x90, ['unsigned long long']], + 'Interceptor' : [ 0x98, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x9c, ['unsigned long']], + 'Signature' : [ 0xa0, ['unsigned long']], + 'SegmentReserve' : [ 0xa8, ['unsigned long long']], + 'SegmentCommit' : [ 0xb0, ['unsigned long long']], + 'DeCommitFreeBlockThreshold' : [ 0xb8, ['unsigned long long']], + 'DeCommitTotalFreeThreshold' : [ 0xc0, ['unsigned long long']], + 'TotalFreeSize' : [ 0xc8, ['unsigned long long']], + 'MaximumAllocationSize' : [ 0xd0, ['unsigned long long']], + 'ProcessHeapsListIndex' : [ 0xd8, ['unsigned short']], + 'HeaderValidateLength' : [ 0xda, ['unsigned short']], + 'HeaderValidateCopy' : [ 0xe0, ['pointer64', ['void']]], + 'NextAvailableTagIndex' : [ 0xe8, ['unsigned short']], + 'MaximumTagIndex' : [ 0xea, ['unsigned short']], + 'TagEntries' : [ 0xf0, ['pointer64', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0xf8, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x108, ['unsigned long long']], + 'AlignMask' : [ 0x110, ['unsigned long long']], + 'VirtualAllocdBlocks' : [ 0x118, ['_LIST_ENTRY']], + 'SegmentList' : [ 0x128, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0x138, ['unsigned short']], + 'NonDedicatedListLength' : [ 0x13c, ['unsigned long']], + 'BlocksIndex' : [ 0x140, ['pointer64', ['void']]], + 'UCRIndex' : [ 0x148, ['pointer64', ['void']]], + 'PseudoTagEntries' : [ 0x150, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0x158, ['_LIST_ENTRY']], + 'LockVariable' : [ 0x168, ['pointer64', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0x170, ['pointer64', ['void']]], + 'FrontEndHeap' : [ 0x178, ['pointer64', ['void']]], + 'FrontHeapLockCount' : [ 0x180, ['unsigned short']], + 'FrontEndHeapType' : [ 0x182, ['unsigned char']], + 'Counters' : [ 0x188, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x1f8, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1901' : [ 0x28, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], +} ], + '_HEAP_LOCK' : [ 0x28, { + 'Lock' : [ 0x0, ['__unnamed_1901']], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x28, { + 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x8, ['long']], + 'RecursionCount' : [ 0xc, ['long']], + 'OwningThread' : [ 0x10, ['pointer64', ['void']]], + 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], + 'SpinCount' : [ 0x20, ['unsigned long long']], +} ], + '_HEAP_ENTRY' : [ 0x10, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x70, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x20, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], + 'FreeList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_PEB' : [ 0x380, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x8, ['pointer64', ['void']]], + 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], + 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], + 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], + 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], + 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], + 'HotpatchInformation' : [ 0x90, ['pointer64', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], + 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], + 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], + 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], + 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], + 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], + 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], + 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], + 'pContextData' : [ 0x368, ['pointer64', ['void']]], + 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_PEB_LDR_DATA' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer64', ['void']]], + 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], + 'ShutdownInProgress' : [ 0x48, ['unsigned char']], + 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0xe0, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'Flags' : [ 0x68, ['unsigned long']], + 'LoadCount' : [ 0x6c, ['unsigned short']], + 'TlsIndex' : [ 0x6e, ['unsigned short']], + 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], + 'SectionPointer' : [ 0x70, ['pointer64', ['void']]], + 'CheckSum' : [ 0x78, ['unsigned long']], + 'TimeDateStamp' : [ 0x80, ['unsigned long']], + 'LoadedImports' : [ 0x80, ['pointer64', ['void']]], + 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'PatchInformation' : [ 0x90, ['pointer64', ['void']]], + 'ForwarderLinks' : [ 0x98, ['_LIST_ENTRY']], + 'ServiceTagLinks' : [ 0xa8, ['_LIST_ENTRY']], + 'StaticLinks' : [ 0xb8, ['_LIST_ENTRY']], + 'ContextInformation' : [ 0xc8, ['pointer64', ['void']]], + 'OriginalBase' : [ 0xd0, ['unsigned long long']], + 'LoadTime' : [ 0xd8, ['_LARGE_INTEGER']], +} ], + '_HEAP_SUBSEGMENT' : [ 0x30, { + 'LocalInfo' : [ 0x0, ['pointer64', ['_HEAP_LOCAL_SEGMENT_INFO']]], + 'UserBlocks' : [ 0x8, ['pointer64', ['_HEAP_USERDATA_HEADER']]], + 'AggregateExchg' : [ 0x10, ['_INTERLOCK_SEQ']], + 'BlockSize' : [ 0x18, ['unsigned short']], + 'Flags' : [ 0x1a, ['unsigned short']], + 'BlockCount' : [ 0x1c, ['unsigned short']], + 'SizeIndex' : [ 0x1e, ['unsigned char']], + 'AffinityIndex' : [ 0x1f, ['unsigned char']], + 'Alignment' : [ 0x18, ['array', 2, ['unsigned long']]], + 'SFreeListEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'Lock' : [ 0x28, ['unsigned long']], +} ], + '__unnamed_197f' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1981' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_197f']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1983' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1985' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1983']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_1981']], + 'u2' : [ 0x4, ['__unnamed_1985']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x18, ['unsigned long']], + 'ClientViewSize' : [ 0x20, ['unsigned long long']], + 'CallbackId' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x38, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'CreatedObjects' : [ 0xc, ['unsigned long']], + 'DeletedObjects' : [ 0x10, ['unsigned long']], + 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], + 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], + 'UsualSize' : [ 0x28, ['unsigned long long']], + 'LookasideIndex' : [ 0x30, ['unsigned long']], +} ], + '__unnamed_199e' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_19a0' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_199e']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x20, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_19a0']], + 'ResourceId' : [ 0x11, ['unsigned char']], + 'CachedReferences' : [ 0x12, ['short']], + 'ReferenceCount' : [ 0x14, ['long']], + 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_19b3' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_19b5' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19b3']], +} ], + '_KALPC_SECTION' : [ 0x48, { + 'SectionObject' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], + 'u1' : [ 0x30, ['__unnamed_19b5']], + 'NumberOfRegions' : [ 0x34, ['unsigned long']], + 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], +} ], + '__unnamed_19bb' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_19bd' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19bb']], +} ], + '_KALPC_REGION' : [ 0x58, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], + 'Offset' : [ 0x18, ['unsigned long long']], + 'Size' : [ 0x20, ['unsigned long long']], + 'ViewSize' : [ 0x28, ['unsigned long long']], + 'u1' : [ 0x30, ['__unnamed_19bd']], + 'NumberOfViews' : [ 0x34, ['unsigned long']], + 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], +} ], + '__unnamed_19c3' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_19c5' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19c3']], +} ], + '_KALPC_VIEW' : [ 0x60, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'Address' : [ 0x28, ['pointer64', ['void']]], + 'Size' : [ 0x30, ['unsigned long long']], + 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], + 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], + 'u1' : [ 0x48, ['__unnamed_19c5']], + 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x40, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], +} ], + '__unnamed_19e1' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_19e3' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19e1']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x1a0, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], + 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x38, ['pointer64', ['void']]], + 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], + 'MainQueue' : [ 0x88, ['_LIST_ENTRY']], + 'PendingQueue' : [ 0x98, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0xa8, ['_LIST_ENTRY']], + 'WaitQueue' : [ 0xb8, ['_LIST_ENTRY']], + 'Semaphore' : [ 0xc8, ['pointer64', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0xc8, ['pointer64', ['_KEVENT']]], + 'PortAttributes' : [ 0xd0, ['_ALPC_PORT_ATTRIBUTES']], + 'Lock' : [ 0x118, ['_EX_PUSH_LOCK']], + 'ResourceListLock' : [ 0x120, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0x128, ['_LIST_ENTRY']], + 'CompletionList' : [ 0x138, ['pointer64', ['_ALPC_COMPLETION_LIST']]], + 'MessageZone' : [ 0x140, ['pointer64', ['_ALPC_MESSAGE_ZONE']]], + 'CallbackObject' : [ 0x148, ['pointer64', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0x150, ['pointer64', ['void']]], + 'CanceledQueue' : [ 0x158, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0x168, ['long']], + 'u1' : [ 0x16c, ['__unnamed_19e3']], + 'TargetQueuePort' : [ 0x170, ['pointer64', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0x178, ['pointer64', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x180, ['pointer64', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x188, ['unsigned long']], + 'PendingQueueLength' : [ 0x18c, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x190, ['unsigned long']], + 'CanceledQueueLength' : [ 0x194, ['unsigned long']], + 'WaitQueueLength' : [ 0x198, ['unsigned long']], +} ], + '_OBJECT_TYPE' : [ 0xd0, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], + 'Index' : [ 0x28, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], + 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'Key' : [ 0xb8, ['unsigned long']], + 'CallbackList' : [ 0xc0, ['_LIST_ENTRY']], +} ], + '_PORT_MESSAGE32' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1981']], + 'u2' : [ 0x4, ['__unnamed_1985']], + 'ClientId' : [ 0x8, ['_CLIENT_ID32']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1a02' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], +} ], + '__unnamed_1a04' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a02']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x100, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtensionBuffer' : [ 0x10, ['pointer64', ['void']]], + 'ExtensionBufferSize' : [ 0x18, ['unsigned long long']], + 'QuotaProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x20, ['pointer64', ['void']]], + 'SequenceNo' : [ 0x28, ['long']], + 'u1' : [ 0x2c, ['__unnamed_1a04']], + 'CancelSequencePort' : [ 0x30, ['pointer64', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x40, ['long']], + 'CancelListEntry' : [ 0x48, ['_LIST_ENTRY']], + 'WaitingThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], + 'PortQueue' : [ 0x68, ['pointer64', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x70, ['pointer64', ['_ALPC_PORT']]], + 'MessageAttributes' : [ 0x78, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0xb0, ['pointer64', ['void']]], + 'DataSystemVa' : [ 0xb8, ['pointer64', ['void']]], + 'CommunicationInfo' : [ 0xc0, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0xc8, ['pointer64', ['_ALPC_PORT']]], + 'ServerThread' : [ 0xd0, ['pointer64', ['_ETHREAD']]], + 'PortMessage' : [ 0xd8, ['_PORT_MESSAGE']], +} ], + '_REMOTE_PORT_VIEW' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x8, ['unsigned long long']], + 'ViewBase' : [ 0x10, ['pointer64', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x28, { + 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x20, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['pointer64', ['_OB_DUPLICATE_OBJECT_STATE']]], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x38, { + 'ClientContext' : [ 0x0, ['pointer64', ['void']]], + 'ServerContext' : [ 0x8, ['pointer64', ['void']]], + 'PortContext' : [ 0x10, ['pointer64', ['void']]], + 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], + 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], +} ], + '__unnamed_1a42' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1a44' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a42']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x70, { + 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], + 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x68, ['__unnamed_1a44']], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x10, ['unsigned long']], + 'KeyContext' : [ 0x18, ['pointer64', ['void']]], + 'ApcContext' : [ 0x20, ['pointer64', ['void']]], + 'IoStatus' : [ 0x28, ['long']], + 'IoStatusInformation' : [ 0x30, ['unsigned long long']], + 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Allocated' : [ 0x48, ['unsigned char']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x38, { + 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], + 'Flags' : [ 0x28, ['unsigned long']], + 'TotalLength' : [ 0x2c, ['unsigned short']], + 'Type' : [ 0x2e, ['unsigned short']], + 'DataInfoOffset' : [ 0x30, ['unsigned short']], +} ], + '_DRIVER_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'DriverStart' : [ 0x18, ['pointer64', ['void']]], + 'DriverSize' : [ 0x20, ['unsigned long']], + 'DriverSection' : [ 0x28, ['pointer64', ['void']]], + 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x38, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x58, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x20, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x48, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], + 'FoIoPriorityHint' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0xb8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x10, ['long']], + 'Information' : [ 0x18, ['unsigned long long']], + 'ParseCheck' : [ 0x20, ['unsigned long']], + 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], + 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x40, ['unsigned long']], + 'FileAttributes' : [ 0x44, ['unsigned short']], + 'ShareAccess' : [ 0x46, ['unsigned short']], + 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], + 'EaLength' : [ 0x50, ['unsigned long']], + 'Options' : [ 0x54, ['unsigned long']], + 'Disposition' : [ 0x58, ['unsigned long']], + 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], + 'Override' : [ 0x80, ['unsigned char']], + 'QueryOnly' : [ 0x81, ['unsigned char']], + 'DeleteOnly' : [ 0x82, ['unsigned char']], + 'FullAttributes' : [ 0x83, ['unsigned char']], + 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x90, ['unsigned long']], + 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '_RTL_RB_TREE' : [ 0x10, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0x18, { + 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_AVL_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x340, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'CollectionOn' : [ 0xc, ['long']], + 'LoggerMode' : [ 0x10, ['unsigned long']], + 'AcceptNewEvents' : [ 0x14, ['long']], + 'GetCpuClock' : [ 0x18, ['pointer64', ['void']]], + 'StartTime' : [ 0x20, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x28, ['pointer64', ['void']]], + 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x38, ['long']], + 'NBQHead' : [ 0x40, ['pointer64', ['void']]], + 'OverflowNBQHead' : [ 0x48, ['pointer64', ['void']]], + 'QueueBlockFreeList' : [ 0x50, ['_SLIST_HEADER']], + 'GlobalList' : [ 0x60, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x70, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x70, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x78, ['_UNICODE_STRING']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0x98, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0xa8, ['_UNICODE_STRING']], + 'ClockType' : [ 0xb8, ['unsigned long']], + 'MaximumFileSize' : [ 0xbc, ['unsigned long']], + 'LastFlushedBuffer' : [ 0xc0, ['unsigned long']], + 'FlushTimer' : [ 0xc4, ['unsigned long']], + 'FlushThreshold' : [ 0xc8, ['unsigned long']], + 'ByteOffset' : [ 0xd0, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0xd8, ['unsigned long']], + 'BuffersAvailable' : [ 0xdc, ['long']], + 'NumberOfBuffers' : [ 0xe0, ['long']], + 'MaximumBuffers' : [ 0xe4, ['unsigned long']], + 'EventsLost' : [ 0xe8, ['unsigned long']], + 'BuffersWritten' : [ 0xec, ['unsigned long']], + 'LogBuffersLost' : [ 0xf0, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0xf4, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0xf8, ['unsigned long']], + 'SequencePtr' : [ 0x100, ['pointer64', ['long']]], + 'LocalSequence' : [ 0x108, ['unsigned long']], + 'InstanceGuid' : [ 0x10c, ['_GUID']], + 'FileCounter' : [ 0x11c, ['long']], + 'BufferCallback' : [ 0x120, ['pointer64', ['void']]], + 'PoolType' : [ 0x128, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0x130, ['_ETW_REF_CLOCK']], + 'Consumers' : [ 0x140, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x150, ['unsigned long']], + 'TransitionConsumer' : [ 0x158, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x160, ['pointer64', ['void']]], + 'RealtimeLogfileName' : [ 0x168, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x178, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x180, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x188, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x190, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x198, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x1a0, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x1a8, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x1b8, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x1c0, ['_KEVENT']], + 'FlushEvent' : [ 0x1d8, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x1f0, ['_KTIMER']], + 'FlushDpc' : [ 0x230, ['_KDPC']], + 'LoggerMutex' : [ 0x270, ['_KMUTANT']], + 'LoggerLock' : [ 0x2a8, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x2b0, ['unsigned long long']], + 'BufferListPushLock' : [ 0x2b0, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x2b8, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x300, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x308, ['_EX_FAST_REF']], + 'BufferSequenceNumber' : [ 0x310, ['long long']], + 'Flags' : [ 0x318, ['unsigned long']], + 'Persistent' : [ 0x318, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x318, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x318, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x318, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x318, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x318, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x318, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x318, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x318, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x318, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'RequestFlag' : [ 0x31c, ['unsigned long']], + 'RequestNewFie' : [ 0x31c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x31c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x31c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x31c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x31c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x31c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HookIdMap' : [ 0x320, ['_RTL_BITMAP']], + 'DisallowedGuids' : [ 0x330, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_ETW_BUFFER_HANDLE' : [ 0x10, { + 'TraceBuffer' : [ 0x0, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'BufferFastRef' : [ 0x8, ['pointer64', ['_EX_FAST_REF']]], +} ], + '_SYSTEM_TRACE_HEADER' : [ 0x20, { + 'Marker' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['unsigned char']], + 'Header' : [ 0x4, ['unsigned long']], + 'Packet' : [ 0x4, ['_WMI_TRACE_PACKET']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'SystemTime' : [ 0x10, ['_LARGE_INTEGER']], + 'KernelTime' : [ 0x18, ['unsigned long']], + 'UserTime' : [ 0x1c, ['unsigned long']], +} ], + '_PERFINFO_TRACE_HEADER' : [ 0x18, { + 'Marker' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['unsigned char']], + 'Header' : [ 0x4, ['unsigned long']], + 'Packet' : [ 0x4, ['_WMI_TRACE_PACKET']], + 'TS' : [ 0x8, ['unsigned long long']], + 'SystemTime' : [ 0x8, ['_LARGE_INTEGER']], + 'Data' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_NBQUEUE_BLOCK' : [ 0x20, { + 'SListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'Next' : [ 0x10, ['unsigned long long']], + 'Data' : [ 0x18, ['unsigned long long']], +} ], + '_TlgProvider_t' : [ 0x40, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], + 'KeywordAny' : [ 0x10, ['unsigned long long']], + 'KeywordAll' : [ 0x18, ['unsigned long long']], + 'RegHandle' : [ 0x20, ['unsigned long long']], + 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], + 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KMUTANT' : [ 0x38, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], + 'Abandoned' : [ 0x30, ['unsigned char']], + 'ApcDisable' : [ 0x31, ['unsigned char']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_TRACE_ENABLE_CONTEXT' : [ 0x8, { + 'LoggerId' : [ 0x0, ['unsigned short']], + 'Level' : [ 0x2, ['unsigned char']], + 'InternalFlag' : [ 0x3, ['unsigned char']], + 'EnableFlags' : [ 0x4, ['unsigned long']], +} ], + '_TRACE_ENABLE_CONTEXT_EX' : [ 0x10, { + 'LoggerId' : [ 0x0, ['unsigned short']], + 'Level' : [ 0x2, ['unsigned char']], + 'InternalFlag' : [ 0x3, ['unsigned char']], + 'EnableFlags' : [ 0x4, ['unsigned long']], + 'EnableFlagsHigh' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_ETW_GUID_ENTRY' : [ 0x1b0, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x10, ['long']], + 'Guid' : [ 0x14, ['_GUID']], + 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x40, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x170, ['array', 8, ['pointer64', ['_EVENT_FILTER_HEADER']]]], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x310, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x38, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x74, ['unsigned long']], + 'UserAndGroupCount' : [ 0x78, ['unsigned long']], + 'RestrictedSidCount' : [ 0x7c, ['unsigned long']], + 'VariableLength' : [ 0x80, ['unsigned long']], + 'DynamicCharged' : [ 0x84, ['unsigned long']], + 'DynamicAvailable' : [ 0x88, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x8c, ['unsigned long']], + 'UserAndGroups' : [ 0x90, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0xa0, ['pointer64', ['void']]], + 'DynamicPart' : [ 0xa8, ['pointer64', ['unsigned long']]], + 'DefaultDacl' : [ 0xb0, ['pointer64', ['_ACL']]], + 'TokenType' : [ 0xb8, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xc0, ['unsigned long']], + 'TokenInUse' : [ 0xc4, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xc8, ['unsigned long']], + 'MandatoryPolicy' : [ 0xcc, ['unsigned long']], + 'LogonSession' : [ 0xd0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xd8, ['_LUID']], + 'SidHash' : [ 0xe0, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x1f0, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x300, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'VariablePart' : [ 0x308, ['unsigned long long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0x50, { + 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x8, ['_LUID']], + 'BuddyLogonId' : [ 0x10, ['_LUID']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], + 'pDeviceMap' : [ 0x20, ['pointer64', ['_DEVICE_MAP']]], + 'Token' : [ 0x28, ['pointer64', ['void']]], + 'AccountName' : [ 0x30, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x40, ['_UNICODE_STRING']], +} ], + '_OBJECT_HEADER' : [ 0x38, { + 'PointerCount' : [ 0x0, ['long long']], + 'HandleCount' : [ 0x8, ['long long']], + 'NextToFree' : [ 0x8, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0x18, ['unsigned char']], + 'TraceFlags' : [ 0x19, ['unsigned char']], + 'InfoMask' : [ 0x1a, ['unsigned char']], + 'Flags' : [ 0x1b, ['unsigned char']], + 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], + 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], + 'Body' : [ 0x30, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], + 'Reserved' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { + 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { + 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0x18, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], + 'Reserved' : [ 0x1a, ['unsigned short']], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], + 'HashIndex' : [ 0x14, ['unsigned short']], + 'DirectoryLocked' : [ 0x16, ['unsigned char']], + 'LockedExclusive' : [ 0x17, ['unsigned char']], + 'LockStateSignature' : [ 0x18, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0x150, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], + 'SessionId' : [ 0x138, ['unsigned long']], + 'NamespaceEntry' : [ 0x140, ['pointer64', ['void']]], + 'Flags' : [ 0x148, ['unsigned long']], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { + 'ImpersonationData' : [ 0x0, ['unsigned long long']], + 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MMVAD_FLAGS3' : [ 0x8, { + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { + 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'Reserved1' : [ 0xa8, ['array', 85, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x68, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0x18, ['short']], + 'Flag' : [ 0x1a, ['unsigned short']], + 'SharedWaiters' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x40, ['unsigned long']], + 'ContentionCount' : [ 0x44, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], + 'Reserved2' : [ 0x50, ['pointer64', ['void']]], + 'Address' : [ 0x58, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], + 'SpinLock' : [ 0x60, ['unsigned long long']], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x50, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x8, ['unsigned long']], + 'SenderPort' : [ 0x10, ['pointer64', ['void']]], + 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'PortContext' : [ 0x20, ['pointer64', ['void']]], + 'Request' : [ 0x28, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_DUAL' : [ 0x278, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], + 'Guard' : [ 0x18, ['unsigned long']], + 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeSummary' : [ 0x260, ['unsigned long']], + 'FreeBins' : [ 0x268, ['_LIST_ENTRY']], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long long']], + 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], + 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], + 'MaxSectionSize' : [ 0x28, ['unsigned long long']], + 'MaxViewSize' : [ 0x30, ['unsigned long long']], + 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], + 'DupObjectTypes' : [ 0x40, ['unsigned long']], + 'Reserved' : [ 0x44, ['unsigned long']], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_KQUEUE' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x28, ['unsigned long']], + 'MaximumCount' : [ 0x2c, ['unsigned long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_DISPATCHER_HEADER' : [ 0x18, { + 'Type' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'Abandoned' : [ 0x1, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DpcActive' : [ 0x3, ['unsigned char']], + 'Lock' : [ 0x0, ['long']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_VI_POOL_ENTRY' : [ 0x20, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'WaitResponse' : [ 0xc, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_COUNTERS' : [ 0x70, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], + 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], + 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], + 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], + 'TotalSegments' : [ 0x20, ['unsigned long']], + 'TotalUCRs' : [ 0x24, ['unsigned long']], + 'CommittOps' : [ 0x28, ['unsigned long']], + 'DeCommitOps' : [ 0x2c, ['unsigned long']], + 'LockAcquires' : [ 0x30, ['unsigned long']], + 'LockCollisions' : [ 0x34, ['unsigned long']], + 'CommitRate' : [ 0x38, ['unsigned long']], + 'DecommittRate' : [ 0x3c, ['unsigned long']], + 'CommitFailures' : [ 0x40, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], + 'CompactHeapCalls' : [ 0x48, ['unsigned long']], + 'CompactedUCRs' : [ 0x4c, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x50, ['unsigned long']], + 'InBlockDeccommits' : [ 0x54, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x58, ['unsigned long long']], + 'HighWatermarkSize' : [ 0x60, ['unsigned long long']], + 'LastPolledSize' : [ 0x68, ['unsigned long long']], +} ], + '_CM_KEY_HASH' : [ 0x20, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], +} ], + '_SYSPTES_HEADER' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Count' : [ 0x10, ['unsigned long long']], + 'NumberOfEntries' : [ 0x18, ['unsigned long long']], + 'NumberOfEntriesPeak' : [ 0x20, ['unsigned long long']], +} ], + '_EXCEPTION_RECORD' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], + 'NumberParameters' : [ 0x18, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x54, ['unsigned long']], + 'ProfileChangingEject' : [ 0x58, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], + 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], +} ], + '_I386_LOADER_BLOCK' : [ 0x10, { + 'CommonDataArea' : [ 0x0, ['pointer64', ['void']]], + 'MachineType' : [ 0x8, ['unsigned long']], + 'VirtualBias' : [ 0xc, ['unsigned long']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x30, { + 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x2c, ['unsigned long']], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_ARC_DISK_INFORMATION' : [ 0x10, { + 'DiskSignatures' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x10, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { + 'Key' : [ 0x0, ['pointer64', ['void']]], + 'Index' : [ 0x8, ['unsigned long']], +} ], + '_HMAP_DIRECTORY' : [ 0x2000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], +} ], + '_KAPC' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], + 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], + 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], + 'NormalContext' : [ 0x38, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], + 'ApcStateIndex' : [ 0x50, ['unsigned char']], + 'ApcMode' : [ 0x51, ['unsigned char']], + 'Inserted' : [ 0x52, ['unsigned char']], +} ], + '_HANDLE_TABLE' : [ 0x68, { + 'TableCode' : [ 0x0, ['unsigned long long']], + 'QuotaProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'UniqueProcessId' : [ 0x10, ['pointer64', ['void']]], + 'HandleLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'HandleTableList' : [ 0x20, ['_LIST_ENTRY']], + 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], + 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], + 'ExtraInfoPages' : [ 0x40, ['long']], + 'Flags' : [ 0x44, ['unsigned long']], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FirstFreeHandle' : [ 0x48, ['unsigned long']], + 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x58, ['unsigned long']], + 'NextHandleNeedingPool' : [ 0x5c, ['unsigned long']], + 'HandleCountHighWatermark' : [ 0x60, ['unsigned long']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { + 'Va' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['unsigned long']], + 'PoolType' : [ 0xc, ['unsigned long']], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_TEB_ACTIVE_FRAME' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0x18, ['pointer64', ['void']]], + 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], + 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], + 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x30, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'Object' : [ 0x18, ['pointer64', ['void']]], + 'NextWaitBlock' : [ 0x20, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitKey' : [ 0x28, ['unsigned short']], + 'WaitType' : [ 0x2a, ['unsigned char']], + 'BlockState' : [ 0x2b, ['unsigned char']], + 'SpareLong' : [ 0x2c, ['long']], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x78, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['_KAFFINITY_EX']], + 'SamplingPeriod' : [ 0x38, ['unsigned long']], + 'CurrentTemperature' : [ 0x3c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x40, ['unsigned long']], + 'CriticalTripPoint' : [ 0x44, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x48, ['unsigned char']], + 'ActiveTripPoint' : [ 0x4c, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x74, ['unsigned long']], +} ], + '__unnamed_1cdf' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1ce1' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1cdf']], + 'Private' : [ 0x0, ['__unnamed_1ce1']], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x20, { + 'IssueType' : [ 0x0, ['unsigned long long']], + 'Address' : [ 0x8, ['pointer64', ['void']]], + 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x10, { + 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], +} ], + '_OBJECT_REF_INFO' : [ 0x28, { + 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x20, ['unsigned short']], + 'MaxStacks' : [ 0x22, ['unsigned short']], + 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x18, { + 'SecurityContext' : [ 0x0, ['_IMAGE_SECURITY_CONTEXT']], + 'DynamicRelocations' : [ 0x8, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x10, ['long']], +} ], + '_HEAP_TAG_ENTRY' : [ 0x48, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], + 'TagIndex' : [ 0x10, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], + 'TagName' : [ 0x14, ['array', 24, ['wchar']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '__unnamed_1d02' : [ 0x10, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], +} ], + '__unnamed_1d08' : [ 0x8, { + 'Banked' : [ 0x0, ['pointer64', ['_MMBANKED_SECTION']]], + 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD_LONG' : [ 0x90, { + 'u1' : [ 0x0, ['__unnamed_15bf']], + 'LeftChild' : [ 0x8, ['pointer64', ['_MMVAD']]], + 'RightChild' : [ 0x10, ['pointer64', ['_MMVAD']]], + 'StartingVpn' : [ 0x18, ['unsigned long long']], + 'EndingVpn' : [ 0x20, ['unsigned long long']], + 'u' : [ 0x28, ['__unnamed_15c2']], + 'PushLock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x38, ['__unnamed_15c5']], + 'u2' : [ 0x40, ['__unnamed_15d2']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], + 'u3' : [ 0x78, ['__unnamed_1d02']], + 'u4' : [ 0x88, ['__unnamed_1d08']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NT_TIB' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x8, ['pointer64', ['void']]], + 'StackLimit' : [ 0x10, ['pointer64', ['void']]], + 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], + 'FiberData' : [ 0x20, ['pointer64', ['void']]], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], + 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_EJOB' : [ 0x1c8, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], + 'JobLock' : [ 0x38, ['_ERESOURCE']], + 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'TotalPageFaultCount' : [ 0xc0, ['unsigned long']], + 'TotalProcesses' : [ 0xc4, ['unsigned long']], + 'ActiveProcesses' : [ 0xc8, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0xcc, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0xd0, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xd8, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xe0, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0xe8, ['unsigned long long']], + 'LimitFlags' : [ 0xf0, ['unsigned long']], + 'ActiveProcessLimit' : [ 0xf4, ['unsigned long']], + 'Affinity' : [ 0xf8, ['_KAFFINITY_EX']], + 'PriorityClass' : [ 0x120, ['unsigned char']], + 'AccessState' : [ 0x128, ['pointer64', ['_JOB_ACCESS_STATE']]], + 'UIRestrictionsClass' : [ 0x130, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0x134, ['unsigned long']], + 'CompletionPort' : [ 0x138, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x140, ['pointer64', ['void']]], + 'SessionId' : [ 0x148, ['unsigned long']], + 'SchedulingClass' : [ 0x14c, ['unsigned long']], + 'ReadOperationCount' : [ 0x150, ['unsigned long long']], + 'WriteOperationCount' : [ 0x158, ['unsigned long long']], + 'OtherOperationCount' : [ 0x160, ['unsigned long long']], + 'ReadTransferCount' : [ 0x168, ['unsigned long long']], + 'WriteTransferCount' : [ 0x170, ['unsigned long long']], + 'OtherTransferCount' : [ 0x178, ['unsigned long long']], + 'ProcessMemoryLimit' : [ 0x180, ['unsigned long long']], + 'JobMemoryLimit' : [ 0x188, ['unsigned long long']], + 'PeakProcessMemoryUsed' : [ 0x190, ['unsigned long long']], + 'PeakJobMemoryUsed' : [ 0x198, ['unsigned long long']], + 'CurrentJobMemoryUsed' : [ 0x1a0, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x1a8, ['_EX_PUSH_LOCK']], + 'JobSetLinks' : [ 0x1b0, ['_LIST_ENTRY']], + 'MemberLevel' : [ 0x1c0, ['unsigned long']], + 'JobFlags' : [ 0x1c4, ['unsigned long']], +} ], + '__unnamed_1d1c' : [ 0x4, { + 'AsULONG' : [ 0x0, ['unsigned long']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_IDLE_STATES' : [ 0xa0, { + 'Count' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['__unnamed_1d1c']], + 'TargetState' : [ 0x8, ['unsigned long']], + 'ActualState' : [ 0xc, ['unsigned long']], + 'OldState' : [ 0x10, ['unsigned long']], + 'TargetProcessors' : [ 0x18, ['_KAFFINITY_EX']], + 'State' : [ 0x40, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '__unnamed_1d25' : [ 0x18, { + 'EfiInformation' : [ 0x0, ['_EFI_FIRMWARE_INFORMATION']], + 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], +} ], + '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_1d25']], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Address' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x88, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], + 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], + 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], + 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], + 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], + 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x50, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], + 'LoggerId' : [ 0x58, ['unsigned long']], + 'ShutDownRequested' : [ 0x5c, ['unsigned char']], + 'NewBuffersLost' : [ 0x5d, ['unsigned char']], + 'Disconnected' : [ 0x5e, ['unsigned char']], + 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], + 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], + 'UserPagesReused' : [ 0x80, ['unsigned long']], + 'Wow' : [ 0x84, ['unsigned char']], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x8, ['_KGUARDED_MUTEX']], + 'NonPagedLock' : [ 0x8, ['unsigned long long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['pointer64', ['pointer64', ['void']]]], + 'PendingFreeDepth' : [ 0x108, ['long']], + 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_KGATE' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x20, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], +} ], + '_DRIVER_EXTENSION' : [ 0x38, { + 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x8, ['pointer64', ['void']]], + 'Count' : [ 0x10, ['unsigned long']], + 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x58, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_KINTERRUPT' : [ 0xa0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], + 'MessageIndex' : [ 0x28, ['unsigned long']], + 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], + 'SpinLock' : [ 0x38, ['unsigned long long']], + 'TickCount' : [ 0x40, ['unsigned long']], + 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], + 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], + 'Vector' : [ 0x58, ['unsigned long']], + 'Irql' : [ 0x5c, ['unsigned char']], + 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], + 'FloatingSave' : [ 0x5e, ['unsigned char']], + 'Connected' : [ 0x5f, ['unsigned char']], + 'Number' : [ 0x60, ['unsigned long']], + 'ShareVector' : [ 0x64, ['unsigned char']], + 'Pad' : [ 0x65, ['array', 3, ['unsigned char']]], + 'Mode' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptActiveHigh', 2: 'InterruptActiveLow'})]], + 'ServiceCount' : [ 0x70, ['unsigned long']], + 'DispatchCount' : [ 0x74, ['unsigned long']], + 'Rsvd1' : [ 0x78, ['unsigned long long']], + 'TrapFrame' : [ 0x80, ['pointer64', ['_KTRAP_FRAME']]], + 'Reserved' : [ 0x88, ['pointer64', ['void']]], + 'DispatchCode' : [ 0x90, ['array', 4, ['unsigned long']]], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x10, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'ObAttributes' : [ 0x0, ['unsigned long']], + 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'GrantedAccess' : [ 0x8, ['unsigned long']], + 'GrantedAccessIndex' : [ 0x8, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0xa, ['unsigned short']], + 'NextFreeTableEntry' : [ 0x8, ['unsigned long']], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x88, { + 'FileName' : [ 0x0, ['pointer64', ['unsigned short']]], + 'BaseName' : [ 0x8, ['pointer64', ['unsigned short']]], + 'RegRootName' : [ 0x10, ['pointer64', ['unsigned short']]], + 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x20, ['unsigned long']], + 'CmHiveFlags' : [ 0x24, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], + 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'HiveMounted' : [ 0x38, ['unsigned char']], + 'ThreadFinished' : [ 0x39, ['unsigned char']], + 'ThreadStarted' : [ 0x3a, ['unsigned char']], + 'Allocate' : [ 0x3b, ['unsigned char']], + 'WinPERequired' : [ 0x3c, ['unsigned char']], + 'StartEvent' : [ 0x40, ['_KEVENT']], + 'FinishedEvent' : [ 0x58, ['_KEVENT']], + 'MountLock' : [ 0x70, ['_KEVENT']], +} ], + '_CONTEXT' : [ 0x4d0, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5Home' : [ 0x20, ['unsigned long long']], + 'P6Home' : [ 0x28, ['unsigned long long']], + 'ContextFlags' : [ 0x30, ['unsigned long']], + 'MxCsr' : [ 0x34, ['unsigned long']], + 'SegCs' : [ 0x38, ['unsigned short']], + 'SegDs' : [ 0x3a, ['unsigned short']], + 'SegEs' : [ 0x3c, ['unsigned short']], + 'SegFs' : [ 0x3e, ['unsigned short']], + 'SegGs' : [ 0x40, ['unsigned short']], + 'SegSs' : [ 0x42, ['unsigned short']], + 'EFlags' : [ 0x44, ['unsigned long']], + 'Dr0' : [ 0x48, ['unsigned long long']], + 'Dr1' : [ 0x50, ['unsigned long long']], + 'Dr2' : [ 0x58, ['unsigned long long']], + 'Dr3' : [ 0x60, ['unsigned long long']], + 'Dr6' : [ 0x68, ['unsigned long long']], + 'Dr7' : [ 0x70, ['unsigned long long']], + 'Rax' : [ 0x78, ['unsigned long long']], + 'Rcx' : [ 0x80, ['unsigned long long']], + 'Rdx' : [ 0x88, ['unsigned long long']], + 'Rbx' : [ 0x90, ['unsigned long long']], + 'Rsp' : [ 0x98, ['unsigned long long']], + 'Rbp' : [ 0xa0, ['unsigned long long']], + 'Rsi' : [ 0xa8, ['unsigned long long']], + 'Rdi' : [ 0xb0, ['unsigned long long']], + 'R8' : [ 0xb8, ['unsigned long long']], + 'R9' : [ 0xc0, ['unsigned long long']], + 'R10' : [ 0xc8, ['unsigned long long']], + 'R11' : [ 0xd0, ['unsigned long long']], + 'R12' : [ 0xd8, ['unsigned long long']], + 'R13' : [ 0xe0, ['unsigned long long']], + 'R14' : [ 0xe8, ['unsigned long long']], + 'R15' : [ 0xf0, ['unsigned long long']], + 'Rip' : [ 0xf8, ['unsigned long long']], + 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], + 'Header' : [ 0x100, ['array', 2, ['_M128A']]], + 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], + 'Xmm0' : [ 0x1a0, ['_M128A']], + 'Xmm1' : [ 0x1b0, ['_M128A']], + 'Xmm2' : [ 0x1c0, ['_M128A']], + 'Xmm3' : [ 0x1d0, ['_M128A']], + 'Xmm4' : [ 0x1e0, ['_M128A']], + 'Xmm5' : [ 0x1f0, ['_M128A']], + 'Xmm6' : [ 0x200, ['_M128A']], + 'Xmm7' : [ 0x210, ['_M128A']], + 'Xmm8' : [ 0x220, ['_M128A']], + 'Xmm9' : [ 0x230, ['_M128A']], + 'Xmm10' : [ 0x240, ['_M128A']], + 'Xmm11' : [ 0x250, ['_M128A']], + 'Xmm12' : [ 0x260, ['_M128A']], + 'Xmm13' : [ 0x270, ['_M128A']], + 'Xmm14' : [ 0x280, ['_M128A']], + 'Xmm15' : [ 0x290, ['_M128A']], + 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], + 'VectorControl' : [ 0x4a0, ['unsigned long long']], + 'DebugControl' : [ 0x4a8, ['unsigned long long']], + 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x18, { + 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x10, { + 'Port' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['pointer64', ['void']]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x20, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], + 'Tag' : [ 0x18, ['unsigned long long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0x98, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x20, ['pointer64', ['void']]], + 'UserLimit' : [ 0x28, ['pointer64', ['void']]], + 'DataUserVa' : [ 0x30, ['pointer64', ['void']]], + 'SystemVa' : [ 0x38, ['pointer64', ['void']]], + 'TotalSize' : [ 0x40, ['unsigned long long']], + 'Header' : [ 0x48, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x50, ['pointer64', ['void']]], + 'ListSize' : [ 0x58, ['unsigned long long']], + 'Bitmap' : [ 0x60, ['pointer64', ['void']]], + 'BitmapSize' : [ 0x68, ['unsigned long long']], + 'Data' : [ 0x70, ['pointer64', ['void']]], + 'DataSize' : [ 0x78, ['unsigned long long']], + 'BitmapLimit' : [ 0x80, ['unsigned long']], + 'BitmapNextHint' : [ 0x84, ['unsigned long']], + 'ConcurrencyCount' : [ 0x88, ['unsigned long']], + 'AttributeFlags' : [ 0x8c, ['unsigned long']], + 'AttributeSize' : [ 0x90, ['unsigned long']], +} ], + '_INTERFACE' : [ 0x20, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_LAZY_WRITER' : [ 0x88, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x40, ['_KTIMER']], + 'ScanActive' : [ 0x80, ['unsigned char']], + 'OtherWork' : [ 0x81, ['unsigned char']], + 'PendingTeardownScan' : [ 0x82, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], + 'PendingPowerScan' : [ 0x85, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x70, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], + 'DataPortMapped' : [ 0x10, ['unsigned char']], + 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], + 'AddrPortMapped' : [ 0x20, ['unsigned char']], + 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], + 'CmdPortMapped' : [ 0x30, ['unsigned char']], + 'NextSlotNumber' : [ 0x34, ['unsigned long']], + 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x60, ['unsigned long']], + 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x10, { + 'Sid' : [ 0x0, ['pointer64', ['void']]], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_IO_WORKITEM' : [ 0x40, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x20, ['pointer64', ['void']]], + 'IoObject' : [ 0x28, ['pointer64', ['void']]], + 'Context' : [ 0x30, ['pointer64', ['void']]], + 'Type' : [ 0x38, ['unsigned long']], +} ], + '_CM_RM' : [ 0x88, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x20, ['pointer64', ['void']]], + 'Tm' : [ 0x28, ['pointer64', ['void']]], + 'RmHandle' : [ 0x30, ['pointer64', ['void']]], + 'KtmRm' : [ 0x38, ['pointer64', ['void']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'ContainerNum' : [ 0x44, ['unsigned long']], + 'ContainerSize' : [ 0x48, ['unsigned long long']], + 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], + 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], + 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], + 'RmFlags' : [ 0x68, ['unsigned long']], + 'LogStartStatus1' : [ 0x6c, ['long']], + 'LogStartStatus2' : [ 0x70, ['long']], + 'BaseLsn' : [ 0x78, ['unsigned long long']], + 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_MMVAD_FLAGS' : [ 0x8, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MMWSLE_HASH' : [ 0x4, { + 'Index' : [ 0x0, ['unsigned long']], +} ], + '_UNEXPECTED_INTERRUPT' : [ 0x10, { + 'PushImmOp' : [ 0x0, ['unsigned char']], + 'PushImm' : [ 0x1, ['unsigned long']], + 'PushRbp' : [ 0x5, ['unsigned char']], + 'JmpOp' : [ 0x6, ['unsigned char']], + 'JmpOffset' : [ 0x7, ['long']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x30, { + 'AllocAddress' : [ 0x0, ['unsigned long long']], + 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x10, ['unsigned long long']], + 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x20, ['unsigned long long']], + 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], + 'CallCount' : [ 0x20, ['unsigned long']], +} ], + '_VF_TRACKER_STAMP' : [ 0x10, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'OldIrql' : [ 0x8, ['unsigned char']], + 'NewIrql' : [ 0x9, ['unsigned char']], + 'Processor' : [ 0xa, ['unsigned short']], + 'TickCount' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0x90, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x10, ['unsigned long']], + 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], + 'Data' : [ 0x40, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_NLS_DATA_BLOCK' : [ 0x18, { + 'AnsiCodePageData' : [ 0x0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0x8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0x10, ['pointer64', ['void']]], +} ], + '_ALIGNED_AFFINITY_SUMMARY' : [ 0x80, { + 'CpuSet' : [ 0x0, ['_KAFFINITY_EX']], + 'SMTSet' : [ 0x28, ['_KAFFINITY_EX']], +} ], + '_XSTATE_CONFIGURATION' : [ 0x210, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x38, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x18, ['unsigned long']], + 'RealRefCount' : [ 0x1c, ['unsigned long']], + 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'InStore' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_RTL_UMS_CONTEXT' : [ 0x540, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Context' : [ 0x10, ['_CONTEXT']], + 'Teb' : [ 0x4e0, ['pointer64', ['void']]], + 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HasQuantumReq' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HasAffinityReq' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HasPriorityReq' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4f0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0x4f0, ['long']], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x4f8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], + 'ContextLock' : [ 0x4f8, ['unsigned long long']], + 'QuantumValue' : [ 0x500, ['unsigned long long']], + 'AffinityMask' : [ 0x508, ['_GROUP_AFFINITY']], + 'Priority' : [ 0x518, ['long']], + 'PrimaryUmsContext' : [ 0x520, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'SwitchCount' : [ 0x528, ['unsigned long']], + 'KernelYieldCount' : [ 0x52c, ['unsigned long']], + 'MixedYieldCount' : [ 0x530, ['unsigned long']], + 'YieldCount' : [ 0x534, ['unsigned long']], +} ], + '_CM_RESOURCE_LIST' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x28, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['long']], + 'NonPagedFrees' : [ 0x8, ['long']], + 'NonPagedBytes' : [ 0x10, ['unsigned long long']], + 'PagedAllocs' : [ 0x18, ['unsigned long']], + 'PagedFrees' : [ 0x1c, ['unsigned long']], + 'PagedBytes' : [ 0x20, ['unsigned long long']], +} ], + '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { + 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], + 'NodeHint' : [ 0x30, ['pointer64', ['void']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'Padding0' : [ 0x20, ['array', 2, ['unsigned long']]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer64', ['void']]], + 'Pointer1' : [ 0x40, ['pointer64', ['void']]], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x100, { + 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], + 'IdleTimeLast' : [ 0x8, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x10, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x18, ['unsigned long long']], + 'IdleAccounting' : [ 0x20, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], + 'Hypervisor' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower'})]], + 'PerfHistoryTotal' : [ 0x2c, ['unsigned long']], + 'ThermalConstraint' : [ 0x30, ['unsigned char']], + 'PerfHistoryCount' : [ 0x31, ['unsigned char']], + 'PerfHistorySlot' : [ 0x32, ['unsigned char']], + 'Reserved' : [ 0x33, ['unsigned char']], + 'LastSysTime' : [ 0x34, ['unsigned long']], + 'WmiDispatchPtr' : [ 0x38, ['unsigned long long']], + 'WmiInterfaceEnabled' : [ 0x40, ['long']], + 'FFHThrottleStateInfo' : [ 0x48, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0x68, ['_KDPC']], + 'PerfActionMask' : [ 0xa8, ['long']], + 'IdleCheck' : [ 0xb0, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0xc0, ['_PROC_IDLE_SNAP']], + 'Domain' : [ 0xd0, ['pointer64', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0xd8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'Load' : [ 0xe0, ['pointer64', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0xe8, ['pointer64', ['_PROC_HISTORY_ENTRY']]], + 'Utility' : [ 0xf0, ['unsigned long']], + 'OverUtilizedHistory' : [ 0xf4, ['unsigned long']], + 'AffinityCount' : [ 0xf8, ['unsigned long']], + 'AffinityHistory' : [ 0xfc, ['unsigned long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_SEGMENT_OBJECT' : [ 0x40, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['_LARGE_INTEGER']], + 'NonExtendedPtes' : [ 0x18, ['unsigned long']], + 'ImageCommitment' : [ 0x1c, ['unsigned long']], + 'ControlArea' : [ 0x20, ['pointer64', ['_CONTROL_AREA']]], + 'Subsection' : [ 0x28, ['pointer64', ['_SUBSECTION']]], + 'MmSectionFlags' : [ 0x30, ['pointer64', ['_MMSECTION_FLAGS']]], + 'MmSubSectionFlags' : [ 0x38, ['pointer64', ['_MMSUBSECTION_FLAGS']]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x28, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], + 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0x18, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], + 'DataLength' : [ 0x10, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], +} ], + '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], + 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], + 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], + 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], + 'LoaderFlags' : [ 0x68, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], + 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'ActiveCount' : [ 0xc, ['unsigned long']], + 'PendingNullCount' : [ 0x10, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], + 'PendingDelete' : [ 0x18, ['unsigned long']], + 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], + 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_TERMINATION_PORT' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], + 'Port' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderReserve', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderMaximum'})]], + 'BasePage' : [ 0x18, ['unsigned long long']], + 'PageCount' : [ 0x20, ['unsigned long long']], +} ], + '_CM_INTENT_LOCK' : [ 0x10, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x2c0, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'BucketLimits' : [ 0x18, ['array', 16, ['unsigned long long']]], + 'State' : [ 0x98, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['unsigned long long']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], +} ], + '_TEB64' : [ 0x1818, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'SystemReserved1' : [ 0x110, ['array', 54, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'SpareBytes' : [ 0x2d0, ['array', 24, ['unsigned char']]], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'EtwLocalData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'SoftPatchPtr1' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'SpareUlong0' : [ 0x180c, ['unsigned long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0xa0, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long long']], + 'NonPagedBytes' : [ 0x58, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], + 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], + 'SessionTrims' : [ 0x74, ['unsigned long']], + 'OptionChanges' : [ 0x78, ['unsigned long']], + 'VerifyMode' : [ 0x7c, ['unsigned long']], + 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], + 'ActivityCounter' : [ 0x90, ['unsigned long']], + 'PreviousActivityCounter' : [ 0x94, ['unsigned long']], + 'WorkerTrimRequests' : [ 0x98, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_OWNER_ENTRY' : [ 0x10, { + 'OwnerThread' : [ 0x0, ['unsigned long long']], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x8, ['unsigned long']], +} ], + '_ETIMER' : [ 0x110, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'TimerApc' : [ 0x40, ['_KAPC']], + 'TimerDpc' : [ 0x98, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Lock' : [ 0xe8, ['unsigned long long']], + 'Period' : [ 0xf0, ['long']], + 'ApcAssociated' : [ 0xf4, ['unsigned char']], + 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], +} ], + '_FREE_DISPLAY' : [ 0x18, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + '_POOL_BLOCK_HEAD' : [ 0x20, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'List' : [ 0x10, ['_LIST_ENTRY']], +} ], + '__unnamed_1e83' : [ 0x8, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'StartVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x10, { + 'u1' : [ 0x0, ['__unnamed_1e83']], + 'EndVa' : [ 0x8, ['pointer64', ['void']]], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_ARBITER_INSTANCE' : [ 0x698, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], + 'Name' : [ 0x10, ['pointer64', ['unsigned short']]], + 'OrderingName' : [ 0x18, ['pointer64', ['unsigned short']]], + 'ResourceType' : [ 0x20, ['long']], + 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x58, ['long']], + 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], + 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], + 'PackResource' : [ 0x80, ['pointer64', ['void']]], + 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], + 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], + 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], + 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], + 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], + 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], + 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], + 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], + 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], + 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], + 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], + 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], + 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], + 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], + 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], + 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], + 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], + 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], + 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], + 'TransactionInProgress' : [ 0x120, ['unsigned char']], + 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], + 'Extension' : [ 0x130, ['pointer64', ['void']]], + 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], + 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], + 'PdoDescriptionString' : [ 0x150, ['array', 336, ['wchar']]], + 'PdoSymbolicNameString' : [ 0x3f0, ['array', 672, ['unsigned char']]], + 'PdoAddressString' : [ 0x690, ['array', 1, ['wchar']]], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x10, ['unsigned long']], + 'Inserted' : [ 0x14, ['unsigned char']], +} ], + '__unnamed_1edc' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1ede' : [ 0x8, { + 'Last' : [ 0x0, ['unsigned long']], + 'u' : [ 0x4, ['__unnamed_1edc']], +} ], + '__unnamed_1ee0' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_1edc']], +} ], + '__unnamed_1ee2' : [ 0x8, { + 'OldCell' : [ 0x0, ['__unnamed_1ede']], + 'NewCell' : [ 0x0, ['__unnamed_1ee0']], +} ], + '_HCELL' : [ 0xc, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_1ee2']], +} ], + '_HMAP_TABLE' : [ 0x4000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x30, { + 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], + 'PerfContext' : [ 0x8, ['unsigned long long']], + 'PercentageCap' : [ 0x10, ['unsigned long']], + 'ThermalCap' : [ 0x14, ['unsigned long']], + 'TargetFrequency' : [ 0x18, ['unsigned long']], + 'AcumulatedFullFrequency' : [ 0x1c, ['unsigned long']], + 'AcumulatedZeroFrequency' : [ 0x20, ['unsigned long']], + 'FrequencyHistoryTotal' : [ 0x24, ['unsigned long']], + 'AverageFrequency' : [ 0x28, ['unsigned long']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x20, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x10, ['long']], + 'Misses' : [ 0x14, ['unsigned long']], + 'MissesLast' : [ 0x18, ['unsigned long']], + 'Pad0' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_1ef7' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1efb' : [ 0x18, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_1efd' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1eff' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_1f01' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1f03' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1f05' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1f07' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1f09' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1f0b' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_1ef7']], + 'Memory' : [ 0x0, ['__unnamed_1ef7']], + 'Interrupt' : [ 0x0, ['__unnamed_1efb']], + 'Dma' : [ 0x0, ['__unnamed_1efd']], + 'Generic' : [ 0x0, ['__unnamed_1ef7']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1eff']], + 'BusNumber' : [ 0x0, ['__unnamed_1f01']], + 'ConfigData' : [ 0x0, ['__unnamed_1f03']], + 'Memory40' : [ 0x0, ['__unnamed_1f05']], + 'Memory48' : [ 0x0, ['__unnamed_1f07']], + 'Memory64' : [ 0x0, ['__unnamed_1f09']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_1f0b']], +} ], + '_POP_THERMAL_ZONE' : [ 0x1e8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'State' : [ 0x10, ['unsigned char']], + 'Flags' : [ 0x11, ['unsigned char']], + 'Mode' : [ 0x12, ['unsigned char']], + 'PendingMode' : [ 0x13, ['unsigned char']], + 'ActivePoint' : [ 0x14, ['unsigned char']], + 'PendingActivePoint' : [ 0x15, ['unsigned char']], + 'Throttle' : [ 0x18, ['long']], + 'LastTime' : [ 0x20, ['unsigned long long']], + 'SampleRate' : [ 0x28, ['unsigned long']], + 'LastTemp' : [ 0x2c, ['unsigned long']], + 'PassiveTimer' : [ 0x30, ['_KTIMER']], + 'PassiveDpc' : [ 0x70, ['_KDPC']], + 'OverThrottled' : [ 0xb0, ['_POP_ACTION_TRIGGER']], + 'Irp' : [ 0xc8, ['pointer64', ['_IRP']]], + 'Info' : [ 0xd0, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0x148, ['_LARGE_INTEGER']], + 'Metrics' : [ 0x150, ['_POP_THERMAL_ZONE_METRICS']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0x18, { + 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], + 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x48, ['unsigned long']], + 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_CM_WORKITEM' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x10, ['unsigned long']], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Parameter' : [ 0x20, ['pointer64', ['void']]], +} ], + '_POP_THERMAL_ZONE_METRICS' : [ 0x98, { + 'MetricsResource' : [ 0x0, ['_ERESOURCE']], + 'ActiveCount' : [ 0x68, ['unsigned long']], + 'PassiveCount' : [ 0x6c, ['unsigned long']], + 'LastActiveStartTick' : [ 0x70, ['_LARGE_INTEGER']], + 'AverageActiveTime' : [ 0x78, ['_LARGE_INTEGER']], + 'LastPassiveStartTick' : [ 0x80, ['_LARGE_INTEGER']], + 'AveragePassiveTime' : [ 0x88, ['_LARGE_INTEGER']], + 'StartTickSinceLastReset' : [ 0x90, ['_LARGE_INTEGER']], +} ], + '_CM_TRANS' : [ 0xa8, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x30, ['pointer64', ['void']]], + 'CmRm' : [ 0x38, ['pointer64', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x40, ['pointer64', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x48, ['pointer64', ['void']]], + 'KtmUow' : [ 0x50, ['_GUID']], + 'StartLsn' : [ 0x60, ['unsigned long long']], + 'TransState' : [ 0x68, ['unsigned long']], + 'HiveCount' : [ 0x6c, ['unsigned long']], + 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x20, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Count' : [ 0x14, ['unsigned long']], + 'Stamp' : [ 0x18, ['unsigned long']], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x40, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ProbeMode' : [ 0x10, ['unsigned char']], + 'PagedPoolCharge' : [ 0x14, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'Flags' : [ 0x28, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], + 'SpareUSHORT' : [ 0x2e, ['unsigned short']], +} ], + '_POOL_HACKER' : [ 0x30, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'Contents' : [ 0x10, ['array', 8, ['unsigned long']]], +} ], + '_DISALLOWED_GUIDS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x10, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0x18, { + 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], + 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1c, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1b, ['unsigned char']], +} ], + '__unnamed_1f48' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1f4a' : [ 0x18, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_1f48']], +} ], + '_VF_TARGET_DRIVER' : [ 0x30, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x10, ['__unnamed_1f4a']], + 'VerifiedData' : [ 0x28, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '__unnamed_1f52' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f54' : [ 0x2, { + 'DeviceIds' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f56' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f58' : [ 0x10, { + 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], + 'DeviceIds' : [ 0x8, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f5a' : [ 0x8, { + 'Notification' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1f5c' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1f5e' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f60' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_1f62' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f64' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_1f66' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_1f52']], + 'TargetDevice' : [ 0x0, ['__unnamed_1f54']], + 'InstallDevice' : [ 0x0, ['__unnamed_1f56']], + 'CustomNotification' : [ 0x0, ['__unnamed_1f58']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1f5a']], + 'PowerNotification' : [ 0x0, ['__unnamed_1f5c']], + 'VetoNotification' : [ 0x0, ['__unnamed_1f5e']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1f60']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_1f62']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_1f64']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_1f56']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], + 'u' : [ 0x30, ['__unnamed_1f66']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x10, ['unsigned long']], + 'Unloads' : [ 0x14, ['unsigned long']], + 'BaseName' : [ 0x18, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], + 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], +} ], + '_MBCB' : [ 0xc0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x20, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], + 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], +} ], + '_PS_CPU_QUOTA_BLOCK' : [ 0x4080, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x10, ['unsigned long']], + 'CpuShareWeight' : [ 0x14, ['unsigned long']], + 'CapturedWeightData' : [ 0x18, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], + 'DuplicateInputMarker' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x20, ['long']], + 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long long']], + 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], + 'CycleCredit' : [ 0x40, ['unsigned long long']], + 'BlockCurrentGeneration' : [ 0x48, ['unsigned long']], + 'CpuCyclePercent' : [ 0x4c, ['unsigned long']], + 'CyclesFinishedForCurrentGeneration' : [ 0x50, ['unsigned char']], + 'Cpu' : [ 0x80, ['array', 256, ['_PS_PER_CPU_QUOTA_CACHE_AWARE']]], +} ], + '__unnamed_1f82' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_1f82']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x8, ['unsigned long long']], + 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x28, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x18, ['unsigned long long']], + 'Busy' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], + 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], + 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], + 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], + 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], + 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], + 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], + 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], +} ], + '__unnamed_1fb7' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '_SUBSECTION' : [ 0x38, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'PtesInSubsection' : [ 0x18, ['unsigned long']], + 'UnusedPtes' : [ 0x20, ['unsigned long']], + 'GlobalPerSessionHead' : [ 0x20, ['pointer64', ['_MM_AVL_TABLE']]], + 'u' : [ 0x28, ['__unnamed_1fb7']], + 'StartingSector' : [ 0x2c, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x30, ['unsigned long']], +} ], + '_KPROCESSOR_STATE' : [ 0x5b0, { + 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], + 'ContextFrame' : [ 0xe0, ['_CONTEXT']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x10, { + 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], +} ], + '_PS_PER_CPU_QUOTA_CACHE_AWARE' : [ 0x40, { + 'SortedListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'IdleOnlyListHead' : [ 0x10, ['_LIST_ENTRY']], + 'CycleBaseAllowance' : [ 0x20, ['unsigned long long']], + 'CyclesRemaining' : [ 0x28, ['long long']], + 'CurrentGeneration' : [ 0x30, ['unsigned long']], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x28, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'StackLimit' : [ 0x8, ['unsigned long long']], + 'KernelStack' : [ 0x10, ['unsigned long long']], + 'InitialStack' : [ 0x18, ['unsigned long long']], + 'ActualLimit' : [ 0x20, ['unsigned long long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x20, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Parameter' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x50, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x30, ['unsigned long']], + 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x40, ['unsigned short']], + 'RangeAttributes' : [ 0x42, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], + 'WorkSpace' : [ 0x48, ['unsigned long long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_REQUEST_MAILBOX' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x8, ['long long']], + 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_INTERLOCK_SEQ' : [ 0x8, { + 'Depth' : [ 0x0, ['unsigned short']], + 'FreeEntryOffset' : [ 0x2, ['unsigned short']], + 'OffsetAndDepth' : [ 0x0, ['unsigned long']], + 'Sequence' : [ 0x4, ['unsigned long']], + 'Exchg' : [ 0x0, ['long long']], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_PEB32' : [ 0x248, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['unsigned long']], + 'ImageBaseAddress' : [ 0x8, ['unsigned long']], + 'Ldr' : [ 0xc, ['unsigned long']], + 'ProcessParameters' : [ 0x10, ['unsigned long']], + 'SubSystemData' : [ 0x14, ['unsigned long']], + 'ProcessHeap' : [ 0x18, ['unsigned long']], + 'FastPebLock' : [ 0x1c, ['unsigned long']], + 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], + 'IFEOKey' : [ 0x24, ['unsigned long']], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], + 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['unsigned long']], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['unsigned long']], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], + 'HotpatchInformation' : [ 0x50, ['unsigned long']], + 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], + 'AnsiCodePageData' : [ 0x58, ['unsigned long']], + 'OemCodePageData' : [ 0x5c, ['unsigned long']], + 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['unsigned long']], + 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], + 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['unsigned long']], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], + 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['unsigned long']], + 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], + 'CSDVersion' : [ 0x1f0, ['_STRING32']], + 'ActivationContextData' : [ 0x1f8, ['unsigned long']], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], + 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], + 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['unsigned long']], + 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], + 'FlsBitmap' : [ 0x218, ['unsigned long']], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['unsigned long']], + 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], + 'pContextData' : [ 0x238, ['unsigned long']], + 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_VPB' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], +} diff --git a/volatility/plugins/overlays/windows/win7_sp1_x86_BBA98F40_vtypes.py b/volatility/plugins/overlays/windows/win7_sp1_x86_BBA98F40_vtypes.py new file mode 100755 index 000000000..3e1ad6dcb --- /dev/null +++ b/volatility/plugins/overlays/windows/win7_sp1_x86_BBA98F40_vtypes.py @@ -0,0 +1,8842 @@ +ntkrnlmp_types = { + '_CONFIGURATION_COMPONENT_DATA' : [ 0x34, { + 'Parent' : [ 0x0, ['pointer', ['_CONFIGURATION_COMPONENT_DATA']]], + 'Child' : [ 0x4, ['pointer', ['_CONFIGURATION_COMPONENT_DATA']]], + 'Sibling' : [ 0x8, ['pointer', ['_CONFIGURATION_COMPONENT_DATA']]], + 'ComponentEntry' : [ 0xc, ['_CONFIGURATION_COMPONENT']], + 'ConfigurationData' : [ 0x30, ['pointer', ['void']]], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2005' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], + 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], +} ], + '_MMSUBSECTION_NODE' : [ 0x18, { + 'u' : [ 0x0, ['__unnamed_1f77']], + 'StartingSector' : [ 0x4, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x8, ['unsigned long']], + 'u1' : [ 0xc, ['__unnamed_2005']], + 'LeftChild' : [ 0x10, ['pointer', ['_MMSUBSECTION_NODE']]], + 'RightChild' : [ 0x14, ['pointer', ['_MMSUBSECTION_NODE']]], +} ], + '_VF_AVL_TREE_NODE' : [ 0x8, { + 'p' : [ 0x0, ['pointer', ['void']]], + 'RangeSize' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_200d' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_200f' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_200d']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x40, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x1c, ['_LIST_ENTRY']], + 'IdleType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'Volume' : [ 0x30, ['_LIST_ENTRY']], + 'Specific' : [ 0x38, ['__unnamed_200f']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x38, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0xc, ['pointer', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x10, ['pointer', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x14, ['pointer', ['void']]], + 'PreAcquireForCcFlush' : [ 0x18, ['pointer', ['void']]], + 'PostAcquireForCcFlush' : [ 0x1c, ['pointer', ['void']]], + 'PreReleaseForCcFlush' : [ 0x20, ['pointer', ['void']]], + 'PostReleaseForCcFlush' : [ 0x24, ['pointer', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x28, ['pointer', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x2c, ['pointer', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x30, ['pointer', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x34, ['pointer', ['void']]], +} ], + '_KENLISTMENT' : [ 0x168, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x4, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x18, ['_GUID']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NextSameTx' : [ 0x48, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x50, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x58, ['pointer', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0x5c, ['pointer', ['_KTRANSACTION']]], + 'State' : [ 0x60, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0x64, ['unsigned long']], + 'NotificationMask' : [ 0x68, ['unsigned long']], + 'Key' : [ 0x6c, ['pointer', ['void']]], + 'KeyRefCount' : [ 0x70, ['unsigned long']], + 'RecoveryInformation' : [ 0x74, ['pointer', ['void']]], + 'RecoveryInformationLength' : [ 0x78, ['unsigned long']], + 'DynamicNameInformation' : [ 0x7c, ['pointer', ['void']]], + 'DynamicNameInformationLength' : [ 0x80, ['unsigned long']], + 'FinalNotification' : [ 0x84, ['pointer', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0x88, ['pointer', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0x8c, ['pointer', ['void']]], + 'SubordinateTxHandle' : [ 0x90, ['pointer', ['void']]], + 'CrmEnlistmentEnId' : [ 0x94, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0xa4, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0xb4, ['_GUID']], + 'NextHistory' : [ 0xc4, ['unsigned long']], + 'History' : [ 0xc8, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ArbiterHandler' : [ 0x10, ['pointer', ['void']]], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_KAPC_STATE' : [ 0x18, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x10, ['pointer', ['_KPROCESS']]], + 'KernelApcInProgress' : [ 0x14, ['unsigned char']], + 'KernelApcPending' : [ 0x15, ['unsigned char']], + 'UserApcPending' : [ 0x16, ['unsigned char']], +} ], + '_IA64_LOADER_BLOCK' : [ 0x4, { + 'PlaceHolder' : [ 0x0, ['unsigned long']], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x4, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x300, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x80, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x88, ['unsigned long']], + 'LastCallbackId' : [ 0x8c, ['unsigned long']], + 'PostCount' : [ 0x100, ['unsigned long']], + 'ReturnCount' : [ 0x180, ['unsigned long']], + 'LogSequenceNumber' : [ 0x200, ['unsigned long']], + 'UserLock' : [ 0x280, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x288, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_DEVICE_MAP' : [ 0x34, { + 'DosDevicesDirectory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x4, ['pointer', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x8, ['pointer', ['void']]], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DriveMap' : [ 0x10, ['unsigned long']], + 'DriveType' : [ 0x14, ['array', 32, ['unsigned char']]], +} ], + '_HEAP_DEBUGGING_INFORMATION' : [ 0x1c, { + 'InterceptorFunction' : [ 0x0, ['pointer', ['void']]], + 'InterceptorValue' : [ 0x4, ['unsigned short']], + 'ExtendedOptions' : [ 0x8, ['unsigned long']], + 'StackTraceDepth' : [ 0xc, ['unsigned long']], + 'MinTotalBlockSize' : [ 0x10, ['unsigned long']], + 'MaxTotalBlockSize' : [ 0x14, ['unsigned long']], + 'HeapLeakEnumerationRoutine' : [ 0x18, ['pointer', ['void']]], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_MMBANKED_SECTION' : [ 0x20, { + 'BasePhysicalPage' : [ 0x0, ['unsigned long']], + 'BasedPte' : [ 0x4, ['pointer', ['_MMPTE']]], + 'BankSize' : [ 0x8, ['unsigned long']], + 'BankShift' : [ 0xc, ['unsigned long']], + 'BankedRoutine' : [ 0x10, ['pointer', ['void']]], + 'Context' : [ 0x14, ['pointer', ['void']]], + 'CurrentMappedPte' : [ 0x18, ['pointer', ['_MMPTE']]], + 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['array', 7, ['unsigned long long']]], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x20, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x8, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x10, ['unsigned long']], + 'ReserveSize' : [ 0x14, ['unsigned long']], + 'BusyBlock' : [ 0x18, ['_HEAP_ENTRY']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'Context' : [ 0xc, ['pointer', ['void']]], + 'CompletionState' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x14, ['unsigned long']], + 'Status' : [ 0x18, ['long']], + 'Information' : [ 0x1c, ['pointer', ['void']]], + 'WorkItem' : [ 0x20, ['_WORK_QUEUE_ITEM']], + 'FailingDriver' : [ 0x30, ['pointer', ['_DRIVER_OBJECT']]], + 'ReferenceCount' : [ 0x34, ['long']], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x28, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DeviceRoutine' : [ 0x10, ['pointer', ['void']]], + 'DeviceContext' : [ 0x14, ['pointer', ['void']]], + 'NumberOfMapRegisters' : [ 0x18, ['unsigned long']], + 'DeviceObject' : [ 0x1c, ['pointer', ['void']]], + 'CurrentIrp' : [ 0x20, ['pointer', ['void']]], + 'BufferChainingDpc' : [ 0x24, ['pointer', ['_KDPC']]], +} ], + '_SECTION_OBJECT' : [ 0x18, { + 'StartingVa' : [ 0x0, ['pointer', ['void']]], + 'EndingVa' : [ 0x4, ['pointer', ['void']]], + 'Parent' : [ 0x8, ['pointer', ['void']]], + 'LeftChild' : [ 0xc, ['pointer', ['void']]], + 'RightChild' : [ 0x10, ['pointer', ['void']]], + 'Segment' : [ 0x14, ['pointer', ['_SEGMENT_OBJECT']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x10, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x4, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0xc, ['unsigned short']], + 'Name' : [ 0xe, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x48, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0xc, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_208d' : [ 0x4, { + 'AsULONG' : [ 0x0, ['unsigned long']], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_PERF_STATES' : [ 0x80, { + 'Count' : [ 0x0, ['unsigned long']], + 'MaxFrequency' : [ 0x4, ['unsigned long']], + 'PStateCap' : [ 0x8, ['unsigned long']], + 'TStateCap' : [ 0xc, ['unsigned long']], + 'MaxPerfState' : [ 0x10, ['unsigned long']], + 'MinPerfState' : [ 0x14, ['unsigned long']], + 'LowestPState' : [ 0x18, ['unsigned long']], + 'IncreaseTime' : [ 0x1c, ['unsigned long']], + 'DecreaseTime' : [ 0x20, ['unsigned long']], + 'BusyAdjThreshold' : [ 0x24, ['unsigned char']], + 'Reserved' : [ 0x25, ['unsigned char']], + 'ThrottleStatesOnly' : [ 0x26, ['unsigned char']], + 'PolicyType' : [ 0x27, ['unsigned char']], + 'TimerInterval' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['__unnamed_208d']], + 'TargetProcessors' : [ 0x30, ['_KAFFINITY_EX']], + 'PStateHandler' : [ 0x3c, ['pointer', ['void']]], + 'PStateContext' : [ 0x40, ['unsigned long']], + 'TStateHandler' : [ 0x44, ['pointer', ['void']]], + 'TStateContext' : [ 0x48, ['unsigned long']], + 'FeedbackHandler' : [ 0x4c, ['pointer', ['void']]], + 'GetFFHThrottleState' : [ 0x50, ['pointer', ['void']]], + 'State' : [ 0x58, ['array', 1, ['_PPM_PERF_STATE']]], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x30, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'LastTotalAllocates' : [ 0x1c, ['unsigned long']], + 'LastAllocateMisses' : [ 0x20, ['unsigned long']], + 'Counters' : [ 0x24, ['array', 2, ['unsigned long']]], +} ], + '_WMI_TRACE_PACKET' : [ 0x4, { + 'Size' : [ 0x0, ['unsigned short']], + 'HookId' : [ 0x2, ['unsigned short']], + 'Type' : [ 0x2, ['unsigned char']], + 'Group' : [ 0x3, ['unsigned char']], +} ], + '_KTIMER' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x10, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Dpc' : [ 0x20, ['pointer', ['_KDPC']]], + 'Period' : [ 0x24, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x44, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CriticalSection' : [ 0x4, ['_RTL_CRITICAL_SECTION']], + 'RtlHandleTable' : [ 0x1c, ['_RTL_HANDLE_TABLE']], + 'NumberOfBuckets' : [ 0x3c, ['unsigned long']], + 'Buckets' : [ 0x40, ['array', 1, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '_POP_POWER_ACTION' : [ 0xb0, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x34, ['pointer', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x38, ['pointer', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x40, ['unsigned long long']], + 'SleepTime' : [ 0x48, ['unsigned long long']], + 'ProgrammedRTCTime' : [ 0x50, ['unsigned long long']], + 'WakeOnRTC' : [ 0x58, ['unsigned char']], + 'WakeTimerInfo' : [ 0x5c, ['pointer', ['_DIAGNOSTIC_BUFFER']]], + 'FilteredCapabilities' : [ 0x60, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x3c, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x8, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x10, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x1c, ['unsigned char']], + 'DeviceObject' : [ 0x20, ['pointer', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x24, ['pointer', ['unsigned short']]], + 'DriverName' : [ 0x28, ['pointer', ['unsigned short']]], + 'ChildCount' : [ 0x2c, ['unsigned long']], + 'ActiveChild' : [ 0x30, ['unsigned long']], + 'ParentCount' : [ 0x34, ['unsigned long']], + 'ActiveParent' : [ 0x38, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x8, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x24, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0xc, ['pointer', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x10, ['_FS_FILTER_PARAMETERS']], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x228, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTransitions' : [ 0x8, ['unsigned long']], + 'FailedTransitions' : [ 0xc, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x10, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'IdleTimeBuckets' : [ 0x28, ['array', 16, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { + 'PageHashes' : [ 0x0, ['pointer', ['void']]], + 'Value' : [ 0x0, ['unsigned long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_20d0' : [ 0x4, { + 'Level' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_20d2' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x10, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0xc, ['__unnamed_20d0']], + 'Button' : [ 0xc, ['__unnamed_20d2']], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0x70, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x4, ['pointer', ['void']]], + 'FastIoRead' : [ 0x8, ['pointer', ['void']]], + 'FastIoWrite' : [ 0xc, ['pointer', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x10, ['pointer', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x14, ['pointer', ['void']]], + 'FastIoLock' : [ 0x18, ['pointer', ['void']]], + 'FastIoUnlockSingle' : [ 0x1c, ['pointer', ['void']]], + 'FastIoUnlockAll' : [ 0x20, ['pointer', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x24, ['pointer', ['void']]], + 'FastIoDeviceControl' : [ 0x28, ['pointer', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x2c, ['pointer', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x30, ['pointer', ['void']]], + 'FastIoDetachDevice' : [ 0x34, ['pointer', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x38, ['pointer', ['void']]], + 'AcquireForModWrite' : [ 0x3c, ['pointer', ['void']]], + 'MdlRead' : [ 0x40, ['pointer', ['void']]], + 'MdlReadComplete' : [ 0x44, ['pointer', ['void']]], + 'PrepareMdlWrite' : [ 0x48, ['pointer', ['void']]], + 'MdlWriteComplete' : [ 0x4c, ['pointer', ['void']]], + 'FastIoReadCompressed' : [ 0x50, ['pointer', ['void']]], + 'FastIoWriteCompressed' : [ 0x54, ['pointer', ['void']]], + 'MdlReadCompleteCompressed' : [ 0x58, ['pointer', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0x5c, ['pointer', ['void']]], + 'FastIoQueryOpen' : [ 0x60, ['pointer', ['void']]], + 'ReleaseForModWrite' : [ 0x64, ['pointer', ['void']]], + 'AcquireForCcFlush' : [ 0x68, ['pointer', ['void']]], + 'ReleaseForCcFlush' : [ 0x6c, ['pointer', ['void']]], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0xc, { + 'ChainLink' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'HashValue' : [ 0x8, ['unsigned long']], +} ], + '_LOADER_PARAMETER_EXTENSION' : [ 0xe8, { + 'Size' : [ 0x0, ['unsigned long']], + 'Profile' : [ 0x4, ['_PROFILE_PARAMETER_BLOCK']], + 'EmInfFileImage' : [ 0x14, ['pointer', ['void']]], + 'EmInfFileSize' : [ 0x18, ['unsigned long']], + 'TriageDumpBlock' : [ 0x1c, ['pointer', ['void']]], + 'LoaderPagesSpanned' : [ 0x20, ['unsigned long']], + 'HeadlessLoaderBlock' : [ 0x24, ['pointer', ['_HEADLESS_LOADER_BLOCK']]], + 'SMBiosEPSHeader' : [ 0x28, ['pointer', ['_SMBIOS_TABLE_HEADER']]], + 'DrvDBImage' : [ 0x2c, ['pointer', ['void']]], + 'DrvDBSize' : [ 0x30, ['unsigned long']], + 'NetworkLoaderBlock' : [ 0x34, ['pointer', ['_NETWORK_LOADER_BLOCK']]], + 'HalpIRQLToTPR' : [ 0x38, ['pointer', ['unsigned char']]], + 'HalpVectorToIRQL' : [ 0x3c, ['pointer', ['unsigned char']]], + 'FirmwareDescriptorListHead' : [ 0x40, ['_LIST_ENTRY']], + 'AcpiTable' : [ 0x48, ['pointer', ['void']]], + 'AcpiTableSize' : [ 0x4c, ['unsigned long']], + 'LastBootSucceeded' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'LoaderPerformanceData' : [ 0x54, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], + 'BootApplicationPersistentData' : [ 0x58, ['_LIST_ENTRY']], + 'WmdTestResult' : [ 0x60, ['pointer', ['void']]], + 'BootIdentifier' : [ 0x64, ['_GUID']], + 'ResumePages' : [ 0x74, ['unsigned long']], + 'DumpHeader' : [ 0x78, ['pointer', ['void']]], + 'BgContext' : [ 0x7c, ['pointer', ['void']]], + 'NumaLocalityInfo' : [ 0x80, ['pointer', ['void']]], + 'NumaGroupAssignment' : [ 0x84, ['pointer', ['void']]], + 'AttachedHives' : [ 0x88, ['_LIST_ENTRY']], + 'MemoryCachingRequirementsCount' : [ 0x90, ['unsigned long']], + 'MemoryCachingRequirements' : [ 0x94, ['pointer', ['void']]], + 'TpmBootEntropyResult' : [ 0x98, ['_TPM_BOOT_ENTROPY_LDR_RESULT']], + 'ProcessorCounterFrequency' : [ 0xe0, ['unsigned long long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x38, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x8, ['unsigned char']], + 'ArbiterInterface' : [ 0xc, ['pointer', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x10, ['pointer', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x1c, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x24, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x2c, ['_LIST_ENTRY']], + 'State' : [ 0x34, ['unsigned char']], + 'ResourcesChanged' : [ 0x35, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['pointer', ['void']]], + 'Group' : [ 0x8, ['pointer', ['void']]], + 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], + 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x298, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer', ['void']]], + 'ConsoleFlags' : [ 0x14, ['unsigned long']], + 'StandardInput' : [ 0x18, ['pointer', ['void']]], + 'StandardOutput' : [ 0x1c, ['pointer', ['void']]], + 'StandardError' : [ 0x20, ['pointer', ['void']]], + 'CurrentDirectory' : [ 0x24, ['_CURDIR']], + 'DllPath' : [ 0x30, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x38, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x40, ['_UNICODE_STRING']], + 'Environment' : [ 0x48, ['pointer', ['void']]], + 'StartingX' : [ 0x4c, ['unsigned long']], + 'StartingY' : [ 0x50, ['unsigned long']], + 'CountX' : [ 0x54, ['unsigned long']], + 'CountY' : [ 0x58, ['unsigned long']], + 'CountCharsX' : [ 0x5c, ['unsigned long']], + 'CountCharsY' : [ 0x60, ['unsigned long']], + 'FillAttribute' : [ 0x64, ['unsigned long']], + 'WindowFlags' : [ 0x68, ['unsigned long']], + 'ShowWindowFlags' : [ 0x6c, ['unsigned long']], + 'WindowTitle' : [ 0x70, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0x78, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0x80, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0x88, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0x90, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x290, ['unsigned long']], + 'EnvironmentVersion' : [ 0x294, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x8, { + 'BasePage' : [ 0x0, ['unsigned long']], + 'PageCount' : [ 0x4, ['unsigned long']], +} ], + '_RTL_SRWLOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_ALPC_MESSAGE_ZONE' : [ 0x18, { + 'Mdl' : [ 0x0, ['pointer', ['_MDL']]], + 'UserVa' : [ 0x4, ['pointer', ['void']]], + 'UserLimit' : [ 0x8, ['pointer', ['void']]], + 'SystemVa' : [ 0xc, ['pointer', ['void']]], + 'SystemLimit' : [ 0x10, ['pointer', ['void']]], + 'Size' : [ 0x14, ['unsigned long']], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x14, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x10, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x10, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x4, ['pointer', ['void']]], + 'AcquireForReadAhead' : [ 0x8, ['pointer', ['void']]], + 'ReleaseFromReadAhead' : [ 0xc, ['pointer', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_PROC_HISTORY_ENTRY' : [ 0x4, { + 'Utility' : [ 0x0, ['unsigned short']], + 'Frequency' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x20, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer', ['void']]], + 'Owner' : [ 0x14, ['pointer', ['void']]], + 'Attributes' : [ 0x18, ['unsigned char']], + 'Flags' : [ 0x19, ['unsigned char']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_POOL_HEADER' : [ 0x8, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], + 'PoolTagHash' : [ 0x6, ['unsigned short']], +} ], + '_ETW_PROVIDER_TABLE_ENTRY' : [ 0x10, { + 'RefCount' : [ 0x0, ['long']], + 'State' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'EtwProviderStateFree', 1: 'EtwProviderStateTransition', 2: 'EtwProviderStateActive', 3: 'EtwProviderStateMax'})]], + 'RegEntry' : [ 0x8, ['pointer', ['_ETW_REG_ENTRY']]], + 'Caller' : [ 0xc, ['pointer', ['void']]], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x4, { + 'ImageFileName' : [ 0x0, ['pointer', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x8, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x4, ['unsigned long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x40, { + 'Address' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0xc, ['array', 13, ['pointer', ['void']]]], +} ], + '__unnamed_2164' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x2040, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_2164']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'LastProcessSwappedOutTime' : [ 0x18, ['_LARGE_INTEGER']], + 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long']], + 'NonPagablePages' : [ 0x24, ['unsigned long']], + 'CommittedPages' : [ 0x28, ['unsigned long']], + 'PagedPoolStart' : [ 0x2c, ['pointer', ['void']]], + 'PagedPoolEnd' : [ 0x30, ['pointer', ['void']]], + 'SessionObject' : [ 0x34, ['pointer', ['void']]], + 'SessionObjectHandle' : [ 0x38, ['pointer', ['void']]], + 'ResidentProcessCount' : [ 0x3c, ['long']], + 'SessionPoolAllocationFailures' : [ 0x40, ['array', 4, ['unsigned long']]], + 'ImageList' : [ 0x50, ['_LIST_ENTRY']], + 'LocaleId' : [ 0x58, ['unsigned long']], + 'AttachCount' : [ 0x5c, ['unsigned long']], + 'AttachGate' : [ 0x60, ['_KGATE']], + 'WsListEntry' : [ 0x70, ['_LIST_ENTRY']], + 'Lookaside' : [ 0x80, ['array', 25, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xd00, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xd38, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xd70, ['_MMSUPPORT']], + 'Wsle' : [ 0xddc, ['pointer', ['_MMWSLE']]], + 'DriverUnload' : [ 0xde0, ['pointer', ['void']]], + 'PagedPool' : [ 0xe00, ['_POOL_DESCRIPTOR']], + 'PageTables' : [ 0x1f40, ['pointer', ['_MMPTE']]], + 'SpecialPool' : [ 0x1f44, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1f68, ['_KGUARDED_MUTEX']], + 'PoolBigEntriesInUse' : [ 0x1f88, ['long']], + 'PagedPoolPdeCount' : [ 0x1f8c, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1f90, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1f94, ['unsigned long']], + 'SystemPteInfo' : [ 0x1f98, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1fc8, ['pointer', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1fcc, ['unsigned long']], + 'PoolTrackBigPages' : [ 0x1fd0, ['pointer', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1fd4, ['unsigned long']], + 'IoState' : [ 0x1fd8, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1fdc, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1fe0, ['_KEVENT']], + 'CreateTime' : [ 0x1ff0, ['unsigned long long']], + 'SessionPoolPdes' : [ 0x1ff8, ['_RTL_BITMAP']], + 'CpuQuotaBlock' : [ 0x2000, ['pointer', ['_PS_CPU_QUOTA_BLOCK']]], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { + 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_CLIENT_ID' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], + 'UniqueThread' : [ 0x4, ['pointer', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0x80, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], + 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x20, ['array', 8, ['pointer', ['void']]]], + 'LastAcquireTrace' : [ 0x40, ['array', 8, ['pointer', ['void']]]], + 'LastReleaseTrace' : [ 0x60, ['array', 8, ['pointer', ['void']]]], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0xc, ['pointer', ['void']]], + 'DirectlyAccessClientToken' : [ 0x10, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x11, ['unsigned char']], + 'ServerIsRemote' : [ 0x12, ['unsigned char']], + 'ClientTokenControl' : [ 0x14, ['_TOKEN_CONTROL']], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x38, { + 'Mutex' : [ 0x0, ['_KGUARDED_MUTEX']], + 'PagedPoolAllocationMap' : [ 0x20, ['_RTL_BITMAP']], + 'FirstPteForPagedPool' : [ 0x28, ['pointer', ['_MMPTE']]], + 'PagedPoolHint' : [ 0x2c, ['unsigned long']], + 'PagedPoolCommit' : [ 0x30, ['unsigned long']], + 'AllocatedPagedPool' : [ 0x34, ['unsigned long']], +} ], + '_BITMAP_RANGE' : [ 0x20, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x8, ['long long']], + 'FirstDirtyPage' : [ 0x10, ['unsigned long']], + 'LastDirtyPage' : [ 0x14, ['unsigned long']], + 'DirtyPages' : [ 0x18, ['unsigned long']], + 'Bitmap' : [ 0x1c, ['pointer', ['unsigned long']]], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x10, { + 'SecurityQos' : [ 0x0, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x4, ['pointer', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x8, ['unsigned long']], + 'FullCreateOptions' : [ 0xc, ['unsigned long']], +} ], + '_PROC_PERF_DOMAIN' : [ 0x78, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x8, ['pointer', ['_KPRCB']]], + 'Members' : [ 0xc, ['_KAFFINITY_EX']], + 'FeedbackHandler' : [ 0x18, ['pointer', ['void']]], + 'GetFFHThrottleState' : [ 0x1c, ['pointer', ['void']]], + 'BoostPolicyHandler' : [ 0x20, ['pointer', ['void']]], + 'PerfSelectionHandler' : [ 0x24, ['pointer', ['void']]], + 'PerfHandler' : [ 0x28, ['pointer', ['void']]], + 'Processors' : [ 0x2c, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'PerfChangeTime' : [ 0x30, ['unsigned long long']], + 'ProcessorCount' : [ 0x38, ['unsigned long']], + 'PreviousFrequencyMhz' : [ 0x3c, ['unsigned long']], + 'CurrentFrequencyMhz' : [ 0x40, ['unsigned long']], + 'PreviousFrequency' : [ 0x44, ['unsigned long']], + 'CurrentFrequency' : [ 0x48, ['unsigned long']], + 'CurrentPerfContext' : [ 0x4c, ['unsigned long']], + 'DesiredFrequency' : [ 0x50, ['unsigned long']], + 'MaxFrequency' : [ 0x54, ['unsigned long']], + 'MinPerfPercent' : [ 0x58, ['unsigned long']], + 'MinThrottlePercent' : [ 0x5c, ['unsigned long']], + 'MaxPercent' : [ 0x60, ['unsigned long']], + 'MinPercent' : [ 0x64, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x68, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x6c, ['unsigned long']], + 'Coordination' : [ 0x70, ['unsigned char']], + 'PerfChangeIntervalCount' : [ 0x74, ['long']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0x50, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Type' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 16, ['pointer', ['void']]]], +} ], + '_DUMMY_FILE_OBJECT' : [ 0xa0, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x20, ['array', 128, ['unsigned char']]], +} ], + '_POP_TRIGGER_WAIT' : [ 0x20, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x10, ['long']], + 'Link' : [ 0x14, ['_LIST_ENTRY']], + 'Trigger' : [ 0x1c, ['pointer', ['_POP_ACTION_TRIGGER']]], +} ], + '_RELATION_LIST' : [ 0x14, { + 'Count' : [ 0x0, ['unsigned long']], + 'TagCount' : [ 0x4, ['unsigned long']], + 'FirstLevel' : [ 0x8, ['unsigned long']], + 'MaxLevel' : [ 0xc, ['unsigned long']], + 'Entries' : [ 0x10, ['array', 1, ['pointer', ['_RELATION_LIST_ENTRY']]]], +} ], + '_IO_TIMER' : [ 0x18, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x4, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Context' : [ 0x10, ['pointer', ['void']]], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0xc, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x4, ['unsigned long']], + 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x24, { + 'PteBase' : [ 0x0, ['pointer', ['_MMPTE']]], + 'Lock' : [ 0x4, ['unsigned long']], + 'Paged' : [ 0x8, ['_MI_SPECIAL_POOL_PTE_LIST']], + 'NonPaged' : [ 0x10, ['_MI_SPECIAL_POOL_PTE_LIST']], + 'PagesInUse' : [ 0x18, ['long']], + 'SpecialPoolPdes' : [ 0x1c, ['_RTL_BITMAP']], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x10, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], + 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x10, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x4, ['unsigned long']], + 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x4, ['_KMUTANT']], + 'Lock' : [ 0x24, ['_KGUARDED_MUTEX']], + 'List' : [ 0x44, ['_LIST_ENTRY']], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x10, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x8, ['_PO_IRP_QUEUE']], +} ], + '_PPM_PERF_STATE' : [ 0x28, { + 'Frequency' : [ 0x0, ['unsigned long']], + 'Power' : [ 0x4, ['unsigned long']], + 'PercentFrequency' : [ 0x8, ['unsigned char']], + 'IncreaseLevel' : [ 0x9, ['unsigned char']], + 'DecreaseLevel' : [ 0xa, ['unsigned char']], + 'Type' : [ 0xb, ['unsigned char']], + 'Control' : [ 0x10, ['unsigned long long']], + 'Status' : [ 0x18, ['unsigned long long']], + 'TotalHitCount' : [ 0x20, ['unsigned long']], + 'DesiredCount' : [ 0x24, ['unsigned long']], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '_KDPC_DATA' : [ 0x14, { + 'DpcListHead' : [ 0x0, ['_LIST_ENTRY']], + 'DpcLock' : [ 0x8, ['unsigned long']], + 'DpcQueueDepth' : [ 0xc, ['long']], + 'DpcCount' : [ 0x10, ['unsigned long']], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_21f1' : [ 0x8, { + 'UserData' : [ 0x0, ['pointer', ['void']]], + 'Owner' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_21f3' : [ 0x8, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_21f1']], + 'Merged' : [ 0x10, ['__unnamed_21f3']], + 'Attributes' : [ 0x18, ['unsigned char']], + 'PublicFlags' : [ 0x19, ['unsigned char']], + 'PrivateFlags' : [ 0x1a, ['unsigned short']], + 'ListEntry' : [ 0x1c, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0xc, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x4, ['pointer', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x8, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '__unnamed_21fb' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_21fb']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x18, { + 'ActiveFrame' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x4, ['_LIST_ENTRY']], + 'Flags' : [ 0xc, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x10, ['unsigned long']], + 'StackId' : [ 0x14, ['unsigned long']], +} ], + '_MSUBSECTION' : [ 0x3c, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x4, ['pointer', ['_MMPTE']]], + 'NextSubsection' : [ 0x8, ['pointer', ['_SUBSECTION']]], + 'NextMappedSubsection' : [ 0x8, ['pointer', ['_MSUBSECTION']]], + 'PtesInSubsection' : [ 0xc, ['unsigned long']], + 'UnusedPtes' : [ 0x10, ['unsigned long']], + 'GlobalPerSessionHead' : [ 0x10, ['pointer', ['_MM_AVL_TABLE']]], + 'u' : [ 0x14, ['__unnamed_1f77']], + 'StartingSector' : [ 0x18, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x1c, ['unsigned long']], + 'u1' : [ 0x20, ['__unnamed_2005']], + 'LeftChild' : [ 0x24, ['pointer', ['_MMSUBSECTION_NODE']]], + 'RightChild' : [ 0x28, ['pointer', ['_MMSUBSECTION_NODE']]], + 'DereferenceList' : [ 0x2c, ['_LIST_ENTRY']], + 'NumberOfMappedViews' : [ 0x34, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x38, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_VIRTUAL_EFI_RUNTIME_SERVICES' : [ 0x38, { + 'GetTime' : [ 0x0, ['unsigned long']], + 'SetTime' : [ 0x4, ['unsigned long']], + 'GetWakeupTime' : [ 0x8, ['unsigned long']], + 'SetWakeupTime' : [ 0xc, ['unsigned long']], + 'SetVirtualAddressMap' : [ 0x10, ['unsigned long']], + 'ConvertPointer' : [ 0x14, ['unsigned long']], + 'GetVariable' : [ 0x18, ['unsigned long']], + 'GetNextVariableName' : [ 0x1c, ['unsigned long']], + 'SetVariable' : [ 0x20, ['unsigned long']], + 'GetNextHighMonotonicCount' : [ 0x24, ['unsigned long']], + 'ResetSystem' : [ 0x28, ['unsigned long']], + 'UpdateCapsule' : [ 0x2c, ['unsigned long']], + 'QueryCapsuleCapabilities' : [ 0x30, ['unsigned long']], + 'QueryVariableInfo' : [ 0x34, ['unsigned long']], +} ], + '_MI_SPECIAL_POOL_PTE_LIST' : [ 0x8, { + 'FreePteHead' : [ 0x0, ['_MMPTE']], + 'FreePteTail' : [ 0x4, ['_MMPTE']], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'spare2' : [ 0x12, ['array', 3, ['unsigned char']]], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'spare3' : [ 0x16, ['array', 8, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_2211' : [ 0x4, { + 'ImageCommitment' : [ 0x0, ['unsigned long']], + 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], +} ], + '__unnamed_2215' : [ 0x4, { + 'ImageInformation' : [ 0x0, ['pointer', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x20, ['__unnamed_2211']], + 'u2' : [ 0x24, ['__unnamed_2215']], + 'PrototypePte' : [ 0x28, ['pointer', ['_MMPTE']]], + 'ThePtes' : [ 0x2c, ['array', 1, ['_MMPTE']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x10, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_221e' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2220' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_221e']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x90, { + 'SuspectDriverEntry' : [ 0x0, ['pointer', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x4, ['pointer', ['void']]], + 'EtwHandlesListHead' : [ 0x8, ['_LIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_2220']], + 'Signature' : [ 0x14, ['unsigned long']], + 'PoolPageHeaders' : [ 0x18, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x20, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x28, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x2c, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x30, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x34, ['unsigned long']], + 'PagedBytes' : [ 0x38, ['unsigned long']], + 'NonPagedBytes' : [ 0x3c, ['unsigned long']], + 'PeakPagedBytes' : [ 0x40, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x44, ['unsigned long']], + 'RaiseIrqls' : [ 0x48, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x4c, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x50, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x54, ['unsigned long']], + 'AllocationsFailed' : [ 0x58, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x5c, ['unsigned long']], + 'LockedBytes' : [ 0x60, ['unsigned long']], + 'PeakLockedBytes' : [ 0x64, ['unsigned long']], + 'MappedLockedBytes' : [ 0x68, ['unsigned long']], + 'PeakMappedLockedBytes' : [ 0x6c, ['unsigned long']], + 'MappedIoSpaceBytes' : [ 0x70, ['unsigned long']], + 'PeakMappedIoSpaceBytes' : [ 0x74, ['unsigned long']], + 'PagesForMdlBytes' : [ 0x78, ['unsigned long']], + 'PeakPagesForMdlBytes' : [ 0x7c, ['unsigned long']], + 'ContiguousMemoryBytes' : [ 0x80, ['unsigned long']], + 'PeakContiguousMemoryBytes' : [ 0x84, ['unsigned long']], + 'ContiguousMemoryListHead' : [ 0x88, ['_LIST_ENTRY']], +} ], + '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { + 'PlaceHolder' : [ 0x0, ['unsigned long']], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x58, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'UlongFlags' : [ 0x0, ['unsigned long']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'ReadAheadSpinLock' : [ 0x48, ['unsigned long']], + 'PrivateLinks' : [ 0x4c, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x54, ['pointer', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'Spare' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_TPM_BOOT_ENTROPY_LDR_RESULT' : [ 0x48, { + 'Policy' : [ 0x0, ['unsigned long long']], + 'ResultCode' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'TpmBootEntropyStructureUninitialized', 1: 'TpmBootEntropyDisabledByPolicy', 2: 'TpmBootEntropyNoTpmFound', 3: 'TpmBootEntropyTpmError', 4: 'TpmBootEntropySuccess'})]], + 'ResultStatus' : [ 0xc, ['long']], + 'Time' : [ 0x10, ['unsigned long long']], + 'EntropyLength' : [ 0x18, ['unsigned long']], + 'EntropyData' : [ 0x1c, ['array', 40, ['unsigned char']]], +} ], + '_RTL_HANDLE_TABLE' : [ 0x20, { + 'MaximumNumberOfHandles' : [ 0x0, ['unsigned long']], + 'SizeOfHandleTableEntry' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['array', 2, ['unsigned long']]], + 'FreeHandles' : [ 0x10, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'CommittedHandles' : [ 0x14, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'UnCommittedHandles' : [ 0x18, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], + 'MaxReservedHandles' : [ 0x1c, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], +} ], + '_PTE_TRACKER' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x8, ['pointer', ['_MDL']]], + 'Count' : [ 0xc, ['unsigned long']], + 'SystemVa' : [ 0x10, ['pointer', ['void']]], + 'StartVa' : [ 0x14, ['pointer', ['void']]], + 'Offset' : [ 0x18, ['unsigned long']], + 'Length' : [ 0x1c, ['unsigned long']], + 'Page' : [ 0x20, ['unsigned long']], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'CallingAddress' : [ 0x28, ['pointer', ['void']]], + 'CallersCaller' : [ 0x2c, ['pointer', ['void']]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0xc, ['unsigned long']], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0xc, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_HMAP_ENTRY' : [ 0x10, { + 'BlockAddress' : [ 0x0, ['unsigned long']], + 'BinAddress' : [ 0x4, ['unsigned long']], + 'CmView' : [ 0x8, ['pointer', ['_CM_VIEW_OF_FILE']]], + 'MemAlloc' : [ 0xc, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x10, { + 'HashLink' : [ 0x0, ['pointer', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x4, ['unsigned short']], + 'Atom' : [ 0x6, ['unsigned short']], + 'ReferenceCount' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'NameLength' : [ 0xb, ['unsigned char']], + 'Name' : [ 0xc, ['array', 1, ['wchar']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x4, ['pointer', ['void']]], +} ], + '_LOADER_PERFORMANCE_DATA' : [ 0x10, { + 'StartTime' : [ 0x0, ['unsigned long long']], + 'EndTime' : [ 0x8, ['unsigned long long']], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1'})]], + 'ReorderingBarrier' : [ 0x10, ['unsigned char']], + 'RequestArgument' : [ 0x14, ['unsigned long']], + 'CompletionEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'CompletionStatus' : [ 0x1c, ['pointer', ['long']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MMSESSION' : [ 0x38, { + 'SystemSpaceViewLock' : [ 0x0, ['_KGUARDED_MUTEX']], + 'SystemSpaceViewLockPointer' : [ 0x20, ['pointer', ['_KGUARDED_MUTEX']]], + 'SystemSpaceViewTable' : [ 0x24, ['pointer', ['_MMVIEW']]], + 'SystemSpaceHashSize' : [ 0x28, ['unsigned long']], + 'SystemSpaceHashEntries' : [ 0x2c, ['unsigned long']], + 'SystemSpaceHashKey' : [ 0x30, ['unsigned long']], + 'BitmapFailures' : [ 0x34, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x3c, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x8, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x10, ['pointer', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x14, ['pointer', ['_ETW_GUID_ENTRY']]], + 'Index' : [ 0x18, ['unsigned short']], + 'Flags' : [ 0x1a, ['unsigned short']], + 'EnableMask' : [ 0x1c, ['unsigned char']], + 'GroupEnableMask' : [ 0x1d, ['unsigned char']], + 'UseDescriptorType' : [ 0x1e, ['unsigned char']], + 'SessionId' : [ 0x20, ['unsigned long']], + 'ReplyQueue' : [ 0x20, ['pointer', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x20, ['array', 4, ['pointer', ['_ETW_REG_ENTRY']]]], + 'Process' : [ 0x30, ['pointer', ['_EPROCESS']]], + 'Callback' : [ 0x30, ['pointer', ['void']]], + 'CallbackContext' : [ 0x34, ['pointer', ['void']]], + 'Traits' : [ 0x38, ['pointer', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0xa4, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x4, ['pointer', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x8, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x18, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x20, ['pointer', ['void']]], + 'ServerSectionBase' : [ 0x24, ['pointer', ['void']]], + 'PortContext' : [ 0x28, ['pointer', ['void']]], + 'ClientThread' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'SecurityQos' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x3c, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0x78, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0x80, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MappingProcess' : [ 0x88, ['pointer', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0x8c, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0x8e, ['unsigned short']], + 'Flags' : [ 0x90, ['unsigned long']], + 'WaitEvent' : [ 0x94, ['_KEVENT']], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x8, ['unsigned long']], + 'Alternatives' : [ 0xc, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'WorkSpace' : [ 0x1c, ['long']], + 'InterfaceType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x24, ['unsigned long']], + 'BusNumber' : [ 0x28, ['unsigned long']], + 'Assignment' : [ 0x2c, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x30, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x14, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'Traits' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x1a8, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long']], + 'Thread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'AbortEvent' : [ 0x10, ['pointer', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x14, ['pointer', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x18, ['pointer', ['_KSEMAPHORE']]], + 'GetNewDeviceList' : [ 0x1c, ['unsigned char']], + 'Order' : [ 0x20, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x190, ['_LIST_ENTRY']], + 'Status' : [ 0x198, ['long']], + 'FailedDevice' : [ 0x19c, ['pointer', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x1a0, ['unsigned char']], + 'Cancelled' : [ 0x1a1, ['unsigned char']], + 'IgnoreErrors' : [ 0x1a2, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x1a3, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x1a4, ['unsigned char']], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 7, ['pointer', ['void']]]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned long']], + 'CallerType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x8, ['unsigned long']], + 'DevicePathOffset' : [ 0xc, ['unsigned long']], + 'ReasonOffset' : [ 0x14, ['unsigned long']], +} ], + '_EX_WORK_QUEUE' : [ 0x3c, { + 'WorkerQueue' : [ 0x0, ['_KQUEUE']], + 'DynamicThreadCount' : [ 0x28, ['unsigned long']], + 'WorkItemsProcessed' : [ 0x2c, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x30, ['unsigned long']], + 'QueueDepthLastPass' : [ 0x34, ['unsigned long']], + 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x4, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x8, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x14, ['unsigned long']], + 'PagingCount' : [ 0x18, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x1c, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0x40, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'IdleCheck' : [ 0xc, ['pointer', ['void']]], + 'IdleHandler' : [ 0x10, ['pointer', ['void']]], + 'HvConfig' : [ 0x18, ['unsigned long long']], + 'Context' : [ 0x20, ['pointer', ['void']]], + 'Latency' : [ 0x24, ['unsigned long']], + 'Power' : [ 0x28, ['unsigned long']], + 'TimeCheck' : [ 0x2c, ['unsigned long']], + 'StateFlags' : [ 0x30, ['unsigned long']], + 'PromotePercent' : [ 0x34, ['unsigned char']], + 'DemotePercent' : [ 0x35, ['unsigned char']], + 'PromotePercentBase' : [ 0x36, ['unsigned char']], + 'DemotePercentBase' : [ 0x37, ['unsigned char']], + 'StateType' : [ 0x38, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x154, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'State' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x1c, ['_KMUTANT']], + 'NamespaceLink' : [ 0x3c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x50, ['_GUID']], + 'NotificationQueue' : [ 0x60, ['_KQUEUE']], + 'NotificationMutex' : [ 0x88, ['_KMUTANT']], + 'EnlistmentHead' : [ 0xa8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xb0, ['unsigned long']], + 'NotificationRoutine' : [ 0xb4, ['pointer', ['void']]], + 'Key' : [ 0xb8, ['pointer', ['void']]], + 'ProtocolListHead' : [ 0xbc, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0xc4, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0xcc, ['_LIST_ENTRY']], + 'Tm' : [ 0xd4, ['pointer', ['_KTM']]], + 'Description' : [ 0xd8, ['_UNICODE_STRING']], + 'Enlistments' : [ 0xe0, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x140, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '__unnamed_229b' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x40, { + 'Lock' : [ 0x0, ['long']], + 'NodeToFree' : [ 0x4, ['pointer', ['void']]], + 'NodeRangeSize' : [ 0x8, ['unsigned long']], + 'NodeCount' : [ 0xc, ['unsigned long']], + 'Tables' : [ 0x10, ['pointer', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x14, ['unsigned long']], + 'u1' : [ 0x18, ['__unnamed_229b']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_RELATION_LIST_ENTRY' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned long']], + 'MaxCount' : [ 0x4, ['unsigned long']], + 'Devices' : [ 0x8, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x40e0, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x14, ['unsigned long']], + 'ResourceAddressRange' : [ 0x18, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x2010, ['pointer', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x2014, ['unsigned long']], + 'ThreadAddressRange' : [ 0x2018, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x4010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x4014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x4018, ['unsigned long']], + 'NodesSearched' : [ 0x401c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x4020, ['unsigned long']], + 'SequenceNumber' : [ 0x4024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x4028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x402c, ['unsigned long']], + 'DepthLimitHits' : [ 0x4030, ['unsigned long']], + 'SearchLimitHits' : [ 0x4034, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x4038, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x403c, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x4040, ['unsigned long']], + 'TotalReleases' : [ 0x4044, ['unsigned long']], + 'RootNodesDeleted' : [ 0x4048, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x404c, ['unsigned long']], + 'Instigator' : [ 0x4050, ['pointer', ['void']]], + 'NumberOfParticipants' : [ 0x4054, ['unsigned long']], + 'Participant' : [ 0x4058, ['array', 32, ['pointer', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x40d8, ['long']], +} ], + '_KTM' : [ 0x238, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x4, ['_KMUTANT']], + 'State' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x28, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x3c, ['_GUID']], + 'Flags' : [ 0x4c, ['unsigned long']], + 'VolatileFlags' : [ 0x50, ['unsigned long']], + 'LogFileName' : [ 0x54, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x5c, ['pointer', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0x60, ['pointer', ['void']]], + 'LogManagementContext' : [ 0x64, ['pointer', ['void']]], + 'Transactions' : [ 0x68, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0xc8, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x128, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x148, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x150, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x158, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x178, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x180, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x188, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x190, ['pointer', ['void']]], + 'TmRm' : [ 0x194, ['pointer', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x198, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x1a8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x1b8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x1c0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x1d0, ['_ERESOURCE']], + 'LogFlags' : [ 0x208, ['unsigned long']], + 'LogFullStatus' : [ 0x20c, ['long']], + 'RecoveryStatus' : [ 0x210, ['long']], + 'LastCheckBaseLsn' : [ 0x218, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x220, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x228, ['_WORK_QUEUE_ITEM']], +} ], + '_CONFIGURATION_COMPONENT' : [ 0x24, { + 'Class' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SystemClass', 1: 'ProcessorClass', 2: 'CacheClass', 3: 'AdapterClass', 4: 'ControllerClass', 5: 'PeripheralClass', 6: 'MemoryClass', 7: 'MaximumClass'})]], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'ArcSystem', 1: 'CentralProcessor', 2: 'FloatingPointProcessor', 3: 'PrimaryIcache', 4: 'PrimaryDcache', 5: 'SecondaryIcache', 6: 'SecondaryDcache', 7: 'SecondaryCache', 8: 'EisaAdapter', 9: 'TcAdapter', 10: 'ScsiAdapter', 11: 'DtiAdapter', 12: 'MultiFunctionAdapter', 13: 'DiskController', 14: 'TapeController', 15: 'CdromController', 16: 'WormController', 17: 'SerialController', 18: 'NetworkController', 19: 'DisplayController', 20: 'ParallelController', 21: 'PointerController', 22: 'KeyboardController', 23: 'AudioController', 24: 'OtherController', 25: 'DiskPeripheral', 26: 'FloppyDiskPeripheral', 27: 'TapePeripheral', 28: 'ModemPeripheral', 29: 'MonitorPeripheral', 30: 'PrinterPeripheral', 31: 'PointerPeripheral', 32: 'KeyboardPeripheral', 33: 'TerminalPeripheral', 34: 'OtherPeripheral', 35: 'LinePeripheral', 36: 'NetworkPeripheral', 37: 'SystemMemory', 38: 'DockingInformation', 39: 'RealModeIrqRoutingTable', 40: 'RealModePCIEnumeration', 41: 'MaximumType'})]], + 'Flags' : [ 0x8, ['_DEVICE_FLAGS']], + 'Version' : [ 0xc, ['unsigned short']], + 'Revision' : [ 0xe, ['unsigned short']], + 'Key' : [ 0x10, ['unsigned long']], + 'AffinityMask' : [ 0x14, ['unsigned long']], + 'Group' : [ 0x14, ['unsigned short']], + 'GroupIndex' : [ 0x16, ['unsigned short']], + 'ConfigurationDataLength' : [ 0x18, ['unsigned long']], + 'IdentifierLength' : [ 0x1c, ['unsigned long']], + 'Identifier' : [ 0x20, ['pointer', ['unsigned char']]], +} ], + '_VF_BTS_RECORD' : [ 0xc, { + 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], + 'JumpedTo' : [ 0x4, ['pointer', ['void']]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], +} ], + '_KTRANSACTION' : [ 0x1e0, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x10, ['unsigned long']], + 'Mutex' : [ 0x14, ['_KMUTANT']], + 'TreeTx' : [ 0x34, ['pointer', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x38, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x4c, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0x60, ['_GUID']], + 'State' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0x74, ['unsigned long']], + 'EnlistmentHead' : [ 0x78, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x80, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0x84, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0x88, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0x8c, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0x90, ['unsigned long']], + 'PendingResponses' : [ 0x94, ['unsigned long']], + 'SuperiorEnlistment' : [ 0x98, ['pointer', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xa0, ['_CLS_LSN']], + 'PromotedEntry' : [ 0xa8, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0xb0, ['pointer', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0xb4, ['pointer', ['void']]], + 'IsolationLevel' : [ 0xb8, ['unsigned long']], + 'IsolationFlags' : [ 0xbc, ['unsigned long']], + 'Timeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'Description' : [ 0xc8, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0xd0, ['pointer', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0xd4, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0xe4, ['_KDPC']], + 'RollbackTimer' : [ 0x108, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x130, ['_LIST_ENTRY']], + 'Outcome' : [ 0x138, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x13c, ['pointer', ['_KTM']]], + 'CommitReservation' : [ 0x140, ['long long']], + 'TransactionHistory' : [ 0x148, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x198, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x19c, ['pointer', ['void']]], + 'DTCPrivateInformationLength' : [ 0x1a0, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x1a4, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x1c4, ['pointer', ['void']]], + 'PendingPromotionCount' : [ 0x1c8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x38, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x8, ['pointer', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0xc, ['pointer', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x18, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x1c, ['pointer', ['_CM_TRANS']]], + 'UoWState' : [ 0x20, ['unsigned long']], + 'ActionType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x30, ['unsigned long']], + 'OldValueCell' : [ 0x30, ['unsigned long']], + 'NewValueCell' : [ 0x34, ['unsigned long']], + 'UserFlags' : [ 0x30, ['unsigned long']], + 'LastWriteTime' : [ 0x30, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x30, ['unsigned long']], + 'OldChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x34, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x30, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x34, ['unsigned long']], +} ], + '_KPROCESSOR_STATE' : [ 0x320, { + 'ContextFrame' : [ 0x0, ['_CONTEXT']], + 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], +} ], + '_MMPTE_TRANSITION' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_VF_WATCHDOG_IRP' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x8, ['pointer', ['_IRP']]], + 'DueTickCount' : [ 0xc, ['unsigned long']], + 'Inserted' : [ 0x10, ['unsigned char']], + 'TrackedStackLocation' : [ 0x11, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x12, ['unsigned short']], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_22f8' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_22fa' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_22f8']], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_22fa']], +} ], + '_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA' : [ 0x8, { + 'CapturedCpuShareWeight' : [ 0x0, ['unsigned long']], + 'CapturedTotalWeight' : [ 0x4, ['unsigned long']], + 'CombinedData' : [ 0x0, ['long long']], +} ], + '_CM_NAME_HASH' : [ 0xc, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x8, ['unsigned short']], + 'Name' : [ 0xa, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], +} ], + '_PO_IRP_QUEUE' : [ 0x8, { + 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], +} ], + '__unnamed_230d' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0x6c, { + 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x4, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0xc, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x14, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], + 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x24, ['__unnamed_230d']], + 'ChildrenCount' : [ 0x28, ['long']], + 'StackTrace' : [ 0x2c, ['array', 8, ['pointer', ['void']]]], + 'ParentStackTrace' : [ 0x4c, ['array', 8, ['pointer', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0x60, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x38, ['_KMUTANT']], + 'LinksOffset' : [ 0x58, ['unsigned short']], + 'GuidOffset' : [ 0x5a, ['unsigned short']], + 'Expired' : [ 0x5c, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x10, { + 'NonPagedPortQueue' : [ 0x0, ['pointer', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x4, ['pointer', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x8, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x4, ['pointer', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x8, { + 'Stream' : [ 0x0, ['pointer', ['void']]], + 'Detail' : [ 0x4, ['unsigned long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x8, { + 'Start' : [ 0x0, ['pointer', ['unsigned char']]], + 'End' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x18, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x18, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x14, ['pointer', ['_LPCP_PORT_OBJECT']]], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x14, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x8, ['pointer', ['void']]], + 'Key' : [ 0xc, ['unsigned long']], + 'BindingProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x204, { + 'SpinLock' : [ 0x0, ['unsigned long']], + 'HashTable' : [ 0x4, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x38, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x30, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_HEAP_USERDATA_HEADER' : [ 0x10, { + 'SFreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'SubSegment' : [ 0x0, ['pointer', ['_HEAP_SUBSEGMENT']]], + 'Reserved' : [ 0x4, ['pointer', ['void']]], + 'SizeIndex' : [ 0x8, ['unsigned long']], + 'Signature' : [ 0xc, ['unsigned long']], +} ], + '_STACK_TABLE' : [ 0x8040, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x4, ['array', 16, ['pointer', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x44, ['array', 16381, ['unsigned short']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_DEFERRED_WRITE' : [ 0x24, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x8, ['unsigned long']], + 'DeferredWriteLinks' : [ 0xc, ['_LIST_ENTRY']], + 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], + 'PostRoutine' : [ 0x18, ['pointer', ['void']]], + 'Context1' : [ 0x1c, ['pointer', ['void']]], + 'Context2' : [ 0x20, ['pointer', ['void']]], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x4, ['pointer', ['_ARBITER_ORDERING']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x30, { + 'TransferAddress' : [ 0x0, ['pointer', ['void']]], + 'ZeroBits' : [ 0x4, ['unsigned long']], + 'MaximumStackSize' : [ 0x8, ['unsigned long']], + 'CommittedStackSize' : [ 0xc, ['unsigned long']], + 'SubSystemType' : [ 0x10, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x14, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x16, ['unsigned short']], + 'SubSystemVersion' : [ 0x14, ['unsigned long']], + 'GpValue' : [ 0x18, ['unsigned long']], + 'ImageCharacteristics' : [ 0x1c, ['unsigned short']], + 'DllCharacteristics' : [ 0x1e, ['unsigned short']], + 'Machine' : [ 0x20, ['unsigned short']], + 'ImageContainsCode' : [ 0x22, ['unsigned char']], + 'ImageFlags' : [ 0x23, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x24, ['unsigned long']], + 'ImageFileSize' : [ 0x28, ['unsigned long']], + 'CheckSum' : [ 0x2c, ['unsigned long']], +} ], + '_VF_AVL_TABLE' : [ 0x3c, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x38, ['pointer', ['_VF_AVL_TREE_NODE']]], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1b, { + 'PerUserPolicy' : [ 0x0, ['array', 27, ['unsigned char']]], +} ], + '__unnamed_2365' : [ 0x8, { + 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], +} ], + '__unnamed_2367' : [ 0x4, { + 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], +} ], + '__unnamed_236b' : [ 0x8, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_236f' : [ 0x8, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x4, ['unsigned char']], +} ], + '__unnamed_2371' : [ 0x14, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], + 'Argument5' : [ 0x10, ['pointer', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x14, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_2365']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_2367']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_236b']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_236f']], + 'Others' : [ 0x0, ['__unnamed_2371']], +} ], + '_PROFILE_PARAMETER_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'DockingState' : [ 0x4, ['unsigned short']], + 'Capabilities' : [ 0x6, ['unsigned short']], + 'DockID' : [ 0x8, ['unsigned long']], + 'SerialNumber' : [ 0xc, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_POP_HIBER_CONTEXT' : [ 0xa0, { + 'WriteToFile' : [ 0x0, ['unsigned char']], + 'ReserveLoaderMemory' : [ 0x1, ['unsigned char']], + 'ReserveFreeMemory' : [ 0x2, ['unsigned char']], + 'Reset' : [ 0x3, ['unsigned char']], + 'HiberFlags' : [ 0x4, ['unsigned char']], + 'WroteHiberFile' : [ 0x5, ['unsigned char']], + 'MapFrozen' : [ 0x6, ['unsigned char']], + 'MemoryMap' : [ 0x8, ['_RTL_BITMAP']], + 'DiscardedMemoryPages' : [ 0x10, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x18, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x20, ['unsigned long']], + 'NextCloneRange' : [ 0x24, ['pointer', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x28, ['unsigned long']], + 'LoaderMdl' : [ 0x2c, ['pointer', ['_MDL']]], + 'AllocatedMdl' : [ 0x30, ['pointer', ['_MDL']]], + 'PagesOut' : [ 0x38, ['unsigned long long']], + 'IoPages' : [ 0x40, ['pointer', ['void']]], + 'IoPagesCount' : [ 0x44, ['unsigned long']], + 'CurrentMcb' : [ 0x48, ['pointer', ['void']]], + 'DumpStack' : [ 0x4c, ['pointer', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0x50, ['pointer', ['_KPROCESSOR_STATE']]], + 'PreferredIoWriteSize' : [ 0x54, ['unsigned long']], + 'IoProgress' : [ 0x58, ['unsigned long']], + 'HiberVa' : [ 0x5c, ['unsigned long']], + 'HiberPte' : [ 0x60, ['_LARGE_INTEGER']], + 'Status' : [ 0x68, ['long']], + 'MemoryImage' : [ 0x6c, ['pointer', ['PO_MEMORY_IMAGE']]], + 'CompressionWorkspace' : [ 0x70, ['pointer', ['void']]], + 'CompressedWriteBuffer' : [ 0x74, ['pointer', ['unsigned char']]], + 'CompressedWriteBufferSize' : [ 0x78, ['unsigned long']], + 'MaxCompressedOutputSize' : [ 0x7c, ['unsigned long']], + 'PerformanceStats' : [ 0x80, ['pointer', ['unsigned long']]], + 'CompressionBlock' : [ 0x84, ['pointer', ['void']]], + 'DmaIO' : [ 0x88, ['pointer', ['void']]], + 'TemporaryHeap' : [ 0x8c, ['pointer', ['void']]], + 'BootLoaderLogMdl' : [ 0x90, ['pointer', ['_MDL']]], + 'FirmwareRuntimeInformationMdl' : [ 0x94, ['pointer', ['_MDL']]], + 'ResumeContext' : [ 0x98, ['pointer', ['void']]], + 'ResumeContextPages' : [ 0x9c, ['unsigned long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x40, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer', ['void']]]], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x8, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0xb0, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0x70, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0x78, ['pointer', ['void']]], + 'PointersLength' : [ 0x7c, ['unsigned long']], + 'ModulePrefix' : [ 0x80, ['pointer', ['unsigned short']]], + 'DriverList' : [ 0x84, ['_LIST_ENTRY']], + 'InitMsg' : [ 0x8c, ['_STRING']], + 'ProgMsg' : [ 0x94, ['_STRING']], + 'DoneMsg' : [ 0x9c, ['_STRING']], + 'FileObject' : [ 0xa4, ['pointer', ['void']]], + 'UsageType' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x20, { + 'ThreadHandle' : [ 0x0, ['pointer', ['void']]], + 'ThreadId' : [ 0x4, ['pointer', ['void']]], + 'ProcessId' : [ 0x8, ['pointer', ['void']]], + 'Code' : [ 0xc, ['unsigned long']], + 'Parameter1' : [ 0x10, ['unsigned long']], + 'Parameter2' : [ 0x14, ['unsigned long']], + 'Parameter3' : [ 0x18, ['unsigned long']], + 'Parameter4' : [ 0x1c, ['unsigned long']], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_PCW_MASK_INFORMATION' : [ 0x20, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0xc, ['unsigned long']], + 'CollectMultiple' : [ 0x10, ['unsigned char']], + 'Buffer' : [ 0x14, ['pointer', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x18, ['pointer', ['_KEVENT']]], +} ], + '_RTL_HANDLE_TABLE_ENTRY' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NextFree' : [ 0x0, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], +} ], + '__unnamed_2395' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x10, { + 'Parameters' : [ 0x0, ['__unnamed_2395']], +} ], + '__unnamed_2399' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_2399']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + 'PO_MEMORY_IMAGE' : [ 0xe0, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long']], + 'PageSize' : [ 0x14, ['unsigned long']], + 'SystemTime' : [ 0x18, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x20, ['unsigned long long']], + 'FeatureFlags' : [ 0x28, ['unsigned long']], + 'HiberFlags' : [ 0x2c, ['unsigned char']], + 'spare' : [ 0x2d, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x30, ['unsigned long']], + 'HiberVa' : [ 0x34, ['unsigned long']], + 'HiberPte' : [ 0x38, ['_LARGE_INTEGER']], + 'NoFreePages' : [ 0x40, ['unsigned long']], + 'FreeMapCheck' : [ 0x44, ['unsigned long']], + 'WakeCheck' : [ 0x48, ['unsigned long']], + 'FirstTablePage' : [ 0x4c, ['unsigned long']], + 'PerfInfo' : [ 0x50, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0xa8, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0xac, ['array', 1, ['unsigned long']]], + 'NoBootLoaderLogPages' : [ 0xb0, ['unsigned long']], + 'BootLoaderLogPages' : [ 0xb4, ['array', 8, ['unsigned long']]], + 'NotUsed' : [ 0xd4, ['unsigned long']], + 'ResumeContextCheck' : [ 0xd8, ['unsigned long']], + 'ResumeContextPages' : [ 0xdc, ['unsigned long']], +} ], + 'EX_QUEUE_WORKER_INFO' : [ 0x4, { + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'QueueWorkerInfo' : [ 0x0, ['long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_CURDIR' : [ 0xc, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x8, ['pointer', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x58, { + 'IoTicks' : [ 0x0, ['unsigned long long']], + 'InitTicks' : [ 0x8, ['unsigned long long']], + 'CopyTicks' : [ 0x10, ['unsigned long long']], + 'ElapsedTicks' : [ 0x18, ['unsigned long long']], + 'CompressTicks' : [ 0x20, ['unsigned long long']], + 'ResumeAppTime' : [ 0x28, ['unsigned long long']], + 'HiberFileResumeTime' : [ 0x30, ['unsigned long long']], + 'BytesCopied' : [ 0x38, ['unsigned long long']], + 'PagesProcessed' : [ 0x40, ['unsigned long long']], + 'PagesWritten' : [ 0x48, ['unsigned long']], + 'DumpCount' : [ 0x4c, ['unsigned long']], + 'FileRuns' : [ 0x50, ['unsigned long']], +} ], + '_DEVICE_FLAGS' : [ 0x4, { + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], +} ], + '_RTL_BALANCED_LINKS' : [ 0x10, { + 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x4, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x8, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0xc, ['unsigned char']], + 'Reserved' : [ 0xd, ['array', 3, ['unsigned char']]], +} ], + '_MMVIEW' : [ 0x18, { + 'Entry' : [ 0x0, ['unsigned long']], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], + 'ViewLinks' : [ 0x8, ['_LIST_ENTRY']], + 'SessionViewVa' : [ 0x10, ['pointer', ['void']]], + 'SessionId' : [ 0x14, ['unsigned long']], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], +} ], + '_HEADLESS_LOADER_BLOCK' : [ 0x34, { + 'UsedBiosSettings' : [ 0x0, ['unsigned char']], + 'DataBits' : [ 0x1, ['unsigned char']], + 'StopBits' : [ 0x2, ['unsigned char']], + 'Parity' : [ 0x3, ['unsigned char']], + 'BaudRate' : [ 0x4, ['unsigned long']], + 'PortNumber' : [ 0x8, ['unsigned long']], + 'PortAddress' : [ 0xc, ['pointer', ['unsigned char']]], + 'PciDeviceId' : [ 0x10, ['unsigned short']], + 'PciVendorId' : [ 0x12, ['unsigned short']], + 'PciBusNumber' : [ 0x14, ['unsigned char']], + 'PciBusSegment' : [ 0x16, ['unsigned short']], + 'PciSlotNumber' : [ 0x18, ['unsigned char']], + 'PciFunctionNumber' : [ 0x19, ['unsigned char']], + 'PciFlags' : [ 0x1c, ['unsigned long']], + 'SystemGUID' : [ 0x20, ['_GUID']], + 'IsMMIODevice' : [ 0x30, ['unsigned char']], + 'TerminalType' : [ 0x31, ['unsigned char']], +} ], + '__unnamed_23c1' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_23c3' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_23c5' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_23c1']], + 'Gpt' : [ 0x0, ['__unnamed_23c3']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer', ['void']]], + 'CommonBuffer' : [ 0xc, ['array', 2, ['pointer', ['void']]]], + 'PhysicalAddress' : [ 0x18, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x28, ['pointer', ['void']]], + 'OpenRoutine' : [ 0x2c, ['pointer', ['void']]], + 'WriteRoutine' : [ 0x30, ['pointer', ['void']]], + 'FinishRoutine' : [ 0x34, ['pointer', ['void']]], + 'AdapterObject' : [ 0x38, ['pointer', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x3c, ['pointer', ['void']]], + 'PortConfiguration' : [ 0x40, ['pointer', ['void']]], + 'CrashDump' : [ 0x44, ['unsigned char']], + 'MaximumTransferSize' : [ 0x48, ['unsigned long']], + 'CommonBufferSize' : [ 0x4c, ['unsigned long']], + 'TargetAddress' : [ 0x50, ['pointer', ['void']]], + 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], + 'PartitionStyle' : [ 0x58, ['unsigned long']], + 'DiskInfo' : [ 0x5c, ['__unnamed_23c5']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x30, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Hint' : [ 0xc, ['unsigned long']], + 'BasePte' : [ 0x10, ['pointer', ['_MMPTE']]], + 'FailureCount' : [ 0x14, ['pointer', ['unsigned long']]], + 'Vm' : [ 0x18, ['pointer', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x1c, ['long']], + 'TotalFreeSystemPtes' : [ 0x20, ['long']], + 'CachedPteCount' : [ 0x24, ['long']], + 'PteFailures' : [ 0x28, ['unsigned long']], + 'SpinLock' : [ 0x2c, ['unsigned long']], + 'GlobalMutex' : [ 0x2c, ['pointer', ['_KGUARDED_MUTEX']]], +} ], + '_NETWORK_LOADER_BLOCK' : [ 0x10, { + 'DHCPServerACK' : [ 0x0, ['pointer', ['unsigned char']]], + 'DHCPServerACKLength' : [ 0x4, ['unsigned long']], + 'BootServerReplyPacket' : [ 0x8, ['pointer', ['unsigned char']]], + 'BootServerReplyPacketLength' : [ 0xc, ['unsigned long']], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x170, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x4, ['pointer', ['pointer', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x8, ['array', 9, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x28, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x10, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x18, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x2c, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x28, ['long']], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x4, { + 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '_KSPECIAL_REGISTERS' : [ 0x54, { + 'Cr0' : [ 0x0, ['unsigned long']], + 'Cr2' : [ 0x4, ['unsigned long']], + 'Cr3' : [ 0x8, ['unsigned long']], + 'Cr4' : [ 0xc, ['unsigned long']], + 'KernelDr0' : [ 0x10, ['unsigned long']], + 'KernelDr1' : [ 0x14, ['unsigned long']], + 'KernelDr2' : [ 0x18, ['unsigned long']], + 'KernelDr3' : [ 0x1c, ['unsigned long']], + 'KernelDr6' : [ 0x20, ['unsigned long']], + 'KernelDr7' : [ 0x24, ['unsigned long']], + 'Gdtr' : [ 0x28, ['_DESCRIPTOR']], + 'Idtr' : [ 0x30, ['_DESCRIPTOR']], + 'Tr' : [ 0x38, ['unsigned short']], + 'Ldtr' : [ 0x3a, ['unsigned short']], + 'Reserved' : [ 0x3c, ['array', 6, ['unsigned long']]], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0xc, { + 'Previous' : [ 0x0, ['pointer', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x4, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_AVL_TABLE' : [ 0x38, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x10, ['pointer', ['void']]], + 'WhichOrderedElement' : [ 0x14, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x18, ['unsigned long']], + 'DepthOfTree' : [ 0x1c, ['unsigned long']], + 'RestartKey' : [ 0x20, ['pointer', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x24, ['unsigned long']], + 'CompareRoutine' : [ 0x28, ['pointer', ['void']]], + 'AllocateRoutine' : [ 0x2c, ['pointer', ['void']]], + 'FreeRoutine' : [ 0x30, ['pointer', ['void']]], + 'TableContext' : [ 0x34, ['pointer', ['void']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_DESCRIPTOR' : [ 0x8, { + 'Pad' : [ 0x0, ['unsigned short']], + 'Limit' : [ 0x2, ['unsigned short']], + 'Base' : [ 0x4, ['unsigned long']], +} ], + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x5f0, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'Reserved2' : [ 0x248, ['array', 7, ['unsigned long']]], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'AltArchitecturePad' : [ 0x2c4, ['array', 1, ['unsigned long']]], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['unsigned char']], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'TscQpcData' : [ 0x2ed, ['unsigned char']], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'SystemCall' : [ 0x300, ['unsigned long']], + 'SystemCallReturn' : [ 0x304, ['unsigned long']], + 'SystemCallPad' : [ 0x308, ['array', 3, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'DEPRECATED_Wow64SharedInformation' : [ 0x340, ['array', 16, ['unsigned long']]], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved5' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'TscQpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned short']], + 'Reserved4' : [ 0x3c6, ['unsigned short']], + 'AitSamplingValue' : [ 0x3c8, ['unsigned long']], + 'AppCompatFlag' : [ 0x3cc, ['unsigned long']], + 'DEPRECATED_SystemDllNativeRelocation' : [ 0x3d0, ['unsigned long long']], + 'DEPRECATED_SystemDllWowRelocation' : [ 0x3d8, ['unsigned long']], + 'XStatePad' : [ 0x3dc, ['array', 1, ['unsigned long']]], + 'XState' : [ 0x3e0, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_1041' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_1041']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1045' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1045']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '__unnamed_105e' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1060' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_105e']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x4, ['pointer', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x8, ['pointer', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0xc, ['pointer', ['void']]], + 'RaceDll' : [ 0x10, ['pointer', ['void']]], + 'ActivationContext' : [ 0x14, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x18, ['pointer', ['void']]], + 'u' : [ 0x1c, ['__unnamed_1060']], + 'CallbackPriority' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_INVALID'})]], + 'Size' : [ 0x24, ['unsigned long']], +} ], + '_TP_TASK' : [ 0x14, { + 'Callbacks' : [ 0x0, ['pointer', ['_TP_TASK_CALLBACKS']]], + 'NumaNode' : [ 0x4, ['unsigned long']], + 'IdealProcessor' : [ 0x8, ['unsigned char']], + 'ListEntry' : [ 0xc, ['_LIST_ENTRY']], +} ], + '_TP_TASK_CALLBACKS' : [ 0x8, { + 'ExecuteCallback' : [ 0x0, ['pointer', ['void']]], + 'Unposted' : [ 0x4, ['pointer', ['void']]], +} ], + '_TP_DIRECT' : [ 0xc, { + 'Callback' : [ 0x0, ['pointer', ['void']]], + 'NumaNode' : [ 0x4, ['unsigned long']], + 'IdealProcessor' : [ 0x8, ['unsigned char']], +} ], + '_TEB' : [ 0xfe4, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x1c, ['pointer', ['void']]], + 'ClientId' : [ 0x20, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x28, ['pointer', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x2c, ['pointer', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x30, ['pointer', ['_PEB']]], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['pointer', ['void']]], + 'Win32ThreadInfo' : [ 0x40, ['pointer', ['void']]], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['pointer', ['void']]], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'SystemReserved1' : [ 0xcc, ['array', 54, ['pointer', ['void']]]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['pointer', ['_ACTIVATION_CONTEXT_STACK']]], + 'SpareBytes' : [ 0x1ac, ['array', 36, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['pointer', ['void']]], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['pointer', ['void']]], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['pointer', ['void']]]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['pointer', ['void']]], + 'glSectionInfo' : [ 0xbe0, ['pointer', ['void']]], + 'glSection' : [ 0xbe4, ['pointer', ['void']]], + 'glTable' : [ 0xbe8, ['pointer', ['void']]], + 'glCurrentRC' : [ 0xbec, ['pointer', ['void']]], + 'glContext' : [ 0xbf0, ['pointer', ['void']]], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['pointer', ['void']]], + 'TlsSlots' : [ 0xe10, ['array', 64, ['pointer', ['void']]]], + 'TlsLinks' : [ 0xf10, ['_LIST_ENTRY']], + 'Vdm' : [ 0xf18, ['pointer', ['void']]], + 'ReservedForNtRpc' : [ 0xf1c, ['pointer', ['void']]], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['pointer', ['void']]]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['pointer', ['void']]]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['pointer', ['void']]], + 'EtwLocalData' : [ 0xf64, ['pointer', ['void']]], + 'EtwTraceData' : [ 0xf68, ['pointer', ['void']]], + 'WinSockData' : [ 0xf6c, ['pointer', ['void']]], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['pointer', ['void']]], + 'ReservedForOle' : [ 0xf80, ['pointer', ['void']]], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['pointer', ['void']]], + 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['pointer', ['void']]], + 'TlsExpansionSlots' : [ 0xf94, ['pointer', ['pointer', ['void']]]], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['pointer', ['void']]], + 'pShimData' : [ 0xfa4, ['pointer', ['void']]], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0xfac, ['pointer', ['void']]], + 'ActiveFrame' : [ 0xfb0, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0xfb4, ['pointer', ['void']]], + 'PreferredLanguages' : [ 0xfb8, ['pointer', ['void']]], + 'UserPrefLanguages' : [ 0xfbc, ['pointer', ['void']]], + 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], + 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], + 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'SpareUlong0' : [ 0xfdc, ['unsigned long']], + 'ResourceRetValue' : [ 0xfe0, ['pointer', ['void']]], +} ], + '_LIST_ENTRY' : [ 0x8, { + 'Flink' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'Blink' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x4, { + 'Next' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0xc, { + 'ChainHead' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x4, ['pointer', ['_LIST_ENTRY']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x14, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ChainHead' : [ 0xc, ['pointer', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x10, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x24, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned short']]], +} ], + '_STRING' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS' : [ 0xf8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_KPCR' : [ 0x3748, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'Used_ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Used_StackBase' : [ 0x4, ['pointer', ['void']]], + 'Spare2' : [ 0x8, ['pointer', ['void']]], + 'TssCopy' : [ 0xc, ['pointer', ['void']]], + 'ContextSwitches' : [ 0x10, ['unsigned long']], + 'SetMemberCopy' : [ 0x14, ['unsigned long']], + 'Used_Self' : [ 0x18, ['pointer', ['void']]], + 'SelfPcr' : [ 0x1c, ['pointer', ['_KPCR']]], + 'Prcb' : [ 0x20, ['pointer', ['_KPRCB']]], + 'Irql' : [ 0x24, ['unsigned char']], + 'IRR' : [ 0x28, ['unsigned long']], + 'IrrActive' : [ 0x2c, ['unsigned long']], + 'IDR' : [ 0x30, ['unsigned long']], + 'KdVersionBlock' : [ 0x34, ['pointer', ['void']]], + 'IDT' : [ 0x38, ['pointer', ['_KIDTENTRY']]], + 'GDT' : [ 0x3c, ['pointer', ['_KGDTENTRY']]], + 'TSS' : [ 0x40, ['pointer', ['_KTSS']]], + 'MajorVersion' : [ 0x44, ['unsigned short']], + 'MinorVersion' : [ 0x46, ['unsigned short']], + 'SetMember' : [ 0x48, ['unsigned long']], + 'StallScaleFactor' : [ 0x4c, ['unsigned long']], + 'SpareUnused' : [ 0x50, ['unsigned char']], + 'Number' : [ 0x51, ['unsigned char']], + 'Spare0' : [ 0x52, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x53, ['unsigned char']], + 'VdmAlert' : [ 0x54, ['unsigned long']], + 'KernelReserved' : [ 0x58, ['array', 14, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0x90, ['unsigned long']], + 'HalReserved' : [ 0x94, ['array', 16, ['unsigned long']]], + 'InterruptMode' : [ 0xd4, ['unsigned long']], + 'Spare1' : [ 0xd8, ['unsigned char']], + 'KernelReserved2' : [ 0xdc, ['array', 17, ['unsigned long']]], + 'PrcbData' : [ 0x120, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x3628, { + 'MinorVersion' : [ 0x0, ['unsigned short']], + 'MajorVersion' : [ 0x2, ['unsigned short']], + 'CurrentThread' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'NextThread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'IdleThread' : [ 0xc, ['pointer', ['_KTHREAD']]], + 'LegacyNumber' : [ 0x10, ['unsigned char']], + 'NestingLevel' : [ 0x11, ['unsigned char']], + 'BuildType' : [ 0x12, ['unsigned short']], + 'CpuType' : [ 0x14, ['unsigned char']], + 'CpuID' : [ 0x15, ['unsigned char']], + 'CpuStep' : [ 0x16, ['unsigned short']], + 'CpuStepping' : [ 0x16, ['unsigned char']], + 'CpuModel' : [ 0x17, ['unsigned char']], + 'ProcessorState' : [ 0x18, ['_KPROCESSOR_STATE']], + 'KernelReserved' : [ 0x338, ['array', 16, ['unsigned long']]], + 'HalReserved' : [ 0x378, ['array', 16, ['unsigned long']]], + 'CFlushSize' : [ 0x3b8, ['unsigned long']], + 'CoresPerPhysicalProcessor' : [ 0x3bc, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x3bd, ['unsigned char']], + 'PrcbPad0' : [ 0x3be, ['array', 2, ['unsigned char']]], + 'MHz' : [ 0x3c0, ['unsigned long']], + 'CpuVendor' : [ 0x3c4, ['unsigned char']], + 'GroupIndex' : [ 0x3c5, ['unsigned char']], + 'Group' : [ 0x3c6, ['unsigned short']], + 'GroupSetMember' : [ 0x3c8, ['unsigned long']], + 'Number' : [ 0x3cc, ['unsigned long']], + 'PrcbPad1' : [ 0x3d0, ['array', 72, ['unsigned char']]], + 'LockQueue' : [ 0x418, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'NpxThread' : [ 0x4a0, ['pointer', ['_KTHREAD']]], + 'InterruptCount' : [ 0x4a4, ['unsigned long']], + 'KernelTime' : [ 0x4a8, ['unsigned long']], + 'UserTime' : [ 0x4ac, ['unsigned long']], + 'DpcTime' : [ 0x4b0, ['unsigned long']], + 'DpcTimeCount' : [ 0x4b4, ['unsigned long']], + 'InterruptTime' : [ 0x4b8, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x4bc, ['unsigned long']], + 'PageColor' : [ 0x4c0, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x4c4, ['unsigned char']], + 'NodeColor' : [ 0x4c5, ['unsigned char']], + 'PrcbPad20' : [ 0x4c6, ['array', 2, ['unsigned char']]], + 'NodeShiftedColor' : [ 0x4c8, ['unsigned long']], + 'ParentNode' : [ 0x4cc, ['pointer', ['_KNODE']]], + 'SecondaryColorMask' : [ 0x4d0, ['unsigned long']], + 'DpcTimeLimit' : [ 0x4d4, ['unsigned long']], + 'PrcbPad21' : [ 0x4d8, ['array', 2, ['unsigned long']]], + 'CcFastReadNoWait' : [ 0x4e0, ['unsigned long']], + 'CcFastReadWait' : [ 0x4e4, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x4e8, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x4ec, ['unsigned long']], + 'CcCopyReadWait' : [ 0x4f0, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x4f4, ['unsigned long']], + 'MmSpinLockOrdering' : [ 0x4f8, ['long']], + 'IoReadOperationCount' : [ 0x4fc, ['long']], + 'IoWriteOperationCount' : [ 0x500, ['long']], + 'IoOtherOperationCount' : [ 0x504, ['long']], + 'IoReadTransferCount' : [ 0x508, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x510, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x518, ['_LARGE_INTEGER']], + 'CcFastMdlReadNoWait' : [ 0x520, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x524, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x528, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x52c, ['unsigned long']], + 'CcMapDataWait' : [ 0x530, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x534, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x538, ['unsigned long']], + 'CcPinReadWait' : [ 0x53c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x540, ['unsigned long']], + 'CcMdlReadWait' : [ 0x544, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x548, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x54c, ['unsigned long']], + 'CcLazyWritePages' : [ 0x550, ['unsigned long']], + 'CcDataFlushes' : [ 0x554, ['unsigned long']], + 'CcDataPages' : [ 0x558, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x55c, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x560, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x564, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x568, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x56c, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x570, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x574, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x578, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x57c, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x580, ['unsigned long']], + 'CcReadAheadIos' : [ 0x584, ['unsigned long']], + 'KeAlignmentFixupCount' : [ 0x588, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x58c, ['unsigned long']], + 'KeSystemCalls' : [ 0x590, ['unsigned long']], + 'AvailableTime' : [ 0x594, ['unsigned long']], + 'PrcbPad22' : [ 0x598, ['array', 2, ['unsigned long']]], + 'PPLookasideList' : [ 0x5a0, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNPagedLookasideList' : [ 0x620, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0xf20, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PacketBarrier' : [ 0x1820, ['unsigned long']], + 'ReverseStall' : [ 0x1824, ['long']], + 'IpiFrame' : [ 0x1828, ['pointer', ['void']]], + 'PrcbPad3' : [ 0x182c, ['array', 52, ['unsigned char']]], + 'CurrentPacket' : [ 0x1860, ['array', 3, ['pointer', ['void']]]], + 'TargetSet' : [ 0x186c, ['unsigned long']], + 'WorkerRoutine' : [ 0x1870, ['pointer', ['void']]], + 'IpiFrozen' : [ 0x1874, ['unsigned long']], + 'PrcbPad4' : [ 0x1878, ['array', 40, ['unsigned char']]], + 'RequestSummary' : [ 0x18a0, ['unsigned long']], + 'SignalDone' : [ 0x18a4, ['pointer', ['_KPRCB']]], + 'PrcbPad50' : [ 0x18a8, ['array', 56, ['unsigned char']]], + 'DpcData' : [ 0x18e0, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x1908, ['pointer', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x190c, ['long']], + 'DpcRequestRate' : [ 0x1910, ['unsigned long']], + 'MinimumDpcRate' : [ 0x1914, ['unsigned long']], + 'DpcLastCount' : [ 0x1918, ['unsigned long']], + 'PrcbLock' : [ 0x191c, ['unsigned long']], + 'DpcGate' : [ 0x1920, ['_KGATE']], + 'ThreadDpcEnable' : [ 0x1930, ['unsigned char']], + 'QuantumEnd' : [ 0x1931, ['unsigned char']], + 'DpcRoutineActive' : [ 0x1932, ['unsigned char']], + 'IdleSchedule' : [ 0x1933, ['unsigned char']], + 'DpcRequestSummary' : [ 0x1934, ['long']], + 'DpcRequestSlot' : [ 0x1934, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x1934, ['short']], + 'DpcThreadActive' : [ 0x1936, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ThreadDpcState' : [ 0x1936, ['short']], + 'TimerHand' : [ 0x1938, ['unsigned long']], + 'LastTick' : [ 0x193c, ['unsigned long']], + 'MasterOffset' : [ 0x1940, ['long']], + 'PrcbPad41' : [ 0x1944, ['array', 2, ['unsigned long']]], + 'PeriodicCount' : [ 0x194c, ['unsigned long']], + 'PeriodicBias' : [ 0x1950, ['unsigned long']], + 'TickOffset' : [ 0x1958, ['unsigned long long']], + 'TimerTable' : [ 0x1960, ['_KTIMER_TABLE']], + 'CallDpc' : [ 0x31a0, ['_KDPC']], + 'ClockKeepAlive' : [ 0x31c0, ['long']], + 'ClockCheckSlot' : [ 0x31c4, ['unsigned char']], + 'ClockPollCycle' : [ 0x31c5, ['unsigned char']], + 'PrcbPad6' : [ 0x31c6, ['array', 2, ['unsigned char']]], + 'DpcWatchdogPeriod' : [ 0x31c8, ['long']], + 'DpcWatchdogCount' : [ 0x31cc, ['long']], + 'ThreadWatchdogPeriod' : [ 0x31d0, ['long']], + 'ThreadWatchdogCount' : [ 0x31d4, ['long']], + 'KeSpinLockOrdering' : [ 0x31d8, ['long']], + 'PrcbPad70' : [ 0x31dc, ['array', 1, ['unsigned long']]], + 'WaitListHead' : [ 0x31e0, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x31e8, ['unsigned long']], + 'ReadySummary' : [ 0x31ec, ['unsigned long']], + 'QueueIndex' : [ 0x31f0, ['unsigned long']], + 'DeferredReadyListHead' : [ 0x31f4, ['_SINGLE_LIST_ENTRY']], + 'StartCycles' : [ 0x31f8, ['unsigned long long']], + 'CycleTime' : [ 0x3200, ['unsigned long long']], + 'HighCycleTime' : [ 0x3208, ['unsigned long']], + 'PrcbPad71' : [ 0x320c, ['unsigned long']], + 'PrcbPad72' : [ 0x3210, ['array', 2, ['unsigned long long']]], + 'DispatcherReadyListHead' : [ 0x3220, ['array', 32, ['_LIST_ENTRY']]], + 'ChainedInterruptList' : [ 0x3320, ['pointer', ['void']]], + 'LookasideIrpFloat' : [ 0x3324, ['long']], + 'MmPageFaultCount' : [ 0x3328, ['long']], + 'MmCopyOnWriteCount' : [ 0x332c, ['long']], + 'MmTransitionCount' : [ 0x3330, ['long']], + 'MmCacheTransitionCount' : [ 0x3334, ['long']], + 'MmDemandZeroCount' : [ 0x3338, ['long']], + 'MmPageReadCount' : [ 0x333c, ['long']], + 'MmPageReadIoCount' : [ 0x3340, ['long']], + 'MmCacheReadCount' : [ 0x3344, ['long']], + 'MmCacheIoCount' : [ 0x3348, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x334c, ['long']], + 'MmDirtyWriteIoCount' : [ 0x3350, ['long']], + 'MmMappedPagesWriteCount' : [ 0x3354, ['long']], + 'MmMappedWriteIoCount' : [ 0x3358, ['long']], + 'CachedCommit' : [ 0x335c, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x3360, ['unsigned long']], + 'HyperPte' : [ 0x3364, ['pointer', ['void']]], + 'PrcbPad8' : [ 0x3368, ['array', 4, ['unsigned char']]], + 'VendorString' : [ 0x336c, ['array', 13, ['unsigned char']]], + 'InitialApicId' : [ 0x3379, ['unsigned char']], + 'LogicalProcessorsPerPhysicalProcessor' : [ 0x337a, ['unsigned char']], + 'PrcbPad9' : [ 0x337b, ['array', 5, ['unsigned char']]], + 'FeatureBits' : [ 0x3380, ['unsigned long']], + 'UpdateSignature' : [ 0x3388, ['_LARGE_INTEGER']], + 'IsrTime' : [ 0x3390, ['unsigned long long']], + 'RuntimeAccumulation' : [ 0x3398, ['unsigned long long']], + 'PowerState' : [ 0x33a0, ['_PROCESSOR_POWER_STATE']], + 'DpcWatchdogDpc' : [ 0x3468, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x3488, ['_KTIMER']], + 'WheaInfo' : [ 0x34b0, ['pointer', ['void']]], + 'EtwSupport' : [ 0x34b4, ['pointer', ['void']]], + 'InterruptObjectPool' : [ 0x34b8, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x34c0, ['_SLIST_HEADER']], + 'HypercallPageVirtual' : [ 0x34c8, ['pointer', ['void']]], + 'VirtualApicAssist' : [ 0x34cc, ['pointer', ['void']]], + 'StatisticsPage' : [ 0x34d0, ['pointer', ['unsigned long long']]], + 'RateControl' : [ 0x34d4, ['pointer', ['void']]], + 'Cache' : [ 0x34d8, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x3514, ['unsigned long']], + 'CacheProcessorMask' : [ 0x3518, ['array', 5, ['unsigned long']]], + 'PackageProcessorSet' : [ 0x352c, ['_KAFFINITY_EX']], + 'PrcbPad91' : [ 0x3538, ['array', 1, ['unsigned long']]], + 'CoreProcessorSet' : [ 0x353c, ['unsigned long']], + 'TimerExpirationDpc' : [ 0x3540, ['_KDPC']], + 'SpinLockAcquireCount' : [ 0x3560, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x3564, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x3568, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0x356c, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x3570, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x3574, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x3578, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x357c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x3580, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x3584, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x3588, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x358c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x3590, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x3594, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x3598, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x359c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x35a0, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x35a4, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x35a8, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x35ac, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x35b0, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x35b4, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x35b8, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x35bc, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x35c0, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x35c4, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x35c8, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x35cc, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x35d0, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x35d4, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x35d8, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x35dc, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x35e0, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x35e4, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x35e8, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x35ec, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x35f0, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x35f4, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x35f8, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x35fc, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0x3600, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0x3604, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0x3608, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0x360c, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0x3610, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0x3614, ['unsigned long']], + 'Context' : [ 0x3618, ['pointer', ['_CONTEXT']]], + 'ContextFlags' : [ 0x361c, ['unsigned long']], + 'ExtendedState' : [ 0x3620, ['pointer', ['_XSAVE_AREA']]], +} ], + '_KAPC' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'ApcListEntry' : [ 0xc, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x14, ['pointer', ['void']]], + 'RundownRoutine' : [ 0x18, ['pointer', ['void']]], + 'NormalRoutine' : [ 0x1c, ['pointer', ['void']]], + 'NormalContext' : [ 0x20, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x24, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x28, ['pointer', ['void']]], + 'ApcStateIndex' : [ 0x2c, ['unsigned char']], + 'ApcMode' : [ 0x2d, ['unsigned char']], + 'Inserted' : [ 0x2e, ['unsigned char']], +} ], + '_KTHREAD' : [ 0x200, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'CycleTime' : [ 0x10, ['unsigned long long']], + 'HighCycleTime' : [ 0x18, ['unsigned long']], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer', ['void']]], + 'StackLimit' : [ 0x2c, ['pointer', ['void']]], + 'KernelStack' : [ 0x30, ['pointer', ['void']]], + 'ThreadLock' : [ 0x34, ['unsigned long']], + 'WaitRegister' : [ 0x38, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x39, ['unsigned char']], + 'Alerted' : [ 0x3a, ['array', 2, ['unsigned char']]], + 'KernelStackResident' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x3c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x3c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x3c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x3c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x3c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x3c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x3c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x3c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x3c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x3c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SystemThread' : [ 0x3c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Reserved' : [ 0x3c, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x3c, ['long']], + 'ApcState' : [ 0x40, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x40, ['array', 23, ['unsigned char']]], + 'Priority' : [ 0x57, ['unsigned char']], + 'NextProcessor' : [ 0x58, ['unsigned long']], + 'DeferredProcessor' : [ 0x5c, ['unsigned long']], + 'ApcQueueLock' : [ 0x60, ['unsigned long']], + 'ContextSwitches' : [ 0x64, ['unsigned long']], + 'State' : [ 0x68, ['unsigned char']], + 'NpxState' : [ 0x69, ['unsigned char']], + 'WaitIrql' : [ 0x6a, ['unsigned char']], + 'WaitMode' : [ 0x6b, ['unsigned char']], + 'WaitStatus' : [ 0x6c, ['long']], + 'WaitBlockList' : [ 0x70, ['pointer', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0x74, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x74, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0x7c, ['pointer', ['_KQUEUE']]], + 'WaitTime' : [ 0x80, ['unsigned long']], + 'KernelApcDisable' : [ 0x84, ['short']], + 'SpecialApcDisable' : [ 0x86, ['short']], + 'CombinedApcDisable' : [ 0x84, ['unsigned long']], + 'Teb' : [ 0x88, ['pointer', ['void']]], + 'Timer' : [ 0x90, ['_KTIMER']], + 'AutoAlignment' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'VdmSafe' : [ 0xb8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'UmsDispatched' : [ 0xb8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb8, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0xb8, ['long']], + 'ServiceTable' : [ 0xbc, ['pointer', ['void']]], + 'WaitBlock' : [ 0xc0, ['array', 4, ['_KWAIT_BLOCK']]], + 'QueueListEntry' : [ 0x120, ['_LIST_ENTRY']], + 'TrapFrame' : [ 0x128, ['pointer', ['_KTRAP_FRAME']]], + 'FirstArgument' : [ 0x12c, ['pointer', ['void']]], + 'CallbackStack' : [ 0x130, ['pointer', ['void']]], + 'CallbackDepth' : [ 0x130, ['unsigned long']], + 'ApcStateIndex' : [ 0x134, ['unsigned char']], + 'BasePriority' : [ 0x135, ['unsigned char']], + 'PriorityDecrement' : [ 0x136, ['unsigned char']], + 'ForegroundBoost' : [ 0x136, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x136, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x137, ['unsigned char']], + 'AdjustReason' : [ 0x138, ['unsigned char']], + 'AdjustIncrement' : [ 0x139, ['unsigned char']], + 'PreviousMode' : [ 0x13a, ['unsigned char']], + 'Saturation' : [ 0x13b, ['unsigned char']], + 'SystemCallNumber' : [ 0x13c, ['unsigned long']], + 'FreezeCount' : [ 0x140, ['unsigned long']], + 'UserAffinity' : [ 0x144, ['_GROUP_AFFINITY']], + 'Process' : [ 0x150, ['pointer', ['_KPROCESS']]], + 'Affinity' : [ 0x154, ['_GROUP_AFFINITY']], + 'IdealProcessor' : [ 0x160, ['unsigned long']], + 'UserIdealProcessor' : [ 0x164, ['unsigned long']], + 'ApcStatePointer' : [ 0x168, ['array', 2, ['pointer', ['_KAPC_STATE']]]], + 'SavedApcState' : [ 0x170, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x170, ['array', 23, ['unsigned char']]], + 'WaitReason' : [ 0x187, ['unsigned char']], + 'SuspendCount' : [ 0x188, ['unsigned char']], + 'Spare1' : [ 0x189, ['unsigned char']], + 'OtherPlatformFill' : [ 0x18a, ['unsigned char']], + 'Win32Thread' : [ 0x18c, ['pointer', ['void']]], + 'StackBase' : [ 0x190, ['pointer', ['void']]], + 'SuspendApc' : [ 0x194, ['_KAPC']], + 'SuspendApcFill0' : [ 0x194, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x195, ['unsigned char']], + 'SuspendApcFill1' : [ 0x194, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x197, ['unsigned char']], + 'SuspendApcFill2' : [ 0x194, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x198, ['unsigned long']], + 'SuspendApcFill3' : [ 0x194, ['array', 36, ['unsigned char']]], + 'WaitPrcb' : [ 0x1b8, ['pointer', ['_KPRCB']]], + 'SuspendApcFill4' : [ 0x194, ['array', 40, ['unsigned char']]], + 'LegoData' : [ 0x1bc, ['pointer', ['void']]], + 'SuspendApcFill5' : [ 0x194, ['array', 47, ['unsigned char']]], + 'LargeStack' : [ 0x1c3, ['unsigned char']], + 'UserTime' : [ 0x1c4, ['unsigned long']], + 'SuspendSemaphore' : [ 0x1c8, ['_KSEMAPHORE']], + 'SuspendSemaphorefill' : [ 0x1c8, ['array', 20, ['unsigned char']]], + 'SListFaultCount' : [ 0x1dc, ['unsigned long']], + 'ThreadListEntry' : [ 0x1e0, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x1e8, ['_LIST_ENTRY']], + 'SListFaultAddress' : [ 0x1f0, ['pointer', ['void']]], + 'ThreadCounters' : [ 0x1f4, ['pointer', ['_KTHREAD_COUNTERS']]], + 'XStateSave' : [ 0x1f8, ['pointer', ['_XSTATE_SAVE']]], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '_FAST_MUTEX' : [ 0x20, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'Contention' : [ 0x8, ['unsigned long']], + 'Event' : [ 0xc, ['_KEVENT']], + 'OldIrql' : [ 0x1c, ['unsigned long']], +} ], + '_KEVENT' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_SLIST_HEADER' : [ 0x8, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x4, ['unsigned short']], + 'Sequence' : [ 0x6, ['unsigned short']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x48, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0xc0, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_IO_STATUS_BLOCK' : [ 0x8, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer', ['void']]], + 'Information' : [ 0x4, ['unsigned long']], +} ], + '_EX_PUSH_LOCK' : [ 0x4, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x8, { + 'P' : [ 0x0, ['pointer', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x4, ['pointer', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'AllocateEx' : [ 0x28, ['pointer', ['void']]], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'FreeEx' : [ 0x2c, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], +} ], + '_EX_FAST_REF' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Value' : [ 0x0, ['unsigned long']], +} ], + '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Next' : [ 0x10, ['pointer', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'Last' : [ 0x14, ['pointer', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'Previous' : [ 0x18, ['pointer', ['_EX_PUSH_LOCK_WAIT_BLOCK']]], + 'ShareCount' : [ 0x1c, ['long']], + 'Flags' : [ 0x20, ['long']], +} ], + '_ETHREAD' : [ 0x2b8, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x200, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x208, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x208, ['_LIST_ENTRY']], + 'ExitStatus' : [ 0x210, ['long']], + 'PostBlockList' : [ 0x214, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x214, ['pointer', ['void']]], + 'StartAddress' : [ 0x218, ['pointer', ['void']]], + 'TerminationPort' : [ 0x21c, ['pointer', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x21c, ['pointer', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x21c, ['pointer', ['void']]], + 'ActiveTimerListLock' : [ 0x220, ['unsigned long']], + 'ActiveTimerListHead' : [ 0x224, ['_LIST_ENTRY']], + 'Cid' : [ 0x22c, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x234, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x234, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x248, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x24c, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x254, ['unsigned long']], + 'DeviceToVerify' : [ 0x258, ['pointer', ['_DEVICE_OBJECT']]], + 'CpuQuotaApc' : [ 0x25c, ['pointer', ['_PSP_CPU_QUOTA_APC']]], + 'Win32StartAddress' : [ 0x260, ['pointer', ['void']]], + 'LegacyPowerObject' : [ 0x264, ['pointer', ['void']]], + 'ThreadListEntry' : [ 0x268, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x270, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x274, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x278, ['unsigned long']], + 'MmLockOrdering' : [ 0x27c, ['long']], + 'CrossThreadFlags' : [ 0x280, ['unsigned long']], + 'Terminated' : [ 0x280, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x280, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x280, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x280, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x280, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x280, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x280, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x280, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x280, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x280, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x280, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x280, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x280, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x280, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x284, ['unsigned long']], + 'ActiveExWorker' : [ 0x284, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x284, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x284, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x284, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x284, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x284, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x284, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x288, ['unsigned long']], + 'Spare' : [ 0x288, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x288, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x288, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x289, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x289, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x289, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x289, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x289, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x289, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x289, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x289, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x28a, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x28a, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'PriorityRegionActive' : [ 0x28b, ['unsigned char']], + 'CacheManagerActive' : [ 0x28c, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x28d, ['unsigned char']], + 'ActiveFaultCount' : [ 0x28e, ['unsigned char']], + 'LockOrderState' : [ 0x28f, ['unsigned char']], + 'AlpcMessageId' : [ 0x290, ['unsigned long']], + 'AlpcMessage' : [ 0x294, ['pointer', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x294, ['unsigned long']], + 'AlpcWaitListEntry' : [ 0x298, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x2a0, ['unsigned long']], + 'IoBoostCount' : [ 0x2a4, ['unsigned long']], + 'IrpListLock' : [ 0x2a8, ['unsigned long']], + 'ReservedForSynchTracking' : [ 0x2ac, ['pointer', ['void']]], + 'CmCallbackListHead' : [ 0x2b0, ['_SINGLE_LIST_ENTRY']], + 'KernelStackReference' : [ 0x2b4, ['unsigned long']], +} ], + '_EPROCESS' : [ 0x2d8, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x98, ['_EX_PUSH_LOCK']], + 'CreateTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'RundownProtect' : [ 0xb0, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0xb4, ['pointer', ['void']]], + 'ActiveProcessLinks' : [ 0xb8, ['_LIST_ENTRY']], + 'ProcessQuotaUsage' : [ 0xc0, ['array', 2, ['unsigned long']]], + 'ProcessQuotaPeak' : [ 0xc8, ['array', 2, ['unsigned long']]], + 'CommitCharge' : [ 0xd0, ['unsigned long']], + 'QuotaBlock' : [ 0xd4, ['pointer', ['_EPROCESS_QUOTA_BLOCK']]], + 'CpuQuotaBlock' : [ 0xd8, ['pointer', ['_PS_CPU_QUOTA_BLOCK']]], + 'PeakVirtualSize' : [ 0xdc, ['unsigned long']], + 'VirtualSize' : [ 0xe0, ['unsigned long']], + 'SessionProcessLinks' : [ 0xe4, ['_LIST_ENTRY']], + 'DebugPort' : [ 0xec, ['pointer', ['void']]], + 'ExceptionPortData' : [ 0xf0, ['pointer', ['void']]], + 'ExceptionPortValue' : [ 0xf0, ['unsigned long']], + 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'ObjectTable' : [ 0xf4, ['pointer', ['_HANDLE_TABLE']]], + 'Token' : [ 0xf8, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0xfc, ['unsigned long']], + 'AddressCreationLock' : [ 0x100, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x104, ['pointer', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x108, ['pointer', ['_ETHREAD']]], + 'HardwareTrigger' : [ 0x10c, ['unsigned long']], + 'PhysicalVadRoot' : [ 0x110, ['pointer', ['_MM_AVL_TABLE']]], + 'CloneRoot' : [ 0x114, ['pointer', ['void']]], + 'NumberOfPrivatePages' : [ 0x118, ['unsigned long']], + 'NumberOfLockedPages' : [ 0x11c, ['unsigned long']], + 'Win32Process' : [ 0x120, ['pointer', ['void']]], + 'Job' : [ 0x124, ['pointer', ['_EJOB']]], + 'SectionObject' : [ 0x128, ['pointer', ['void']]], + 'SectionBaseAddress' : [ 0x12c, ['pointer', ['void']]], + 'Cookie' : [ 0x130, ['unsigned long']], + 'Spare8' : [ 0x134, ['unsigned long']], + 'WorkingSetWatch' : [ 0x138, ['pointer', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x13c, ['pointer', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x140, ['pointer', ['void']]], + 'LdtInformation' : [ 0x144, ['pointer', ['void']]], + 'VdmObjects' : [ 0x148, ['pointer', ['void']]], + 'ConsoleHostProcess' : [ 0x14c, ['unsigned long']], + 'DeviceMap' : [ 0x150, ['pointer', ['void']]], + 'EtwDataSource' : [ 0x154, ['pointer', ['void']]], + 'FreeTebHint' : [ 0x158, ['pointer', ['void']]], + 'PageDirectoryPte' : [ 0x160, ['_HARDWARE_PTE']], + 'Filler' : [ 0x160, ['unsigned long long']], + 'Session' : [ 0x168, ['pointer', ['void']]], + 'ImageFileName' : [ 0x16c, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x17b, ['unsigned char']], + 'JobLinks' : [ 0x17c, ['_LIST_ENTRY']], + 'LockedPagesList' : [ 0x184, ['pointer', ['void']]], + 'ThreadListHead' : [ 0x188, ['_LIST_ENTRY']], + 'SecurityPort' : [ 0x190, ['pointer', ['void']]], + 'PaeTop' : [ 0x194, ['pointer', ['void']]], + 'ActiveThreads' : [ 0x198, ['unsigned long']], + 'ImagePathHash' : [ 0x19c, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x1a0, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x1a4, ['long']], + 'Peb' : [ 0x1a8, ['pointer', ['_PEB']]], + 'PrefetchTrace' : [ 0x1ac, ['_EX_FAST_REF']], + 'ReadOperationCount' : [ 0x1b0, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x1b8, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x1c0, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x1c8, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x1d0, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x1d8, ['_LARGE_INTEGER']], + 'CommitChargeLimit' : [ 0x1e0, ['unsigned long']], + 'CommitChargePeak' : [ 0x1e4, ['unsigned long']], + 'AweInfo' : [ 0x1e8, ['pointer', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x1ec, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'Vm' : [ 0x1f0, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x25c, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x264, ['pointer', ['void']]], + 'ModifiedPageCount' : [ 0x268, ['unsigned long']], + 'Flags2' : [ 0x26c, ['unsigned long']], + 'JobNotReallyActive' : [ 0x26c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x26c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x26c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x26c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x26c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x26c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x26c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x26c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x26c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x26c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x26c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x26c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x26c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x26c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x26c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x26c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x26c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x26c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Spare1' : [ 0x26c, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x26c, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x26c, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'LowVaAccessible' : [ 0x26c, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Flags' : [ 0x270, ['unsigned long']], + 'CreateReported' : [ 0x270, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x270, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x270, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x270, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x270, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x270, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x270, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x270, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x270, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x270, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x270, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x270, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x270, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x270, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x270, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x270, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x270, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x270, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x270, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x270, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x270, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x270, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x270, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x270, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x270, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x270, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x270, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ExitStatus' : [ 0x274, ['long']], + 'VadRoot' : [ 0x278, ['_MM_AVL_TABLE']], + 'AlpcContext' : [ 0x298, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x2a8, ['_LIST_ENTRY']], + 'RequestedTimerResolution' : [ 0x2b0, ['unsigned long']], + 'ActiveThreadsHighWatermark' : [ 0x2b4, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x2b8, ['unsigned long']], + 'TimerResolutionStackRecord' : [ 0x2bc, ['pointer', ['_PO_DIAG_STACK_RECORD']]], + 'SequenceNumber' : [ 0x2c0, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x2c8, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x2d0, ['unsigned long long']], +} ], + '_KPROCESS' : [ 0x98, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x10, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x18, ['unsigned long']], + 'LdtDescriptor' : [ 0x1c, ['_KGDTENTRY']], + 'Int21Descriptor' : [ 0x24, ['_KIDTENTRY']], + 'ThreadListHead' : [ 0x2c, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x34, ['unsigned long']], + 'Affinity' : [ 0x38, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0x44, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x4c, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x50, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x5c, ['long']], + 'BasePriority' : [ 0x60, ['unsigned char']], + 'QuantumReset' : [ 0x61, ['unsigned char']], + 'Visited' : [ 0x62, ['unsigned char']], + 'Unused3' : [ 0x63, ['unsigned char']], + 'ThreadSeed' : [ 0x64, ['array', 1, ['unsigned long']]], + 'IdealNode' : [ 0x68, ['array', 1, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x6a, ['unsigned short']], + 'Flags' : [ 0x6c, ['_KEXECUTE_OPTIONS']], + 'Unused1' : [ 0x6d, ['unsigned char']], + 'IopmOffset' : [ 0x6e, ['unsigned short']], + 'Unused4' : [ 0x70, ['unsigned long']], + 'StackCount' : [ 0x74, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x80, ['unsigned long long']], + 'KernelTime' : [ 0x88, ['unsigned long']], + 'UserTime' : [ 0x8c, ['unsigned long']], + 'VdmTrapcHandler' : [ 0x90, ['pointer', ['void']]], +} ], + '__unnamed_1292' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0x74, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'AuxData' : [ 0x30, ['pointer', ['void']]], + 'Privileges' : [ 0x34, ['__unnamed_1292']], + 'AuditPrivileges' : [ 0x60, ['unsigned char']], + 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xc0, { + 'PrivilegesUsed' : [ 0x0, ['pointer', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x4, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x14, ['unsigned long']], + 'MaximumAuditMask' : [ 0x18, ['unsigned long']], + 'TransactionId' : [ 0x1c, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x30, ['pointer', ['void']]], + 'ParentSecurityDescriptor' : [ 0x34, ['pointer', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x38, ['pointer', ['void']]], + 'SDLock' : [ 0x3c, ['pointer', ['void']]], + 'AccessReasons' : [ 0x40, ['_ACCESS_REASONS']], +} ], + '__unnamed_12a1' : [ 0x4, { + 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_12a6' : [ 0x8, { + 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer', ['void']]], + 'UserApcContext' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_12a8' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_12a6']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_12b3' : [ 0x28, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], + 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x14, ['pointer', ['unsigned char']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x20, ['pointer', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x20, ['unsigned long']], + 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], +} ], + '__unnamed_12b5' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_12b3']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer', ['void']]], +} ], + '_IRP' : [ 0x70, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_12a1']], + 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x20, ['unsigned char']], + 'PendingReturned' : [ 0x21, ['unsigned char']], + 'StackCount' : [ 0x22, ['unsigned char']], + 'CurrentLocation' : [ 0x23, ['unsigned char']], + 'Cancel' : [ 0x24, ['unsigned char']], + 'CancelIrql' : [ 0x25, ['unsigned char']], + 'ApcEnvironment' : [ 0x26, ['unsigned char']], + 'AllocationFlags' : [ 0x27, ['unsigned char']], + 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], + 'Overlay' : [ 0x30, ['__unnamed_12a8']], + 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], + 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], + 'Tail' : [ 0x40, ['__unnamed_12b5']], +} ], + '__unnamed_12bc' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'FileAttributes' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'EaLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_12c0' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_12c4' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned short']], + 'ShareAccess' : [ 0xa, ['unsigned short']], + 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_12c6' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_12ca' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_12cc' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_12ce' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], +} ], + '__unnamed_12d0' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileAttributeCacheInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0xc, ['unsigned char']], + 'AdvanceOnly' : [ 0xd, ['unsigned char']], + 'ClusterCount' : [ 0xc, ['unsigned long']], + 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_12d2' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x4, ['pointer', ['void']]], + 'EaListLength' : [ 0x8, ['unsigned long']], + 'EaIndex' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_12d4' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_12d8' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_12da' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'FsControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_12dd' : [ 0x10, { + 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], + 'Key' : [ 0x4, ['unsigned long']], + 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '__unnamed_12df' : [ 0x10, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x4, ['unsigned long']], + 'IoControlCode' : [ 0x8, ['unsigned long']], + 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_12e1' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_12e3' : [ 0x8, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], +} ], + '__unnamed_12e7' : [ 0x8, { + 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_12eb' : [ 0x4, { + 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_12ef' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x4, ['pointer', ['void']]], + 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_12f3' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_12f9' : [ 0x10, { + 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned short']], + 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_12fd' : [ 0x4, { + 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_1301' : [ 0x4, { + 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_1303' : [ 0x10, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['void']]], + 'Offset' : [ 0x8, ['unsigned long']], + 'Length' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1305' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_1309' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_130d' : [ 0x8, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1311' : [ 0x8, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], +} ], + '__unnamed_1315' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_1319' : [ 0x4, { + 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_1321' : [ 0x10, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x8, ['_POWER_STATE']], + 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], +} ], + '__unnamed_1325' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1327' : [ 0x10, { + 'ProviderId' : [ 0x0, ['unsigned long']], + 'DataPath' : [ 0x4, ['pointer', ['void']]], + 'BufferSize' : [ 0x8, ['unsigned long']], + 'Buffer' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_1329' : [ 0x10, { + 'Argument1' : [ 0x0, ['pointer', ['void']]], + 'Argument2' : [ 0x4, ['pointer', ['void']]], + 'Argument3' : [ 0x8, ['pointer', ['void']]], + 'Argument4' : [ 0xc, ['pointer', ['void']]], +} ], + '__unnamed_132b' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_12bc']], + 'CreatePipe' : [ 0x0, ['__unnamed_12c0']], + 'CreateMailslot' : [ 0x0, ['__unnamed_12c4']], + 'Read' : [ 0x0, ['__unnamed_12c6']], + 'Write' : [ 0x0, ['__unnamed_12c6']], + 'QueryDirectory' : [ 0x0, ['__unnamed_12ca']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_12cc']], + 'QueryFile' : [ 0x0, ['__unnamed_12ce']], + 'SetFile' : [ 0x0, ['__unnamed_12d0']], + 'QueryEa' : [ 0x0, ['__unnamed_12d2']], + 'SetEa' : [ 0x0, ['__unnamed_12d4']], + 'QueryVolume' : [ 0x0, ['__unnamed_12d8']], + 'SetVolume' : [ 0x0, ['__unnamed_12d8']], + 'FileSystemControl' : [ 0x0, ['__unnamed_12da']], + 'LockControl' : [ 0x0, ['__unnamed_12dd']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_12df']], + 'QuerySecurity' : [ 0x0, ['__unnamed_12e1']], + 'SetSecurity' : [ 0x0, ['__unnamed_12e3']], + 'MountVolume' : [ 0x0, ['__unnamed_12e7']], + 'VerifyVolume' : [ 0x0, ['__unnamed_12e7']], + 'Scsi' : [ 0x0, ['__unnamed_12eb']], + 'QueryQuota' : [ 0x0, ['__unnamed_12ef']], + 'SetQuota' : [ 0x0, ['__unnamed_12d4']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_12f3']], + 'QueryInterface' : [ 0x0, ['__unnamed_12f9']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_12fd']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1301']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1303']], + 'SetLock' : [ 0x0, ['__unnamed_1305']], + 'QueryId' : [ 0x0, ['__unnamed_1309']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_130d']], + 'UsageNotification' : [ 0x0, ['__unnamed_1311']], + 'WaitWake' : [ 0x0, ['__unnamed_1315']], + 'PowerSequence' : [ 0x0, ['__unnamed_1319']], + 'Power' : [ 0x0, ['__unnamed_1321']], + 'StartDevice' : [ 0x0, ['__unnamed_1325']], + 'WMI' : [ 0x0, ['__unnamed_1327']], + 'Others' : [ 0x0, ['__unnamed_1329']], +} ], + '_IO_STACK_LOCATION' : [ 0x24, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x4, ['__unnamed_132b']], + 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], +} ], + '__unnamed_1341' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0xb8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x14, ['pointer', ['_IRP']]], + 'Timer' : [ 0x18, ['pointer', ['_IO_TIMER']]], + 'Flags' : [ 0x1c, ['unsigned long']], + 'Characteristics' : [ 0x20, ['unsigned long']], + 'Vpb' : [ 0x24, ['pointer', ['_VPB']]], + 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], + 'DeviceType' : [ 0x2c, ['unsigned long']], + 'StackSize' : [ 0x30, ['unsigned char']], + 'Queue' : [ 0x34, ['__unnamed_1341']], + 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], + 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0x74, ['_KDPC']], + 'ActiveThreadCount' : [ 0x94, ['unsigned long']], + 'SecurityDescriptor' : [ 0x98, ['pointer', ['void']]], + 'DeviceLock' : [ 0x9c, ['_KEVENT']], + 'SectorSize' : [ 0xac, ['unsigned short']], + 'Spare1' : [ 0xae, ['unsigned short']], + 'DeviceObjectExtension' : [ 0xb0, ['pointer', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0xb4, ['pointer', ['void']]], +} ], + '_KDPC' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'DeferredRoutine' : [ 0xc, ['pointer', ['void']]], + 'DeferredContext' : [ 0x10, ['pointer', ['void']]], + 'SystemArgument1' : [ 0x14, ['pointer', ['void']]], + 'SystemArgument2' : [ 0x18, ['pointer', ['void']]], + 'DpcData' : [ 0x1c, ['pointer', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x10, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x4, ['pointer', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x8, ['pointer', ['void']]], + 'TxnParameters' : [ 0xc, ['pointer', ['_TXN_PARAMETER_BLOCK']]], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ObjectName' : [ 0x8, ['pointer', ['_UNICODE_STRING']]], + 'Attributes' : [ 0xc, ['unsigned long']], + 'SecurityDescriptor' : [ 0x10, ['pointer', ['void']]], + 'SecurityQualityOfService' : [ 0x14, ['pointer', ['void']]], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0x80, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x8, ['pointer', ['_VPB']]], + 'FsContext' : [ 0xc, ['pointer', ['void']]], + 'FsContext2' : [ 0x10, ['pointer', ['void']]], + 'SectionObjectPointer' : [ 0x14, ['pointer', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x18, ['pointer', ['void']]], + 'FinalStatus' : [ 0x1c, ['long']], + 'RelatedFileObject' : [ 0x20, ['pointer', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x24, ['unsigned char']], + 'DeletePending' : [ 0x25, ['unsigned char']], + 'ReadAccess' : [ 0x26, ['unsigned char']], + 'WriteAccess' : [ 0x27, ['unsigned char']], + 'DeleteAccess' : [ 0x28, ['unsigned char']], + 'SharedRead' : [ 0x29, ['unsigned char']], + 'SharedWrite' : [ 0x2a, ['unsigned char']], + 'SharedDelete' : [ 0x2b, ['unsigned char']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x40, ['unsigned long']], + 'Busy' : [ 0x44, ['unsigned long']], + 'LastLock' : [ 0x48, ['pointer', ['void']]], + 'Lock' : [ 0x4c, ['_KEVENT']], + 'Event' : [ 0x5c, ['_KEVENT']], + 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0x70, ['unsigned long']], + 'IrpList' : [ 0x74, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0x7c, ['pointer', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x4, { + 'Count' : [ 0x0, ['unsigned long']], + 'Ptr' : [ 0x0, ['pointer', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x38, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0x8, ['unsigned long']], + 'CurrentFileIndex' : [ 0x8, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x24, ['pointer', ['unsigned long']]], + 'FirstFileEntry' : [ 0x28, ['pointer', ['unsigned long']]], + 'Process' : [ 0x2c, ['pointer', ['_EPROCESS']]], + 'SessionId' : [ 0x30, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer', ['unsigned long']]], + 'LastPageFrameEntry' : [ 0x24, ['pointer', ['unsigned long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x40, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0xc, ['pointer', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x10, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x28, ['pointer', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x2c, ['_LIST_ENTRY']], + 'PushLock' : [ 0x34, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x38, ['pointer', ['pointer', ['void']]]], +} ], + '_iobuf' : [ 0x20, { + '_ptr' : [ 0x0, ['pointer', ['unsigned char']]], + '_cnt' : [ 0x4, ['long']], + '_base' : [ 0x8, ['pointer', ['unsigned char']]], + '_flag' : [ 0xc, ['long']], + '_file' : [ 0x10, ['long']], + '_charbuf' : [ 0x14, ['long']], + '_bufsiz' : [ 0x18, ['long']], + '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], +} ], + '__unnamed_14ae' : [ 0x4, { + 'Long' : [ 0x0, ['unsigned long']], + 'VolatileLong' : [ 0x0, ['unsigned long']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_14ae']], +} ], + '__unnamed_14bf' : [ 0xc, { + 'I386' : [ 0x0, ['_I386_LOADER_BLOCK']], + 'Ia64' : [ 0x0, ['_IA64_LOADER_BLOCK']], +} ], + '_LOADER_PARAMETER_BLOCK' : [ 0x88, { + 'OsMajorVersion' : [ 0x0, ['unsigned long']], + 'OsMinorVersion' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'LoadOrderListHead' : [ 0x10, ['_LIST_ENTRY']], + 'MemoryDescriptorListHead' : [ 0x18, ['_LIST_ENTRY']], + 'BootDriverListHead' : [ 0x20, ['_LIST_ENTRY']], + 'KernelStack' : [ 0x28, ['unsigned long']], + 'Prcb' : [ 0x2c, ['unsigned long']], + 'Process' : [ 0x30, ['unsigned long']], + 'Thread' : [ 0x34, ['unsigned long']], + 'RegistryLength' : [ 0x38, ['unsigned long']], + 'RegistryBase' : [ 0x3c, ['pointer', ['void']]], + 'ConfigurationRoot' : [ 0x40, ['pointer', ['_CONFIGURATION_COMPONENT_DATA']]], + 'ArcBootDeviceName' : [ 0x44, ['pointer', ['unsigned char']]], + 'ArcHalDeviceName' : [ 0x48, ['pointer', ['unsigned char']]], + 'NtBootPathName' : [ 0x4c, ['pointer', ['unsigned char']]], + 'NtHalPathName' : [ 0x50, ['pointer', ['unsigned char']]], + 'LoadOptions' : [ 0x54, ['pointer', ['unsigned char']]], + 'NlsData' : [ 0x58, ['pointer', ['_NLS_DATA_BLOCK']]], + 'ArcDiskInformation' : [ 0x5c, ['pointer', ['_ARC_DISK_INFORMATION']]], + 'OemFontFile' : [ 0x60, ['pointer', ['void']]], + 'Extension' : [ 0x64, ['pointer', ['_LOADER_PARAMETER_EXTENSION']]], + 'u' : [ 0x68, ['__unnamed_14bf']], + 'FirmwareInformation' : [ 0x74, ['_FIRMWARE_INFORMATION_LOADER_BLOCK']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0xc, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x8, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x14, { + 'Total' : [ 0x0, ['unsigned long']], + 'ListName' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x8, ['unsigned long']], + 'Blink' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_14f0' : [ 0x4, { + 'Flink' : [ 0x0, ['unsigned long']], + 'WsIndex' : [ 0x0, ['unsigned long']], + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_14f2' : [ 0x4, { + 'Blink' : [ 0x0, ['unsigned long']], + 'ImageProtoPte' : [ 0x0, ['pointer', ['_MMPTE']]], + 'ShareCount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_14f5' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'VolatileReferenceCount' : [ 0x0, ['short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_14f7' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_14f5']], +} ], + '__unnamed_14fc' : [ 0x4, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMPFN' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_14f0']], + 'u2' : [ 0x4, ['__unnamed_14f2']], + 'PteAddress' : [ 0x8, ['pointer', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x8, ['pointer', ['void']]], + 'Lock' : [ 0x8, ['long']], + 'PteLong' : [ 0x8, ['unsigned long']], + 'u3' : [ 0xc, ['__unnamed_14f7']], + 'OriginalPte' : [ 0x10, ['_MMPTE']], + 'AweReferenceCount' : [ 0x10, ['long']], + 'u4' : [ 0x14, ['__unnamed_14fc']], +} ], + '_MI_COLOR_BASE' : [ 0x8, { + 'ColorPointer' : [ 0x0, ['pointer', ['unsigned short']]], + 'ColorMask' : [ 0x4, ['unsigned short']], + 'ColorNode' : [ 0x6, ['unsigned short']], +} ], + '_MMSUPPORT' : [ 0x6c, { + 'WorkingSetMutex' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ExitGate' : [ 0x4, ['pointer', ['_KGATE']]], + 'AccessLog' : [ 0x8, ['pointer', ['void']]], + 'WorkingSetExpansionLinks' : [ 0xc, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x14, ['array', 7, ['unsigned long']]], + 'MinimumWorkingSetSize' : [ 0x30, ['unsigned long']], + 'WorkingSetSize' : [ 0x34, ['unsigned long']], + 'WorkingSetPrivateSize' : [ 0x38, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0x3c, ['unsigned long']], + 'ChargedWslePages' : [ 0x40, ['unsigned long']], + 'ActualWslePages' : [ 0x44, ['unsigned long']], + 'WorkingSetSizeOverhead' : [ 0x48, ['unsigned long']], + 'PeakWorkingSetSize' : [ 0x4c, ['unsigned long']], + 'HardFaultCount' : [ 0x50, ['unsigned long']], + 'VmWorkingSetList' : [ 0x54, ['pointer', ['_MMWSL']]], + 'NextPageColor' : [ 0x58, ['unsigned short']], + 'LastTrimStamp' : [ 0x5a, ['unsigned short']], + 'PageFaultCount' : [ 0x5c, ['unsigned long']], + 'RepurposeCount' : [ 0x60, ['unsigned long']], + 'Spare' : [ 0x64, ['array', 1, ['unsigned long']]], + 'Flags' : [ 0x68, ['_MMSUPPORT_FLAGS']], +} ], + '_MMWSL' : [ 0x6a8, { + 'FirstFree' : [ 0x0, ['unsigned long']], + 'FirstDynamic' : [ 0x4, ['unsigned long']], + 'LastEntry' : [ 0x8, ['unsigned long']], + 'NextSlot' : [ 0xc, ['unsigned long']], + 'Wsle' : [ 0x10, ['pointer', ['_MMWSLE']]], + 'LowestPagableAddress' : [ 0x14, ['pointer', ['void']]], + 'LastInitializedWsle' : [ 0x18, ['unsigned long']], + 'NextAgingSlot' : [ 0x1c, ['unsigned long']], + 'NumberOfCommittedPageTables' : [ 0x20, ['unsigned long']], + 'VadBitMapHint' : [ 0x24, ['unsigned long']], + 'NonDirectCount' : [ 0x28, ['unsigned long']], + 'LastVadBit' : [ 0x2c, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x30, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0x34, ['unsigned long']], + 'LastAllocationSize' : [ 0x38, ['unsigned long']], + 'NonDirectHash' : [ 0x3c, ['pointer', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x40, ['pointer', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x44, ['pointer', ['_MMWSLE_HASH']]], + 'UsedPageTableEntries' : [ 0x48, ['array', 768, ['unsigned short']]], + 'CommittedPageTables' : [ 0x648, ['array', 24, ['unsigned long']]], +} ], + '__unnamed_152c' : [ 0x4, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'Long' : [ 0x0, ['unsigned long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x4, { + 'u1' : [ 0x0, ['__unnamed_152c']], +} ], + '__unnamed_1538' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_1542' : [ 0xc, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], + 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_1544' : [ 0xc, { + 'e2' : [ 0x0, ['__unnamed_1542']], +} ], + '_CONTROL_AREA' : [ 0x50, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'DereferenceList' : [ 0x4, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0xc, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x10, ['unsigned long']], + 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], + 'NumberOfUserReferences' : [ 0x18, ['unsigned long']], + 'u' : [ 0x1c, ['__unnamed_1538']], + 'FlushInProgressCount' : [ 0x20, ['unsigned long']], + 'FilePointer' : [ 0x24, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x28, ['long']], + 'ModifiedWriteCount' : [ 0x2c, ['unsigned long']], + 'StartingFrame' : [ 0x2c, ['unsigned long']], + 'WaitList' : [ 0x30, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x34, ['__unnamed_1544']], + 'LockedPages' : [ 0x40, ['unsigned long long']], + 'ViewList' : [ 0x48, ['_LIST_ENTRY']], +} ], + '_MM_STORE_KEY' : [ 0x4, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28, native_type='unsigned long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'EntireKey' : [ 0x0, ['unsigned long']], +} ], + '_MMPAGING_FILE' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'MinimumSize' : [ 0x8, ['unsigned long']], + 'FreeSpace' : [ 0xc, ['unsigned long']], + 'PeakUsage' : [ 0x10, ['unsigned long']], + 'HighestPage' : [ 0x14, ['unsigned long']], + 'File' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], + 'Entry' : [ 0x1c, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PageFileName' : [ 0x24, ['_UNICODE_STRING']], + 'Bitmap' : [ 0x2c, ['pointer', ['_RTL_BITMAP']]], + 'EvictStoreBitmap' : [ 0x30, ['pointer', ['_RTL_BITMAP']]], + 'BitmapHint' : [ 0x34, ['unsigned long']], + 'LastAllocationSize' : [ 0x38, ['unsigned long']], + 'ToBeEvictedCount' : [ 0x3c, ['unsigned long']], + 'PageFileNumber' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x42, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x42, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'FileHandle' : [ 0x44, ['pointer', ['void']]], + 'Lock' : [ 0x48, ['unsigned long']], + 'LockOwner' : [ 0x4c, ['pointer', ['_ETHREAD']]], +} ], + '_RTL_BITMAP' : [ 0x8, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], +} ], + '_MM_AVL_TABLE' : [ 0x20, { + 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'NodeHint' : [ 0x18, ['pointer', ['void']]], + 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], +} ], + '__unnamed_1584' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], + 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], +} ], + '__unnamed_1587' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_158a' : [ 0x4, { + 'LongFlags3' : [ 0x0, ['unsigned long']], + 'VadFlags3' : [ 0x0, ['_MMVAD_FLAGS3']], +} ], + '_MMVAD_SHORT' : [ 0x20, { + 'u1' : [ 0x0, ['__unnamed_1584']], + 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], + 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'u' : [ 0x14, ['__unnamed_1587']], + 'PushLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x1c, ['__unnamed_158a']], +} ], + '__unnamed_1592' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], + 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], +} ], + '_MMADDRESS_NODE' : [ 0x14, { + 'u1' : [ 0x0, ['__unnamed_1592']], + 'LeftChild' : [ 0x4, ['pointer', ['_MMADDRESS_NODE']]], + 'RightChild' : [ 0x8, ['pointer', ['_MMADDRESS_NODE']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_1597' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '_MMVAD' : [ 0x3c, { + 'u1' : [ 0x0, ['__unnamed_1584']], + 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], + 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'u' : [ 0x14, ['__unnamed_1587']], + 'PushLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x1c, ['__unnamed_158a']], + 'u2' : [ 0x20, ['__unnamed_1597']], + 'Subsection' : [ 0x24, ['pointer', ['_SUBSECTION']]], + 'MappedSubsection' : [ 0x24, ['pointer', ['_MSUBSECTION']]], + 'FirstPrototypePte' : [ 0x28, ['pointer', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x2c, ['pointer', ['_MMPTE']]], + 'ViewLinks' : [ 0x30, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x38, ['pointer', ['_EPROCESS']]], +} ], + '__unnamed_15a2' : [ 0x20, { + 'Mdl' : [ 0x0, ['_MDL']], + 'Page' : [ 0x1c, ['array', 1, ['unsigned long']]], +} ], + '_MI_PAGEFILE_TRACES' : [ 0x40, { + 'Status' : [ 0x0, ['long']], + 'Priority' : [ 0x4, ['unsigned char']], + 'IrpPriority' : [ 0x5, ['unsigned char']], + 'CurrentTime' : [ 0x8, ['_LARGE_INTEGER']], + 'AvailablePages' : [ 0x10, ['unsigned long']], + 'ModifiedPagesTotal' : [ 0x14, ['unsigned long']], + 'ModifiedPagefilePages' : [ 0x18, ['unsigned long']], + 'ModifiedNoWritePages' : [ 0x1c, ['unsigned long']], + 'MdlHack' : [ 0x20, ['__unnamed_15a2']], +} ], + '__unnamed_15a8' : [ 0x8, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '__unnamed_15aa' : [ 0x4, { + 'KeepForever' : [ 0x0, ['unsigned long']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0x60, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x8, ['__unnamed_15a8']], + 'Irp' : [ 0x10, ['pointer', ['_IRP']]], + 'u1' : [ 0x14, ['__unnamed_15aa']], + 'PagingFile' : [ 0x18, ['pointer', ['_MMPAGING_FILE']]], + 'File' : [ 0x1c, ['pointer', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x20, ['pointer', ['_CONTROL_AREA']]], + 'FileResource' : [ 0x24, ['pointer', ['_ERESOURCE']]], + 'WriteOffset' : [ 0x28, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0x30, ['_LARGE_INTEGER']], + 'PointerMdl' : [ 0x38, ['pointer', ['_MDL']]], + 'Mdl' : [ 0x3c, ['_MDL']], + 'Page' : [ 0x58, ['array', 1, ['unsigned long']]], +} ], + '_MDL' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MDL']]], + 'Size' : [ 0x4, ['short']], + 'MdlFlags' : [ 0x6, ['short']], + 'Process' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0xc, ['pointer', ['void']]], + 'StartVa' : [ 0x10, ['pointer', ['void']]], + 'ByteCount' : [ 0x14, ['unsigned long']], + 'ByteOffset' : [ 0x18, ['unsigned long']], +} ], + '_HHIVE' : [ 0x2ec, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x4, ['pointer', ['void']]], + 'ReleaseCellRoutine' : [ 0x8, ['pointer', ['void']]], + 'Allocate' : [ 0xc, ['pointer', ['void']]], + 'Free' : [ 0x10, ['pointer', ['void']]], + 'FileSetSize' : [ 0x14, ['pointer', ['void']]], + 'FileWrite' : [ 0x18, ['pointer', ['void']]], + 'FileRead' : [ 0x1c, ['pointer', ['void']]], + 'FileFlush' : [ 0x20, ['pointer', ['void']]], + 'HiveLoadFailure' : [ 0x24, ['pointer', ['void']]], + 'BaseBlock' : [ 0x28, ['pointer', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x2c, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x34, ['unsigned long']], + 'DirtyAlloc' : [ 0x38, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x3c, ['unsigned long']], + 'Cluster' : [ 0x40, ['unsigned long']], + 'Flat' : [ 0x44, ['unsigned char']], + 'ReadOnly' : [ 0x45, ['unsigned char']], + 'DirtyFlag' : [ 0x46, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x48, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x4c, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x50, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x54, ['unsigned long']], + 'HiveFlags' : [ 0x58, ['unsigned long']], + 'CurrentLog' : [ 0x5c, ['unsigned long']], + 'LogSize' : [ 0x60, ['array', 2, ['unsigned long']]], + 'RefreshCount' : [ 0x68, ['unsigned long']], + 'StorageTypeCount' : [ 0x6c, ['unsigned long']], + 'Version' : [ 0x70, ['unsigned long']], + 'Storage' : [ 0x74, ['array', 2, ['_DUAL']]], +} ], + '_CM_VIEW_OF_FILE' : [ 0x30, { + 'MappedViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'PinnedViewLinks' : [ 0x8, ['_LIST_ENTRY']], + 'FlushedViewLinks' : [ 0x10, ['_LIST_ENTRY']], + 'CmHive' : [ 0x18, ['pointer', ['_CMHIVE']]], + 'Bcb' : [ 0x1c, ['pointer', ['void']]], + 'ViewAddress' : [ 0x20, ['pointer', ['void']]], + 'FileOffset' : [ 0x24, ['unsigned long']], + 'Size' : [ 0x28, ['unsigned long']], + 'UseCount' : [ 0x2c, ['unsigned long']], +} ], + '_CMHIVE' : [ 0x638, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0x2ec, ['array', 6, ['pointer', ['void']]]], + 'NotifyList' : [ 0x304, ['_LIST_ENTRY']], + 'HiveList' : [ 0x30c, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0x314, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0x31c, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0x320, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0x328, ['pointer', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0x32c, ['unsigned long']], + 'Identity' : [ 0x330, ['unsigned long']], + 'HiveLock' : [ 0x334, ['pointer', ['_FAST_MUTEX']]], + 'ViewLock' : [ 0x338, ['_EX_PUSH_LOCK']], + 'ViewLockOwner' : [ 0x33c, ['pointer', ['_KTHREAD']]], + 'ViewLockLast' : [ 0x340, ['unsigned long']], + 'ViewUnLockLast' : [ 0x344, ['unsigned long']], + 'WriterLock' : [ 0x348, ['pointer', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0x34c, ['pointer', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0x350, ['_RTL_BITMAP']], + 'FlushOffsetArray' : [ 0x358, ['pointer', ['CMP_OFFSET_ARRAY']]], + 'FlushOffsetArrayCount' : [ 0x35c, ['unsigned long']], + 'FlushHiveTruncated' : [ 0x360, ['unsigned long']], + 'FlushLock2' : [ 0x364, ['pointer', ['_FAST_MUTEX']]], + 'SecurityLock' : [ 0x368, ['_EX_PUSH_LOCK']], + 'MappedViewList' : [ 0x36c, ['_LIST_ENTRY']], + 'PinnedViewList' : [ 0x374, ['_LIST_ENTRY']], + 'FlushedViewList' : [ 0x37c, ['_LIST_ENTRY']], + 'MappedViewCount' : [ 0x384, ['unsigned short']], + 'PinnedViewCount' : [ 0x386, ['unsigned short']], + 'UseCount' : [ 0x388, ['unsigned long']], + 'ViewsPerHive' : [ 0x38c, ['unsigned long']], + 'FileObject' : [ 0x390, ['pointer', ['_FILE_OBJECT']]], + 'LastShrinkHiveSize' : [ 0x394, ['unsigned long']], + 'ActualFileSize' : [ 0x398, ['_LARGE_INTEGER']], + 'FileFullPath' : [ 0x3a0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0x3a8, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0x3b0, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0x3b8, ['unsigned long']], + 'SecurityCacheSize' : [ 0x3bc, ['unsigned long']], + 'SecurityHitHint' : [ 0x3c0, ['long']], + 'SecurityCache' : [ 0x3c4, ['pointer', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0x3c8, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0x5c8, ['unsigned long']], + 'UnloadEventArray' : [ 0x5cc, ['pointer', ['pointer', ['_KEVENT']]]], + 'RootKcb' : [ 0x5d0, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0x5d4, ['unsigned char']], + 'UnloadWorkItem' : [ 0x5d8, ['pointer', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0x5dc, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0x5f0, ['unsigned char']], + 'GrowOffset' : [ 0x5f4, ['unsigned long']], + 'KcbConvertListHead' : [ 0x5f8, ['_LIST_ENTRY']], + 'KnodeConvertListHead' : [ 0x600, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0x608, ['pointer', ['_CM_CELL_REMAP_BLOCK']]], + 'Flags' : [ 0x60c, ['unsigned long']], + 'TrustClassEntry' : [ 0x610, ['_LIST_ENTRY']], + 'FlushCount' : [ 0x618, ['unsigned long']], + 'CmRm' : [ 0x61c, ['pointer', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0x620, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0x624, ['long']], + 'CreatorOwner' : [ 0x628, ['pointer', ['_KTHREAD']]], + 'RundownThread' : [ 0x62c, ['pointer', ['_KTHREAD']]], + 'LastWriteTime' : [ 0x630, ['_LARGE_INTEGER']], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0xa0, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0xc, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0xc, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x14, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], + 'KcbPushlock' : [ 0x1c, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x20, ['pointer', ['_KTHREAD']]], + 'SharedCount' : [ 0x20, ['long']], + 'SlotHint' : [ 0x24, ['unsigned long']], + 'ParentKcb' : [ 0x28, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x2c, ['pointer', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x30, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x34, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x3c, ['pointer', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x3c, ['unsigned long']], + 'SubKeyCount' : [ 0x3c, ['unsigned long']], + 'KeyBodyListHead' : [ 0x40, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x48, ['array', 4, ['pointer', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0x58, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0x60, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0x62, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0x64, ['unsigned long']], + 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KCBUoWListHead' : [ 0x6c, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0x74, ['_LIST_ENTRY']], + 'Stolen' : [ 0x74, ['pointer', ['unsigned char']]], + 'TransKCBOwner' : [ 0x7c, ['pointer', ['_CM_TRANS']]], + 'KCBLock' : [ 0x80, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x88, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x90, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x98, ['pointer', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x9c, ['pointer', ['_UNICODE_STRING']]], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0xc, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'Entry' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], +} ], + '__unnamed_162f' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapAndCopy', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpReadFileImageAndBuildMap', 8: '_HvpRecoverData', 9: '_HvpRecoverWholeHive', 10: '_HvpMapFileImageAndBuildMap', 11: '_CmpValidateHiveSecurityDescriptors', 12: '_HvpEnlistBinInMap', 13: '_CmCheckRegistry', 14: '_CmRegistryIO', 15: '_CmCheckRegistry2', 16: '_CmpCheckKey', 17: '_CmpCheckValueList', 18: '_HvCheckHive', 19: '_HvCheckBin'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1632' : [ 0xc, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x4, ['pointer', ['void']]], + 'Status' : [ 0x8, ['long']], +} ], + '__unnamed_1634' : [ 0x4, { + 'CheckStack' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1636' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x4, ['pointer', ['_CELL_DATA']]], + 'RootPoint' : [ 0x8, ['pointer', ['void']]], + 'Index' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1638' : [ 0x10, { + 'List' : [ 0x0, ['pointer', ['_CELL_DATA']]], + 'Index' : [ 0x4, ['unsigned long']], + 'Cell' : [ 0x8, ['unsigned long']], + 'CellPoint' : [ 0xc, ['pointer', ['_CELL_DATA']]], +} ], + '__unnamed_163c' : [ 0xc, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer', ['_HBIN']]], +} ], + '__unnamed_1640' : [ 0x8, { + 'Bin' : [ 0x0, ['pointer', ['_HBIN']]], + 'CellPoint' : [ 0x4, ['pointer', ['_HCELL']]], +} ], + '__unnamed_1642' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x120, { + 'Hive' : [ 0x0, ['pointer', ['_HHIVE']]], + 'Index' : [ 0x4, ['unsigned long']], + 'RecoverableIndex' : [ 0x8, ['unsigned long']], + 'Locations' : [ 0xc, ['array', 8, ['__unnamed_162f']]], + 'RecoverableLocations' : [ 0x6c, ['array', 8, ['__unnamed_162f']]], + 'RegistryIO' : [ 0xcc, ['__unnamed_1632']], + 'CheckRegistry2' : [ 0xd8, ['__unnamed_1634']], + 'CheckKey' : [ 0xdc, ['__unnamed_1636']], + 'CheckValueList' : [ 0xec, ['__unnamed_1638']], + 'CheckHive' : [ 0xfc, ['__unnamed_163c']], + 'CheckHive1' : [ 0x108, ['__unnamed_163c']], + 'CheckBin' : [ 0x114, ['__unnamed_1640']], + 'RecoverData' : [ 0x11c, ['__unnamed_1642']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x8, ['unsigned long']], + 'Counters' : [ 0xc, ['pointer', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x10, ['pointer', ['void']]], + 'CallbackContext' : [ 0x14, ['pointer', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0x80, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'DpcCount' : [ 0x38, ['unsigned long']], + 'DpcRate' : [ 0x3c, ['unsigned long']], + 'C1Time' : [ 0x40, ['unsigned long long']], + 'C2Time' : [ 0x48, ['unsigned long long']], + 'C3Time' : [ 0x50, ['unsigned long long']], + 'C1Transitions' : [ 0x58, ['unsigned long long']], + 'C2Transitions' : [ 0x60, ['unsigned long long']], + 'C3Transitions' : [ 0x68, ['unsigned long long']], + 'ParkingStatus' : [ 0x70, ['unsigned long']], + 'CurrentFrequency' : [ 0x74, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x78, ['unsigned long']], + 'StateFlags' : [ 0x7c, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x8, { + 'Data' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_TEB32' : [ 0xfe4, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'SystemReserved1' : [ 0xcc, ['array', 54, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'SpareBytes' : [ 0x1ac, ['array', 36, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'EtwLocalData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'SpareUlong0' : [ 0xfdc, ['unsigned long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], +} ], + '_TEB64' : [ 0x1818, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'SystemReserved1' : [ 0x110, ['array', 54, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'SpareBytes' : [ 0x2d0, ['array', 24, ['unsigned char']]], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'EtwLocalData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'SoftPatchPtr1' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'SpareUlong0' : [ 0x180c, ['unsigned long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], +} ], + '_KTIMER_TABLE' : [ 0x1840, { + 'TimerExpiry' : [ 0x0, ['array', 16, ['pointer', ['_KTIMER']]]], + 'TimerEntries' : [ 0x40, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Entry' : [ 0x4, ['_LIST_ENTRY']], + 'Time' : [ 0x10, ['_ULARGE_INTEGER']], +} ], + '_KAFFINITY_EX' : [ 0xc, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KAFFINITY_ENUMERATION_CONTEXT' : [ 0xc, { + 'Affinity' : [ 0x0, ['pointer', ['_KAFFINITY_EX']]], + 'CurrentMask' : [ 0x4, ['unsigned long']], + 'CurrentIndex' : [ 0x8, ['unsigned short']], +} ], + '_GROUP_AFFINITY' : [ 0xc, { + 'Mask' : [ 0x0, ['unsigned long']], + 'Group' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['array', 3, ['unsigned short']]], +} ], + '_XSTATE_SAVE' : [ 0x20, { + 'Reserved1' : [ 0x0, ['long long']], + 'Reserved2' : [ 0x8, ['unsigned long']], + 'Prev' : [ 0xc, ['pointer', ['_XSTATE_SAVE']]], + 'Reserved3' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Thread' : [ 0x14, ['pointer', ['_KTHREAD']]], + 'Reserved4' : [ 0x18, ['pointer', ['void']]], + 'Level' : [ 0x1c, ['unsigned char']], + 'XStateContext' : [ 0x0, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_FXSAVE_FORMAT' : [ 0x1e0, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned short']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned long']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned long']], + 'MXCsr' : [ 0x18, ['unsigned long']], + 'MXCsrMask' : [ 0x1c, ['unsigned long']], + 'RegisterArea' : [ 0x20, ['array', 128, ['unsigned char']]], + 'Reserved3' : [ 0xa0, ['array', 128, ['unsigned char']]], + 'Reserved4' : [ 0x120, ['array', 192, ['unsigned char']]], +} ], + '_FNSAVE_FORMAT' : [ 0x6c, { + 'ControlWord' : [ 0x0, ['unsigned long']], + 'StatusWord' : [ 0x4, ['unsigned long']], + 'TagWord' : [ 0x8, ['unsigned long']], + 'ErrorOffset' : [ 0xc, ['unsigned long']], + 'ErrorSelector' : [ 0x10, ['unsigned long']], + 'DataOffset' : [ 0x14, ['unsigned long']], + 'DataSelector' : [ 0x18, ['unsigned long']], + 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], +} ], + '_KSTACK_AREA' : [ 0x210, { + 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], + 'NpxFrame' : [ 0x0, ['_FXSAVE_FORMAT']], + 'StackControl' : [ 0x1e0, ['_KERNEL_STACK_CONTROL']], + 'Cr0NpxState' : [ 0x1fc, ['unsigned long']], + 'Padding' : [ 0x200, ['array', 4, ['unsigned long']]], +} ], + '_KERNEL_STACK_CONTROL' : [ 0x1c, { + 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], + 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], + 'StackControlFlags' : [ 0x4, ['unsigned long']], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned short']], + 'Logging' : [ 0x12, ['unsigned char']], + 'Reserved' : [ 0x13, ['unsigned char']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x8, ['unsigned long']], + 'CompletedList' : [ 0xc, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x14, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x28, ['unsigned long']], +} ], + '_KSEMAPHORE' : [ 0x14, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x10, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x3c, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x8, ['unsigned long']], + 'Dope' : [ 0xc, ['pointer', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x10, ['unsigned long']], + 'DeviceNode' : [ 0x14, ['pointer', ['void']]], + 'AttachedTo' : [ 0x18, ['pointer', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x1c, ['long']], + 'StartIoKey' : [ 0x20, ['long']], + 'StartIoFlags' : [ 0x24, ['unsigned long']], + 'Vpb' : [ 0x28, ['pointer', ['_VPB']]], + 'DependentList' : [ 0x2c, ['_LIST_ENTRY']], + 'ProviderList' : [ 0x34, ['_LIST_ENTRY']], +} ], + '__unnamed_1744' : [ 0x4, { + 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1746' : [ 0x4, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], +} ], + '__unnamed_174a' : [ 0x10, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x188, { + 'Sibling' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], + 'Child' : [ 0x4, ['pointer', ['_DEVICE_NODE']]], + 'Parent' : [ 0x8, ['pointer', ['_DEVICE_NODE']]], + 'LastChild' : [ 0xc, ['pointer', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x14, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x1c, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'Level' : [ 0x28, ['unsigned long']], + 'Notify' : [ 0x2c, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0x68, ['_PO_IRP_MANAGER']], + 'State' : [ 0x78, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0x7c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0x80, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0xd0, ['unsigned long']], + 'CompletionStatus' : [ 0xd4, ['long']], + 'Flags' : [ 0xd8, ['unsigned long']], + 'UserFlags' : [ 0xdc, ['unsigned long']], + 'Problem' : [ 0xe0, ['unsigned long']], + 'ResourceList' : [ 0xe4, ['pointer', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0xec, ['pointer', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0xf0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0xf4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0xf8, ['unsigned long']], + 'ChildInterfaceType' : [ 0xfc, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x100, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x104, ['unsigned short']], + 'RemovalPolicy' : [ 0x106, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x107, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x108, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x110, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x118, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x120, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x122, ['unsigned short']], + 'NoArbiterMask' : [ 0x124, ['unsigned short']], + 'QueryArbiterMask' : [ 0x126, ['unsigned short']], + 'OverUsed1' : [ 0x128, ['__unnamed_1744']], + 'OverUsed2' : [ 0x12c, ['__unnamed_1746']], + 'BootResources' : [ 0x130, ['pointer', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x134, ['pointer', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x138, ['unsigned long']], + 'DockInfo' : [ 0x13c, ['__unnamed_174a']], + 'DisableableDepends' : [ 0x14c, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x150, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x160, ['unsigned long']], + 'PreviousParent' : [ 0x164, ['pointer', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x168, ['unsigned long']], + 'NumaNodeIndex' : [ 0x16c, ['unsigned long']], + 'ContainerID' : [ 0x170, ['_GUID']], + 'OverrideFlags' : [ 0x180, ['unsigned char']], + 'RequiresUnloadedDriver' : [ 0x181, ['unsigned char']], + 'PendingEjectRelations' : [ 0x184, ['pointer', ['_PENDING_RELATIONS_LIST_ENTRY']]], +} ], + '_KNODE' : [ 0x80, { + 'PagedPoolSListHead' : [ 0x0, ['_SLIST_HEADER']], + 'NonPagedPoolSListHead' : [ 0x8, ['array', 3, ['_SLIST_HEADER']]], + 'Affinity' : [ 0x20, ['_GROUP_AFFINITY']], + 'ProximityId' : [ 0x2c, ['unsigned long']], + 'NodeNumber' : [ 0x30, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x32, ['unsigned short']], + 'MaximumProcessors' : [ 0x34, ['unsigned char']], + 'Color' : [ 0x35, ['unsigned char']], + 'Flags' : [ 0x36, ['_flags']], + 'NodePad0' : [ 0x37, ['unsigned char']], + 'Seed' : [ 0x38, ['unsigned long']], + 'MmShiftedColor' : [ 0x3c, ['unsigned long']], + 'FreeCount' : [ 0x40, ['array', 2, ['unsigned long']]], + 'CachedKernelStacks' : [ 0x48, ['_CACHED_KSTACK_LIST']], + 'ParkLock' : [ 0x60, ['long']], + 'NodePad1' : [ 0x64, ['unsigned long']], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0xc, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x28, { + 'PhysicalDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x4, ['unsigned long']], + 'AllocationType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0xc, ['unsigned long']], + 'Position' : [ 0x10, ['unsigned long']], + 'ResourceRequirements' : [ 0x14, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x18, ['pointer', ['void']]], + 'ResourceAssignment' : [ 0x1c, ['pointer', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x20, ['pointer', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x24, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_17f3' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_17f3']], +} ], + '__unnamed_17fa' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_17fa']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_X86_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_POP_CPU_INFO' : [ 0x10, { + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_VOLUME_CACHE_MAP' : [ 0x20, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0xc, ['_LIST_ENTRY']], + 'Flags' : [ 0x14, ['unsigned long']], + 'DirtyPages' : [ 0x18, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0x1c, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x160, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x18, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x28, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x30, ['array', 4, ['pointer', ['_VACB']]]], + 'Vacbs' : [ 0x40, ['pointer', ['pointer', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x44, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x4c, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x50, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x58, ['_LIST_ENTRY']], + 'Flags' : [ 0x60, ['unsigned long']], + 'Status' : [ 0x64, ['long']], + 'Mbcb' : [ 0x68, ['pointer', ['_MBCB']]], + 'Section' : [ 0x6c, ['pointer', ['void']]], + 'CreateEvent' : [ 0x70, ['pointer', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0x74, ['pointer', ['_KEVENT']]], + 'PagesToWrite' : [ 0x78, ['unsigned long']], + 'BeyondLastFlush' : [ 0x80, ['long long']], + 'Callbacks' : [ 0x88, ['pointer', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0x8c, ['pointer', ['void']]], + 'PrivateList' : [ 0x90, ['_LIST_ENTRY']], + 'LogHandle' : [ 0x98, ['pointer', ['void']]], + 'FlushToLsnRoutine' : [ 0x9c, ['pointer', ['void']]], + 'DirtyPageThreshold' : [ 0xa0, ['unsigned long']], + 'LazyWritePassCount' : [ 0xa4, ['unsigned long']], + 'UninitializeEvent' : [ 0xa8, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0xac, ['_KGUARDED_MUTEX']], + 'LastUnmapBehindOffset' : [ 0xd0, ['_LARGE_INTEGER']], + 'Event' : [ 0xd8, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0xe8, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0xf0, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x148, ['pointer', ['void']]], + 'VolumeCacheMap' : [ 0x14c, ['pointer', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x150, ['unsigned long']], + 'WritesInProgress' : [ 0x154, ['unsigned long']], + 'PipelinedReadAheadSize' : [ 0x158, ['unsigned long']], +} ], + '__unnamed_186a' : [ 0x8, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], +} ], + '_VACB' : [ 0x20, { + 'BaseAddress' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x8, ['__unnamed_186a']], + 'Links' : [ 0x10, ['_LIST_ENTRY']], + 'ArrayHead' : [ 0x18, ['pointer', ['_VACB_ARRAY_HEADER']]], +} ], + '_KGUARDED_MUTEX' : [ 0x20, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x4, ['pointer', ['_KTHREAD']]], + 'Contention' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0xc, ['_KGATE']], + 'KernelApcDisable' : [ 0x1c, ['short']], + 'SpecialApcDisable' : [ 0x1e, ['short']], + 'CombinedApcDisable' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_1888' : [ 0x4, { + 'FileObject' : [ 0x0, ['pointer', ['_FILE_OBJECT']]], +} ], + '__unnamed_188a' : [ 0x4, { + 'SharedCacheMap' : [ 0x0, ['pointer', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_188c' : [ 0x4, { + 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], +} ], + '__unnamed_188e' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1890' : [ 0x4, { + 'Read' : [ 0x0, ['__unnamed_1888']], + 'Write' : [ 0x0, ['__unnamed_188a']], + 'Event' : [ 0x0, ['__unnamed_188c']], + 'Notification' : [ 0x0, ['__unnamed_188e']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x10, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x8, ['__unnamed_1890']], + 'Function' : [ 0xc, ['unsigned char']], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x10, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x8, ['pointer', ['void']]], + 'VacbLevelsAllocated' : [ 0xc, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { + 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x4, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x24, { + 'ExtendedLookup' : [ 0x0, ['pointer', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x4, ['unsigned long']], + 'ExtraItem' : [ 0x8, ['unsigned long']], + 'ItemCount' : [ 0xc, ['unsigned long']], + 'OutOfRangeItems' : [ 0x10, ['unsigned long']], + 'BaseIndex' : [ 0x14, ['unsigned long']], + 'ListHead' : [ 0x18, ['pointer', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x1c, ['pointer', ['unsigned long']]], + 'ListHints' : [ 0x20, ['pointer', ['pointer', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x138, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], + 'Flags' : [ 0x40, ['unsigned long']], + 'ForceFlags' : [ 0x44, ['unsigned long']], + 'CompatibilityFlags' : [ 0x48, ['unsigned long']], + 'EncodeFlagMask' : [ 0x4c, ['unsigned long']], + 'Encoding' : [ 0x50, ['_HEAP_ENTRY']], + 'PointerKey' : [ 0x58, ['unsigned long']], + 'Interceptor' : [ 0x5c, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x60, ['unsigned long']], + 'Signature' : [ 0x64, ['unsigned long']], + 'SegmentReserve' : [ 0x68, ['unsigned long']], + 'SegmentCommit' : [ 0x6c, ['unsigned long']], + 'DeCommitFreeBlockThreshold' : [ 0x70, ['unsigned long']], + 'DeCommitTotalFreeThreshold' : [ 0x74, ['unsigned long']], + 'TotalFreeSize' : [ 0x78, ['unsigned long']], + 'MaximumAllocationSize' : [ 0x7c, ['unsigned long']], + 'ProcessHeapsListIndex' : [ 0x80, ['unsigned short']], + 'HeaderValidateLength' : [ 0x82, ['unsigned short']], + 'HeaderValidateCopy' : [ 0x84, ['pointer', ['void']]], + 'NextAvailableTagIndex' : [ 0x88, ['unsigned short']], + 'MaximumTagIndex' : [ 0x8a, ['unsigned short']], + 'TagEntries' : [ 0x8c, ['pointer', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0x90, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x98, ['unsigned long']], + 'AlignMask' : [ 0x9c, ['unsigned long']], + 'VirtualAllocdBlocks' : [ 0xa0, ['_LIST_ENTRY']], + 'SegmentList' : [ 0xa8, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0xb0, ['unsigned short']], + 'NonDedicatedListLength' : [ 0xb4, ['unsigned long']], + 'BlocksIndex' : [ 0xb8, ['pointer', ['void']]], + 'UCRIndex' : [ 0xbc, ['pointer', ['void']]], + 'PseudoTagEntries' : [ 0xc0, ['pointer', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0xc4, ['_LIST_ENTRY']], + 'LockVariable' : [ 0xcc, ['pointer', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0xd0, ['pointer', ['void']]], + 'FrontEndHeap' : [ 0xd4, ['pointer', ['void']]], + 'FrontHeapLockCount' : [ 0xd8, ['unsigned short']], + 'FrontEndHeapType' : [ 0xda, ['unsigned char']], + 'Counters' : [ 0xdc, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x130, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_18e1' : [ 0x18, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], +} ], + '_HEAP_LOCK' : [ 0x18, { + 'Lock' : [ 0x0, ['__unnamed_18e1']], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x18, { + 'DebugInfo' : [ 0x0, ['pointer', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x4, ['long']], + 'RecursionCount' : [ 0x8, ['long']], + 'OwningThread' : [ 0xc, ['pointer', ['void']]], + 'LockSemaphore' : [ 0x10, ['pointer', ['void']]], + 'SpinCount' : [ 0x14, ['unsigned long']], +} ], + '_HEAP_ENTRY' : [ 0x8, { + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['pointer', ['void']]], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x40, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['unsigned long']], + 'SegmentListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Heap' : [ 0x18, ['pointer', ['_HEAP']]], + 'BaseAddress' : [ 0x1c, ['pointer', ['void']]], + 'NumberOfPages' : [ 0x20, ['unsigned long']], + 'FirstEntry' : [ 0x24, ['pointer', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x28, ['pointer', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x2c, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x30, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x34, ['unsigned short']], + 'Reserved' : [ 0x36, ['unsigned short']], + 'UCRSegmentList' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned char']], + 'SmallTagIndex' : [ 0x3, ['unsigned char']], + 'SubSegmentCode' : [ 0x0, ['pointer', ['void']]], + 'PreviousSize' : [ 0x4, ['unsigned short']], + 'SegmentOffset' : [ 0x6, ['unsigned char']], + 'LFHFlags' : [ 0x6, ['unsigned char']], + 'UnusedBytes' : [ 0x7, ['unsigned char']], + 'FunctionIndex' : [ 0x0, ['unsigned short']], + 'ContextValue' : [ 0x2, ['unsigned short']], + 'InterceptorValue' : [ 0x0, ['unsigned long']], + 'UnusedBytesLength' : [ 0x4, ['unsigned short']], + 'EntryOffset' : [ 0x6, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0x7, ['unsigned char']], + 'Code1' : [ 0x0, ['unsigned long']], + 'Code2' : [ 0x4, ['unsigned short']], + 'Code3' : [ 0x6, ['unsigned char']], + 'Code4' : [ 0x7, ['unsigned char']], + 'AgregateCode' : [ 0x0, ['unsigned long long']], + 'FreeList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_PEB' : [ 0x248, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['pointer', ['void']]], + 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], + 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x10, ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x14, ['pointer', ['void']]], + 'ProcessHeap' : [ 0x18, ['pointer', ['void']]], + 'FastPebLock' : [ 0x1c, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], + 'IFEOKey' : [ 0x24, ['pointer', ['void']]], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], + 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['pointer', ['void']]], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['pointer', ['void']]], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['pointer', ['void']]], + 'HotpatchInformation' : [ 0x50, ['pointer', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x54, ['pointer', ['pointer', ['void']]]], + 'AnsiCodePageData' : [ 0x58, ['pointer', ['void']]], + 'OemCodePageData' : [ 0x5c, ['pointer', ['void']]], + 'UnicodeCaseTableData' : [ 0x60, ['pointer', ['void']]], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['pointer', ['pointer', ['void']]]], + 'GdiSharedHandleTable' : [ 0x94, ['pointer', ['void']]], + 'ProcessStarterHelper' : [ 0x98, ['pointer', ['void']]], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['pointer', ['void']]], + 'TlsExpansionBitmap' : [ 0x150, ['pointer', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['pointer', ['void']]], + 'AppCompatInfo' : [ 0x1ec, ['pointer', ['void']]], + 'CSDVersion' : [ 0x1f0, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x1f8, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x200, ['pointer', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x204, ['pointer', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['pointer', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x210, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x218, ['pointer', ['void']]], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['pointer', ['void']]], + 'WerShipAssertPtr' : [ 0x234, ['pointer', ['void']]], + 'pContextData' : [ 0x238, ['pointer', ['void']]], + 'pImageHeaderHash' : [ 0x23c, ['pointer', ['void']]], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '_PEB_LDR_DATA' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer', ['void']]], + 'InLoadOrderModuleList' : [ 0xc, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x14, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x1c, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x24, ['pointer', ['void']]], + 'ShutdownInProgress' : [ 0x28, ['unsigned char']], + 'ShutdownThreadId' : [ 0x2c, ['pointer', ['void']]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0x78, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x8, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DllBase' : [ 0x18, ['pointer', ['void']]], + 'EntryPoint' : [ 0x1c, ['pointer', ['void']]], + 'SizeOfImage' : [ 0x20, ['unsigned long']], + 'FullDllName' : [ 0x24, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x2c, ['_UNICODE_STRING']], + 'Flags' : [ 0x34, ['unsigned long']], + 'LoadCount' : [ 0x38, ['unsigned short']], + 'TlsIndex' : [ 0x3a, ['unsigned short']], + 'HashLinks' : [ 0x3c, ['_LIST_ENTRY']], + 'SectionPointer' : [ 0x3c, ['pointer', ['void']]], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'TimeDateStamp' : [ 0x44, ['unsigned long']], + 'LoadedImports' : [ 0x44, ['pointer', ['void']]], + 'EntryPointActivationContext' : [ 0x48, ['pointer', ['_ACTIVATION_CONTEXT']]], + 'PatchInformation' : [ 0x4c, ['pointer', ['void']]], + 'ForwarderLinks' : [ 0x50, ['_LIST_ENTRY']], + 'ServiceTagLinks' : [ 0x58, ['_LIST_ENTRY']], + 'StaticLinks' : [ 0x60, ['_LIST_ENTRY']], + 'ContextInformation' : [ 0x68, ['pointer', ['void']]], + 'OriginalBase' : [ 0x6c, ['unsigned long']], + 'LoadTime' : [ 0x70, ['_LARGE_INTEGER']], +} ], + '_HEAP_SUBSEGMENT' : [ 0x20, { + 'LocalInfo' : [ 0x0, ['pointer', ['_HEAP_LOCAL_SEGMENT_INFO']]], + 'UserBlocks' : [ 0x4, ['pointer', ['_HEAP_USERDATA_HEADER']]], + 'AggregateExchg' : [ 0x8, ['_INTERLOCK_SEQ']], + 'BlockSize' : [ 0x10, ['unsigned short']], + 'Flags' : [ 0x12, ['unsigned short']], + 'BlockCount' : [ 0x14, ['unsigned short']], + 'SizeIndex' : [ 0x16, ['unsigned char']], + 'AffinityIndex' : [ 0x17, ['unsigned char']], + 'Alignment' : [ 0x10, ['array', 2, ['unsigned long']]], + 'SFreeListEntry' : [ 0x18, ['_SINGLE_LIST_ENTRY']], + 'Lock' : [ 0x1c, ['unsigned long']], +} ], + '__unnamed_1960' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1962' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1960']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1964' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1966' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1964']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1962']], + 'u2' : [ 0x4, ['__unnamed_1966']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x4, { + 'Object' : [ 0x0, ['pointer', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x24, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'CreatedObjects' : [ 0xc, ['unsigned long']], + 'DeletedObjects' : [ 0x10, ['unsigned long']], + 'DeleteProcedure' : [ 0x14, ['pointer', ['void']]], + 'DestroyProcedure' : [ 0x18, ['pointer', ['void']]], + 'UsualSize' : [ 0x1c, ['unsigned long']], + 'LookasideIndex' : [ 0x20, ['unsigned long']], +} ], + '__unnamed_1982' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1984' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1982']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x18, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'u1' : [ 0x8, ['__unnamed_1984']], + 'ResourceId' : [ 0x9, ['unsigned char']], + 'CachedReferences' : [ 0xa, ['short']], + 'ReferenceCount' : [ 0xc, ['long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'Pad' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1996' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1998' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1996']], +} ], + '_KALPC_SECTION' : [ 0x28, { + 'SectionObject' : [ 0x0, ['pointer', ['void']]], + 'Size' : [ 0x4, ['unsigned long']], + 'HandleTable' : [ 0x8, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0xc, ['pointer', ['void']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0x14, ['pointer', ['_ALPC_PORT']]], + 'u1' : [ 0x18, ['__unnamed_1998']], + 'NumberOfRegions' : [ 0x1c, ['unsigned long']], + 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '__unnamed_199e' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_19a0' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_199e']], +} ], + '_KALPC_REGION' : [ 0x30, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x8, ['pointer', ['_KALPC_SECTION']]], + 'Offset' : [ 0xc, ['unsigned long']], + 'Size' : [ 0x10, ['unsigned long']], + 'ViewSize' : [ 0x14, ['unsigned long']], + 'u1' : [ 0x18, ['__unnamed_19a0']], + 'NumberOfViews' : [ 0x1c, ['unsigned long']], + 'ViewListHead' : [ 0x20, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x28, ['pointer', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x2c, ['pointer', ['_KALPC_VIEW']]], +} ], + '__unnamed_19a6' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_19a8' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19a6']], +} ], + '_KALPC_VIEW' : [ 0x34, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x8, ['pointer', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'Address' : [ 0x14, ['pointer', ['void']]], + 'Size' : [ 0x18, ['unsigned long']], + 'SecureViewHandle' : [ 0x1c, ['pointer', ['void']]], + 'WriteAccessHandle' : [ 0x20, ['pointer', ['void']]], + 'u1' : [ 0x24, ['__unnamed_19a8']], + 'NumberOfOwnerMessages' : [ 0x28, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x2c, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x24, { + 'ConnectionPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x4, ['pointer', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x8, ['pointer', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0xc, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], +} ], + '__unnamed_19c4' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_19c6' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19c4']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0xfc, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'CompletionPort' : [ 0x10, ['pointer', ['void']]], + 'CompletionKey' : [ 0x14, ['pointer', ['void']]], + 'CompletionPacketLookaside' : [ 0x18, ['pointer', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x1c, ['pointer', ['void']]], + 'StaticSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'MainQueue' : [ 0x5c, ['_LIST_ENTRY']], + 'PendingQueue' : [ 0x64, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0x6c, ['_LIST_ENTRY']], + 'WaitQueue' : [ 0x74, ['_LIST_ENTRY']], + 'Semaphore' : [ 0x7c, ['pointer', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0x7c, ['pointer', ['_KEVENT']]], + 'PortAttributes' : [ 0x80, ['_ALPC_PORT_ATTRIBUTES']], + 'Lock' : [ 0xac, ['_EX_PUSH_LOCK']], + 'ResourceListLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0xb4, ['_LIST_ENTRY']], + 'CompletionList' : [ 0xbc, ['pointer', ['_ALPC_COMPLETION_LIST']]], + 'MessageZone' : [ 0xc0, ['pointer', ['_ALPC_MESSAGE_ZONE']]], + 'CallbackObject' : [ 0xc4, ['pointer', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0xc8, ['pointer', ['void']]], + 'CanceledQueue' : [ 0xcc, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0xd4, ['long']], + 'u1' : [ 0xd8, ['__unnamed_19c6']], + 'TargetQueuePort' : [ 0xdc, ['pointer', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0xe0, ['pointer', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0xe4, ['pointer', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0xe8, ['unsigned long']], + 'PendingQueueLength' : [ 0xec, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0xf0, ['unsigned long']], + 'CanceledQueueLength' : [ 0xf4, ['unsigned long']], + 'WaitQueueLength' : [ 0xf8, ['unsigned long']], +} ], + '_OBJECT_TYPE' : [ 0x88, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x10, ['pointer', ['void']]], + 'Index' : [ 0x14, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x18, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x1c, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x20, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x24, ['unsigned long']], + 'TypeInfo' : [ 0x28, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0x78, ['_EX_PUSH_LOCK']], + 'Key' : [ 0x7c, ['unsigned long']], + 'CallbackList' : [ 0x80, ['_LIST_ENTRY']], +} ], + '__unnamed_19df' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], +} ], + '__unnamed_19e1' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_19df']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x88, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtensionBuffer' : [ 0x8, ['pointer', ['void']]], + 'ExtensionBufferSize' : [ 0xc, ['unsigned long']], + 'QuotaProcess' : [ 0x10, ['pointer', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x10, ['pointer', ['void']]], + 'SequenceNo' : [ 0x14, ['long']], + 'u1' : [ 0x18, ['__unnamed_19e1']], + 'CancelSequencePort' : [ 0x1c, ['pointer', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x20, ['pointer', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x24, ['long']], + 'CancelListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'WaitingThread' : [ 0x30, ['pointer', ['_ETHREAD']]], + 'Reserve' : [ 0x34, ['pointer', ['_KALPC_RESERVE']]], + 'PortQueue' : [ 0x38, ['pointer', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x3c, ['pointer', ['_ALPC_PORT']]], + 'MessageAttributes' : [ 0x40, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0x5c, ['pointer', ['void']]], + 'DataSystemVa' : [ 0x60, ['pointer', ['void']]], + 'CommunicationInfo' : [ 0x64, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0x68, ['pointer', ['_ALPC_PORT']]], + 'ServerThread' : [ 0x6c, ['pointer', ['_ETHREAD']]], + 'PortMessage' : [ 0x70, ['_PORT_MESSAGE']], +} ], + '_REMOTE_PORT_VIEW' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x4, ['unsigned long']], + 'ViewBase' : [ 0x8, ['pointer', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x14, { + 'OwnerPort' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x4, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x8, ['pointer', ['void']]], + 'Message' : [ 0xc, ['pointer', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x10, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['pointer', ['_OB_DUPLICATE_OBJECT_STATE']]], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x1c, { + 'ClientContext' : [ 0x0, ['pointer', ['void']]], + 'ServerContext' : [ 0x4, ['pointer', ['void']]], + 'PortContext' : [ 0x8, ['pointer', ['void']]], + 'CancelPortContext' : [ 0xc, ['pointer', ['void']]], + 'SecurityData' : [ 0x10, ['pointer', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x14, ['pointer', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], +} ], + '__unnamed_1a1e' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1a20' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a1e']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x50, { + 'HandleTable' : [ 0x0, ['pointer', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x4, ['pointer', ['void']]], + 'OwningProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'OwnerPort' : [ 0xc, ['pointer', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x10, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x4c, ['__unnamed_1a20']], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x8, ['unsigned long']], + 'KeyContext' : [ 0xc, ['pointer', ['void']]], + 'ApcContext' : [ 0x10, ['pointer', ['void']]], + 'IoStatus' : [ 0x14, ['long']], + 'IoStatusInformation' : [ 0x18, ['unsigned long']], + 'MiniPacketCallback' : [ 0x1c, ['pointer', ['void']]], + 'Context' : [ 0x20, ['pointer', ['void']]], + 'Allocated' : [ 0x24, ['unsigned char']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x20, { + 'PortObject' : [ 0x0, ['pointer', ['_ALPC_PORT']]], + 'Message' : [ 0x4, ['pointer', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x8, ['pointer', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'TargetPort' : [ 0x10, ['pointer', ['_ALPC_PORT']]], + 'Flags' : [ 0x14, ['unsigned long']], + 'TotalLength' : [ 0x18, ['unsigned short']], + 'Type' : [ 0x1a, ['unsigned short']], + 'DataInfoOffset' : [ 0x1c, ['unsigned short']], +} ], + '_DRIVER_OBJECT' : [ 0xa8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'DriverStart' : [ 0xc, ['pointer', ['void']]], + 'DriverSize' : [ 0x10, ['unsigned long']], + 'DriverSection' : [ 0x14, ['pointer', ['void']]], + 'DriverExtension' : [ 0x18, ['pointer', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x1c, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x28, ['pointer', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x2c, ['pointer', ['void']]], + 'DriverStartIo' : [ 0x30, ['pointer', ['void']]], + 'DriverUnload' : [ 0x34, ['pointer', ['void']]], + 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x14, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0xc, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x24, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x4, ['array', 7, ['pointer', ['void']]]], + 'FoIoPriorityHint' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0x70, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x8, ['long']], + 'Information' : [ 0xc, ['unsigned long']], + 'ParseCheck' : [ 0x10, ['unsigned long']], + 'RelatedFileObject' : [ 0x14, ['pointer', ['_FILE_OBJECT']]], + 'OriginalAttributes' : [ 0x18, ['pointer', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x28, ['unsigned long']], + 'FileAttributes' : [ 0x2c, ['unsigned short']], + 'ShareAccess' : [ 0x2e, ['unsigned short']], + 'EaBuffer' : [ 0x30, ['pointer', ['void']]], + 'EaLength' : [ 0x34, ['unsigned long']], + 'Options' : [ 0x38, ['unsigned long']], + 'Disposition' : [ 0x3c, ['unsigned long']], + 'BasicInformation' : [ 0x40, ['pointer', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x44, ['pointer', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x4c, ['pointer', ['void']]], + 'Override' : [ 0x50, ['unsigned char']], + 'QueryOnly' : [ 0x51, ['unsigned char']], + 'DeleteOnly' : [ 0x52, ['unsigned char']], + 'FullAttributes' : [ 0x53, ['unsigned char']], + 'LocalFileObject' : [ 0x54, ['pointer', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x58, ['unsigned long']], + 'DriverCreateContext' : [ 0x5c, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '_RTL_RB_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_BALANCED_NODE' : [ 0xc, { + 'Children' : [ 0x0, ['array', 2, ['pointer', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x4, ['pointer', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x8, ['unsigned long']], +} ], + '_RTL_AVL_TREE' : [ 0x4, { + 'Root' : [ 0x0, ['pointer', ['_RTL_BALANCED_NODE']]], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x248, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'CollectionOn' : [ 0xc, ['long']], + 'LoggerMode' : [ 0x10, ['unsigned long']], + 'AcceptNewEvents' : [ 0x14, ['long']], + 'GetCpuClock' : [ 0x18, ['pointer', ['void']]], + 'StartTime' : [ 0x20, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x28, ['pointer', ['void']]], + 'LoggerThread' : [ 0x2c, ['pointer', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x30, ['long']], + 'NBQHead' : [ 0x34, ['pointer', ['void']]], + 'OverflowNBQHead' : [ 0x38, ['pointer', ['void']]], + 'QueueBlockFreeList' : [ 0x40, ['_SLIST_HEADER']], + 'GlobalList' : [ 0x48, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x50, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x50, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x54, ['_UNICODE_STRING']], + 'LogFileName' : [ 0x5c, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0x64, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0x6c, ['_UNICODE_STRING']], + 'ClockType' : [ 0x74, ['unsigned long']], + 'MaximumFileSize' : [ 0x78, ['unsigned long']], + 'LastFlushedBuffer' : [ 0x7c, ['unsigned long']], + 'FlushTimer' : [ 0x80, ['unsigned long']], + 'FlushThreshold' : [ 0x84, ['unsigned long']], + 'ByteOffset' : [ 0x88, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0x90, ['unsigned long']], + 'BuffersAvailable' : [ 0x94, ['long']], + 'NumberOfBuffers' : [ 0x98, ['long']], + 'MaximumBuffers' : [ 0x9c, ['unsigned long']], + 'EventsLost' : [ 0xa0, ['unsigned long']], + 'BuffersWritten' : [ 0xa4, ['unsigned long']], + 'LogBuffersLost' : [ 0xa8, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0xac, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0xb0, ['unsigned long']], + 'SequencePtr' : [ 0xb4, ['pointer', ['long']]], + 'LocalSequence' : [ 0xb8, ['unsigned long']], + 'InstanceGuid' : [ 0xbc, ['_GUID']], + 'FileCounter' : [ 0xcc, ['long']], + 'BufferCallback' : [ 0xd0, ['pointer', ['void']]], + 'PoolType' : [ 0xd4, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0xd8, ['_ETW_REF_CLOCK']], + 'Consumers' : [ 0xe8, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0xf0, ['unsigned long']], + 'TransitionConsumer' : [ 0xf4, ['pointer', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0xf8, ['pointer', ['void']]], + 'RealtimeLogfileName' : [ 0xfc, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x108, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x110, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x118, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x120, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x128, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x130, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x138, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x148, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x14c, ['_KEVENT']], + 'FlushEvent' : [ 0x15c, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x170, ['_KTIMER']], + 'FlushDpc' : [ 0x198, ['_KDPC']], + 'LoggerMutex' : [ 0x1b8, ['_KMUTANT']], + 'LoggerLock' : [ 0x1d8, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x1dc, ['unsigned long']], + 'BufferListPushLock' : [ 0x1dc, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x1e0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x21c, ['pointer', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x220, ['_EX_FAST_REF']], + 'BufferSequenceNumber' : [ 0x228, ['long long']], + 'Flags' : [ 0x230, ['unsigned long']], + 'Persistent' : [ 0x230, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x230, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x230, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x230, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x230, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x230, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x230, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x230, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x230, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x230, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'RequestFlag' : [ 0x234, ['unsigned long']], + 'RequestNewFie' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x234, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x234, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x234, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x234, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HookIdMap' : [ 0x238, ['_RTL_BITMAP']], + 'DisallowedGuids' : [ 0x240, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_ETW_BUFFER_HANDLE' : [ 0x8, { + 'TraceBuffer' : [ 0x0, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'BufferFastRef' : [ 0x4, ['pointer', ['_EX_FAST_REF']]], +} ], + '_SYSTEM_TRACE_HEADER' : [ 0x20, { + 'Marker' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['unsigned char']], + 'Header' : [ 0x4, ['unsigned long']], + 'Packet' : [ 0x4, ['_WMI_TRACE_PACKET']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'SystemTime' : [ 0x10, ['_LARGE_INTEGER']], + 'KernelTime' : [ 0x18, ['unsigned long']], + 'UserTime' : [ 0x1c, ['unsigned long']], +} ], + '_PERFINFO_TRACE_HEADER' : [ 0x18, { + 'Marker' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['unsigned char']], + 'Header' : [ 0x4, ['unsigned long']], + 'Packet' : [ 0x4, ['_WMI_TRACE_PACKET']], + 'TS' : [ 0x8, ['unsigned long long']], + 'SystemTime' : [ 0x8, ['_LARGE_INTEGER']], + 'Data' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_NBQUEUE_BLOCK' : [ 0x18, { + 'SListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Next' : [ 0x8, ['unsigned long long']], + 'Data' : [ 0x10, ['unsigned long long']], +} ], + '_TlgProvider_t' : [ 0x30, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x4, ['pointer', ['unsigned short']]], + 'KeywordAny' : [ 0x8, ['unsigned long long']], + 'KeywordAll' : [ 0x10, ['unsigned long long']], + 'RegHandle' : [ 0x18, ['unsigned long long']], + 'EnableCallback' : [ 0x20, ['pointer', ['void']]], + 'CallbackContext' : [ 0x24, ['pointer', ['void']]], + 'AnnotationFunc' : [ 0x28, ['pointer', ['void']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KMUTANT' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x18, ['pointer', ['_KTHREAD']]], + 'Abandoned' : [ 0x1c, ['unsigned char']], + 'ApcDisable' : [ 0x1d, ['unsigned char']], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '_TRACE_ENABLE_CONTEXT' : [ 0x8, { + 'LoggerId' : [ 0x0, ['unsigned short']], + 'Level' : [ 0x2, ['unsigned char']], + 'InternalFlag' : [ 0x3, ['unsigned char']], + 'EnableFlags' : [ 0x4, ['unsigned long']], +} ], + '_TRACE_ENABLE_CONTEXT_EX' : [ 0x10, { + 'LoggerId' : [ 0x0, ['unsigned short']], + 'Level' : [ 0x2, ['unsigned char']], + 'InternalFlag' : [ 0x3, ['unsigned char']], + 'EnableFlags' : [ 0x4, ['unsigned long']], + 'EnableFlagsHigh' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_ETW_GUID_ENTRY' : [ 0x178, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x8, ['long']], + 'Guid' : [ 0xc, ['_GUID']], + 'RegListHead' : [ 0x1c, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x24, ['pointer', ['void']]], + 'LastEnable' : [ 0x28, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x28, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x38, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x58, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x158, ['array', 8, ['pointer', ['_EVENT_FILTER_HEADER']]]], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x1e0, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x34, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x74, ['unsigned long']], + 'UserAndGroupCount' : [ 0x78, ['unsigned long']], + 'RestrictedSidCount' : [ 0x7c, ['unsigned long']], + 'VariableLength' : [ 0x80, ['unsigned long']], + 'DynamicCharged' : [ 0x84, ['unsigned long']], + 'DynamicAvailable' : [ 0x88, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x8c, ['unsigned long']], + 'UserAndGroups' : [ 0x90, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0x94, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0x98, ['pointer', ['void']]], + 'DynamicPart' : [ 0x9c, ['pointer', ['unsigned long']]], + 'DefaultDacl' : [ 0xa0, ['pointer', ['_ACL']]], + 'TokenType' : [ 0xa4, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xac, ['unsigned long']], + 'TokenInUse' : [ 0xb0, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xb4, ['unsigned long']], + 'MandatoryPolicy' : [ 0xb8, ['unsigned long']], + 'LogonSession' : [ 0xbc, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xc0, ['_LUID']], + 'SidHash' : [ 0xc8, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x150, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x1d8, ['pointer', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'VariablePart' : [ 0x1dc, ['unsigned long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0x34, { + 'Next' : [ 0x0, ['pointer', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x4, ['_LUID']], + 'BuddyLogonId' : [ 0xc, ['_LUID']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'pDeviceMap' : [ 0x1c, ['pointer', ['_DEVICE_MAP']]], + 'Token' : [ 0x20, ['pointer', ['void']]], + 'AccountName' : [ 0x24, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x2c, ['_UNICODE_STRING']], +} ], + '_OBJECT_HEADER' : [ 0x20, { + 'PointerCount' : [ 0x0, ['long']], + 'HandleCount' : [ 0x4, ['long']], + 'NextToFree' : [ 0x4, ['pointer', ['void']]], + 'Lock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0xc, ['unsigned char']], + 'TraceFlags' : [ 0xd, ['unsigned char']], + 'InfoMask' : [ 0xe, ['unsigned char']], + 'Flags' : [ 0xf, ['unsigned char']], + 'ObjectCreateInfo' : [ 0x10, ['pointer', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x10, ['pointer', ['void']]], + 'SecurityDescriptor' : [ 0x14, ['pointer', ['void']]], + 'Body' : [ 0x18, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x10, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0xc, ['pointer', ['void']]], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x8, { + 'ExclusiveProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'Reserved' : [ 0x4, ['unsigned long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x8, { + 'HandleCountDataBase' : [ 0x0, ['pointer', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x10, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x4, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0xc, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x10, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x8, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x14, { + 'Directory' : [ 0x0, ['pointer', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x4, ['pointer', ['void']]], + 'HashValue' : [ 0x8, ['unsigned long']], + 'HashIndex' : [ 0xc, ['unsigned short']], + 'DirectoryLocked' : [ 0xe, ['unsigned char']], + 'LockedExclusive' : [ 0xf, ['unsigned char']], + 'LockStateSignature' : [ 0x10, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0xa8, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x94, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x98, ['pointer', ['_DEVICE_MAP']]], + 'SessionId' : [ 0x9c, ['unsigned long']], + 'NamespaceEntry' : [ 0xa0, ['pointer', ['void']]], + 'Flags' : [ 0xa4, ['unsigned long']], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { + 'ImpersonationData' : [ 0x0, ['unsigned long']], + 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MMVAD_FLAGS3' : [ 0x4, { + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { + 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'Reserved1' : [ 0xa8, ['array', 85, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_ERESOURCE' : [ 0x38, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x8, ['pointer', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0xc, ['short']], + 'Flag' : [ 0xe, ['unsigned short']], + 'SharedWaiters' : [ 0x10, ['pointer', ['_KSEMAPHORE']]], + 'ExclusiveWaiters' : [ 0x14, ['pointer', ['_KEVENT']]], + 'OwnerEntry' : [ 0x18, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x28, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x2c, ['unsigned long']], + 'Address' : [ 0x30, ['pointer', ['void']]], + 'CreatorBackTraceIndex' : [ 0x30, ['unsigned long']], + 'SpinLock' : [ 0x34, ['unsigned long']], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x30, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x4, ['unsigned long']], + 'SenderPort' : [ 0x8, ['pointer', ['void']]], + 'RepliedToThread' : [ 0xc, ['pointer', ['_ETHREAD']]], + 'PortContext' : [ 0x10, ['pointer', ['void']]], + 'Request' : [ 0x18, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_DUAL' : [ 0x13c, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x4, ['pointer', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x8, ['pointer', ['_HMAP_TABLE']]], + 'Guard' : [ 0xc, ['unsigned long']], + 'FreeDisplay' : [ 0x10, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeSummary' : [ 0x130, ['unsigned long']], + 'FreeBins' : [ 0x134, ['_LIST_ENTRY']], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x2c, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long']], + 'MemoryBandwidth' : [ 0x14, ['unsigned long']], + 'MaxPoolUsage' : [ 0x18, ['unsigned long']], + 'MaxSectionSize' : [ 0x1c, ['unsigned long']], + 'MaxViewSize' : [ 0x20, ['unsigned long']], + 'MaxTotalSectionSize' : [ 0x24, ['unsigned long']], + 'DupObjectTypes' : [ 0x28, ['unsigned long']], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_KQUEUE' : [ 0x28, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x10, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x18, ['unsigned long']], + 'MaximumCount' : [ 0x1c, ['unsigned long']], + 'ThreadListHead' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_DISPATCHER_HEADER' : [ 0x10, { + 'Type' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'Abandoned' : [ 0x1, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'DpcActive' : [ 0x3, ['unsigned char']], + 'Lock' : [ 0x0, ['long']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_VI_POOL_ENTRY' : [ 0x10, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x1c, { + 'Next' : [ 0x0, ['pointer', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x4, ['unsigned long']], + 'WaitResponse' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0xc, ['_KGATE']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_COUNTERS' : [ 0x54, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long']], + 'TotalMemoryCommitted' : [ 0x4, ['unsigned long']], + 'TotalMemoryLargeUCR' : [ 0x8, ['unsigned long']], + 'TotalSizeInVirtualBlocks' : [ 0xc, ['unsigned long']], + 'TotalSegments' : [ 0x10, ['unsigned long']], + 'TotalUCRs' : [ 0x14, ['unsigned long']], + 'CommittOps' : [ 0x18, ['unsigned long']], + 'DeCommitOps' : [ 0x1c, ['unsigned long']], + 'LockAcquires' : [ 0x20, ['unsigned long']], + 'LockCollisions' : [ 0x24, ['unsigned long']], + 'CommitRate' : [ 0x28, ['unsigned long']], + 'DecommittRate' : [ 0x2c, ['unsigned long']], + 'CommitFailures' : [ 0x30, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x34, ['unsigned long']], + 'CompactHeapCalls' : [ 0x38, ['unsigned long']], + 'CompactedUCRs' : [ 0x3c, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x40, ['unsigned long']], + 'InBlockDeccommits' : [ 0x44, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x48, ['unsigned long']], + 'HighWatermarkSize' : [ 0x4c, ['unsigned long']], + 'LastPolledSize' : [ 0x50, ['unsigned long']], +} ], + '_CM_KEY_HASH' : [ 0x10, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x4, ['pointer', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], + 'KeyCell' : [ 0xc, ['unsigned long']], +} ], + '_SYSPTES_HEADER' : [ 0x14, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Count' : [ 0x8, ['unsigned long']], + 'NumberOfEntries' : [ 0xc, ['unsigned long']], + 'NumberOfEntriesPeak' : [ 0x10, ['unsigned long']], +} ], + '_EXCEPTION_RECORD' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0xc, ['pointer', ['void']]], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x3c, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x8, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x18, ['pointer', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x1c, ['pointer', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x20, ['pointer', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x24, ['pointer', ['_IRP']]], + 'Lock' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x2c, ['unsigned long']], + 'ProfileChangingEject' : [ 0x30, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x31, ['unsigned char']], + 'LightestSleepState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x38, ['pointer', ['DOCK_INTERFACE']]], +} ], + '_I386_LOADER_BLOCK' : [ 0xc, { + 'CommonDataArea' : [ 0x0, ['pointer', ['void']]], + 'MachineType' : [ 0x4, ['unsigned long']], + 'VirtualBias' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x24, { + 'SidHash' : [ 0x0, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x8, ['pointer', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0xc, ['_LUID']], + 'TokenType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x1c, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x20, ['unsigned long']], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_ARC_DISK_INFORMATION' : [ 0x8, { + 'DiskSignatures' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x8, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x4, ['unsigned long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x8, { + 'Key' : [ 0x0, ['pointer', ['void']]], + 'Index' : [ 0x4, ['unsigned long']], +} ], + '_HMAP_DIRECTORY' : [ 0x1000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer', ['_HMAP_TABLE']]]], +} ], + '_HANDLE_TABLE' : [ 0x3c, { + 'TableCode' : [ 0x0, ['unsigned long']], + 'QuotaProcess' : [ 0x4, ['pointer', ['_EPROCESS']]], + 'UniqueProcessId' : [ 0x8, ['pointer', ['void']]], + 'HandleLock' : [ 0xc, ['_EX_PUSH_LOCK']], + 'HandleTableList' : [ 0x10, ['_LIST_ENTRY']], + 'HandleContentionEvent' : [ 0x18, ['_EX_PUSH_LOCK']], + 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], + 'ExtraInfoPages' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FirstFreeHandle' : [ 0x28, ['unsigned long']], + 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x30, ['unsigned long']], + 'NextHandleNeedingPool' : [ 0x34, ['unsigned long']], + 'HandleCountHighWatermark' : [ 0x38, ['unsigned long']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { + 'Va' : [ 0x0, ['pointer', ['void']]], + 'Key' : [ 0x4, ['unsigned long']], + 'PoolType' : [ 0x8, ['unsigned long']], + 'NumberOfBytes' : [ 0xc, ['unsigned long']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_TEB_ACTIVE_FRAME' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x4, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x8, ['pointer', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x8, ['pointer', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0xc, ['pointer', ['void']]], + 'KeyBodyList' : [ 0x10, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x1c, ['pointer', ['void']]], + 'KtmUow' : [ 0x20, ['pointer', ['_GUID']]], + 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x18, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x8, ['pointer', ['_KTHREAD']]], + 'Object' : [ 0xc, ['pointer', ['void']]], + 'NextWaitBlock' : [ 0x10, ['pointer', ['_KWAIT_BLOCK']]], + 'WaitKey' : [ 0x14, ['unsigned short']], + 'WaitType' : [ 0x16, ['unsigned char']], + 'BlockState' : [ 0x17, ['unsigned char']], +} ], + '_MMPTE_PROTOTYPE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0xc, ['_KAFFINITY_EX']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], +} ], + '__unnamed_1c9d' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1c9f' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1c9d']], + 'Private' : [ 0x0, ['__unnamed_1c9f']], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x10, { + 'IssueType' : [ 0x0, ['unsigned long']], + 'Address' : [ 0x4, ['pointer', ['void']]], + 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x8, { + 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x4, ['pointer', ['_CONTEXT']]], +} ], + '_OBJECT_REF_INFO' : [ 0x1c, { + 'ObjectHeader' : [ 0x0, ['pointer', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x4, ['pointer', ['void']]], + 'ImageFileName' : [ 0x8, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x18, ['unsigned short']], + 'MaxStacks' : [ 0x1a, ['unsigned short']], + 'StackInfo' : [ 0x1c, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0xc, { + 'SecurityContext' : [ 0x0, ['_IMAGE_SECURITY_CONTEXT']], + 'DynamicRelocations' : [ 0x4, ['pointer', ['void']]], + 'ReferenceCount' : [ 0x8, ['long']], +} ], + '_HEAP_TAG_ENTRY' : [ 0x40, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'TagIndex' : [ 0xc, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0xe, ['unsigned short']], + 'TagName' : [ 0x10, ['array', 24, ['wchar']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '__unnamed_1cc1' : [ 0x8, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], +} ], + '__unnamed_1cc7' : [ 0x4, { + 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], + 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD_LONG' : [ 0x48, { + 'u1' : [ 0x0, ['__unnamed_1584']], + 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], + 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], + 'u' : [ 0x14, ['__unnamed_1587']], + 'PushLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'u5' : [ 0x1c, ['__unnamed_158a']], + 'u2' : [ 0x20, ['__unnamed_1597']], + 'Subsection' : [ 0x24, ['pointer', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x28, ['pointer', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x2c, ['pointer', ['_MMPTE']]], + 'ViewLinks' : [ 0x30, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x38, ['pointer', ['_EPROCESS']]], + 'u3' : [ 0x3c, ['__unnamed_1cc1']], + 'u4' : [ 0x44, ['__unnamed_1cc7']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x4, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_NT_TIB' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x4, ['pointer', ['void']]], + 'StackLimit' : [ 0x8, ['pointer', ['void']]], + 'SubSystemTib' : [ 0xc, ['pointer', ['void']]], + 'FiberData' : [ 0x10, ['pointer', ['void']]], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['pointer', ['void']]], + 'Self' : [ 0x18, ['pointer', ['_NT_TIB']]], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_EJOB' : [ 0x138, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x10, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x18, ['_LIST_ENTRY']], + 'JobLock' : [ 0x20, ['_ERESOURCE']], + 'TotalUserTime' : [ 0x58, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0x60, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0x68, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0x70, ['_LARGE_INTEGER']], + 'TotalPageFaultCount' : [ 0x78, ['unsigned long']], + 'TotalProcesses' : [ 0x7c, ['unsigned long']], + 'ActiveProcesses' : [ 0x80, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0x84, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0x88, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0x90, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0x98, ['unsigned long']], + 'MaximumWorkingSetSize' : [ 0x9c, ['unsigned long']], + 'LimitFlags' : [ 0xa0, ['unsigned long']], + 'ActiveProcessLimit' : [ 0xa4, ['unsigned long']], + 'Affinity' : [ 0xa8, ['_KAFFINITY_EX']], + 'PriorityClass' : [ 0xb4, ['unsigned char']], + 'AccessState' : [ 0xb8, ['pointer', ['_JOB_ACCESS_STATE']]], + 'UIRestrictionsClass' : [ 0xbc, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0xc0, ['unsigned long']], + 'CompletionPort' : [ 0xc4, ['pointer', ['void']]], + 'CompletionKey' : [ 0xc8, ['pointer', ['void']]], + 'SessionId' : [ 0xcc, ['unsigned long']], + 'SchedulingClass' : [ 0xd0, ['unsigned long']], + 'ReadOperationCount' : [ 0xd8, ['unsigned long long']], + 'WriteOperationCount' : [ 0xe0, ['unsigned long long']], + 'OtherOperationCount' : [ 0xe8, ['unsigned long long']], + 'ReadTransferCount' : [ 0xf0, ['unsigned long long']], + 'WriteTransferCount' : [ 0xf8, ['unsigned long long']], + 'OtherTransferCount' : [ 0x100, ['unsigned long long']], + 'ProcessMemoryLimit' : [ 0x108, ['unsigned long']], + 'JobMemoryLimit' : [ 0x10c, ['unsigned long']], + 'PeakProcessMemoryUsed' : [ 0x110, ['unsigned long']], + 'PeakJobMemoryUsed' : [ 0x114, ['unsigned long']], + 'CurrentJobMemoryUsed' : [ 0x118, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x120, ['_EX_PUSH_LOCK']], + 'JobSetLinks' : [ 0x124, ['_LIST_ENTRY']], + 'MemberLevel' : [ 0x12c, ['unsigned long']], + 'JobFlags' : [ 0x130, ['unsigned long']], +} ], + '__unnamed_1cd8' : [ 0x4, { + 'AsULONG' : [ 0x0, ['unsigned long']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], +} ], + '_PPM_IDLE_STATES' : [ 0x60, { + 'Count' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['__unnamed_1cd8']], + 'TargetState' : [ 0x8, ['unsigned long']], + 'ActualState' : [ 0xc, ['unsigned long']], + 'OldState' : [ 0x10, ['unsigned long']], + 'TargetProcessors' : [ 0x14, ['_KAFFINITY_EX']], + 'State' : [ 0x20, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '__unnamed_1ce1' : [ 0x10, { + 'EfiInformation' : [ 0x0, ['_EFI_FIRMWARE_INFORMATION']], + 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], +} ], + '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x4, ['__unnamed_1ce1']], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x8, ['_LIST_ENTRY']], + 'Address' : [ 0x10, ['pointer', ['void']]], + 'Size' : [ 0x14, ['unsigned long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x50, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x8, ['pointer', ['void']]], + 'ProcessObject' : [ 0xc, ['pointer', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x10, ['pointer', ['void']]], + 'RealtimeConnectContext' : [ 0x14, ['pointer', ['void']]], + 'DisconnectEvent' : [ 0x18, ['pointer', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x1c, ['pointer', ['_KEVENT']]], + 'UserBufferCount' : [ 0x20, ['pointer', ['unsigned long']]], + 'UserBufferListHead' : [ 0x24, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x28, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x2c, ['unsigned long']], + 'LoggerId' : [ 0x30, ['unsigned long']], + 'ShutDownRequested' : [ 0x34, ['unsigned char']], + 'NewBuffersLost' : [ 0x35, ['unsigned char']], + 'Disconnected' : [ 0x36, ['unsigned char']], + 'ReservedBufferSpaceBitMap' : [ 0x38, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x40, ['pointer', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x44, ['unsigned long']], + 'UserPagesAllocated' : [ 0x48, ['unsigned long']], + 'UserPagesReused' : [ 0x4c, ['unsigned long']], +} ], + '__unnamed_1cea' : [ 0x4, { + 'BaseMid' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHi' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_1cf0' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1cf2' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_1cea']], + 'Bits' : [ 0x0, ['__unnamed_1cf0']], +} ], + '_KGDTENTRY' : [ 0x8, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'HighWord' : [ 0x4, ['__unnamed_1cf2']], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x4, ['_KGUARDED_MUTEX']], + 'NonPagedLock' : [ 0x4, ['unsigned long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['pointer', ['pointer', ['void']]]], + 'PendingFreeDepth' : [ 0x104, ['long']], + 'ListHeads' : [ 0x140, ['array', 512, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_KGATE' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x4, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0xc, ['unsigned long']], +} ], + '_DRIVER_EXTENSION' : [ 0x1c, { + 'DriverObject' : [ 0x0, ['pointer', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x4, ['pointer', ['void']]], + 'Count' : [ 0x8, ['unsigned long']], + 'ServiceKeyName' : [ 0xc, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x14, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x2c, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x8, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_KINTERRUPT' : [ 0x278, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x4, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0xc, ['pointer', ['void']]], + 'MessageServiceRoutine' : [ 0x10, ['pointer', ['void']]], + 'MessageIndex' : [ 0x14, ['unsigned long']], + 'ServiceContext' : [ 0x18, ['pointer', ['void']]], + 'SpinLock' : [ 0x1c, ['unsigned long']], + 'TickCount' : [ 0x20, ['unsigned long']], + 'ActualLock' : [ 0x24, ['pointer', ['unsigned long']]], + 'DispatchAddress' : [ 0x28, ['pointer', ['void']]], + 'Vector' : [ 0x2c, ['unsigned long']], + 'Irql' : [ 0x30, ['unsigned char']], + 'SynchronizeIrql' : [ 0x31, ['unsigned char']], + 'FloatingSave' : [ 0x32, ['unsigned char']], + 'Connected' : [ 0x33, ['unsigned char']], + 'Number' : [ 0x34, ['unsigned long']], + 'ShareVector' : [ 0x38, ['unsigned char']], + 'Pad' : [ 0x39, ['array', 3, ['unsigned char']]], + 'Mode' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptActiveHigh', 2: 'InterruptActiveLow'})]], + 'ServiceCount' : [ 0x44, ['unsigned long']], + 'DispatchCount' : [ 0x48, ['unsigned long']], + 'Rsvd1' : [ 0x50, ['unsigned long long']], + 'DispatchCode' : [ 0x58, ['array', 135, ['unsigned long']]], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer', ['void']]], + 'ObAttributes' : [ 0x0, ['unsigned long']], + 'InfoTable' : [ 0x0, ['pointer', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'Value' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], + 'GrantedAccessIndex' : [ 0x4, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x6, ['unsigned short']], + 'NextFreeTableEntry' : [ 0x4, ['unsigned long']], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x18, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x4, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0xc, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x58, { + 'FileName' : [ 0x0, ['pointer', ['unsigned short']]], + 'BaseName' : [ 0x4, ['pointer', ['unsigned short']]], + 'RegRootName' : [ 0x8, ['pointer', ['unsigned short']]], + 'CmHive' : [ 0xc, ['pointer', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x10, ['unsigned long']], + 'CmHiveFlags' : [ 0x14, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x18, ['unsigned long']], + 'CmHive2' : [ 0x1c, ['pointer', ['_CMHIVE']]], + 'HiveMounted' : [ 0x20, ['unsigned char']], + 'ThreadFinished' : [ 0x21, ['unsigned char']], + 'ThreadStarted' : [ 0x22, ['unsigned char']], + 'Allocate' : [ 0x23, ['unsigned char']], + 'WinPERequired' : [ 0x24, ['unsigned char']], + 'StartEvent' : [ 0x28, ['_KEVENT']], + 'FinishedEvent' : [ 0x38, ['_KEVENT']], + 'MountLock' : [ 0x48, ['_KEVENT']], +} ], + '_CONTEXT' : [ 0x2cc, { + 'ContextFlags' : [ 0x0, ['unsigned long']], + 'Dr0' : [ 0x4, ['unsigned long']], + 'Dr1' : [ 0x8, ['unsigned long']], + 'Dr2' : [ 0xc, ['unsigned long']], + 'Dr3' : [ 0x10, ['unsigned long']], + 'Dr6' : [ 0x14, ['unsigned long']], + 'Dr7' : [ 0x18, ['unsigned long']], + 'FloatSave' : [ 0x1c, ['_FLOATING_SAVE_AREA']], + 'SegGs' : [ 0x8c, ['unsigned long']], + 'SegFs' : [ 0x90, ['unsigned long']], + 'SegEs' : [ 0x94, ['unsigned long']], + 'SegDs' : [ 0x98, ['unsigned long']], + 'Edi' : [ 0x9c, ['unsigned long']], + 'Esi' : [ 0xa0, ['unsigned long']], + 'Ebx' : [ 0xa4, ['unsigned long']], + 'Edx' : [ 0xa8, ['unsigned long']], + 'Ecx' : [ 0xac, ['unsigned long']], + 'Eax' : [ 0xb0, ['unsigned long']], + 'Ebp' : [ 0xb4, ['unsigned long']], + 'Eip' : [ 0xb8, ['unsigned long']], + 'SegCs' : [ 0xbc, ['unsigned long']], + 'EFlags' : [ 0xc0, ['unsigned long']], + 'Esp' : [ 0xc4, ['unsigned long']], + 'SegSs' : [ 0xc8, ['unsigned long']], + 'ExtendedRegisters' : [ 0xcc, ['array', 512, ['unsigned char']]], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x10, { + 'Handles' : [ 0x0, ['pointer', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], +} ], + '_MMPTE_HARDWARE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x8, { + 'Port' : [ 0x0, ['pointer', ['void']]], + 'Key' : [ 0x4, ['pointer', ['void']]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x100, { + 'Irp' : [ 0x0, ['pointer', ['_IRP']]], + 'Thread' : [ 0x4, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 62, ['pointer', ['void']]]], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x10, { + 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], + 'CallingAddress' : [ 0x4, ['pointer', ['void']]], + 'NumberOfBytes' : [ 0x8, ['unsigned long']], + 'Tag' : [ 0xc, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0x54, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x8, ['pointer', ['_EPROCESS']]], + 'Mdl' : [ 0xc, ['pointer', ['_MDL']]], + 'UserVa' : [ 0x10, ['pointer', ['void']]], + 'UserLimit' : [ 0x14, ['pointer', ['void']]], + 'DataUserVa' : [ 0x18, ['pointer', ['void']]], + 'SystemVa' : [ 0x1c, ['pointer', ['void']]], + 'TotalSize' : [ 0x20, ['unsigned long']], + 'Header' : [ 0x24, ['pointer', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x28, ['pointer', ['void']]], + 'ListSize' : [ 0x2c, ['unsigned long']], + 'Bitmap' : [ 0x30, ['pointer', ['void']]], + 'BitmapSize' : [ 0x34, ['unsigned long']], + 'Data' : [ 0x38, ['pointer', ['void']]], + 'DataSize' : [ 0x3c, ['unsigned long']], + 'BitmapLimit' : [ 0x40, ['unsigned long']], + 'BitmapNextHint' : [ 0x44, ['unsigned long']], + 'ConcurrencyCount' : [ 0x48, ['unsigned long']], + 'AttributeFlags' : [ 0x4c, ['unsigned long']], + 'AttributeSize' : [ 0x50, ['unsigned long']], +} ], + '_INTERFACE' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_LAZY_WRITER' : [ 0x50, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x20, ['_KTIMER']], + 'ScanActive' : [ 0x48, ['unsigned char']], + 'OtherWork' : [ 0x49, ['unsigned char']], + 'PendingTeardownScan' : [ 0x4a, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x4b, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x4c, ['unsigned char']], + 'PendingPowerScan' : [ 0x4d, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x44, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer', ['unsigned char']]], + 'DataPortMapped' : [ 0xc, ['unsigned char']], + 'AddressPort' : [ 0x10, ['pointer', ['unsigned char']]], + 'AddrPortMapped' : [ 0x14, ['unsigned char']], + 'CommandPort' : [ 0x18, ['pointer', ['unsigned char']]], + 'CmdPortMapped' : [ 0x1c, ['unsigned char']], + 'NextSlotNumber' : [ 0x20, ['unsigned long']], + 'DeviceList' : [ 0x24, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x28, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x2c, ['pointer', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x30, ['pointer', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x34, ['pointer', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x38, ['unsigned long']], + 'SystemPowerState' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x4, ['pointer', ['void']]], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x8, { + 'Sid' : [ 0x0, ['pointer', ['void']]], + 'Attributes' : [ 0x4, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_IO_WORKITEM' : [ 0x20, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x10, ['pointer', ['void']]], + 'IoObject' : [ 0x14, ['pointer', ['void']]], + 'Context' : [ 0x18, ['pointer', ['void']]], + 'Type' : [ 0x1c, ['unsigned long']], +} ], + '_CM_RM' : [ 0x58, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x8, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x10, ['pointer', ['void']]], + 'Tm' : [ 0x14, ['pointer', ['void']]], + 'RmHandle' : [ 0x18, ['pointer', ['void']]], + 'KtmRm' : [ 0x1c, ['pointer', ['void']]], + 'RefCount' : [ 0x20, ['unsigned long']], + 'ContainerNum' : [ 0x24, ['unsigned long']], + 'ContainerSize' : [ 0x28, ['unsigned long long']], + 'CmHive' : [ 0x30, ['pointer', ['_CMHIVE']]], + 'LogFileObject' : [ 0x34, ['pointer', ['void']]], + 'MarshallingContext' : [ 0x38, ['pointer', ['void']]], + 'RmFlags' : [ 0x3c, ['unsigned long']], + 'LogStartStatus1' : [ 0x40, ['long']], + 'LogStartStatus2' : [ 0x44, ['long']], + 'BaseLsn' : [ 0x48, ['unsigned long long']], + 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_MMWSLE_HASH' : [ 0x4, { + 'Index' : [ 0x0, ['unsigned long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x18, { + 'AllocAddress' : [ 0x0, ['unsigned long']], + 'AllocTag' : [ 0x4, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x8, ['unsigned long']], + 'ReAllocTag' : [ 0xc, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x10, ['unsigned long']], + 'FreeTag' : [ 0x14, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0xc, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x8, ['pointer', ['void']]], + 'CallersCaller' : [ 0xc, ['pointer', ['void']]], + 'CallCount' : [ 0x10, ['unsigned long']], +} ], + '_VF_TRACKER_STAMP' : [ 0x8, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x20, { + 'Thread' : [ 0x0, ['pointer', ['void']]], + 'OldIrql' : [ 0x4, ['unsigned char']], + 'NewIrql' : [ 0x5, ['unsigned char']], + 'Processor' : [ 0x6, ['unsigned short']], + 'TickCount' : [ 0x8, ['unsigned long']], + 'StackTrace' : [ 0xc, ['array', 5, ['pointer', ['void']]]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0x64, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x8, ['unsigned long']], + 'CallerEvent' : [ 0xc, ['pointer', ['_KEVENT']]], + 'Callback' : [ 0x10, ['pointer', ['void']]], + 'Context' : [ 0x14, ['pointer', ['void']]], + 'VetoType' : [ 0x18, ['pointer', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x1c, ['pointer', ['_UNICODE_STRING']]], + 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x8, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], +} ], + '_NLS_DATA_BLOCK' : [ 0xc, { + 'AnsiCodePageData' : [ 0x0, ['pointer', ['void']]], + 'OemCodePageData' : [ 0x4, ['pointer', ['void']]], + 'UnicodeCaseTableData' : [ 0x8, ['pointer', ['void']]], +} ], + '_ALIGNED_AFFINITY_SUMMARY' : [ 0x40, { + 'CpuSet' : [ 0x0, ['_KAFFINITY_EX']], + 'SMTSet' : [ 0xc, ['_KAFFINITY_EX']], +} ], + '_XSTATE_CONFIGURATION' : [ 0x210, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'RealRefCount' : [ 0x14, ['unsigned long']], + 'Descriptor' : [ 0x18, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_MMPTE_SOFTWARE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + '_CM_RESOURCE_LIST' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x1c, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['long']], + 'NonPagedFrees' : [ 0x8, ['long']], + 'NonPagedBytes' : [ 0xc, ['unsigned long']], + 'PagedAllocs' : [ 0x10, ['unsigned long']], + 'PagedFrees' : [ 0x14, ['unsigned long']], + 'PagedBytes' : [ 0x18, ['unsigned long']], +} ], + '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { + 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'NodeHint' : [ 0x1c, ['pointer', ['void']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'Padding0' : [ 0x20, ['array', 2, ['unsigned long']]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer', ['void']]], + 'Pointer1' : [ 0x3c, ['pointer', ['void']]], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0xc8, { + 'IdleStates' : [ 0x0, ['pointer', ['_PPM_IDLE_STATES']]], + 'IdleTimeLast' : [ 0x8, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x10, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x18, ['unsigned long long']], + 'IdleAccounting' : [ 0x20, ['pointer', ['_PROC_IDLE_ACCOUNTING']]], + 'Hypervisor' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower'})]], + 'PerfHistoryTotal' : [ 0x28, ['unsigned long']], + 'ThermalConstraint' : [ 0x2c, ['unsigned char']], + 'PerfHistoryCount' : [ 0x2d, ['unsigned char']], + 'PerfHistorySlot' : [ 0x2e, ['unsigned char']], + 'Reserved' : [ 0x2f, ['unsigned char']], + 'LastSysTime' : [ 0x30, ['unsigned long']], + 'WmiDispatchPtr' : [ 0x34, ['unsigned long']], + 'WmiInterfaceEnabled' : [ 0x38, ['long']], + 'FFHThrottleStateInfo' : [ 0x40, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0x60, ['_KDPC']], + 'PerfActionMask' : [ 0x80, ['long']], + 'IdleCheck' : [ 0x88, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x98, ['_PROC_IDLE_SNAP']], + 'Domain' : [ 0xa8, ['pointer', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0xac, ['pointer', ['_PROC_PERF_CONSTRAINT']]], + 'Load' : [ 0xb0, ['pointer', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0xb4, ['pointer', ['_PROC_HISTORY_ENTRY']]], + 'Utility' : [ 0xb8, ['unsigned long']], + 'OverUtilizedHistory' : [ 0xbc, ['unsigned long']], + 'AffinityCount' : [ 0xc0, ['unsigned long']], + 'AffinityHistory' : [ 0xc4, ['unsigned long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_SEGMENT_OBJECT' : [ 0x28, { + 'BaseAddress' : [ 0x0, ['pointer', ['void']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SizeOfSegment' : [ 0x8, ['_LARGE_INTEGER']], + 'NonExtendedPtes' : [ 0x10, ['unsigned long']], + 'ImageCommitment' : [ 0x14, ['unsigned long']], + 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], + 'Subsection' : [ 0x1c, ['pointer', ['_SUBSECTION']]], + 'MmSectionFlags' : [ 0x20, ['pointer', ['_MMSECTION_FLAGS']]], + 'MmSubSectionFlags' : [ 0x24, ['pointer', ['_MMSUBSECTION_FLAGS']]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x20, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_KTSS' : [ 0x20ac, { + 'Backlink' : [ 0x0, ['unsigned short']], + 'Reserved0' : [ 0x2, ['unsigned short']], + 'Esp0' : [ 0x4, ['unsigned long']], + 'Ss0' : [ 0x8, ['unsigned short']], + 'Reserved1' : [ 0xa, ['unsigned short']], + 'NotUsed1' : [ 0xc, ['array', 4, ['unsigned long']]], + 'CR3' : [ 0x1c, ['unsigned long']], + 'Eip' : [ 0x20, ['unsigned long']], + 'EFlags' : [ 0x24, ['unsigned long']], + 'Eax' : [ 0x28, ['unsigned long']], + 'Ecx' : [ 0x2c, ['unsigned long']], + 'Edx' : [ 0x30, ['unsigned long']], + 'Ebx' : [ 0x34, ['unsigned long']], + 'Esp' : [ 0x38, ['unsigned long']], + 'Ebp' : [ 0x3c, ['unsigned long']], + 'Esi' : [ 0x40, ['unsigned long']], + 'Edi' : [ 0x44, ['unsigned long']], + 'Es' : [ 0x48, ['unsigned short']], + 'Reserved2' : [ 0x4a, ['unsigned short']], + 'Cs' : [ 0x4c, ['unsigned short']], + 'Reserved3' : [ 0x4e, ['unsigned short']], + 'Ss' : [ 0x50, ['unsigned short']], + 'Reserved4' : [ 0x52, ['unsigned short']], + 'Ds' : [ 0x54, ['unsigned short']], + 'Reserved5' : [ 0x56, ['unsigned short']], + 'Fs' : [ 0x58, ['unsigned short']], + 'Reserved6' : [ 0x5a, ['unsigned short']], + 'Gs' : [ 0x5c, ['unsigned short']], + 'Reserved7' : [ 0x5e, ['unsigned short']], + 'LDT' : [ 0x60, ['unsigned short']], + 'Reserved8' : [ 0x62, ['unsigned short']], + 'Flags' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], + 'IoMaps' : [ 0x68, ['array', 1, ['_KiIoAccessMap']]], + 'IntDirectionMap' : [ 0x208c, ['array', 32, ['unsigned char']]], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_KIDTENTRY' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'Access' : [ 0x4, ['unsigned short']], + 'ExtendedOffset' : [ 0x6, ['unsigned short']], +} ], + 'DOCK_INTERFACE' : [ 0x18, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x4, ['pointer', ['void']]], + 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], + 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], + 'ProfileDepartureSetMode' : [ 0x10, ['pointer', ['void']]], + 'ProfileDepartureUpdate' : [ 0x14, ['pointer', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0xc, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x4, ['pointer', ['void']]], + 'DataLength' : [ 0x8, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], +} ], + '_IMAGE_OPTIONAL_HEADER' : [ 0xe0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'ImageBase' : [ 0x1c, ['unsigned long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long']], + 'SizeOfStackCommit' : [ 0x4c, ['unsigned long']], + 'SizeOfHeapReserve' : [ 0x50, ['unsigned long']], + 'SizeOfHeapCommit' : [ 0x54, ['unsigned long']], + 'LoaderFlags' : [ 0x58, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x5c, ['unsigned long']], + 'DataDirectory' : [ 0x60, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'ActiveCount' : [ 0x8, ['unsigned long']], + 'PendingNullCount' : [ 0xc, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x10, ['unsigned long']], + 'PendingDelete' : [ 0x14, ['unsigned long']], + 'FreeListHead' : [ 0x18, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x1c, ['pointer', ['void']]], + 'CompletionKey' : [ 0x20, ['pointer', ['void']]], + 'Entry' : [ 0x24, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_TERMINATION_PORT' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], + 'Port' : [ 0x4, ['pointer', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderReserve', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderMaximum'})]], + 'BasePage' : [ 0xc, ['unsigned long']], + 'PageCount' : [ 0x10, ['unsigned long']], +} ], + '_CM_INTENT_LOCK' : [ 0x8, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x4, ['pointer', ['pointer', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x2c0, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'BucketLimits' : [ 0x18, ['array', 16, ['unsigned long long']]], + 'State' : [ 0x98, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x4c, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0xc, ['unsigned long']], + 'SamplingPeriod' : [ 0x10, ['unsigned long']], + 'CurrentTemperature' : [ 0x14, ['unsigned long']], + 'PassiveTripPoint' : [ 0x18, ['unsigned long']], + 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], + 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x20, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x4, ['unsigned long']], + 'SegmentFlags' : [ 0x8, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0xc, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['unsigned long long']], + 'ExtendInfo' : [ 0x18, ['pointer', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x18, ['pointer', ['void']]], + 'SegmentLock' : [ 0x1c, ['_EX_PUSH_LOCK']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e0, { + 'Offset' : [ 0x0, ['unsigned long']], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0x84, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long']], + 'NonPagedBytes' : [ 0x54, ['unsigned long']], + 'PeakPagedBytes' : [ 0x58, ['unsigned long']], + 'PeakNonPagedBytes' : [ 0x5c, ['unsigned long']], + 'BurstAllocationsFailedDeliberately' : [ 0x60, ['unsigned long']], + 'SessionTrims' : [ 0x64, ['unsigned long']], + 'OptionChanges' : [ 0x68, ['unsigned long']], + 'VerifyMode' : [ 0x6c, ['unsigned long']], + 'PreviousBucketName' : [ 0x70, ['_UNICODE_STRING']], + 'ActivityCounter' : [ 0x78, ['unsigned long']], + 'PreviousActivityCounter' : [ 0x7c, ['unsigned long']], + 'WorkerTrimRequests' : [ 0x80, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x24, { + 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], + 'StackTrace' : [ 0x4, ['array', 8, ['pointer', ['void']]]], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0xc, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x4, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_OWNER_ENTRY' : [ 0x8, { + 'OwnerThread' : [ 0x0, ['unsigned long']], + 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x4, ['unsigned long']], +} ], + '_ETIMER' : [ 0x98, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'TimerApc' : [ 0x28, ['_KAPC']], + 'TimerDpc' : [ 0x58, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'Lock' : [ 0x80, ['unsigned long']], + 'Period' : [ 0x84, ['long']], + 'ApcAssociated' : [ 0x88, ['unsigned char']], + 'WakeReason' : [ 0x8c, ['pointer', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x90, ['_LIST_ENTRY']], +} ], + '_FREE_DISPLAY' : [ 0xc, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Display' : [ 0x4, ['_RTL_BITMAP']], +} ], + '_POOL_BLOCK_HEAD' : [ 0x10, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'List' : [ 0x8, ['_LIST_ENTRY']], +} ], + '__unnamed_1e46' : [ 0x4, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'StartVa' : [ 0x0, ['pointer', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_1e46']], + 'EndVa' : [ 0x4, ['pointer', ['void']]], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_ARBITER_INSTANCE' : [ 0x5ec, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x4, ['pointer', ['_KEVENT']]], + 'Name' : [ 0x8, ['pointer', ['unsigned short']]], + 'OrderingName' : [ 0xc, ['pointer', ['unsigned short']]], + 'ResourceType' : [ 0x10, ['long']], + 'Allocation' : [ 0x14, ['pointer', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x18, ['pointer', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x1c, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x24, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x2c, ['long']], + 'Interface' : [ 0x30, ['pointer', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x34, ['unsigned long']], + 'AllocationStack' : [ 0x38, ['pointer', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x3c, ['pointer', ['void']]], + 'PackResource' : [ 0x40, ['pointer', ['void']]], + 'UnpackResource' : [ 0x44, ['pointer', ['void']]], + 'ScoreRequirement' : [ 0x48, ['pointer', ['void']]], + 'TestAllocation' : [ 0x4c, ['pointer', ['void']]], + 'RetestAllocation' : [ 0x50, ['pointer', ['void']]], + 'CommitAllocation' : [ 0x54, ['pointer', ['void']]], + 'RollbackAllocation' : [ 0x58, ['pointer', ['void']]], + 'BootAllocation' : [ 0x5c, ['pointer', ['void']]], + 'QueryArbitrate' : [ 0x60, ['pointer', ['void']]], + 'QueryConflict' : [ 0x64, ['pointer', ['void']]], + 'AddReserved' : [ 0x68, ['pointer', ['void']]], + 'StartArbiter' : [ 0x6c, ['pointer', ['void']]], + 'PreprocessEntry' : [ 0x70, ['pointer', ['void']]], + 'AllocateEntry' : [ 0x74, ['pointer', ['void']]], + 'GetNextAllocationRange' : [ 0x78, ['pointer', ['void']]], + 'FindSuitableRange' : [ 0x7c, ['pointer', ['void']]], + 'AddAllocation' : [ 0x80, ['pointer', ['void']]], + 'BacktrackAllocation' : [ 0x84, ['pointer', ['void']]], + 'OverrideConflict' : [ 0x88, ['pointer', ['void']]], + 'InitializeRangeList' : [ 0x8c, ['pointer', ['void']]], + 'TransactionInProgress' : [ 0x90, ['unsigned char']], + 'TransactionEvent' : [ 0x94, ['pointer', ['_KEVENT']]], + 'Extension' : [ 0x98, ['pointer', ['void']]], + 'BusDeviceObject' : [ 0x9c, ['pointer', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0xa0, ['pointer', ['void']]], + 'ConflictCallback' : [ 0xa4, ['pointer', ['void']]], + 'PdoDescriptionString' : [ 0xa8, ['array', 336, ['wchar']]], + 'PdoSymbolicNameString' : [ 0x348, ['array', 672, ['unsigned char']]], + 'PdoAddressString' : [ 0x5e8, ['array', 1, ['wchar']]], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x10, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x8, ['unsigned long']], + 'Inserted' : [ 0xc, ['unsigned char']], +} ], + '__unnamed_1e9f' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1ea1' : [ 0x8, { + 'Last' : [ 0x0, ['unsigned long']], + 'u' : [ 0x4, ['__unnamed_1e9f']], +} ], + '__unnamed_1ea3' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_1e9f']], +} ], + '__unnamed_1ea5' : [ 0x8, { + 'OldCell' : [ 0x0, ['__unnamed_1ea1']], + 'NewCell' : [ 0x0, ['__unnamed_1ea3']], +} ], + '_HCELL' : [ 0xc, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_1ea5']], +} ], + '_HMAP_TABLE' : [ 0x2000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x24, { + 'Prcb' : [ 0x0, ['pointer', ['_KPRCB']]], + 'PerfContext' : [ 0x4, ['unsigned long']], + 'PercentageCap' : [ 0x8, ['unsigned long']], + 'ThermalCap' : [ 0xc, ['unsigned long']], + 'TargetFrequency' : [ 0x10, ['unsigned long']], + 'AcumulatedFullFrequency' : [ 0x14, ['unsigned long']], + 'AcumulatedZeroFrequency' : [ 0x18, ['unsigned long']], + 'FrequencyHistoryTotal' : [ 0x1c, ['unsigned long']], + 'AverageFrequency' : [ 0x20, ['unsigned long']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_CACHED_KSTACK_LIST' : [ 0x18, { + 'SListHead' : [ 0x0, ['_SLIST_HEADER']], + 'MinimumFree' : [ 0x8, ['long']], + 'Misses' : [ 0xc, ['unsigned long']], + 'MissesLast' : [ 0x10, ['unsigned long']], + 'Pad0' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1eba' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1ebe' : [ 0x14, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long']], +} ], + '__unnamed_1ec0' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1ec2' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_1ec4' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1ec6' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1ec8' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1eca' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1ecc' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_1ece' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_1eba']], + 'Memory' : [ 0x0, ['__unnamed_1eba']], + 'Interrupt' : [ 0x0, ['__unnamed_1ebe']], + 'Dma' : [ 0x0, ['__unnamed_1ec0']], + 'Generic' : [ 0x0, ['__unnamed_1eba']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1ec2']], + 'BusNumber' : [ 0x0, ['__unnamed_1ec4']], + 'ConfigData' : [ 0x0, ['__unnamed_1ec6']], + 'Memory40' : [ 0x0, ['__unnamed_1ec8']], + 'Memory48' : [ 0x0, ['__unnamed_1eca']], + 'Memory64' : [ 0x0, ['__unnamed_1ecc']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_1ece']], +} ], + '_POP_THERMAL_ZONE' : [ 0x150, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'State' : [ 0x8, ['unsigned char']], + 'Flags' : [ 0x9, ['unsigned char']], + 'Mode' : [ 0xa, ['unsigned char']], + 'PendingMode' : [ 0xb, ['unsigned char']], + 'ActivePoint' : [ 0xc, ['unsigned char']], + 'PendingActivePoint' : [ 0xd, ['unsigned char']], + 'Throttle' : [ 0x10, ['long']], + 'LastTime' : [ 0x18, ['unsigned long long']], + 'SampleRate' : [ 0x20, ['unsigned long']], + 'LastTemp' : [ 0x24, ['unsigned long']], + 'PassiveTimer' : [ 0x28, ['_KTIMER']], + 'PassiveDpc' : [ 0x50, ['_KDPC']], + 'OverThrottled' : [ 0x70, ['_POP_ACTION_TRIGGER']], + 'Irp' : [ 0x80, ['pointer', ['_IRP']]], + 'Info' : [ 0x84, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0xe0, ['_LARGE_INTEGER']], + 'Metrics' : [ 0xe8, ['_POP_THERMAL_ZONE_METRICS']], +} ], + '_MMPTE_LIST' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0xc, { + 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], + 'VerifierEntry' : [ 0x4, ['pointer', ['void']]], + 'Signature' : [ 0x8, ['unsigned long']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0x80, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0xc, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x2c, ['unsigned long']], + 'TraceDb' : [ 0x30, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_CM_WORKITEM' : [ 0x14, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x8, ['unsigned long']], + 'WorkerRoutine' : [ 0xc, ['pointer', ['void']]], + 'Parameter' : [ 0x10, ['pointer', ['void']]], +} ], + '_POP_THERMAL_ZONE_METRICS' : [ 0x68, { + 'MetricsResource' : [ 0x0, ['_ERESOURCE']], + 'ActiveCount' : [ 0x38, ['unsigned long']], + 'PassiveCount' : [ 0x3c, ['unsigned long']], + 'LastActiveStartTick' : [ 0x40, ['_LARGE_INTEGER']], + 'AverageActiveTime' : [ 0x48, ['_LARGE_INTEGER']], + 'LastPassiveStartTick' : [ 0x50, ['_LARGE_INTEGER']], + 'AveragePassiveTime' : [ 0x58, ['_LARGE_INTEGER']], + 'StartTickSinceLastReset' : [ 0x60, ['_LARGE_INTEGER']], +} ], + '_CM_TRANS' : [ 0x68, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x8, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x18, ['pointer', ['void']]], + 'CmRm' : [ 0x1c, ['pointer', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x20, ['pointer', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x24, ['pointer', ['void']]], + 'KtmUow' : [ 0x28, ['_GUID']], + 'StartLsn' : [ 0x38, ['unsigned long long']], + 'TransState' : [ 0x40, ['unsigned long']], + 'HiveCount' : [ 0x44, ['unsigned long']], + 'HiveArray' : [ 0x48, ['array', 7, ['pointer', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x14, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Count' : [ 0xc, ['unsigned long']], + 'Stamp' : [ 0x10, ['unsigned long']], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x2c, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x4, ['pointer', ['void']]], + 'ProbeMode' : [ 0x8, ['unsigned char']], + 'PagedPoolCharge' : [ 0xc, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x10, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x14, ['unsigned long']], + 'SecurityDescriptor' : [ 0x18, ['pointer', ['void']]], + 'SecurityQos' : [ 0x1c, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x20, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x4, ['pointer', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x8, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x10, ['unsigned long']], + 'ContentionCount' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x1c, ['unsigned short']], + 'SpareUSHORT' : [ 0x1e, ['unsigned short']], +} ], + '_POOL_HACKER' : [ 0x28, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'Contents' : [ 0x8, ['array', 8, ['unsigned long']]], +} ], + '_DISALLOWED_GUIDS' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x4, ['pointer', ['_GUID']]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x8, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x4, ['array', 1, ['pointer', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0xc, { + 'DataSectionObject' : [ 0x0, ['pointer', ['void']]], + 'SharedCacheMap' : [ 0x4, ['pointer', ['void']]], + 'ImageSectionObject' : [ 0x8, ['pointer', ['void']]], +} ], + '_VF_BTS_DATA_MANAGEMENT_AREA' : [ 0x34, { + 'BTSBufferBase' : [ 0x0, ['pointer', ['void']]], + 'BTSIndex' : [ 0x4, ['pointer', ['void']]], + 'BTSMax' : [ 0x8, ['pointer', ['void']]], + 'BTSInterruptThreshold' : [ 0xc, ['pointer', ['void']]], + 'PEBSBufferBase' : [ 0x10, ['pointer', ['void']]], + 'PEBSIndex' : [ 0x14, ['pointer', ['void']]], + 'PEBSMax' : [ 0x18, ['pointer', ['void']]], + 'PEBSInterruptThreshold' : [ 0x1c, ['pointer', ['void']]], + 'PEBSCounterReset' : [ 0x20, ['array', 2, ['pointer', ['void']]]], + 'Reserved' : [ 0x28, ['array', 12, ['unsigned char']]], +} ], + '_FLOATING_SAVE_AREA' : [ 0x70, { + 'ControlWord' : [ 0x0, ['unsigned long']], + 'StatusWord' : [ 0x4, ['unsigned long']], + 'TagWord' : [ 0x8, ['unsigned long']], + 'ErrorOffset' : [ 0xc, ['unsigned long']], + 'ErrorSelector' : [ 0x10, ['unsigned long']], + 'DataOffset' : [ 0x14, ['unsigned long']], + 'DataSelector' : [ 0x18, ['unsigned long']], + 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], + 'Cr0NpxState' : [ 0x6c, ['unsigned long']], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1c, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1b, ['unsigned char']], +} ], + '__unnamed_1f0d' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_1f0f' : [ 0xc, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_1f0d']], +} ], + '_VF_TARGET_DRIVER' : [ 0x18, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x8, ['__unnamed_1f0f']], + 'VerifiedData' : [ 0x14, ['pointer', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '__unnamed_1f17' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f19' : [ 0x2, { + 'DeviceIds' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f1b' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f1d' : [ 0x8, { + 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], + 'DeviceIds' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f1f' : [ 0x4, { + 'Notification' : [ 0x0, ['pointer', ['void']]], +} ], + '__unnamed_1f21' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_1f23' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f25' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_1f27' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_1f29' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_1f2b' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_1f17']], + 'TargetDevice' : [ 0x0, ['__unnamed_1f19']], + 'InstallDevice' : [ 0x0, ['__unnamed_1f1b']], + 'CustomNotification' : [ 0x0, ['__unnamed_1f1d']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1f1f']], + 'PowerNotification' : [ 0x0, ['__unnamed_1f21']], + 'VetoNotification' : [ 0x0, ['__unnamed_1f23']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1f25']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_1f27']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_1f29']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_1f1b']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x44, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x14, ['pointer', ['unsigned long']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'TotalSize' : [ 0x1c, ['unsigned long']], + 'DeviceObject' : [ 0x20, ['pointer', ['void']]], + 'u' : [ 0x24, ['__unnamed_1f2b']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x8, ['unsigned long']], + 'Unloads' : [ 0xc, ['unsigned long']], + 'BaseName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x4, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x4, ['pointer', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x8, ['array', 32, ['unsigned long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer', ['_XSAVE_AREA']]], + 'Reserved2' : [ 0x14, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer', ['void']]], + 'Reserved3' : [ 0x1c, ['unsigned long']], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 8, ['_M128A']]], + 'Reserved4' : [ 0x120, ['array', 192, ['unsigned char']]], + 'StackControl' : [ 0x1e0, ['array', 7, ['unsigned long']]], + 'Cr0NpxState' : [ 0x1fc, ['unsigned long']], +} ], + '_MBCB' : [ 0x88, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x18, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x20, ['long long']], + 'BitmapRange1' : [ 0x28, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x48, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x68, ['_BITMAP_RANGE']], +} ], + '_PS_CPU_QUOTA_BLOCK' : [ 0x880, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'CpuShareWeight' : [ 0xc, ['unsigned long']], + 'CapturedWeightData' : [ 0x10, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], + 'DuplicateInputMarker' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x18, ['long']], + 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long']], + 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], + 'CycleCredit' : [ 0x40, ['unsigned long long']], + 'BlockCurrentGeneration' : [ 0x48, ['unsigned long']], + 'CpuCyclePercent' : [ 0x4c, ['unsigned long']], + 'CyclesFinishedForCurrentGeneration' : [ 0x50, ['unsigned char']], + 'Cpu' : [ 0x80, ['array', 32, ['_PS_PER_CPU_QUOTA_CACHE_AWARE']]], +} ], + '__unnamed_1f46' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_1f46']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x8, { + 'Next' : [ 0x0, ['pointer', ['void']]], + 'BusExtension' : [ 0x4, ['pointer', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x4, ['unsigned long']], + 'RealKcb' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x14, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x4, ['_LIST_ENTRY']], + 'Lock' : [ 0xc, ['unsigned long']], + 'Busy' : [ 0x10, ['unsigned char']], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x50, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer', ['void']]], + 'OpenProcedure' : [ 0x34, ['pointer', ['void']]], + 'CloseProcedure' : [ 0x38, ['pointer', ['void']]], + 'DeleteProcedure' : [ 0x3c, ['pointer', ['void']]], + 'ParseProcedure' : [ 0x40, ['pointer', ['void']]], + 'SecurityProcedure' : [ 0x44, ['pointer', ['void']]], + 'QueryNameProcedure' : [ 0x48, ['pointer', ['void']]], + 'OkayToCloseProcedure' : [ 0x4c, ['pointer', ['void']]], +} ], + '__unnamed_1f77' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '_SUBSECTION' : [ 0x20, { + 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x4, ['pointer', ['_MMPTE']]], + 'NextSubsection' : [ 0x8, ['pointer', ['_SUBSECTION']]], + 'PtesInSubsection' : [ 0xc, ['unsigned long']], + 'UnusedPtes' : [ 0x10, ['unsigned long']], + 'GlobalPerSessionHead' : [ 0x10, ['pointer', ['_MM_AVL_TABLE']]], + 'u' : [ 0x14, ['__unnamed_1f77']], + 'StartingSector' : [ 0x18, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x1c, ['unsigned long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x8, { + 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x4, ['pointer', ['void']]], +} ], + '_PS_PER_CPU_QUOTA_CACHE_AWARE' : [ 0x40, { + 'SortedListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'IdleOnlyListHead' : [ 0x8, ['_LIST_ENTRY']], + 'CycleBaseAllowance' : [ 0x10, ['unsigned long long']], + 'CyclesRemaining' : [ 0x18, ['long long']], + 'CurrentGeneration' : [ 0x20, ['unsigned long']], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x14, { + 'StackBase' : [ 0x0, ['unsigned long']], + 'StackLimit' : [ 0x4, ['unsigned long']], + 'KernelStack' : [ 0x8, ['unsigned long']], + 'InitialStack' : [ 0xc, ['unsigned long']], + 'ActualLimit' : [ 0x10, ['unsigned long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x10, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x8, ['pointer', ['void']]], + 'Parameter' : [ 0xc, ['pointer', ['void']]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x24, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x28, ['unsigned long']], + 'Alternatives' : [ 0x2c, ['pointer', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x30, ['unsigned short']], + 'RangeAttributes' : [ 0x32, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x33, ['unsigned char']], + 'WorkSpace' : [ 0x34, ['unsigned long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_INTERLOCK_SEQ' : [ 0x8, { + 'Depth' : [ 0x0, ['unsigned short']], + 'FreeEntryOffset' : [ 0x2, ['unsigned short']], + 'OffsetAndDepth' : [ 0x0, ['unsigned long']], + 'Sequence' : [ 0x4, ['unsigned long']], + 'Exchg' : [ 0x0, ['long long']], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_VPB' : [ 0x58, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned long']], + 'VolumeLabel' : [ 0x18, ['array', 32, ['wchar']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x10, { + 'ClientToken' : [ 0x0, ['pointer', ['void']]], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x8, ['pointer', ['void']]], + 'ProcessAuditId' : [ 0xc, ['pointer', ['void']]], +} ], + '_KiIoAccessMap' : [ 0x2024, { + 'DirectionMap' : [ 0x0, ['array', 32, ['unsigned char']]], + 'IoMap' : [ 0x20, ['array', 8196, ['unsigned char']]], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x40, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0xc, ['_KEVENT']], + 'AccessBufferMax' : [ 0x1c, ['unsigned long']], + 'AccessBufferList' : [ 0x20, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x28, ['long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x30, ['long']], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x4, { + 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], +} ], + '_POP_SYSTEM_IDLE' : [ 0x38, { + 'AverageIdleness' : [ 0x0, ['long']], + 'LowestIdleness' : [ 0x4, ['long']], + 'Time' : [ 0x8, ['unsigned long']], + 'Timeout' : [ 0xc, ['unsigned long']], + 'LastUserInput' : [ 0x10, ['unsigned long']], + 'Action' : [ 0x14, ['POWER_ACTION_POLICY']], + 'MinState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SystemRequired' : [ 0x24, ['unsigned char']], + 'IdleWorker' : [ 0x25, ['unsigned char']], + 'Sampling' : [ 0x26, ['unsigned char']], + 'LastTick' : [ 0x28, ['unsigned long long']], + 'LastSystemRequiredTime' : [ 0x30, ['unsigned long']], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0xc, { + 'SharedExportThunks' : [ 0x0, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x4, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x8, ['pointer', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x18, { + 'SourceProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], + 'SourceHandle' : [ 0x4, ['pointer', ['void']]], + 'Object' : [ 0x8, ['pointer', ['void']]], + 'TargetAccess' : [ 0xc, ['unsigned long']], + 'ObjectInfo' : [ 0x10, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x14, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_EFI_FIRMWARE_INFORMATION' : [ 0x10, { + 'FirmwareVersion' : [ 0x0, ['unsigned long']], + 'VirtualEfiRuntimeServices' : [ 0x4, ['pointer', ['_VIRTUAL_EFI_RUNTIME_SERVICES']]], + 'SetVirtualAddressMapStatus' : [ 0x8, ['long']], + 'MissedMappingsCount' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_1fd8' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fda' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fdc' : [ 0xc, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fde' : [ 0xc, { + 'Raw' : [ 0x0, ['__unnamed_1fdc']], + 'Translated' : [ 0x0, ['__unnamed_1fda']], +} ], + '__unnamed_1fe0' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fe2' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fe4' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fe6' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fe8' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fea' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1fec' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_1fd8']], + 'Port' : [ 0x0, ['__unnamed_1fd8']], + 'Interrupt' : [ 0x0, ['__unnamed_1fda']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_1fde']], + 'Memory' : [ 0x0, ['__unnamed_1fd8']], + 'Dma' : [ 0x0, ['__unnamed_1fe0']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1ec2']], + 'BusNumber' : [ 0x0, ['__unnamed_1fe2']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_1fe4']], + 'Memory40' : [ 0x0, ['__unnamed_1fe6']], + 'Memory48' : [ 0x0, ['__unnamed_1fe8']], + 'Memory64' : [ 0x0, ['__unnamed_1fea']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_1fec']], +} ], + '__unnamed_1ff1' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_1ff1']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x4, { + 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_1ffb' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x54, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x4, ['__unnamed_1ffb']], +} ], +} From 759691b99f0ad2577e46e963bce7a8d4d18bd593 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Fri, 16 Sep 2016 23:33:06 -0400 Subject: [PATCH 034/304] win8: added recent profile. Fixes hivelist. --- volatility/plugins/overlays/windows/win8.py | 13 + .../windows/win8_sp1_x64_54B5A1C6_vtypes.py | 11259 ++++++++++++++++ 2 files changed, 11272 insertions(+) create mode 100644 volatility/plugins/overlays/windows/win8_sp1_x64_54B5A1C6_vtypes.py diff --git a/volatility/plugins/overlays/windows/win8.py b/volatility/plugins/overlays/windows/win8.py index 9e13be737..a2171a544 100644 --- a/volatility/plugins/overlays/windows/win8.py +++ b/volatility/plugins/overlays/windows/win8.py @@ -422,6 +422,15 @@ class Win8SP1x64(obj.Profile): _md_build = 9600 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp1_x64_vtypes' +class Win8SP1x64_54B5A1C6(obj.Profile): + """ A Profile for Windows 8.1 x64 from PDB 54B5A1C6""" + _md_memory_model = '64bit' + _md_os = 'windows' + _md_major = 6 + _md_minor = 3 + _md_build = 9600 + _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp1_x64_54B5A1C6_vtypes' + class Win2012x64(Win8SP0x64): """ A Profile for Windows Server 2012 x64 """ _md_build = 9201 ##FIXME: fake build number to indicate server 2012 vs windows 8 @@ -430,6 +439,10 @@ class Win2012R2x64(Win8SP1x64): """ A Profile for Windows Server 2012 R2 x64 """ _md_build = 9601 ##FIXME: fake build number to indicate server 2012 R2 vs windows 8.1 +class Win2012R2x64_54B5A1C6(Win8SP1x64_54B5A1C6): + """ A Profile for Windows Server 2012 R2 x64 from PDB 54B5A1C6""" + _md_build = 9601 ##FIXME: fake build number to indicate server 2012 R2 vs windows 8.1 + class Win8SP0x86(obj.Profile): """ A Profile for Windows 8 x86 """ _md_memory_model = '32bit' diff --git a/volatility/plugins/overlays/windows/win8_sp1_x64_54B5A1C6_vtypes.py b/volatility/plugins/overlays/windows/win8_sp1_x64_54B5A1C6_vtypes.py new file mode 100644 index 000000000..91aaab42b --- /dev/null +++ b/volatility/plugins/overlays/windows/win8_sp1_x64_54B5A1C6_vtypes.py @@ -0,0 +1,11259 @@ +ntkrnlmp_types = { + 'LIST_ENTRY64' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + 'LIST_ENTRY32' : [ 0x8, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['unsigned long']], +} ], + '_KUSER_SHARED_DATA' : [ 0x5f0, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'AitSamplingValue' : [ 0x248, ['unsigned long']], + 'AppCompatFlag' : [ 0x24c, ['unsigned long']], + 'RNGSeedVersion' : [ 0x250, ['unsigned long long']], + 'GlobalValidationRunlevel' : [ 0x258, ['unsigned long']], + 'TimeZoneBiasStamp' : [ 0x25c, ['long']], + 'Reserved2' : [ 0x260, ['unsigned long']], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'Reserved0' : [ 0x269, ['array', 1, ['unsigned char']]], + 'NativeProcessorArchitecture' : [ 0x26a, ['unsigned short']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'AltArchitecturePad' : [ 0x2c4, ['array', 1, ['unsigned long']]], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'MitigationPolicies' : [ 0x2d5, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'SEHValidationPolicy' : [ 0x2d5, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned char')]], + 'CurDirDevicesSkippedForDlls' : [ 0x2d5, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Reserved' : [ 0x2d5, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Reserved6' : [ 0x2d6, ['array', 2, ['unsigned char']]], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'Reserved12' : [ 0x2ed, ['array', 3, ['unsigned char']]], + 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgLkgEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgConsoleBrokerEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgSecureBootEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'QpcFrequency' : [ 0x300, ['long long']], + 'SystemCallPad' : [ 0x308, ['array', 3, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'ReservedTickCountOverlay' : [ 0x320, ['array', 3, ['unsigned long']]], + 'TickCountPad' : [ 0x32c, ['array', 1, ['unsigned long']]], + 'Cookie' : [ 0x330, ['unsigned long']], + 'CookiePad' : [ 0x334, ['array', 1, ['unsigned long']]], + 'ConsoleSessionForegroundProcessId' : [ 0x338, ['long long']], + 'TimeUpdateLock' : [ 0x340, ['unsigned long long']], + 'BaselineSystemTimeQpc' : [ 0x348, ['unsigned long long']], + 'BaselineInterruptTimeQpc' : [ 0x350, ['unsigned long long']], + 'QpcSystemTimeIncrement' : [ 0x358, ['unsigned long long']], + 'QpcInterruptTimeIncrement' : [ 0x360, ['unsigned long long']], + 'QpcSystemTimeIncrement32' : [ 0x368, ['unsigned long']], + 'QpcInterruptTimeIncrement32' : [ 0x36c, ['unsigned long']], + 'QpcSystemTimeIncrementShift' : [ 0x370, ['unsigned char']], + 'QpcInterruptTimeIncrementShift' : [ 0x371, ['unsigned char']], + 'UnparkedProcessorCount' : [ 0x372, ['unsigned short']], + 'Reserved8' : [ 0x374, ['array', 12, ['unsigned char']]], + 'UserModeGlobalLogger' : [ 0x380, ['array', 16, ['unsigned short']]], + 'ImageFileExecutionOptions' : [ 0x3a0, ['unsigned long']], + 'LangGenerationCount' : [ 0x3a4, ['unsigned long']], + 'Reserved4' : [ 0x3a8, ['unsigned long long']], + 'InterruptTimeBias' : [ 0x3b0, ['unsigned long long']], + 'QpcBias' : [ 0x3b8, ['unsigned long long']], + 'ActiveProcessorCount' : [ 0x3c0, ['unsigned long']], + 'ActiveGroupCount' : [ 0x3c4, ['unsigned char']], + 'Reserved9' : [ 0x3c5, ['unsigned char']], + 'QpcData' : [ 0x3c6, ['unsigned short']], + 'QpcBypassEnabled' : [ 0x3c6, ['unsigned char']], + 'QpcShift' : [ 0x3c7, ['unsigned char']], + 'TimeZoneBiasEffectiveStart' : [ 0x3c8, ['_LARGE_INTEGER']], + 'TimeZoneBiasEffectiveEnd' : [ 0x3d0, ['_LARGE_INTEGER']], + 'XState' : [ 0x3d8, ['_XSTATE_CONFIGURATION']], +} ], + '__unnamed_107f' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], +} ], + '_ULARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['unsigned long']], + 'u' : [ 0x0, ['__unnamed_107f']], + 'QuadPart' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1083' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_LARGE_INTEGER' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], + 'u' : [ 0x0, ['__unnamed_1083']], + 'QuadPart' : [ 0x0, ['long long']], +} ], + '__unnamed_109b' : [ 0x4, { + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_109d' : [ 0x4, { + 'Flags' : [ 0x0, ['unsigned long']], + 's' : [ 0x0, ['__unnamed_109b']], +} ], + '_TP_CALLBACK_ENVIRON_V3' : [ 0x48, { + 'Version' : [ 0x0, ['unsigned long']], + 'Pool' : [ 0x8, ['pointer64', ['_TP_POOL']]], + 'CleanupGroup' : [ 0x10, ['pointer64', ['_TP_CLEANUP_GROUP']]], + 'CleanupGroupCancelCallback' : [ 0x18, ['pointer64', ['void']]], + 'RaceDll' : [ 0x20, ['pointer64', ['void']]], + 'ActivationContext' : [ 0x28, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'FinalizationCallback' : [ 0x30, ['pointer64', ['void']]], + 'u' : [ 0x38, ['__unnamed_109d']], + 'CallbackPriority' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'TP_CALLBACK_PRIORITY_HIGH', 1: 'TP_CALLBACK_PRIORITY_NORMAL', 2: 'TP_CALLBACK_PRIORITY_LOW', 3: 'TP_CALLBACK_PRIORITY_COUNT'})]], + 'Size' : [ 0x40, ['unsigned long']], +} ], + '_TEB' : [ 0x1820, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x38, ['pointer64', ['void']]], + 'ClientId' : [ 0x40, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x50, ['pointer64', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x58, ['pointer64', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x60, ['pointer64', ['_PEB']]], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['pointer64', ['void']]], + 'Win32ThreadInfo' : [ 0x78, ['pointer64', ['void']]], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['pointer64', ['void']]], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'SystemReserved1' : [ 0x110, ['array', 54, ['pointer64', ['void']]]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['pointer64', ['_ACTIVATION_CONTEXT_STACK']]], + 'SpareBytes' : [ 0x2d0, ['array', 24, ['unsigned char']]], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'Padding1' : [ 0x2ec, ['array', 4, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['pointer64', ['void']]], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['pointer64', ['void']]], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['pointer64', ['void']]]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['pointer64', ['void']]], + 'glSectionInfo' : [ 0x1228, ['pointer64', ['void']]], + 'glSection' : [ 0x1230, ['pointer64', ['void']]], + 'glTable' : [ 0x1238, ['pointer64', ['void']]], + 'glCurrentRC' : [ 0x1240, ['pointer64', ['void']]], + 'glContext' : [ 0x1248, ['pointer64', ['void']]], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['pointer64', ['void']]], + 'TlsSlots' : [ 0x1480, ['array', 64, ['pointer64', ['void']]]], + 'TlsLinks' : [ 0x1680, ['_LIST_ENTRY']], + 'Vdm' : [ 0x1690, ['pointer64', ['void']]], + 'ReservedForNtRpc' : [ 0x1698, ['pointer64', ['void']]], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['pointer64', ['void']]]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['pointer64', ['void']]]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['pointer64', ['void']]], + 'PerflibData' : [ 0x1728, ['pointer64', ['void']]], + 'EtwTraceData' : [ 0x1730, ['pointer64', ['void']]], + 'WinSockData' : [ 0x1738, ['pointer64', ['void']]], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['pointer64', ['void']]], + 'ReservedForOle' : [ 0x1758, ['pointer64', ['void']]], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['pointer64', ['void']]], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['pointer64', ['void']]], + 'TlsExpansionSlots' : [ 0x1780, ['pointer64', ['pointer64', ['void']]]], + 'DeallocationBStore' : [ 0x1788, ['pointer64', ['void']]], + 'BStoreLimit' : [ 0x1790, ['pointer64', ['void']]], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['pointer64', ['void']]], + 'pShimData' : [ 0x17a8, ['pointer64', ['void']]], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['pointer64', ['void']]], + 'ActiveFrame' : [ 0x17c0, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0x17c8, ['pointer64', ['void']]], + 'PreferredLanguages' : [ 0x17d0, ['pointer64', ['void']]], + 'UserPrefLanguages' : [ 0x17d8, ['pointer64', ['void']]], + 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], + 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], + 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'SpareUlong0' : [ 0x180c, ['unsigned long']], + 'ResourceRetValue' : [ 0x1810, ['pointer64', ['void']]], + 'ReservedForWdf' : [ 0x1818, ['pointer64', ['void']]], +} ], + '_LIST_ENTRY' : [ 0x10, { + 'Flink' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'Blink' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_SINGLE_LIST_ENTRY' : [ 0x8, { + 'Next' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_RTL_SPLAY_LINKS' : [ 0x18, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_SPLAY_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_SPLAY_LINKS']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_CONTEXT' : [ 0x18, { + 'ChainHead' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'PrevLinkage' : [ 0x8, ['pointer64', ['_LIST_ENTRY']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR' : [ 0x28, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ChainHead' : [ 0x18, ['pointer64', ['_LIST_ENTRY']]], + 'BucketIndex' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DYNAMIC_HASH_TABLE' : [ 0x28, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Shift' : [ 0x4, ['unsigned long']], + 'TableSize' : [ 0x8, ['unsigned long']], + 'Pivot' : [ 0xc, ['unsigned long']], + 'DivisorMask' : [ 0x10, ['unsigned long']], + 'NumEntries' : [ 0x14, ['unsigned long']], + 'NonEmptyBuckets' : [ 0x18, ['unsigned long']], + 'NumEnumerators' : [ 0x1c, ['unsigned long']], + 'Directory' : [ 0x20, ['pointer64', ['void']]], +} ], + '_UNICODE_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], + '_STRING' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_RTL_BITMAP' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long']]], +} ], + '_LUID' : [ 0x8, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'HighPart' : [ 0x4, ['long']], +} ], + '_IMAGE_NT_HEADERS64' : [ 0x108, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], + 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER64']], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], +} ], + '_RTL_BALANCED_NODE' : [ 0x18, { + 'Children' : [ 0x0, ['array', 2, ['pointer64', ['_RTL_BALANCED_NODE']]]], + 'Left' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Right' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Red' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Balance' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'ParentValue' : [ 0x10, ['unsigned long long']], +} ], + '_RTL_RB_TREE' : [ 0x10, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], + 'Min' : [ 0x8, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_RTL_AVL_TREE' : [ 0x8, { + 'Root' : [ 0x0, ['pointer64', ['_RTL_BALANCED_NODE']]], +} ], + '_GUID' : [ 0x10, { + 'Data1' : [ 0x0, ['unsigned long']], + 'Data2' : [ 0x4, ['unsigned short']], + 'Data3' : [ 0x6, ['unsigned short']], + 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KPCR' : [ 0x5f00, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'GdtBase' : [ 0x0, ['pointer64', ['_KGDTENTRY64']]], + 'TssBase' : [ 0x8, ['pointer64', ['_KTSS64']]], + 'UserRsp' : [ 0x10, ['unsigned long long']], + 'Self' : [ 0x18, ['pointer64', ['_KPCR']]], + 'CurrentPrcb' : [ 0x20, ['pointer64', ['_KPRCB']]], + 'LockArray' : [ 0x28, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Used_Self' : [ 0x30, ['pointer64', ['void']]], + 'IdtBase' : [ 0x38, ['pointer64', ['_KIDTENTRY64']]], + 'Unused' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'Irql' : [ 0x50, ['unsigned char']], + 'SecondLevelCacheAssociativity' : [ 0x51, ['unsigned char']], + 'ObsoleteNumber' : [ 0x52, ['unsigned char']], + 'Fill0' : [ 0x53, ['unsigned char']], + 'Unused0' : [ 0x54, ['array', 3, ['unsigned long']]], + 'MajorVersion' : [ 0x60, ['unsigned short']], + 'MinorVersion' : [ 0x62, ['unsigned short']], + 'StallScaleFactor' : [ 0x64, ['unsigned long']], + 'Unused1' : [ 0x68, ['array', 3, ['pointer64', ['void']]]], + 'KernelReserved' : [ 0x80, ['array', 15, ['unsigned long']]], + 'SecondLevelCacheSize' : [ 0xbc, ['unsigned long']], + 'HalReserved' : [ 0xc0, ['array', 16, ['unsigned long']]], + 'Unused2' : [ 0x100, ['unsigned long']], + 'KdVersionBlock' : [ 0x108, ['pointer64', ['void']]], + 'Unused3' : [ 0x110, ['pointer64', ['void']]], + 'PcrAlign1' : [ 0x118, ['array', 24, ['unsigned long']]], + 'Prcb' : [ 0x180, ['_KPRCB']], +} ], + '_KPRCB' : [ 0x5d80, { + 'MxCsr' : [ 0x0, ['unsigned long']], + 'LegacyNumber' : [ 0x4, ['unsigned char']], + 'ReservedMustBeZero' : [ 0x5, ['unsigned char']], + 'InterruptRequest' : [ 0x6, ['unsigned char']], + 'IdleHalt' : [ 0x7, ['unsigned char']], + 'CurrentThread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'NextThread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'IdleThread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NestingLevel' : [ 0x20, ['unsigned char']], + 'ClockOwner' : [ 0x21, ['unsigned char']], + 'PendingTickFlags' : [ 0x22, ['unsigned char']], + 'PendingTick' : [ 0x22, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'PendingBackupTick' : [ 0x22, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'PrcbPad00' : [ 0x23, ['array', 1, ['unsigned char']]], + 'Number' : [ 0x24, ['unsigned long']], + 'RspBase' : [ 0x28, ['unsigned long long']], + 'PrcbLock' : [ 0x30, ['unsigned long long']], + 'PriorityState' : [ 0x38, ['pointer64', ['unsigned char']]], + 'ProcessorState' : [ 0x40, ['_KPROCESSOR_STATE']], + 'CpuType' : [ 0x5f0, ['unsigned char']], + 'CpuID' : [ 0x5f1, ['unsigned char']], + 'CpuStep' : [ 0x5f2, ['unsigned short']], + 'CpuStepping' : [ 0x5f2, ['unsigned char']], + 'CpuModel' : [ 0x5f3, ['unsigned char']], + 'MHz' : [ 0x5f4, ['unsigned long']], + 'HalReserved' : [ 0x5f8, ['array', 8, ['unsigned long long']]], + 'MinorVersion' : [ 0x638, ['unsigned short']], + 'MajorVersion' : [ 0x63a, ['unsigned short']], + 'BuildType' : [ 0x63c, ['unsigned char']], + 'CpuVendor' : [ 0x63d, ['unsigned char']], + 'CoresPerPhysicalProcessor' : [ 0x63e, ['unsigned char']], + 'LogicalProcessorsPerCore' : [ 0x63f, ['unsigned char']], + 'ParentNode' : [ 0x640, ['pointer64', ['_KNODE']]], + 'GroupSetMember' : [ 0x648, ['unsigned long long']], + 'Group' : [ 0x650, ['unsigned char']], + 'GroupIndex' : [ 0x651, ['unsigned char']], + 'PrcbPad05' : [ 0x652, ['array', 2, ['unsigned char']]], + 'ApicMask' : [ 0x654, ['unsigned long']], + 'CFlushSize' : [ 0x658, ['unsigned long']], + 'AcpiReserved' : [ 0x660, ['pointer64', ['void']]], + 'InitialApicId' : [ 0x668, ['unsigned long']], + 'LockQueue' : [ 0x670, ['array', 17, ['_KSPIN_LOCK_QUEUE']]], + 'PPLookasideList' : [ 0x780, ['array', 16, ['_PP_LOOKASIDE_LIST']]], + 'PPNxPagedLookasideList' : [ 0x880, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPNPagedLookasideList' : [ 0x1480, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PPPagedLookasideList' : [ 0x2080, ['array', 32, ['_GENERAL_LOOKASIDE_POOL']]], + 'PrcbPad20' : [ 0x2c80, ['unsigned long long']], + 'DeferredReadyListHead' : [ 0x2c88, ['_SINGLE_LIST_ENTRY']], + 'MmPageFaultCount' : [ 0x2c90, ['long']], + 'MmCopyOnWriteCount' : [ 0x2c94, ['long']], + 'MmTransitionCount' : [ 0x2c98, ['long']], + 'MmDemandZeroCount' : [ 0x2c9c, ['long']], + 'MmPageReadCount' : [ 0x2ca0, ['long']], + 'MmPageReadIoCount' : [ 0x2ca4, ['long']], + 'MmDirtyPagesWriteCount' : [ 0x2ca8, ['long']], + 'MmDirtyWriteIoCount' : [ 0x2cac, ['long']], + 'MmMappedPagesWriteCount' : [ 0x2cb0, ['long']], + 'MmMappedWriteIoCount' : [ 0x2cb4, ['long']], + 'KeSystemCalls' : [ 0x2cb8, ['unsigned long']], + 'KeContextSwitches' : [ 0x2cbc, ['unsigned long']], + 'LdtSelector' : [ 0x2cc0, ['unsigned short']], + 'PrcbPad40' : [ 0x2cc2, ['unsigned short']], + 'CcFastReadNoWait' : [ 0x2cc4, ['unsigned long']], + 'CcFastReadWait' : [ 0x2cc8, ['unsigned long']], + 'CcFastReadNotPossible' : [ 0x2ccc, ['unsigned long']], + 'CcCopyReadNoWait' : [ 0x2cd0, ['unsigned long']], + 'CcCopyReadWait' : [ 0x2cd4, ['unsigned long']], + 'CcCopyReadNoWaitMiss' : [ 0x2cd8, ['unsigned long']], + 'IoReadOperationCount' : [ 0x2cdc, ['long']], + 'IoWriteOperationCount' : [ 0x2ce0, ['long']], + 'IoOtherOperationCount' : [ 0x2ce4, ['long']], + 'IoReadTransferCount' : [ 0x2ce8, ['_LARGE_INTEGER']], + 'IoWriteTransferCount' : [ 0x2cf0, ['_LARGE_INTEGER']], + 'IoOtherTransferCount' : [ 0x2cf8, ['_LARGE_INTEGER']], + 'PacketBarrier' : [ 0x2d00, ['long']], + 'TargetCount' : [ 0x2d04, ['long']], + 'IpiFrozen' : [ 0x2d08, ['unsigned long']], + 'IsrDpcStats' : [ 0x2d10, ['pointer64', ['void']]], + 'DeviceInterrupts' : [ 0x2d18, ['unsigned long']], + 'LookasideIrpFloat' : [ 0x2d1c, ['long']], + 'InterruptLastCount' : [ 0x2d20, ['unsigned long']], + 'InterruptRate' : [ 0x2d24, ['unsigned long']], + 'PrcbPad41' : [ 0x2d28, ['array', 22, ['unsigned long']]], + 'DpcData' : [ 0x2d80, ['array', 2, ['_KDPC_DATA']]], + 'DpcStack' : [ 0x2dd0, ['pointer64', ['void']]], + 'MaximumDpcQueueDepth' : [ 0x2dd8, ['long']], + 'DpcRequestRate' : [ 0x2ddc, ['unsigned long']], + 'MinimumDpcRate' : [ 0x2de0, ['unsigned long']], + 'DpcLastCount' : [ 0x2de4, ['unsigned long']], + 'ThreadDpcEnable' : [ 0x2de8, ['unsigned char']], + 'QuantumEnd' : [ 0x2de9, ['unsigned char']], + 'DpcRoutineActive' : [ 0x2dea, ['unsigned char']], + 'IdleSchedule' : [ 0x2deb, ['unsigned char']], + 'DpcRequestSummary' : [ 0x2dec, ['long']], + 'DpcRequestSlot' : [ 0x2dec, ['array', 2, ['short']]], + 'NormalDpcState' : [ 0x2dec, ['short']], + 'ThreadDpcState' : [ 0x2dee, ['short']], + 'DpcNormalProcessingActive' : [ 0x2dec, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DpcNormalProcessingRequested' : [ 0x2dec, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DpcNormalThreadSignal' : [ 0x2dec, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DpcNormalTimerExpiration' : [ 0x2dec, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DpcNormalDpcPresent' : [ 0x2dec, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DpcNormalLocalInterrupt' : [ 0x2dec, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DpcNormalSpare' : [ 0x2dec, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'DpcThreadActive' : [ 0x2dec, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DpcThreadRequested' : [ 0x2dec, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DpcThreadSpare' : [ 0x2dec, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], + 'LastTimerHand' : [ 0x2df0, ['unsigned long']], + 'LastTick' : [ 0x2df4, ['unsigned long']], + 'ClockInterrupts' : [ 0x2df8, ['unsigned long']], + 'ReadyScanTick' : [ 0x2dfc, ['unsigned long']], + 'TimerTable' : [ 0x2e00, ['_KTIMER_TABLE']], + 'DpcGate' : [ 0x5000, ['_KGATE']], + 'PrcbPad52' : [ 0x5018, ['pointer64', ['void']]], + 'CallDpc' : [ 0x5020, ['_KDPC']], + 'ClockKeepAlive' : [ 0x5060, ['long']], + 'PrcbPad60' : [ 0x5064, ['array', 2, ['unsigned char']]], + 'NmiActive' : [ 0x5066, ['unsigned short']], + 'DpcWatchdogPeriod' : [ 0x5068, ['long']], + 'DpcWatchdogCount' : [ 0x506c, ['long']], + 'KeSpinLockOrdering' : [ 0x5070, ['long']], + 'PrcbPad70' : [ 0x5074, ['array', 1, ['unsigned long']]], + 'CachedPtes' : [ 0x5078, ['pointer64', ['void']]], + 'WaitListHead' : [ 0x5080, ['_LIST_ENTRY']], + 'WaitLock' : [ 0x5090, ['unsigned long long']], + 'ReadySummary' : [ 0x5098, ['unsigned long']], + 'AffinitizedSelectionMask' : [ 0x509c, ['long']], + 'QueueIndex' : [ 0x50a0, ['unsigned long']], + 'PrcbPad75' : [ 0x50a4, ['array', 3, ['unsigned long']]], + 'TimerExpirationDpc' : [ 0x50b0, ['_KDPC']], + 'ScbQueue' : [ 0x50f0, ['_RTL_RB_TREE']], + 'DispatcherReadyListHead' : [ 0x5100, ['array', 32, ['_LIST_ENTRY']]], + 'InterruptCount' : [ 0x5300, ['unsigned long']], + 'KernelTime' : [ 0x5304, ['unsigned long']], + 'UserTime' : [ 0x5308, ['unsigned long']], + 'DpcTime' : [ 0x530c, ['unsigned long']], + 'InterruptTime' : [ 0x5310, ['unsigned long']], + 'AdjustDpcThreshold' : [ 0x5314, ['unsigned long']], + 'DebuggerSavedIRQL' : [ 0x5318, ['unsigned char']], + 'GroupSchedulingOverQuota' : [ 0x5319, ['unsigned char']], + 'DeepSleep' : [ 0x531a, ['unsigned char']], + 'PrcbPad80' : [ 0x531b, ['array', 1, ['unsigned char']]], + 'ScbOffset' : [ 0x531c, ['unsigned long']], + 'DpcTimeCount' : [ 0x5320, ['unsigned long']], + 'DpcTimeLimit' : [ 0x5324, ['unsigned long']], + 'PeriodicCount' : [ 0x5328, ['unsigned long']], + 'PeriodicBias' : [ 0x532c, ['unsigned long']], + 'AvailableTime' : [ 0x5330, ['unsigned long']], + 'KeExceptionDispatchCount' : [ 0x5334, ['unsigned long']], + 'StartCycles' : [ 0x5338, ['unsigned long long']], + 'GenerationTarget' : [ 0x5340, ['unsigned long long']], + 'AffinitizedCycles' : [ 0x5348, ['unsigned long long']], + 'PrcbPad81' : [ 0x5350, ['array', 2, ['unsigned long long']]], + 'MmSpinLockOrdering' : [ 0x5360, ['long']], + 'PageColor' : [ 0x5364, ['unsigned long']], + 'NodeColor' : [ 0x5368, ['unsigned long']], + 'NodeShiftedColor' : [ 0x536c, ['unsigned long']], + 'SecondaryColorMask' : [ 0x5370, ['unsigned long']], + 'PrcbPad83' : [ 0x5374, ['unsigned long']], + 'CycleTime' : [ 0x5378, ['unsigned long long']], + 'CcFastMdlReadNoWait' : [ 0x5380, ['unsigned long']], + 'CcFastMdlReadWait' : [ 0x5384, ['unsigned long']], + 'CcFastMdlReadNotPossible' : [ 0x5388, ['unsigned long']], + 'CcMapDataNoWait' : [ 0x538c, ['unsigned long']], + 'CcMapDataWait' : [ 0x5390, ['unsigned long']], + 'CcPinMappedDataCount' : [ 0x5394, ['unsigned long']], + 'CcPinReadNoWait' : [ 0x5398, ['unsigned long']], + 'CcPinReadWait' : [ 0x539c, ['unsigned long']], + 'CcMdlReadNoWait' : [ 0x53a0, ['unsigned long']], + 'CcMdlReadWait' : [ 0x53a4, ['unsigned long']], + 'CcLazyWriteHotSpots' : [ 0x53a8, ['unsigned long']], + 'CcLazyWriteIos' : [ 0x53ac, ['unsigned long']], + 'CcLazyWritePages' : [ 0x53b0, ['unsigned long']], + 'CcDataFlushes' : [ 0x53b4, ['unsigned long']], + 'CcDataPages' : [ 0x53b8, ['unsigned long']], + 'CcLostDelayedWrites' : [ 0x53bc, ['unsigned long']], + 'CcFastReadResourceMiss' : [ 0x53c0, ['unsigned long']], + 'CcCopyReadWaitMiss' : [ 0x53c4, ['unsigned long']], + 'CcFastMdlReadResourceMiss' : [ 0x53c8, ['unsigned long']], + 'CcMapDataNoWaitMiss' : [ 0x53cc, ['unsigned long']], + 'CcMapDataWaitMiss' : [ 0x53d0, ['unsigned long']], + 'CcPinReadNoWaitMiss' : [ 0x53d4, ['unsigned long']], + 'CcPinReadWaitMiss' : [ 0x53d8, ['unsigned long']], + 'CcMdlReadNoWaitMiss' : [ 0x53dc, ['unsigned long']], + 'CcMdlReadWaitMiss' : [ 0x53e0, ['unsigned long']], + 'CcReadAheadIos' : [ 0x53e4, ['unsigned long']], + 'MmCacheTransitionCount' : [ 0x53e8, ['long']], + 'MmCacheReadCount' : [ 0x53ec, ['long']], + 'MmCacheIoCount' : [ 0x53f0, ['long']], + 'PrcbPad91' : [ 0x53f4, ['array', 3, ['unsigned long']]], + 'PowerState' : [ 0x5400, ['_PROCESSOR_POWER_STATE']], + 'ScbList' : [ 0x55e0, ['_LIST_ENTRY']], + 'PrcbPad92' : [ 0x55f0, ['array', 19, ['unsigned long']]], + 'KeAlignmentFixupCount' : [ 0x563c, ['unsigned long']], + 'DpcWatchdogDpc' : [ 0x5640, ['_KDPC']], + 'DpcWatchdogTimer' : [ 0x5680, ['_KTIMER']], + 'Cache' : [ 0x56c0, ['array', 5, ['_CACHE_DESCRIPTOR']]], + 'CacheCount' : [ 0x56fc, ['unsigned long']], + 'CachedCommit' : [ 0x5700, ['unsigned long']], + 'CachedResidentAvailable' : [ 0x5704, ['unsigned long']], + 'HyperPte' : [ 0x5708, ['pointer64', ['void']]], + 'WheaInfo' : [ 0x5710, ['pointer64', ['void']]], + 'EtwSupport' : [ 0x5718, ['pointer64', ['void']]], + 'InterruptObjectPool' : [ 0x5720, ['_SLIST_HEADER']], + 'HypercallPageList' : [ 0x5730, ['_SLIST_HEADER']], + 'HypercallPageVirtual' : [ 0x5740, ['pointer64', ['void']]], + 'VirtualApicAssist' : [ 0x5748, ['pointer64', ['void']]], + 'StatisticsPage' : [ 0x5750, ['pointer64', ['unsigned long long']]], + 'PackageProcessorSet' : [ 0x5758, ['_KAFFINITY_EX']], + 'SharedReadyQueueMask' : [ 0x5800, ['unsigned long long']], + 'SharedReadyQueue' : [ 0x5808, ['pointer64', ['_KSHARED_READY_QUEUE']]], + 'CoreProcessorSet' : [ 0x5810, ['unsigned long long']], + 'ScanSiblingMask' : [ 0x5818, ['unsigned long long']], + 'LLCMask' : [ 0x5820, ['unsigned long long']], + 'CacheProcessorMask' : [ 0x5828, ['array', 5, ['unsigned long long']]], + 'ScanSiblingIndex' : [ 0x5850, ['unsigned long']], + 'SharedReadyQueueOffset' : [ 0x5854, ['unsigned long']], + 'ProcessorProfileControlArea' : [ 0x5858, ['pointer64', ['_PROCESSOR_PROFILE_CONTROL_AREA']]], + 'ProfileEventIndexAddress' : [ 0x5860, ['pointer64', ['void']]], + 'PrcbPad94' : [ 0x5868, ['array', 3, ['unsigned long long']]], + 'SynchCounters' : [ 0x5880, ['_SYNCH_COUNTERS']], + 'PteBitCache' : [ 0x5938, ['unsigned long long']], + 'PteBitOffset' : [ 0x5940, ['unsigned long']], + 'FsCounters' : [ 0x5948, ['_FILESYSTEM_DISK_COUNTERS']], + 'VendorString' : [ 0x5958, ['array', 13, ['unsigned char']]], + 'PrcbPad10' : [ 0x5965, ['array', 3, ['unsigned char']]], + 'FeatureBits' : [ 0x5968, ['unsigned long long']], + 'PrcbPad11' : [ 0x5970, ['unsigned long']], + 'UpdateSignature' : [ 0x5978, ['_LARGE_INTEGER']], + 'Context' : [ 0x5980, ['pointer64', ['_CONTEXT']]], + 'ContextFlagsInit' : [ 0x5988, ['unsigned long']], + 'ExtendedState' : [ 0x5990, ['pointer64', ['_XSAVE_AREA']]], + 'IsrStack' : [ 0x5998, ['pointer64', ['void']]], + 'EntropyTimingState' : [ 0x59a0, ['_KENTROPY_TIMING_STATE']], + 'AbSelfIoBoostsList' : [ 0x5af0, ['_SINGLE_LIST_ENTRY']], + 'AbPropagateBoostsList' : [ 0x5af8, ['_SINGLE_LIST_ENTRY']], + 'AbDpc' : [ 0x5b00, ['_KDPC']], + 'IoIrpStackProfilerCurrent' : [ 0x5b40, ['_IOP_IRP_STACK_PROFILER']], + 'IoIrpStackProfilerPrevious' : [ 0x5b94, ['_IOP_IRP_STACK_PROFILER']], + 'TimerExpirationTrace' : [ 0x5be8, ['array', 16, ['_KTIMER_EXPIRATION_TRACE']]], + 'TimerExpirationTraceCount' : [ 0x5ce8, ['unsigned long']], + 'Mailbox' : [ 0x5d00, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestMailbox' : [ 0x5d40, ['array', 1, ['_REQUEST_MAILBOX']]], +} ], + '_KFLOATING_SAVE' : [ 0x4, { + 'Dummy' : [ 0x0, ['unsigned long']], +} ], + '_SINGLE_LIST_ENTRY32' : [ 0x4, { + 'Next' : [ 0x0, ['unsigned long']], +} ], + '_EXT_SET_PARAMETERS_V0' : [ 0x10, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'NoWakeTolerance' : [ 0x8, ['long long']], +} ], + '_KTHREAD' : [ 0x5d0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'SListFaultAddress' : [ 0x18, ['pointer64', ['void']]], + 'QuantumTarget' : [ 0x20, ['unsigned long long']], + 'InitialStack' : [ 0x28, ['pointer64', ['void']]], + 'StackLimit' : [ 0x30, ['pointer64', ['void']]], + 'StackBase' : [ 0x38, ['pointer64', ['void']]], + 'ThreadLock' : [ 0x40, ['unsigned long long']], + 'CycleTime' : [ 0x48, ['unsigned long long']], + 'CurrentRunTime' : [ 0x50, ['unsigned long']], + 'ExpectedRunTime' : [ 0x54, ['unsigned long']], + 'KernelStack' : [ 0x58, ['pointer64', ['void']]], + 'StateSaveArea' : [ 0x60, ['pointer64', ['_XSAVE_FORMAT']]], + 'SchedulingGroup' : [ 0x68, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'WaitRegister' : [ 0x70, ['_KWAIT_STATUS_REGISTER']], + 'Running' : [ 0x71, ['unsigned char']], + 'Alerted' : [ 0x72, ['array', 2, ['unsigned char']]], + 'SpareMiscFlag0' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x74, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x74, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x74, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x74, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x74, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'TimerActive' : [ 0x74, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SystemThread' : [ 0x74, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ProcessDetachActive' : [ 0x74, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'CalloutActive' : [ 0x74, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ScbReadyQueue' : [ 0x74, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x74, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedStackInUse' : [ 0x74, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x74, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'ApcPendingReload' : [ 0x74, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'TimerSuspended' : [ 0x74, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'SuspendedWaitMode' : [ 0x74, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], + 'MiscFlags' : [ 0x74, ['long']], + 'AutoAlignment' : [ 0x78, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x78, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UserAffinitySet' : [ 0x78, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'AlertedByThreadId' : [ 0x78, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'QuantumDonation' : [ 0x78, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x78, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GuiThread' : [ 0x78, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DisableQuantum' : [ 0x78, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ChargeOnlySchedulingGroup' : [ 0x78, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QueueDeferPreemption' : [ 0x78, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x78, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'SharedReadyQueueAffinity' : [ 0x78, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'FreezeCount' : [ 0x78, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'TerminationApcRequest' : [ 0x78, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'AutoBoostEntriesExhausted' : [ 0x78, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'KernelStackResident' : [ 0x78, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'EtwStackTraceApcInserted' : [ 0x78, ['BitField', dict(start_bit = 17, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x78, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'ThreadFlags' : [ 0x78, ['long']], + 'Spare0' : [ 0x7c, ['unsigned long']], + 'SystemCallNumber' : [ 0x80, ['unsigned long']], + 'Spare1' : [ 0x84, ['unsigned long']], + 'FirstArgument' : [ 0x88, ['pointer64', ['void']]], + 'TrapFrame' : [ 0x90, ['pointer64', ['_KTRAP_FRAME']]], + 'ApcState' : [ 0x98, ['_KAPC_STATE']], + 'ApcStateFill' : [ 0x98, ['array', 43, ['unsigned char']]], + 'Priority' : [ 0xc3, ['unsigned char']], + 'UserIdealProcessor' : [ 0xc4, ['unsigned long']], + 'WaitStatus' : [ 0xc8, ['long long']], + 'WaitBlockList' : [ 0xd0, ['pointer64', ['_KWAIT_BLOCK']]], + 'WaitListEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0xd8, ['_SINGLE_LIST_ENTRY']], + 'Queue' : [ 0xe8, ['pointer64', ['_DISPATCHER_HEADER']]], + 'Teb' : [ 0xf0, ['pointer64', ['void']]], + 'RelativeTimerBias' : [ 0xf8, ['unsigned long long']], + 'Timer' : [ 0x100, ['_KTIMER']], + 'WaitBlock' : [ 0x140, ['array', 4, ['_KWAIT_BLOCK']]], + 'WaitBlockFill4' : [ 0x140, ['array', 20, ['unsigned char']]], + 'ContextSwitches' : [ 0x154, ['unsigned long']], + 'WaitBlockFill5' : [ 0x140, ['array', 68, ['unsigned char']]], + 'State' : [ 0x184, ['unsigned char']], + 'NpxState' : [ 0x185, ['unsigned char']], + 'WaitIrql' : [ 0x186, ['unsigned char']], + 'WaitMode' : [ 0x187, ['unsigned char']], + 'WaitBlockFill6' : [ 0x140, ['array', 116, ['unsigned char']]], + 'WaitTime' : [ 0x1b4, ['unsigned long']], + 'WaitBlockFill7' : [ 0x140, ['array', 164, ['unsigned char']]], + 'KernelApcDisable' : [ 0x1e4, ['short']], + 'SpecialApcDisable' : [ 0x1e6, ['short']], + 'CombinedApcDisable' : [ 0x1e4, ['unsigned long']], + 'WaitBlockFill8' : [ 0x140, ['array', 40, ['unsigned char']]], + 'ThreadCounters' : [ 0x168, ['pointer64', ['_KTHREAD_COUNTERS']]], + 'WaitBlockFill9' : [ 0x140, ['array', 88, ['unsigned char']]], + 'XStateSave' : [ 0x198, ['pointer64', ['_XSTATE_SAVE']]], + 'WaitBlockFill10' : [ 0x140, ['array', 136, ['unsigned char']]], + 'Win32Thread' : [ 0x1c8, ['pointer64', ['void']]], + 'WaitBlockFill11' : [ 0x140, ['array', 176, ['unsigned char']]], + 'Ucb' : [ 0x1f0, ['pointer64', ['_UMS_CONTROL_BLOCK']]], + 'Uch' : [ 0x1f8, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], + 'TebMappedLowVa' : [ 0x200, ['pointer64', ['void']]], + 'QueueListEntry' : [ 0x208, ['_LIST_ENTRY']], + 'NextProcessor' : [ 0x218, ['unsigned long']], + 'NextProcessorNumber' : [ 0x218, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'SharedReadyQueue' : [ 0x218, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'QueuePriority' : [ 0x21c, ['long']], + 'Process' : [ 0x220, ['pointer64', ['_KPROCESS']]], + 'UserAffinity' : [ 0x228, ['_GROUP_AFFINITY']], + 'UserAffinityFill' : [ 0x228, ['array', 10, ['unsigned char']]], + 'PreviousMode' : [ 0x232, ['unsigned char']], + 'BasePriority' : [ 0x233, ['unsigned char']], + 'PriorityDecrement' : [ 0x234, ['unsigned char']], + 'ForegroundBoost' : [ 0x234, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x234, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Preempted' : [ 0x235, ['unsigned char']], + 'AdjustReason' : [ 0x236, ['unsigned char']], + 'AdjustIncrement' : [ 0x237, ['unsigned char']], + 'Affinity' : [ 0x238, ['_GROUP_AFFINITY']], + 'AffinityFill' : [ 0x238, ['array', 10, ['unsigned char']]], + 'ApcStateIndex' : [ 0x242, ['unsigned char']], + 'WaitBlockCount' : [ 0x243, ['unsigned char']], + 'IdealProcessor' : [ 0x244, ['unsigned long']], + 'ApcStatePointer' : [ 0x248, ['array', 2, ['pointer64', ['_KAPC_STATE']]]], + 'SavedApcState' : [ 0x258, ['_KAPC_STATE']], + 'SavedApcStateFill' : [ 0x258, ['array', 43, ['unsigned char']]], + 'WaitReason' : [ 0x283, ['unsigned char']], + 'SuspendCount' : [ 0x284, ['unsigned char']], + 'Saturation' : [ 0x285, ['unsigned char']], + 'SListFaultCount' : [ 0x286, ['unsigned short']], + 'SchedulerApc' : [ 0x288, ['_KAPC']], + 'SchedulerApcFill0' : [ 0x288, ['array', 1, ['unsigned char']]], + 'ResourceIndex' : [ 0x289, ['unsigned char']], + 'SchedulerApcFill1' : [ 0x288, ['array', 3, ['unsigned char']]], + 'QuantumReset' : [ 0x28b, ['unsigned char']], + 'SchedulerApcFill2' : [ 0x288, ['array', 4, ['unsigned char']]], + 'KernelTime' : [ 0x28c, ['unsigned long']], + 'SchedulerApcFill3' : [ 0x288, ['array', 64, ['unsigned char']]], + 'WaitPrcb' : [ 0x2c8, ['pointer64', ['_KPRCB']]], + 'SchedulerApcFill4' : [ 0x288, ['array', 72, ['unsigned char']]], + 'LegoData' : [ 0x2d0, ['pointer64', ['void']]], + 'SchedulerApcFill5' : [ 0x288, ['array', 83, ['unsigned char']]], + 'CallbackNestingLevel' : [ 0x2db, ['unsigned char']], + 'UserTime' : [ 0x2dc, ['unsigned long']], + 'SuspendEvent' : [ 0x2e0, ['_KEVENT']], + 'ThreadListEntry' : [ 0x2f8, ['_LIST_ENTRY']], + 'MutantListHead' : [ 0x308, ['_LIST_ENTRY']], + 'LockEntriesFreeList' : [ 0x318, ['_SINGLE_LIST_ENTRY']], + 'LockEntries' : [ 0x320, ['array', 6, ['_KLOCK_ENTRY']]], + 'PropagateBoostsEntry' : [ 0x560, ['_SINGLE_LIST_ENTRY']], + 'IoSelfBoostsEntry' : [ 0x568, ['_SINGLE_LIST_ENTRY']], + 'PriorityFloorCounts' : [ 0x570, ['array', 16, ['unsigned char']]], + 'PriorityFloorSummary' : [ 0x580, ['unsigned long']], + 'AbCompletedIoBoostCount' : [ 0x584, ['long']], + 'AbReferenceCount' : [ 0x588, ['short']], + 'AbFreeEntryCount' : [ 0x58a, ['unsigned char']], + 'AbWaitEntryCount' : [ 0x58b, ['unsigned char']], + 'ForegroundLossTime' : [ 0x58c, ['unsigned long']], + 'GlobalForegroundListEntry' : [ 0x590, ['_LIST_ENTRY']], + 'ForegroundDpcStackListEntry' : [ 0x590, ['_SINGLE_LIST_ENTRY']], + 'InGlobalForegroundList' : [ 0x598, ['unsigned long long']], + 'ReadOperationCount' : [ 0x5a0, ['long long']], + 'WriteOperationCount' : [ 0x5a8, ['long long']], + 'OtherOperationCount' : [ 0x5b0, ['long long']], + 'ReadTransferCount' : [ 0x5b8, ['long long']], + 'WriteTransferCount' : [ 0x5c0, ['long long']], + 'OtherTransferCount' : [ 0x5c8, ['long long']], +} ], + '_KSTACK_CONTROL' : [ 0x30, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'ActualLimit' : [ 0x8, ['unsigned long long']], + 'StackExpansion' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Previous' : [ 0x10, ['_KERNEL_STACK_SEGMENT']], +} ], + '_KSPIN_LOCK_QUEUE' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], + 'Lock' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_FAST_MUTEX' : [ 0x38, { + 'Count' : [ 0x0, ['long']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Contention' : [ 0x10, ['unsigned long']], + 'Event' : [ 0x18, ['_KEVENT']], + 'OldIrql' : [ 0x30, ['unsigned long']], +} ], + '_KEVENT' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '__unnamed_1232' : [ 0x10, { + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SLIST_HEADER' : [ 0x10, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Region' : [ 0x8, ['unsigned long long']], + 'HeaderX64' : [ 0x0, ['__unnamed_1232']], +} ], + '_LOOKASIDE_LIST_EX' : [ 0x60, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE_POOL']], +} ], + '_SLIST_ENTRY' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x80, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], +} ], + '_IO_STATUS_BLOCK' : [ 0x10, { + 'Status' : [ 0x0, ['long']], + 'Pointer' : [ 0x0, ['pointer64', ['void']]], + 'Information' : [ 0x8, ['unsigned long long']], +} ], + '_QUAD' : [ 0x8, { + 'UseThisFieldToCopy' : [ 0x0, ['long long']], + 'DoNotUseThisField' : [ 0x0, ['double']], +} ], + '_WORK_QUEUE_ITEM' : [ 0x20, { + 'List' : [ 0x0, ['_LIST_ENTRY']], + 'WorkerRoutine' : [ 0x10, ['pointer64', ['void']]], + 'Parameter' : [ 0x18, ['pointer64', ['void']]], +} ], + '_EXT_DELETE_PARAMETERS' : [ 0x18, { + 'Version' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'DeleteCallback' : [ 0x8, ['pointer64', ['void']]], + 'DeleteContext' : [ 0x10, ['pointer64', ['void']]], +} ], + '_EX_PUSH_LOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x10, { + 'P' : [ 0x0, ['pointer64', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x8, ['pointer64', ['_GENERAL_LOOKASIDE']]], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_KNODE' : [ 0xc0, { + 'DeepIdleSet' : [ 0x0, ['unsigned long long']], + 'SharedReadyQueueLeaders' : [ 0x8, ['unsigned long long']], + 'ProximityId' : [ 0x40, ['unsigned long']], + 'NodeNumber' : [ 0x44, ['unsigned short']], + 'PrimaryNodeNumber' : [ 0x46, ['unsigned short']], + 'MaximumProcessors' : [ 0x48, ['unsigned char']], + 'Flags' : [ 0x49, ['_flags']], + 'Stride' : [ 0x4a, ['unsigned char']], + 'LowIndex' : [ 0x4b, ['unsigned char']], + 'Affinity' : [ 0x50, ['_GROUP_AFFINITY']], + 'IdleCpuSet' : [ 0x60, ['unsigned long long']], + 'IdleSmtSet' : [ 0x68, ['unsigned long long']], + 'NonParkedSet' : [ 0x80, ['unsigned long long']], + 'Seed' : [ 0x88, ['unsigned long']], + 'Lowest' : [ 0x8c, ['unsigned long']], + 'Highest' : [ 0x90, ['unsigned long']], + 'ParkLock' : [ 0x94, ['long']], +} ], + '_ENODE' : [ 0x500, { + 'Ncb' : [ 0x0, ['_KNODE']], + 'ExWorkQueues' : [ 0xc0, ['array', 8, ['pointer64', ['_EX_WORK_QUEUE']]]], + 'ExWorkQueue' : [ 0x100, ['_EX_WORK_QUEUE']], + 'ExpThreadSetManagerEvent' : [ 0x3d0, ['_KEVENT']], + 'ExpDeadlockTimer' : [ 0x3e8, ['_KTIMER']], + 'ExpThreadReaperEvent' : [ 0x428, ['_KEVENT']], + 'WaitBlocks' : [ 0x440, ['array', 3, ['_KWAIT_BLOCK']]], + 'ExpWorkerThreadBalanceManagerPtr' : [ 0x4d0, ['pointer64', ['_ETHREAD']]], + 'ExpWorkerSeed' : [ 0x4d8, ['unsigned long']], + 'ExWorkerFullInit' : [ 0x4dc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerStructInit' : [ 0x4dc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExWorkerFlags' : [ 0x4dc, ['unsigned long']], +} ], + '_HANDLE_TABLE' : [ 0x80, { + 'NextHandleNeedingPool' : [ 0x0, ['unsigned long']], + 'ExtraInfoPages' : [ 0x4, ['long']], + 'TableCode' : [ 0x8, ['unsigned long long']], + 'QuotaProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'HandleTableList' : [ 0x18, ['_LIST_ENTRY']], + 'UniqueProcessId' : [ 0x28, ['unsigned long']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'StrictFIFO' : [ 0x2c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'EnableHandleExceptions' : [ 0x2c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Rundown' : [ 0x2c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Duplicated' : [ 0x2c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'HandleContentionEvent' : [ 0x30, ['_EX_PUSH_LOCK']], + 'HandleTableLock' : [ 0x38, ['_EX_PUSH_LOCK']], + 'FreeLists' : [ 0x40, ['array', 1, ['_HANDLE_TABLE_FREE_LIST']]], + 'ActualEntry' : [ 0x40, ['array', 32, ['unsigned char']]], + 'DebugInfo' : [ 0x60, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], +} ], + '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { + 'AuditMask' : [ 0x0, ['unsigned long']], +} ], + '_HANDLE_TABLE_ENTRY' : [ 0x10, { + 'VolatileLowValue' : [ 0x0, ['long long']], + 'LowValue' : [ 0x0, ['long long']], + 'InfoTable' : [ 0x0, ['pointer64', ['_HANDLE_TABLE_ENTRY_INFO']]], + 'Unlocked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 17, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 20, native_type='unsigned long long')]], + 'ObjectPointerBits' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 64, native_type='unsigned long long')]], + 'HighValue' : [ 0x8, ['long long']], + 'NextFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LeafHandleValue' : [ 0x8, ['_EXHANDLE']], + 'GrantedAccessBits' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'NoRightsUpgrade' : [ 0x8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Spare' : [ 0x8, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], + 'TypeInfo' : [ 0xc, ['unsigned long']], +} ], + '_EX_FAST_REF' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_1329' : [ 0x2c, { + 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], + 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], +} ], + '_ACCESS_STATE' : [ 0xa0, { + 'OperationID' : [ 0x0, ['_LUID']], + 'SecurityEvaluated' : [ 0x8, ['unsigned char']], + 'GenerateAudit' : [ 0x9, ['unsigned char']], + 'GenerateOnClose' : [ 0xa, ['unsigned char']], + 'PrivilegesAllocated' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['unsigned long']], + 'RemainingDesiredAccess' : [ 0x10, ['unsigned long']], + 'PreviouslyGrantedAccess' : [ 0x14, ['unsigned long']], + 'OriginalDesiredAccess' : [ 0x18, ['unsigned long']], + 'SubjectSecurityContext' : [ 0x20, ['_SECURITY_SUBJECT_CONTEXT']], + 'SecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'AuxData' : [ 0x48, ['pointer64', ['void']]], + 'Privileges' : [ 0x50, ['__unnamed_1329']], + 'AuditPrivileges' : [ 0x7c, ['unsigned char']], + 'ObjectName' : [ 0x80, ['_UNICODE_STRING']], + 'ObjectTypeName' : [ 0x90, ['_UNICODE_STRING']], +} ], + '_AUX_ACCESS_DATA' : [ 0xe0, { + 'PrivilegesUsed' : [ 0x0, ['pointer64', ['_PRIVILEGE_SET']]], + 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], + 'AccessesToAudit' : [ 0x18, ['unsigned long']], + 'MaximumAuditMask' : [ 0x1c, ['unsigned long']], + 'TransactionId' : [ 0x20, ['_GUID']], + 'NewSecurityDescriptor' : [ 0x30, ['pointer64', ['void']]], + 'ExistingSecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'ParentSecurityDescriptor' : [ 0x40, ['pointer64', ['void']]], + 'DeRefSecurityDescriptor' : [ 0x48, ['pointer64', ['void']]], + 'SDLock' : [ 0x50, ['pointer64', ['void']]], + 'AccessReasons' : [ 0x58, ['_ACCESS_REASONS']], + 'GenerateStagingEvents' : [ 0xd8, ['unsigned char']], +} ], + '_ETHREAD' : [ 0x778, { + 'Tcb' : [ 0x0, ['_KTHREAD']], + 'CreateTime' : [ 0x5d0, ['_LARGE_INTEGER']], + 'ExitTime' : [ 0x5d8, ['_LARGE_INTEGER']], + 'KeyedWaitChain' : [ 0x5d8, ['_LIST_ENTRY']], + 'ChargeOnlySession' : [ 0x5e8, ['pointer64', ['void']]], + 'PostBlockList' : [ 0x5f0, ['_LIST_ENTRY']], + 'ForwardLinkShadow' : [ 0x5f0, ['pointer64', ['void']]], + 'StartAddress' : [ 0x5f8, ['pointer64', ['void']]], + 'TerminationPort' : [ 0x600, ['pointer64', ['_TERMINATION_PORT']]], + 'ReaperLink' : [ 0x600, ['pointer64', ['_ETHREAD']]], + 'KeyedWaitValue' : [ 0x600, ['pointer64', ['void']]], + 'ActiveTimerListLock' : [ 0x608, ['unsigned long long']], + 'ActiveTimerListHead' : [ 0x610, ['_LIST_ENTRY']], + 'Cid' : [ 0x620, ['_CLIENT_ID']], + 'KeyedWaitSemaphore' : [ 0x630, ['_KSEMAPHORE']], + 'AlpcWaitSemaphore' : [ 0x630, ['_KSEMAPHORE']], + 'ClientSecurity' : [ 0x650, ['_PS_CLIENT_SECURITY_CONTEXT']], + 'IrpList' : [ 0x658, ['_LIST_ENTRY']], + 'TopLevelIrp' : [ 0x668, ['unsigned long long']], + 'DeviceToVerify' : [ 0x670, ['pointer64', ['_DEVICE_OBJECT']]], + 'Win32StartAddress' : [ 0x678, ['pointer64', ['void']]], + 'LegacyPowerObject' : [ 0x680, ['pointer64', ['void']]], + 'ThreadListEntry' : [ 0x688, ['_LIST_ENTRY']], + 'RundownProtect' : [ 0x698, ['_EX_RUNDOWN_REF']], + 'ThreadLock' : [ 0x6a0, ['_EX_PUSH_LOCK']], + 'ReadClusterSize' : [ 0x6a8, ['unsigned long']], + 'MmLockOrdering' : [ 0x6ac, ['long']], + 'CmLockOrdering' : [ 0x6b0, ['long']], + 'CrossThreadFlags' : [ 0x6b4, ['unsigned long']], + 'Terminated' : [ 0x6b4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x6b4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x6b4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x6b4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x6b4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x6b4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x6b4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x6b4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x6b4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x6b4, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x6b4, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'RundownFail' : [ 0x6b4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UmsForceQueueTermination' : [ 0x6b4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReservedCrossThreadFlags' : [ 0x6b4, ['BitField', dict(start_bit = 17, end_bit = 32, native_type='unsigned long')]], + 'SameThreadPassiveFlags' : [ 0x6b8, ['unsigned long']], + 'ActiveExWorker' : [ 0x6b8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x6b8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ClonedThread' : [ 0x6b8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x6b8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x6b8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SameThreadApcFlags' : [ 0x6bc, ['unsigned long']], + 'HardFaultBehavior' : [ 0x6bc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x6bc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwCalloutActive' : [ 0x6bc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x6bc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x6bc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x6bc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x6bc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x6bc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x6bd, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x6bd, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x6bd, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x6bd, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x6bd, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsVadExclusive' : [ 0x6bd, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x6bd, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x6bd, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x6be, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x6be, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x6be, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x6be, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x6be, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare2' : [ 0x6be, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'SystemPagePriorityActive' : [ 0x6bf, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SystemPagePriority' : [ 0x6bf, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'Spare3' : [ 0x6bf, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'CacheManagerActive' : [ 0x6c0, ['unsigned char']], + 'DisablePageFaultClustering' : [ 0x6c1, ['unsigned char']], + 'ActiveFaultCount' : [ 0x6c2, ['unsigned char']], + 'LockOrderState' : [ 0x6c3, ['unsigned char']], + 'AlpcMessageId' : [ 0x6c8, ['unsigned long long']], + 'AlpcMessage' : [ 0x6d0, ['pointer64', ['void']]], + 'AlpcReceiveAttributeSet' : [ 0x6d0, ['unsigned long']], + 'ExitStatus' : [ 0x6d8, ['long']], + 'AlpcWaitListEntry' : [ 0x6e0, ['_LIST_ENTRY']], + 'CacheManagerCount' : [ 0x6f0, ['unsigned long']], + 'IoBoostCount' : [ 0x6f4, ['unsigned long']], + 'BoostList' : [ 0x6f8, ['_LIST_ENTRY']], + 'DeboostList' : [ 0x708, ['_LIST_ENTRY']], + 'BoostListLock' : [ 0x718, ['unsigned long long']], + 'IrpListLock' : [ 0x720, ['unsigned long long']], + 'ReservedForSynchTracking' : [ 0x728, ['pointer64', ['void']]], + 'CmCallbackListHead' : [ 0x730, ['_SINGLE_LIST_ENTRY']], + 'ActivityId' : [ 0x738, ['pointer64', ['_GUID']]], + 'SeLearningModeListHead' : [ 0x740, ['_SINGLE_LIST_ENTRY']], + 'VerifierContext' : [ 0x748, ['pointer64', ['void']]], + 'KernelStackReference' : [ 0x750, ['unsigned long']], + 'AdjustedClientToken' : [ 0x758, ['pointer64', ['void']]], + 'UserFsBase' : [ 0x760, ['unsigned long']], + 'UserGsBase' : [ 0x768, ['unsigned long long']], + 'PicoContext' : [ 0x770, ['pointer64', ['void']]], +} ], + '_EPROCESS' : [ 0x6f0, { + 'Pcb' : [ 0x0, ['_KPROCESS']], + 'ProcessLock' : [ 0x2c8, ['_EX_PUSH_LOCK']], + 'CreateTime' : [ 0x2d0, ['_LARGE_INTEGER']], + 'RundownProtect' : [ 0x2d8, ['_EX_RUNDOWN_REF']], + 'UniqueProcessId' : [ 0x2e0, ['pointer64', ['void']]], + 'ActiveProcessLinks' : [ 0x2e8, ['_LIST_ENTRY']], + 'Flags2' : [ 0x2f8, ['unsigned long']], + 'JobNotReallyActive' : [ 0x2f8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x2f8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x2f8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x2f8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x2f8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x2f8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ForceWakeCharge' : [ 0x2f8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x2f8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x2f8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x2f8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DisableDynamicCode' : [ 0x2f8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'EmptyJobEvaluated' : [ 0x2f8, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x2f8, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x2f8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x2f8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x2f8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x2f8, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x2f8, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x2f8, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x2f8, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ProcessExecutionState' : [ 0x2f8, ['BitField', dict(start_bit = 22, end_bit = 24, native_type='unsigned long')]], + 'DisallowStrippedImages' : [ 0x2f8, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'HighEntropyASLREnabled' : [ 0x2f8, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ExtensionPointDisable' : [ 0x2f8, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ForceRelocateImages' : [ 0x2f8, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'ProcessStateChangeRequest' : [ 0x2f8, ['BitField', dict(start_bit = 28, end_bit = 30, native_type='unsigned long')]], + 'ProcessStateChangeInProgress' : [ 0x2f8, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'DisallowWin32kSystemCalls' : [ 0x2f8, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'Flags' : [ 0x2fc, ['unsigned long']], + 'CreateReported' : [ 0x2fc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x2fc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x2fc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x2fc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ControlFlowGuardEnabled' : [ 0x2fc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x2fc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x2fc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x2fc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x2fc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x2fc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x2fc, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x2fc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x2fc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x2fc, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x2fc, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x2fc, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x2fc, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x2fc, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x2fc, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Background' : [ 0x2fc, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x2fc, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x2fc, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x2fc, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x2fc, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ProcessRundown' : [ 0x2fc, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x2fc, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x2fc, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x2fc, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x2fc, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ProcessQuotaUsage' : [ 0x300, ['array', 2, ['unsigned long long']]], + 'ProcessQuotaPeak' : [ 0x310, ['array', 2, ['unsigned long long']]], + 'PeakVirtualSize' : [ 0x320, ['unsigned long long']], + 'VirtualSize' : [ 0x328, ['unsigned long long']], + 'SessionProcessLinks' : [ 0x330, ['_LIST_ENTRY']], + 'ExceptionPortData' : [ 0x340, ['pointer64', ['void']]], + 'ExceptionPortValue' : [ 0x340, ['unsigned long long']], + 'ExceptionPortState' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Token' : [ 0x348, ['_EX_FAST_REF']], + 'WorkingSetPage' : [ 0x350, ['unsigned long long']], + 'AddressCreationLock' : [ 0x358, ['_EX_PUSH_LOCK']], + 'PageTableCommitmentLock' : [ 0x360, ['_EX_PUSH_LOCK']], + 'RotateInProgress' : [ 0x368, ['pointer64', ['_ETHREAD']]], + 'ForkInProgress' : [ 0x370, ['pointer64', ['_ETHREAD']]], + 'CommitChargeJob' : [ 0x378, ['pointer64', ['_EJOB']]], + 'CloneRoot' : [ 0x380, ['_RTL_AVL_TREE']], + 'NumberOfPrivatePages' : [ 0x388, ['unsigned long long']], + 'NumberOfLockedPages' : [ 0x390, ['unsigned long long']], + 'Win32Process' : [ 0x398, ['pointer64', ['void']]], + 'Job' : [ 0x3a0, ['pointer64', ['_EJOB']]], + 'SectionObject' : [ 0x3a8, ['pointer64', ['void']]], + 'SectionBaseAddress' : [ 0x3b0, ['pointer64', ['void']]], + 'Cookie' : [ 0x3b8, ['unsigned long']], + 'WorkingSetWatch' : [ 0x3c0, ['pointer64', ['_PAGEFAULT_HISTORY']]], + 'Win32WindowStation' : [ 0x3c8, ['pointer64', ['void']]], + 'InheritedFromUniqueProcessId' : [ 0x3d0, ['pointer64', ['void']]], + 'LdtInformation' : [ 0x3d8, ['pointer64', ['void']]], + 'OwnerProcessId' : [ 0x3e0, ['unsigned long long']], + 'Peb' : [ 0x3e8, ['pointer64', ['_PEB']]], + 'Session' : [ 0x3f0, ['pointer64', ['void']]], + 'AweInfo' : [ 0x3f8, ['pointer64', ['void']]], + 'QuotaBlock' : [ 0x400, ['pointer64', ['_EPROCESS_QUOTA_BLOCK']]], + 'ObjectTable' : [ 0x408, ['pointer64', ['_HANDLE_TABLE']]], + 'DebugPort' : [ 0x410, ['pointer64', ['void']]], + 'Wow64Process' : [ 0x418, ['pointer64', ['void']]], + 'DeviceMap' : [ 0x420, ['pointer64', ['void']]], + 'EtwDataSource' : [ 0x428, ['pointer64', ['void']]], + 'PageDirectoryPte' : [ 0x430, ['unsigned long long']], + 'ImageFileName' : [ 0x438, ['array', 15, ['unsigned char']]], + 'PriorityClass' : [ 0x447, ['unsigned char']], + 'SecurityPort' : [ 0x448, ['pointer64', ['void']]], + 'SeAuditProcessCreationInfo' : [ 0x450, ['_SE_AUDIT_PROCESS_CREATION_INFO']], + 'JobLinks' : [ 0x458, ['_LIST_ENTRY']], + 'HighestUserAddress' : [ 0x468, ['pointer64', ['void']]], + 'ThreadListHead' : [ 0x470, ['_LIST_ENTRY']], + 'ActiveThreads' : [ 0x480, ['unsigned long']], + 'ImagePathHash' : [ 0x484, ['unsigned long']], + 'DefaultHardErrorProcessing' : [ 0x488, ['unsigned long']], + 'LastThreadExitStatus' : [ 0x48c, ['long']], + 'PrefetchTrace' : [ 0x490, ['_EX_FAST_REF']], + 'LockedPagesList' : [ 0x498, ['pointer64', ['void']]], + 'ReadOperationCount' : [ 0x4a0, ['_LARGE_INTEGER']], + 'WriteOperationCount' : [ 0x4a8, ['_LARGE_INTEGER']], + 'OtherOperationCount' : [ 0x4b0, ['_LARGE_INTEGER']], + 'ReadTransferCount' : [ 0x4b8, ['_LARGE_INTEGER']], + 'WriteTransferCount' : [ 0x4c0, ['_LARGE_INTEGER']], + 'OtherTransferCount' : [ 0x4c8, ['_LARGE_INTEGER']], + 'CommitCharge' : [ 0x4d0, ['unsigned long long']], + 'Vm' : [ 0x4d8, ['_MMSUPPORT']], + 'MmProcessLinks' : [ 0x5c0, ['_LIST_ENTRY']], + 'ModifiedPageCount' : [ 0x5d0, ['unsigned long']], + 'ExitStatus' : [ 0x5d4, ['long']], + 'VadRoot' : [ 0x5d8, ['_RTL_AVL_TREE']], + 'VadHint' : [ 0x5e0, ['pointer64', ['void']]], + 'VadCount' : [ 0x5e8, ['unsigned long long']], + 'VadPhysicalPages' : [ 0x5f0, ['unsigned long long']], + 'VadPhysicalPagesLimit' : [ 0x5f8, ['unsigned long long']], + 'AlpcContext' : [ 0x600, ['_ALPC_PROCESS_CONTEXT']], + 'TimerResolutionLink' : [ 0x620, ['_LIST_ENTRY']], + 'TimerResolutionStackRecord' : [ 0x630, ['pointer64', ['_PO_DIAG_STACK_RECORD']]], + 'RequestedTimerResolution' : [ 0x638, ['unsigned long']], + 'SmallestTimerResolution' : [ 0x63c, ['unsigned long']], + 'ExitTime' : [ 0x640, ['_LARGE_INTEGER']], + 'InvertedFunctionTable' : [ 0x648, ['pointer64', ['_INVERTED_FUNCTION_TABLE']]], + 'InvertedFunctionTableLock' : [ 0x650, ['_EX_PUSH_LOCK']], + 'ActiveThreadsHighWatermark' : [ 0x658, ['unsigned long']], + 'LargePrivateVadCount' : [ 0x65c, ['unsigned long']], + 'ThreadListLock' : [ 0x660, ['_EX_PUSH_LOCK']], + 'WnfContext' : [ 0x668, ['pointer64', ['void']]], + 'Spare0' : [ 0x670, ['unsigned long long']], + 'SignatureLevel' : [ 0x678, ['unsigned char']], + 'SectionSignatureLevel' : [ 0x679, ['unsigned char']], + 'Protection' : [ 0x67a, ['_PS_PROTECTION']], + 'SpareByte20' : [ 0x67b, ['array', 1, ['unsigned char']]], + 'Flags3' : [ 0x67c, ['unsigned long']], + 'Minimal' : [ 0x67c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SvmReserved' : [ 0x680, ['long']], + 'SvmReserved1' : [ 0x688, ['pointer64', ['void']]], + 'SvmReserved2' : [ 0x690, ['unsigned long long']], + 'LastFreezeInterruptTime' : [ 0x698, ['unsigned long long']], + 'DiskCounters' : [ 0x6a0, ['pointer64', ['_PROCESS_DISK_COUNTERS']]], + 'PicoContext' : [ 0x6a8, ['pointer64', ['void']]], + 'KeepAliveCounter' : [ 0x6b0, ['unsigned long']], + 'NoWakeKeepAliveCounter' : [ 0x6b4, ['unsigned long']], + 'DeepFreezeStartTime' : [ 0x6b8, ['unsigned long long']], + 'CommitChargeLimit' : [ 0x6c0, ['unsigned long long']], + 'CommitChargePeak' : [ 0x6c8, ['unsigned long long']], + 'HighPriorityFaultsAllowed' : [ 0x6d0, ['unsigned long']], + 'SequenceNumber' : [ 0x6d8, ['unsigned long long']], + 'CreateInterruptTime' : [ 0x6e0, ['unsigned long long']], + 'CreateUnbiasedInterruptTime' : [ 0x6e8, ['unsigned long long']], +} ], + '_KPROCESS' : [ 0x2c8, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x18, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x28, ['unsigned long long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x40, ['unsigned long']], + 'Spare0' : [ 0x44, ['unsigned long']], + 'Affinity' : [ 0x48, ['_KAFFINITY_EX']], + 'ReadyListHead' : [ 0xf0, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'ActiveProcessors' : [ 0x108, ['_KAFFINITY_EX']], + 'AutoAlignment' : [ 0x1b0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x1b0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x1b0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'AffinitySet' : [ 0x1b0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='long')]], + 'DeepFreeze' : [ 0x1b0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'TimerVirtualization' : [ 0x1b0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'CheckStackExtents' : [ 0x1b0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'ActiveGroupsMask' : [ 0x1b0, ['BitField', dict(start_bit = 7, end_bit = 27, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x1b0, ['BitField', dict(start_bit = 27, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x1b0, ['long']], + 'BasePriority' : [ 0x1b4, ['unsigned char']], + 'QuantumReset' : [ 0x1b5, ['unsigned char']], + 'Visited' : [ 0x1b6, ['unsigned char']], + 'Flags' : [ 0x1b7, ['_KEXECUTE_OPTIONS']], + 'ThreadSeed' : [ 0x1b8, ['array', 20, ['unsigned long']]], + 'IdealNode' : [ 0x208, ['array', 20, ['unsigned short']]], + 'IdealGlobalNode' : [ 0x230, ['unsigned short']], + 'Spare1' : [ 0x232, ['unsigned short']], + 'StackCount' : [ 0x234, ['_KSTACK_COUNT']], + 'ProcessListEntry' : [ 0x238, ['_LIST_ENTRY']], + 'CycleTime' : [ 0x248, ['unsigned long long']], + 'ContextSwitches' : [ 0x250, ['unsigned long long']], + 'SchedulingGroup' : [ 0x258, ['pointer64', ['_KSCHEDULING_GROUP']]], + 'FreezeCount' : [ 0x260, ['unsigned long']], + 'KernelTime' : [ 0x264, ['unsigned long']], + 'UserTime' : [ 0x268, ['unsigned long']], + 'LdtFreeSelectorHint' : [ 0x26c, ['unsigned short']], + 'LdtTableLength' : [ 0x26e, ['unsigned short']], + 'LdtSystemDescriptor' : [ 0x270, ['_KGDTENTRY64']], + 'LdtBaseAddress' : [ 0x280, ['pointer64', ['void']]], + 'LdtProcessLock' : [ 0x288, ['_FAST_MUTEX']], + 'InstrumentationCallback' : [ 0x2c0, ['pointer64', ['void']]], +} ], + '__unnamed_1381' : [ 0x8, { + 'MasterIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'IrpCount' : [ 0x0, ['long']], + 'SystemBuffer' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1387' : [ 0x10, { + 'UserApcRoutine' : [ 0x0, ['pointer64', ['void']]], + 'IssuingProcess' : [ 0x0, ['pointer64', ['void']]], + 'UserApcContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_1389' : [ 0x10, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_1387']], + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '__unnamed_1394' : [ 0x58, { + 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DriverContext' : [ 0x0, ['array', 4, ['pointer64', ['void']]]], + 'Thread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'AuxiliaryBuffer' : [ 0x28, ['pointer64', ['unsigned char']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'CurrentStackLocation' : [ 0x40, ['pointer64', ['_IO_STACK_LOCATION']]], + 'PacketType' : [ 0x40, ['unsigned long']], + 'OriginalFileObject' : [ 0x48, ['pointer64', ['_FILE_OBJECT']]], + 'IrpExtension' : [ 0x50, ['pointer64', ['void']]], +} ], + '__unnamed_1396' : [ 0x58, { + 'Overlay' : [ 0x0, ['__unnamed_1394']], + 'Apc' : [ 0x0, ['_KAPC']], + 'CompletionKey' : [ 0x0, ['pointer64', ['void']]], +} ], + '_IRP' : [ 0xd0, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'AllocationProcessorNumber' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'MdlAddress' : [ 0x8, ['pointer64', ['_MDL']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'AssociatedIrp' : [ 0x18, ['__unnamed_1381']], + 'ThreadListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'IoStatus' : [ 0x30, ['_IO_STATUS_BLOCK']], + 'RequestorMode' : [ 0x40, ['unsigned char']], + 'PendingReturned' : [ 0x41, ['unsigned char']], + 'StackCount' : [ 0x42, ['unsigned char']], + 'CurrentLocation' : [ 0x43, ['unsigned char']], + 'Cancel' : [ 0x44, ['unsigned char']], + 'CancelIrql' : [ 0x45, ['unsigned char']], + 'ApcEnvironment' : [ 0x46, ['unsigned char']], + 'AllocationFlags' : [ 0x47, ['unsigned char']], + 'UserIosb' : [ 0x48, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'UserEvent' : [ 0x50, ['pointer64', ['_KEVENT']]], + 'Overlay' : [ 0x58, ['__unnamed_1389']], + 'CancelRoutine' : [ 0x68, ['pointer64', ['void']]], + 'UserBuffer' : [ 0x70, ['pointer64', ['void']]], + 'Tail' : [ 0x78, ['__unnamed_1396']], +} ], + '__unnamed_139d' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'FileAttributes' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'EaLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13a1' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_NAMED_PIPE_CREATE_PARAMETERS']]], +} ], + '__unnamed_13a5' : [ 0x20, { + 'SecurityContext' : [ 0x0, ['pointer64', ['_IO_SECURITY_CONTEXT']]], + 'Options' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0x10, ['unsigned short']], + 'ShareAccess' : [ 0x12, ['unsigned short']], + 'Parameters' : [ 0x18, ['pointer64', ['_MAILSLOT_CREATE_PARAMETERS']]], +} ], + '__unnamed_13a7' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_13ab' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileName' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'FileInformationClass' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13ad' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'CompletionFilter' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13af' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], +} ], + '__unnamed_13b1' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileIoStatusBlockRangeInformation', 43: 'FileIoPriorityHintInformation', 44: 'FileSfioReserveInformation', 45: 'FileSfioVolumeInformation', 46: 'FileHardLinkInformation', 47: 'FileProcessIdsUsingFileInformation', 48: 'FileNormalizedNameInformation', 49: 'FileNetworkPhysicalNameInformation', 50: 'FileIdGlobalTxDirectoryInformation', 51: 'FileIsRemoteDeviceInformation', 52: 'FileUnusedInformation', 53: 'FileNumaNodeInformation', 54: 'FileStandardLinkInformation', 55: 'FileRemoteProtocolInformation', 56: 'FileRenameInformationBypassAccessCheck', 57: 'FileLinkInformationBypassAccessCheck', 58: 'FileVolumeNameInformation', 59: 'FileIdInformation', 60: 'FileIdExtdDirectoryInformation', 61: 'FileReplaceCompletionInformation', 62: 'FileHardLinkFullIdInformation', 63: 'FileIdExtdBothDirectoryInformation', 64: 'FileMaximumInformation'})]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'ReplaceIfExists' : [ 0x18, ['unsigned char']], + 'AdvanceOnly' : [ 0x19, ['unsigned char']], + 'ClusterCount' : [ 0x18, ['unsigned long']], + 'DeleteHandle' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13b3' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'EaList' : [ 0x8, ['pointer64', ['void']]], + 'EaListLength' : [ 0x10, ['unsigned long']], + 'EaIndex' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13b5' : [ 0x4, { + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_13b9' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'FsInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsVolumeFlagsInformation', 11: 'FileFsSectorSizeInformation', 12: 'FileFsDataCopyInformation', 13: 'FileFsMaximumInformation'})]], +} ], + '__unnamed_13bb' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'FsControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13bd' : [ 0x18, { + 'Length' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'Key' : [ 0x8, ['unsigned long']], + 'ByteOffset' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_13bf' : [ 0x20, { + 'OutputBufferLength' : [ 0x0, ['unsigned long']], + 'InputBufferLength' : [ 0x8, ['unsigned long']], + 'IoControlCode' : [ 0x10, ['unsigned long']], + 'Type3InputBuffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13c1' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13c3' : [ 0x10, { + 'SecurityInformation' : [ 0x0, ['unsigned long']], + 'SecurityDescriptor' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_13c7' : [ 0x10, { + 'Vpb' : [ 0x0, ['pointer64', ['_VPB']]], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_13cb' : [ 0x8, { + 'Srb' : [ 0x0, ['pointer64', ['_SCSI_REQUEST_BLOCK']]], +} ], + '__unnamed_13cf' : [ 0x20, { + 'Length' : [ 0x0, ['unsigned long']], + 'StartSid' : [ 0x8, ['pointer64', ['void']]], + 'SidList' : [ 0x10, ['pointer64', ['_FILE_GET_QUOTA_INFORMATION']]], + 'SidListLength' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13d3' : [ 0x4, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations', 6: 'TransportRelations'})]], +} ], + '__unnamed_13d7' : [ 0x20, { + 'InterfaceType' : [ 0x0, ['pointer64', ['_GUID']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Version' : [ 0xa, ['unsigned short']], + 'Interface' : [ 0x10, ['pointer64', ['_INTERFACE']]], + 'InterfaceSpecificData' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_13db' : [ 0x8, { + 'Capabilities' : [ 0x0, ['pointer64', ['_DEVICE_CAPABILITIES']]], +} ], + '__unnamed_13df' : [ 0x8, { + 'IoResourceRequirementList' : [ 0x0, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], +} ], + '__unnamed_13e1' : [ 0x20, { + 'WhichSpace' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x8, ['pointer64', ['void']]], + 'Offset' : [ 0x10, ['unsigned long']], + 'Length' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_13e3' : [ 0x1, { + 'Lock' : [ 0x0, ['unsigned char']], +} ], + '__unnamed_13e7' : [ 0x4, { + 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber', 5: 'BusQueryContainerID'})]], +} ], + '__unnamed_13eb' : [ 0x10, { + 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], + 'LocaleId' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_13ef' : [ 0x10, { + 'InPath' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '__unnamed_13f3' : [ 0x4, { + 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_13f7' : [ 0x8, { + 'PowerSequence' : [ 0x0, ['pointer64', ['_POWER_SEQUENCE']]], +} ], + '__unnamed_13ff' : [ 0x20, { + 'SystemContext' : [ 0x0, ['unsigned long']], + 'SystemPowerStateContext' : [ 0x0, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'State' : [ 0x10, ['_POWER_STATE']], + 'ShutdownType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], +} ], + '__unnamed_1403' : [ 0x10, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'AllocatedResourcesTranslated' : [ 0x8, ['pointer64', ['_CM_RESOURCE_LIST']]], +} ], + '__unnamed_1405' : [ 0x20, { + 'ProviderId' : [ 0x0, ['unsigned long long']], + 'DataPath' : [ 0x8, ['pointer64', ['void']]], + 'BufferSize' : [ 0x10, ['unsigned long']], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1407' : [ 0x20, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], +} ], + '__unnamed_1409' : [ 0x20, { + 'Create' : [ 0x0, ['__unnamed_139d']], + 'CreatePipe' : [ 0x0, ['__unnamed_13a1']], + 'CreateMailslot' : [ 0x0, ['__unnamed_13a5']], + 'Read' : [ 0x0, ['__unnamed_13a7']], + 'Write' : [ 0x0, ['__unnamed_13a7']], + 'QueryDirectory' : [ 0x0, ['__unnamed_13ab']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_13ad']], + 'QueryFile' : [ 0x0, ['__unnamed_13af']], + 'SetFile' : [ 0x0, ['__unnamed_13b1']], + 'QueryEa' : [ 0x0, ['__unnamed_13b3']], + 'SetEa' : [ 0x0, ['__unnamed_13b5']], + 'QueryVolume' : [ 0x0, ['__unnamed_13b9']], + 'SetVolume' : [ 0x0, ['__unnamed_13b9']], + 'FileSystemControl' : [ 0x0, ['__unnamed_13bb']], + 'LockControl' : [ 0x0, ['__unnamed_13bd']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_13bf']], + 'QuerySecurity' : [ 0x0, ['__unnamed_13c1']], + 'SetSecurity' : [ 0x0, ['__unnamed_13c3']], + 'MountVolume' : [ 0x0, ['__unnamed_13c7']], + 'VerifyVolume' : [ 0x0, ['__unnamed_13c7']], + 'Scsi' : [ 0x0, ['__unnamed_13cb']], + 'QueryQuota' : [ 0x0, ['__unnamed_13cf']], + 'SetQuota' : [ 0x0, ['__unnamed_13b5']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_13d3']], + 'QueryInterface' : [ 0x0, ['__unnamed_13d7']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_13db']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_13df']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_13e1']], + 'SetLock' : [ 0x0, ['__unnamed_13e3']], + 'QueryId' : [ 0x0, ['__unnamed_13e7']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_13eb']], + 'UsageNotification' : [ 0x0, ['__unnamed_13ef']], + 'WaitWake' : [ 0x0, ['__unnamed_13f3']], + 'PowerSequence' : [ 0x0, ['__unnamed_13f7']], + 'Power' : [ 0x0, ['__unnamed_13ff']], + 'StartDevice' : [ 0x0, ['__unnamed_1403']], + 'WMI' : [ 0x0, ['__unnamed_1405']], + 'Others' : [ 0x0, ['__unnamed_1407']], +} ], + '_IO_STACK_LOCATION' : [ 0x48, { + 'MajorFunction' : [ 0x0, ['unsigned char']], + 'MinorFunction' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned char']], + 'Control' : [ 0x3, ['unsigned char']], + 'Parameters' : [ 0x8, ['__unnamed_1409']], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x30, ['pointer64', ['_FILE_OBJECT']]], + 'CompletionRoutine' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_141f' : [ 0x48, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], +} ], + '_DEVICE_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'ReferenceCount' : [ 0x4, ['long']], + 'DriverObject' : [ 0x8, ['pointer64', ['_DRIVER_OBJECT']]], + 'NextDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentIrp' : [ 0x20, ['pointer64', ['_IRP']]], + 'Timer' : [ 0x28, ['pointer64', ['_IO_TIMER']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'Characteristics' : [ 0x34, ['unsigned long']], + 'Vpb' : [ 0x38, ['pointer64', ['_VPB']]], + 'DeviceExtension' : [ 0x40, ['pointer64', ['void']]], + 'DeviceType' : [ 0x48, ['unsigned long']], + 'StackSize' : [ 0x4c, ['unsigned char']], + 'Queue' : [ 0x50, ['__unnamed_141f']], + 'AlignmentRequirement' : [ 0x98, ['unsigned long']], + 'DeviceQueue' : [ 0xa0, ['_KDEVICE_QUEUE']], + 'Dpc' : [ 0xc8, ['_KDPC']], + 'ActiveThreadCount' : [ 0x108, ['unsigned long']], + 'SecurityDescriptor' : [ 0x110, ['pointer64', ['void']]], + 'DeviceLock' : [ 0x118, ['_KEVENT']], + 'SectorSize' : [ 0x130, ['unsigned short']], + 'Spare1' : [ 0x132, ['unsigned short']], + 'DeviceObjectExtension' : [ 0x138, ['pointer64', ['_DEVOBJ_EXTENSION']]], + 'Reserved' : [ 0x140, ['pointer64', ['void']]], +} ], + '_KDPC' : [ 0x40, { + 'TargetInfoAsUlong' : [ 0x0, ['unsigned long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Importance' : [ 0x1, ['unsigned char']], + 'Number' : [ 0x2, ['unsigned short']], + 'DpcListEntry' : [ 0x8, ['_SINGLE_LIST_ENTRY']], + 'ProcessorHistory' : [ 0x10, ['unsigned long long']], + 'DeferredRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeferredContext' : [ 0x20, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x28, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x30, ['pointer64', ['void']]], + 'DpcData' : [ 0x38, ['pointer64', ['void']]], +} ], + '_IO_DRIVER_CREATE_CONTEXT' : [ 0x20, { + 'Size' : [ 0x0, ['short']], + 'ExtraCreateParameter' : [ 0x8, ['pointer64', ['_ECP_LIST']]], + 'DeviceObjectHint' : [ 0x10, ['pointer64', ['void']]], + 'TxnParameters' : [ 0x18, ['pointer64', ['_TXN_PARAMETER_BLOCK']]], +} ], + '_IO_PRIORITY_INFO' : [ 0x10, { + 'Size' : [ 0x0, ['unsigned long']], + 'ThreadPriority' : [ 0x4, ['unsigned long']], + 'PagePriority' : [ 0x8, ['unsigned long']], + 'IoPriority' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IoPriorityVeryLow', 1: 'IoPriorityLow', 2: 'IoPriorityNormal', 3: 'IoPriorityHigh', 4: 'IoPriorityCritical', 5: 'MaxIoPriorityTypes'})]], +} ], + '_OBJECT_HANDLE_INFORMATION' : [ 0x8, { + 'HandleAttributes' : [ 0x0, ['unsigned long']], + 'GrantedAccess' : [ 0x4, ['unsigned long']], +} ], + '_MDL' : [ 0x30, { + 'Next' : [ 0x0, ['pointer64', ['_MDL']]], + 'Size' : [ 0x8, ['short']], + 'MdlFlags' : [ 0xa, ['short']], + 'AllocationProcessorNumber' : [ 0xc, ['unsigned short']], + 'Reserved' : [ 0xe, ['unsigned short']], + 'Process' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'MappedSystemVa' : [ 0x18, ['pointer64', ['void']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'ByteCount' : [ 0x28, ['unsigned long']], + 'ByteOffset' : [ 0x2c, ['unsigned long']], +} ], + '_EVENT_DATA_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned char']], + 'Reserved1' : [ 0xd, ['unsigned char']], + 'Reserved2' : [ 0xe, ['unsigned short']], +} ], + '_EVENT_DESCRIPTOR' : [ 0x10, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Channel' : [ 0x3, ['unsigned char']], + 'Level' : [ 0x4, ['unsigned char']], + 'Opcode' : [ 0x5, ['unsigned char']], + 'Task' : [ 0x6, ['unsigned short']], + 'Keyword' : [ 0x8, ['unsigned long long']], +} ], + '_EVENT_RECORD' : [ 0x70, { + 'EventHeader' : [ 0x0, ['_EVENT_HEADER']], + 'BufferContext' : [ 0x50, ['_ETW_BUFFER_CONTEXT']], + 'ExtendedDataCount' : [ 0x54, ['unsigned short']], + 'UserDataLength' : [ 0x56, ['unsigned short']], + 'ExtendedData' : [ 0x58, ['pointer64', ['_EVENT_HEADER_EXTENDED_DATA_ITEM']]], + 'UserData' : [ 0x60, ['pointer64', ['void']]], + 'UserContext' : [ 0x68, ['pointer64', ['void']]], +} ], + '_PERFINFO_GROUPMASK' : [ 0x20, { + 'Masks' : [ 0x0, ['array', 8, ['unsigned long']]], +} ], + '_FILE_OBJECT' : [ 0xd8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Vpb' : [ 0x10, ['pointer64', ['_VPB']]], + 'FsContext' : [ 0x18, ['pointer64', ['void']]], + 'FsContext2' : [ 0x20, ['pointer64', ['void']]], + 'SectionObjectPointer' : [ 0x28, ['pointer64', ['_SECTION_OBJECT_POINTERS']]], + 'PrivateCacheMap' : [ 0x30, ['pointer64', ['void']]], + 'FinalStatus' : [ 0x38, ['long']], + 'RelatedFileObject' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'LockOperation' : [ 0x48, ['unsigned char']], + 'DeletePending' : [ 0x49, ['unsigned char']], + 'ReadAccess' : [ 0x4a, ['unsigned char']], + 'WriteAccess' : [ 0x4b, ['unsigned char']], + 'DeleteAccess' : [ 0x4c, ['unsigned char']], + 'SharedRead' : [ 0x4d, ['unsigned char']], + 'SharedWrite' : [ 0x4e, ['unsigned char']], + 'SharedDelete' : [ 0x4f, ['unsigned char']], + 'Flags' : [ 0x50, ['unsigned long']], + 'FileName' : [ 0x58, ['_UNICODE_STRING']], + 'CurrentByteOffset' : [ 0x68, ['_LARGE_INTEGER']], + 'Waiters' : [ 0x70, ['unsigned long']], + 'Busy' : [ 0x74, ['unsigned long']], + 'LastLock' : [ 0x78, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['_KEVENT']], + 'Event' : [ 0x98, ['_KEVENT']], + 'CompletionContext' : [ 0xb0, ['pointer64', ['_IO_COMPLETION_CONTEXT']]], + 'IrpListLock' : [ 0xb8, ['unsigned long long']], + 'IrpList' : [ 0xc0, ['_LIST_ENTRY']], + 'FileObjectExtension' : [ 0xd0, ['pointer64', ['void']]], +} ], + '_EX_RUNDOWN_REF' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MM_PAGE_ACCESS_INFO_HEADER' : [ 0x48, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'MmPteAccessType', 1: 'MmCcReadAheadType', 2: 'MmPfnRepurposeType', 3: 'MmMaximumPageAccessType'})]], + 'EmptySequenceNumber' : [ 0xc, ['unsigned long']], + 'CurrentFileIndex' : [ 0xc, ['unsigned long']], + 'CreateTime' : [ 0x10, ['unsigned long long']], + 'EmptyTime' : [ 0x18, ['unsigned long long']], + 'TempEntry' : [ 0x18, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'PageEntry' : [ 0x20, ['pointer64', ['_MM_PAGE_ACCESS_INFO']]], + 'FileEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], + 'FirstFileEntry' : [ 0x30, ['pointer64', ['unsigned long long']]], + 'Process' : [ 0x38, ['pointer64', ['_EPROCESS']]], + 'SessionId' : [ 0x40, ['unsigned long']], + 'PageFrameEntry' : [ 0x20, ['pointer64', ['unsigned long long']]], + 'LastPageFrameEntry' : [ 0x28, ['pointer64', ['unsigned long long']]], +} ], + '_WHEA_ERROR_PACKET_V2' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_PACKET_FLAGS']], + 'ErrorType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrTypeProcessor', 1: 'WheaErrTypeMemory', 2: 'WheaErrTypePCIExpress', 3: 'WheaErrTypeNMI', 4: 'WheaErrTypePCIXBus', 5: 'WheaErrTypePCIXDevice', 6: 'WheaErrTypeGeneric'})]], + 'ErrorSeverity' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ErrorSourceId' : [ 0x18, ['unsigned long']], + 'ErrorSourceType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'NotifyType' : [ 0x20, ['_GUID']], + 'Context' : [ 0x30, ['unsigned long long']], + 'DataFormat' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'WheaDataFormatIPFSalRecord', 1: 'WheaDataFormatXPFMCA', 2: 'WheaDataFormatMemory', 3: 'WheaDataFormatPCIExpress', 4: 'WheaDataFormatNMIPort', 5: 'WheaDataFormatPCIXBus', 6: 'WheaDataFormatPCIXDevice', 7: 'WheaDataFormatGeneric', 8: 'WheaDataFormatMax'})]], + 'Reserved1' : [ 0x3c, ['unsigned long']], + 'DataOffset' : [ 0x40, ['unsigned long']], + 'DataLength' : [ 0x44, ['unsigned long']], + 'PshedDataOffset' : [ 0x48, ['unsigned long']], + 'PshedDataLength' : [ 0x4c, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD' : [ 0xc8, { + 'Header' : [ 0x0, ['_WHEA_ERROR_RECORD_HEADER']], + 'SectionDescriptor' : [ 0x80, ['array', 1, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR']]], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR' : [ 0x48, { + 'SectionOffset' : [ 0x0, ['unsigned long']], + 'SectionLength' : [ 0x4, ['unsigned long']], + 'Revision' : [ 0x8, ['_WHEA_REVISION']], + 'ValidBits' : [ 0xa, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS']], + 'Reserved' : [ 0xb, ['unsigned char']], + 'Flags' : [ 0xc, ['_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS']], + 'SectionType' : [ 0x10, ['_GUID']], + 'FRUId' : [ 0x20, ['_GUID']], + 'SectionSeverity' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'FRUText' : [ 0x34, ['array', 20, ['unsigned char']]], +} ], + '_FSRTL_ADVANCED_FCB_HEADER' : [ 0x68, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned char']], + 'IsFastIoPossible' : [ 0x5, ['unsigned char']], + 'Flags2' : [ 0x6, ['unsigned char']], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], + 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], + 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], + 'FileSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'FastMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'FilterContexts' : [ 0x38, ['_LIST_ENTRY']], + 'PushLock' : [ 0x48, ['_EX_PUSH_LOCK']], + 'FileContextSupportPointer' : [ 0x50, ['pointer64', ['pointer64', ['void']]]], + 'Oplock' : [ 0x58, ['pointer64', ['void']]], + 'ReservedForRemote' : [ 0x58, ['pointer64', ['void']]], + 'ReservedContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_iobuf' : [ 0x30, { + '_ptr' : [ 0x0, ['pointer64', ['unsigned char']]], + '_cnt' : [ 0x8, ['long']], + '_base' : [ 0x10, ['pointer64', ['unsigned char']]], + '_flag' : [ 0x18, ['long']], + '_file' : [ 0x1c, ['long']], + '_charbuf' : [ 0x20, ['long']], + '_bufsiz' : [ 0x24, ['long']], + '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], +} ], + '__unnamed_15a5' : [ 0x8, { + 'Long' : [ 0x0, ['unsigned long long']], + 'VolatileLong' : [ 0x0, ['unsigned long long']], + 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], + 'Flush' : [ 0x0, ['_HARDWARE_PTE']], + 'Proto' : [ 0x0, ['_MMPTE_PROTOTYPE']], + 'Soft' : [ 0x0, ['_MMPTE_SOFTWARE']], + 'TimeStamp' : [ 0x0, ['_MMPTE_TIMESTAMP']], + 'Trans' : [ 0x0, ['_MMPTE_TRANSITION']], + 'Subsect' : [ 0x0, ['_MMPTE_SUBSECTION']], + 'List' : [ 0x0, ['_MMPTE_LIST']], +} ], + '_MMPTE' : [ 0x8, { + 'u' : [ 0x0, ['__unnamed_15a5']], +} ], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x100, { + 'Locks' : [ 0x0, ['array', 32, ['pointer64', ['_EX_PUSH_LOCK']]]], +} ], + '_ERESOURCE' : [ 0x68, { + 'SystemResourcesList' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerTable' : [ 0x10, ['pointer64', ['_OWNER_ENTRY']]], + 'ActiveCount' : [ 0x18, ['short']], + 'Flag' : [ 0x1a, ['unsigned short']], + 'ReservedLowFlags' : [ 0x1a, ['unsigned char']], + 'WaiterPriority' : [ 0x1b, ['unsigned char']], + 'SharedWaiters' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'ExclusiveWaiters' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'OwnerEntry' : [ 0x30, ['_OWNER_ENTRY']], + 'ActiveEntries' : [ 0x40, ['unsigned long']], + 'ContentionCount' : [ 0x44, ['unsigned long']], + 'NumberOfSharedWaiters' : [ 0x48, ['unsigned long']], + 'NumberOfExclusiveWaiters' : [ 0x4c, ['unsigned long']], + 'Reserved2' : [ 0x50, ['pointer64', ['void']]], + 'Address' : [ 0x58, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x58, ['unsigned long long']], + 'SpinLock' : [ 0x60, ['unsigned long long']], +} ], + '_MI_CACHED_PTE' : [ 0x8, { + 'GlobalTimeStamp' : [ 0x0, ['unsigned long']], + 'PteIndex' : [ 0x4, ['unsigned long']], + 'Long' : [ 0x0, ['long long']], +} ], + '_KLOCK_QUEUE_HANDLE' : [ 0x18, { + 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], + 'OldIrql' : [ 0x10, ['unsigned char']], +} ], + '_MMPFNLIST' : [ 0x28, { + 'Total' : [ 0x0, ['unsigned long long']], + 'ListName' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'ZeroedPageList', 1: 'FreePageList', 2: 'StandbyPageList', 3: 'ModifiedPageList', 4: 'ModifiedNoWritePageList', 5: 'BadPageList', 6: 'ActiveAndValid', 7: 'TransitionPage'})]], + 'Flink' : [ 0x10, ['unsigned long long']], + 'Blink' : [ 0x18, ['unsigned long long']], + 'Lock' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_15e9' : [ 0x8, { + 'Flink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeFlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 64, native_type='unsigned long long')]], + 'WsIndex' : [ 0x0, ['unsigned long long']], + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'VolatileNext' : [ 0x0, ['pointer64', ['void']]], + 'KernelStackOwner' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], +} ], + '__unnamed_15ee' : [ 0x8, { + 'Blink' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'NodeBlinkHigh' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 56, native_type='unsigned long long')]], + 'TbFlushStamp' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 60, native_type='unsigned long long')]], + 'SpareBlink' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'ImageProtoPte' : [ 0x0, ['pointer64', ['_MMPTE']]], + 'ShareCount' : [ 0x0, ['unsigned long long']], +} ], + '__unnamed_15f1' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'VolatileReferenceCount' : [ 0x0, ['short']], + 'ShortFlags' : [ 0x2, ['unsigned short']], + 'VolatileShortFlags' : [ 0x2, ['unsigned short']], +} ], + '__unnamed_15f3' : [ 0x4, { + 'ReferenceCount' : [ 0x0, ['unsigned short']], + 'e1' : [ 0x2, ['_MMPFNENTRY']], + 'e2' : [ 0x0, ['__unnamed_15f1']], +} ], + '__unnamed_15fd' : [ 0x8, { + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'Channel' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 38, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'Unused3' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 53, native_type='unsigned long long')]], + 'PfnExists' : [ 0x0, ['BitField', dict(start_bit = 53, end_bit = 54, native_type='unsigned long long')]], + 'PageIdentity' : [ 0x0, ['BitField', dict(start_bit = 54, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], + 'EntireField' : [ 0x0, ['unsigned long long']], +} ], + '_MMPFN' : [ 0x30, { + 'u1' : [ 0x0, ['__unnamed_15e9']], + 'u2' : [ 0x8, ['__unnamed_15ee']], + 'PteAddress' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'VolatilePteAddress' : [ 0x10, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['long']], + 'PteLong' : [ 0x10, ['unsigned long long']], + 'u3' : [ 0x18, ['__unnamed_15f3']], + 'NodeBlinkLow' : [ 0x1c, ['unsigned short']], + 'Unused' : [ 0x1e, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'VaType' : [ 0x1e, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'ViewCount' : [ 0x1f, ['unsigned char']], + 'NodeFlinkLow' : [ 0x1f, ['unsigned char']], + 'OriginalPte' : [ 0x20, ['_MMPTE']], + 'u4' : [ 0x28, ['__unnamed_15fd']], +} ], + '_MI_SYSTEM_PTE_TYPE' : [ 0x68, { + 'Bitmap' : [ 0x0, ['_RTL_BITMAP_EX']], + 'BasePte' : [ 0x10, ['pointer64', ['_MMPTE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'VaType' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'MiVaUnused', 1: 'MiVaSessionSpace', 2: 'MiVaProcessSpace', 3: 'MiVaBootLoaded', 4: 'MiVaPfnDatabase', 5: 'MiVaNonPagedPool', 6: 'MiVaPagedPool', 7: 'MiVaSpecialPoolPaged', 8: 'MiVaSystemCache', 9: 'MiVaSystemPtes', 10: 'MiVaHal', 11: 'MiVaSessionGlobalSpace', 12: 'MiVaDriverImages', 13: 'MiVaSpecialPoolNonPaged', 14: 'MiVaMaximumType', 15: 'MiVaSystemPtesLarge'})]], + 'FailureCount' : [ 0x20, ['pointer64', ['unsigned long']]], + 'PteFailures' : [ 0x28, ['unsigned long']], + 'SpinLock' : [ 0x30, ['unsigned long long']], + 'GlobalMutex' : [ 0x30, ['pointer64', ['_FAST_MUTEX']]], + 'Vm' : [ 0x38, ['pointer64', ['_MMSUPPORT']]], + 'TotalSystemPtes' : [ 0x40, ['unsigned long long']], + 'Hint' : [ 0x48, ['unsigned long long']], + 'CachedPtes' : [ 0x50, ['pointer64', ['_MI_CACHED_PTE']]], + 'TotalFreeSystemPtes' : [ 0x58, ['unsigned long long']], + 'CachedPteCount' : [ 0x60, ['long']], +} ], + '__unnamed_161f' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'Long' : [ 0x0, ['unsigned long long']], + 'e1' : [ 0x0, ['_MMWSLENTRY']], + 'e2' : [ 0x0, ['_MMWSLE_FREE_ENTRY']], +} ], + '_MMWSLE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_161f']], +} ], + '_MMWSL' : [ 0x320, { + 'FirstFree' : [ 0x0, ['unsigned long long']], + 'FirstDynamic' : [ 0x8, ['unsigned long long']], + 'LastEntry' : [ 0x10, ['unsigned long long']], + 'NextSlot' : [ 0x18, ['unsigned long long']], + 'LastInitializedWsle' : [ 0x20, ['unsigned long long']], + 'NextAgingSlot' : [ 0x28, ['unsigned long long']], + 'NextAccessClearingSlot' : [ 0x30, ['unsigned long long']], + 'LastAccessClearingRemainder' : [ 0x38, ['unsigned long']], + 'LastAgingRemainder' : [ 0x3c, ['unsigned long']], + 'WsleSize' : [ 0x40, ['unsigned long']], + 'NonDirectCount' : [ 0x48, ['unsigned long long']], + 'LowestPagableAddress' : [ 0x50, ['pointer64', ['void']]], + 'NonDirectHash' : [ 0x58, ['pointer64', ['_MMWSLE_NONDIRECT_HASH']]], + 'HashTableStart' : [ 0x60, ['pointer64', ['_MMWSLE_HASH']]], + 'HighestPermittedHashAddress' : [ 0x68, ['pointer64', ['_MMWSLE_HASH']]], + 'ActiveWsleCounts' : [ 0x70, ['array', 16, ['unsigned long long']]], + 'ActiveWsles' : [ 0xf0, ['array', 16, ['_MI_ACTIVE_WSLE_LISTHEAD']]], + 'Wsle' : [ 0x1f0, ['pointer64', ['_MMWSLE']]], + 'UserVaInfo' : [ 0x1f8, ['_MI_USER_VA_INFO']], +} ], + '_MMSUPPORT' : [ 0xe8, { + 'ExitGate' : [ 0x0, ['pointer64', ['_KGATE']]], + 'AccessLog' : [ 0x8, ['pointer64', ['void']]], + 'WorkingSetMutex' : [ 0x10, ['_EX_PUSH_LOCK']], + 'WorkingSetExpansionLinks' : [ 0x18, ['_LIST_ENTRY']], + 'AgeDistribution' : [ 0x28, ['array', 7, ['unsigned long long']]], + 'MinimumWorkingSetSize' : [ 0x60, ['unsigned long long']], + 'WorkingSetLeafSize' : [ 0x68, ['unsigned long long']], + 'WorkingSetLeafPrivateSize' : [ 0x70, ['unsigned long long']], + 'WorkingSetSize' : [ 0x78, ['unsigned long long']], + 'WorkingSetPrivateSize' : [ 0x80, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0x88, ['unsigned long long']], + 'ChargedWslePages' : [ 0x90, ['unsigned long long']], + 'ActualWslePages' : [ 0x98, ['unsigned long long']], + 'WorkingSetSizeOverhead' : [ 0xa0, ['unsigned long long']], + 'PeakWorkingSetSize' : [ 0xa8, ['unsigned long long']], + 'HardFaultCount' : [ 0xb0, ['unsigned long']], + 'VmWorkingSetList' : [ 0xb8, ['pointer64', ['_MMWSL']]], + 'NextPageColor' : [ 0xc0, ['unsigned short']], + 'LastTrimStamp' : [ 0xc2, ['unsigned short']], + 'PageFaultCount' : [ 0xc4, ['unsigned long']], + 'TrimmedPageCount' : [ 0xc8, ['unsigned long long']], + 'ForceTrimPages' : [ 0xd0, ['unsigned long long']], + 'Flags' : [ 0xd8, ['_MMSUPPORT_FLAGS']], + 'WsSwapSupport' : [ 0xe0, ['pointer64', ['void']]], +} ], + '__unnamed_1639' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '__unnamed_1643' : [ 0x10, { + 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], + 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], + 'WritableUserReferences' : [ 0x4, ['long']], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 28, native_type='unsigned long')]], + 'CantMove' : [ 0x4, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'BitMap' : [ 0x4, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'FlushInProgressCount' : [ 0x8, ['unsigned long']], + 'NumberOfSubsections' : [ 0x8, ['unsigned long']], + 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], +} ], + '__unnamed_1645' : [ 0x10, { + 'e2' : [ 0x0, ['__unnamed_1643']], +} ], + '_CONTROL_AREA' : [ 0x78, { + 'Segment' : [ 0x0, ['pointer64', ['_SEGMENT']]], + 'ListHead' : [ 0x8, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0x18, ['unsigned long long']], + 'NumberOfPfnReferences' : [ 0x20, ['unsigned long long']], + 'NumberOfMappedViews' : [ 0x28, ['unsigned long long']], + 'NumberOfUserReferences' : [ 0x30, ['unsigned long long']], + 'u' : [ 0x38, ['__unnamed_1639']], + 'FilePointer' : [ 0x40, ['_EX_FAST_REF']], + 'ControlAreaLock' : [ 0x48, ['long']], + 'ModifiedWriteCount' : [ 0x4c, ['unsigned long']], + 'WaitList' : [ 0x50, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'u2' : [ 0x58, ['__unnamed_1645']], + 'LockedPages' : [ 0x68, ['unsigned long long']], + 'FileObjectLock' : [ 0x70, ['_EX_PUSH_LOCK']], +} ], + '_MM_STORE_KEY' : [ 0x8, { + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], + 'EntireKey' : [ 0x0, ['unsigned long long']], +} ], + '_MMPAGING_FILE' : [ 0xe0, { + 'Size' : [ 0x0, ['unsigned long long']], + 'MaximumSize' : [ 0x8, ['unsigned long long']], + 'MinimumSize' : [ 0x10, ['unsigned long long']], + 'FreeSpace' : [ 0x18, ['unsigned long long']], + 'PeakUsage' : [ 0x20, ['unsigned long long']], + 'HighestPage' : [ 0x28, ['unsigned long long']], + 'FreeReservationSpace' : [ 0x30, ['unsigned long long']], + 'LargestReserveCluster' : [ 0x38, ['unsigned long long']], + 'File' : [ 0x40, ['pointer64', ['_FILE_OBJECT']]], + 'Entry' : [ 0x48, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], + 'PfnsToFree' : [ 0x60, ['_SLIST_HEADER']], + 'PageFileName' : [ 0x70, ['_UNICODE_STRING']], + 'Bitmaps' : [ 0x80, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmapHint' : [ 0x88, ['unsigned long']], + 'ReservationBitmapHint' : [ 0x8c, ['unsigned long']], + 'LargestNonReservedClusterSize' : [ 0x90, ['unsigned long']], + 'RefreshClusterSize' : [ 0x94, ['unsigned long']], + 'LastRefreshClusterSize' : [ 0x98, ['unsigned long']], + 'ReservedClusterSizeAggregate' : [ 0x9c, ['unsigned long']], + 'ToBeEvictedCount' : [ 0xa0, ['unsigned long']], + 'HybridPriority' : [ 0xa4, ['unsigned long']], + 'PageFileNumber' : [ 0xa8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0xa8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'WsSwapPagefile' : [ 0xa8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'NoReservations' : [ 0xa8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Spare0' : [ 0xa8, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0xaa, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Spare1' : [ 0xaa, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0xab, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'PageHashPages' : [ 0xac, ['unsigned long']], + 'PageHashPagesPeak' : [ 0xb0, ['unsigned long']], + 'PageHash' : [ 0xb8, ['pointer64', ['unsigned long']]], + 'FileHandle' : [ 0xc0, ['pointer64', ['void']]], + 'Lock' : [ 0xc8, ['unsigned long long']], + 'LockOwner' : [ 0xd0, ['pointer64', ['_ETHREAD']]], +} ], + '_MI_PAGING_FILE_SPACE_BITMAPS' : [ 0x30, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'Anchor' : [ 0x0, ['pointer64', ['_MI_PAGING_FILE_SPACE_BITMAPS']]], + 'AllocationBitmap' : [ 0x8, ['_RTL_BITMAP']], + 'ReservationBitmap' : [ 0x18, ['_RTL_BITMAP']], + 'EvictStoreBitmap' : [ 0x28, ['pointer64', ['_RTL_BITMAP']]], +} ], + 'tagSWITCH_CONTEXT' : [ 0x60, { + 'Attribute' : [ 0x0, ['tagSWITCH_CONTEXT_ATTRIBUTE']], + 'Data' : [ 0x18, ['tagSWITCH_CONTEXT_DATA']], +} ], + '__unnamed_1686' : [ 0xc, { + 'Failure' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: '_None', 1: '_CmInitializeHive', 2: '_HvInitializeHive', 3: '_HvpBuildMap', 4: '_HvpBuildMapForLoaderHive', 5: '_HvpInitMap', 6: '_HvLoadHive', 7: '_HvpMapHiveImage', 8: '_HvpRecoverData', 9: '_CmpValidateHiveSecurityDescriptors', 10: '_HvpEnlistBinInMap', 11: '_CmCheckRegistry', 12: '_CmRegistryIO', 13: '_CmCheckRegistry2', 14: '_CmpCheckKey', 15: '_CmpCheckValueList', 16: '_HvCheckHive', 17: '_HvCheckBin', 18: '_HvpGetLogEntryDirtyVector', 19: '_HvpReadLogEntryHeader', 20: '_HvpReadLogEntry'})]], + 'Status' : [ 0x4, ['long']], + 'Point' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_1689' : [ 0x18, { + 'Action' : [ 0x0, ['unsigned long']], + 'Handle' : [ 0x8, ['pointer64', ['void']]], + 'Status' : [ 0x10, ['long']], +} ], + '__unnamed_168b' : [ 0x8, { + 'CheckStack' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_168f' : [ 0x20, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CellPoint' : [ 0x8, ['pointer64', ['_CELL_DATA']]], + 'RootPoint' : [ 0x10, ['pointer64', ['void']]], + 'Index' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_1691' : [ 0x18, { + 'List' : [ 0x0, ['pointer64', ['_CELL_DATA']]], + 'Index' : [ 0x8, ['unsigned long']], + 'Cell' : [ 0xc, ['unsigned long']], + 'CellPoint' : [ 0x10, ['pointer64', ['_CELL_DATA']]], +} ], + '__unnamed_1695' : [ 0x10, { + 'Space' : [ 0x0, ['unsigned long']], + 'MapPoint' : [ 0x4, ['unsigned long']], + 'BinPoint' : [ 0x8, ['pointer64', ['_HBIN']]], +} ], + '__unnamed_1699' : [ 0x10, { + 'Bin' : [ 0x0, ['pointer64', ['_HBIN']]], + 'CellPoint' : [ 0x8, ['pointer64', ['_HCELL']]], +} ], + '__unnamed_169b' : [ 0x4, { + 'FileOffset' : [ 0x0, ['unsigned long']], +} ], + '_HIVE_LOAD_FAILURE' : [ 0x160, { + 'Hive' : [ 0x0, ['pointer64', ['_HHIVE']]], + 'Index' : [ 0x8, ['unsigned long']], + 'RecoverableIndex' : [ 0xc, ['unsigned long']], + 'Locations' : [ 0x10, ['array', 8, ['__unnamed_1686']]], + 'RecoverableLocations' : [ 0x70, ['array', 8, ['__unnamed_1686']]], + 'RegistryIO' : [ 0xd0, ['__unnamed_1689']], + 'CheckRegistry2' : [ 0xe8, ['__unnamed_168b']], + 'CheckKey' : [ 0xf0, ['__unnamed_168f']], + 'CheckValueList' : [ 0x110, ['__unnamed_1691']], + 'CheckHive' : [ 0x128, ['__unnamed_1695']], + 'CheckHive1' : [ 0x138, ['__unnamed_1695']], + 'CheckBin' : [ 0x148, ['__unnamed_1699']], + 'RecoverData' : [ 0x158, ['__unnamed_169b']], +} ], + '_PCW_COUNTER_DESCRIPTOR' : [ 0x8, { + 'Id' : [ 0x0, ['unsigned short']], + 'StructIndex' : [ 0x2, ['unsigned short']], + 'Offset' : [ 0x4, ['unsigned short']], + 'Size' : [ 0x6, ['unsigned short']], +} ], + '_PCW_REGISTRATION_INFORMATION' : [ 0x30, { + 'Version' : [ 0x0, ['unsigned long']], + 'Name' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'CounterCount' : [ 0x10, ['unsigned long']], + 'Counters' : [ 0x18, ['pointer64', ['_PCW_COUNTER_DESCRIPTOR']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x28, ['pointer64', ['void']]], +} ], + '_PCW_PROCESSOR_INFO' : [ 0xb8, { + 'IdleTime' : [ 0x0, ['unsigned long long']], + 'AvailableTime' : [ 0x8, ['unsigned long long']], + 'UserTime' : [ 0x10, ['unsigned long long']], + 'KernelTime' : [ 0x18, ['unsigned long long']], + 'Interrupts' : [ 0x20, ['unsigned long']], + 'DpcTime' : [ 0x28, ['unsigned long long']], + 'InterruptTime' : [ 0x30, ['unsigned long long']], + 'ClockInterrupts' : [ 0x38, ['unsigned long']], + 'DpcCount' : [ 0x3c, ['unsigned long']], + 'DpcRate' : [ 0x40, ['unsigned long']], + 'C1Time' : [ 0x48, ['unsigned long long']], + 'C2Time' : [ 0x50, ['unsigned long long']], + 'C3Time' : [ 0x58, ['unsigned long long']], + 'C1Transitions' : [ 0x60, ['unsigned long long']], + 'C2Transitions' : [ 0x68, ['unsigned long long']], + 'C3Transitions' : [ 0x70, ['unsigned long long']], + 'ParkingStatus' : [ 0x78, ['unsigned long']], + 'CurrentFrequency' : [ 0x7c, ['unsigned long']], + 'PercentMaxFrequency' : [ 0x80, ['unsigned long']], + 'StateFlags' : [ 0x84, ['unsigned long']], + 'NominalThroughput' : [ 0x88, ['unsigned long']], + 'ActiveThroughput' : [ 0x8c, ['unsigned long']], + 'ScaledThroughput' : [ 0x90, ['unsigned long long']], + 'ScaledKernelThroughput' : [ 0x98, ['unsigned long long']], + 'AverageIdleTime' : [ 0xa0, ['unsigned long long']], + 'IdleBreakEvents' : [ 0xa8, ['unsigned long long']], + 'PerformanceLimit' : [ 0xb0, ['unsigned long']], + 'PerformanceLimitFlags' : [ 0xb4, ['unsigned long']], +} ], + '_PCW_DATA' : [ 0x10, { + 'Data' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long']], +} ], + '_SYNCH_COUNTERS' : [ 0xb8, { + 'SpinLockAcquireCount' : [ 0x0, ['unsigned long']], + 'SpinLockContentionCount' : [ 0x4, ['unsigned long']], + 'SpinLockSpinCount' : [ 0x8, ['unsigned long']], + 'IpiSendRequestBroadcastCount' : [ 0xc, ['unsigned long']], + 'IpiSendRequestRoutineCount' : [ 0x10, ['unsigned long']], + 'IpiSendSoftwareInterruptCount' : [ 0x14, ['unsigned long']], + 'ExInitializeResourceCount' : [ 0x18, ['unsigned long']], + 'ExReInitializeResourceCount' : [ 0x1c, ['unsigned long']], + 'ExDeleteResourceCount' : [ 0x20, ['unsigned long']], + 'ExecutiveResourceAcquiresCount' : [ 0x24, ['unsigned long']], + 'ExecutiveResourceContentionsCount' : [ 0x28, ['unsigned long']], + 'ExecutiveResourceReleaseExclusiveCount' : [ 0x2c, ['unsigned long']], + 'ExecutiveResourceReleaseSharedCount' : [ 0x30, ['unsigned long']], + 'ExecutiveResourceConvertsCount' : [ 0x34, ['unsigned long']], + 'ExAcqResExclusiveAttempts' : [ 0x38, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusive' : [ 0x3c, ['unsigned long']], + 'ExAcqResExclusiveAcquiresExclusiveRecursive' : [ 0x40, ['unsigned long']], + 'ExAcqResExclusiveWaits' : [ 0x44, ['unsigned long']], + 'ExAcqResExclusiveNotAcquires' : [ 0x48, ['unsigned long']], + 'ExAcqResSharedAttempts' : [ 0x4c, ['unsigned long']], + 'ExAcqResSharedAcquiresExclusive' : [ 0x50, ['unsigned long']], + 'ExAcqResSharedAcquiresShared' : [ 0x54, ['unsigned long']], + 'ExAcqResSharedAcquiresSharedRecursive' : [ 0x58, ['unsigned long']], + 'ExAcqResSharedWaits' : [ 0x5c, ['unsigned long']], + 'ExAcqResSharedNotAcquires' : [ 0x60, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAttempts' : [ 0x64, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresExclusive' : [ 0x68, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresShared' : [ 0x6c, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveAcquiresSharedRecursive' : [ 0x70, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveWaits' : [ 0x74, ['unsigned long']], + 'ExAcqResSharedStarveExclusiveNotAcquires' : [ 0x78, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAttempts' : [ 0x7c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresExclusive' : [ 0x80, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresShared' : [ 0x84, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive' : [ 0x88, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveWaits' : [ 0x8c, ['unsigned long']], + 'ExAcqResSharedWaitForExclusiveNotAcquires' : [ 0x90, ['unsigned long']], + 'ExSetResOwnerPointerExclusive' : [ 0x94, ['unsigned long']], + 'ExSetResOwnerPointerSharedNew' : [ 0x98, ['unsigned long']], + 'ExSetResOwnerPointerSharedOld' : [ 0x9c, ['unsigned long']], + 'ExTryToAcqExclusiveAttempts' : [ 0xa0, ['unsigned long']], + 'ExTryToAcqExclusiveAcquires' : [ 0xa4, ['unsigned long']], + 'ExBoostExclusiveOwner' : [ 0xa8, ['unsigned long']], + 'ExBoostSharedOwners' : [ 0xac, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsCount' : [ 0xb0, ['unsigned long']], + 'ExEtwSynchTrackingNotificationsAccountedCount' : [ 0xb4, ['unsigned long']], +} ], + '_ETW_PERF_COUNTERS' : [ 0x18, { + 'TotalActiveSessions' : [ 0x0, ['long']], + 'TotalBufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'TotalBufferMemoryPagedPool' : [ 0x8, ['long']], + 'TotalGuidsEnabled' : [ 0xc, ['long']], + 'TotalGuidsNotEnabled' : [ 0x10, ['long']], + 'TotalGuidsPreEnabled' : [ 0x14, ['long']], +} ], + '_ETW_SESSION_PERF_COUNTERS' : [ 0x18, { + 'BufferMemoryPagedPool' : [ 0x0, ['long']], + 'BufferMemoryNonPagedPool' : [ 0x4, ['long']], + 'EventsLoggedCount' : [ 0x8, ['unsigned long long']], + 'EventsLost' : [ 0x10, ['long']], + 'NumConsumers' : [ 0x14, ['long']], +} ], + '_FILESYSTEM_DISK_COUNTERS' : [ 0x10, { + 'FsBytesRead' : [ 0x0, ['unsigned long long']], + 'FsBytesWritten' : [ 0x8, ['unsigned long long']], +} ], + '_THERMAL_ZONE_COUNTERS' : [ 0xc, { + 'Temperature' : [ 0x0, ['unsigned long']], + 'ThrottleLimit' : [ 0x4, ['unsigned long']], + 'ThrottleReasons' : [ 0x8, ['unsigned long']], +} ], + '_CONTEXT32_UPDATE' : [ 0x4, { + 'NumberEntries' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1705' : [ 0x10, { + 'ReservedEax' : [ 0x0, ['unsigned long']], + 'ReservedEbx' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'InitialApicId' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'ReservedEcx' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HypervisorPresent' : [ 0x8, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ReservedEdx' : [ 0xc, ['unsigned long']], +} ], + '_HV_CPUID_RESULT' : [ 0x10, { + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'VersionAndFeatures' : [ 0x0, ['__unnamed_1705']], + 'HvVendorAndMaxFunction' : [ 0x0, ['_HV_VENDOR_AND_MAX_FUNCTION']], + 'HvInterface' : [ 0x0, ['_HV_HYPERVISOR_INTERFACE_INFO']], + 'MsHvVersion' : [ 0x0, ['_HV_HYPERVISOR_VERSION_INFO']], + 'MsHvFeatures' : [ 0x0, ['_HV_HYPERVISOR_FEATURES']], + 'MsHvEnlightenmentInformation' : [ 0x0, ['_HV_ENLIGHTENMENT_INFORMATION']], + 'MsHvImplementationLimits' : [ 0x0, ['_HV_IMPLEMENTATION_LIMITS']], + 'MsHvHardwareFeatures' : [ 0x0, ['_HV_HYPERVISOR_HARDWARE_FEATURES']], +} ], + '_HV_VENDOR_AND_MAX_FUNCTION' : [ 0x10, { + 'MaxFunction' : [ 0x0, ['unsigned long']], + 'VendorName' : [ 0x4, ['array', 12, ['unsigned char']]], +} ], + '_HV_HYPERVISOR_INTERFACE_INFO' : [ 0x10, { + 'Interface' : [ 0x0, ['unsigned long']], + 'ReservedEbx' : [ 0x4, ['unsigned long']], + 'ReservedEcx' : [ 0x8, ['unsigned long']], + 'ReservedEdx' : [ 0xc, ['unsigned long']], +} ], + '_HV_HYPERVISOR_VERSION_INFO' : [ 0x10, { + 'BuildNumber' : [ 0x0, ['unsigned long']], + 'MinorVersion' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'MajorVersion' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ServicePack' : [ 0x8, ['unsigned long']], + 'ServiceNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'ServiceBranch' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_HYPERVISOR_FEATURES' : [ 0x10, { + 'PartitionPrivileges' : [ 0x0, ['_HV_PARTITION_PRIVILEGE_MASK']], + 'MaxSupportedCState' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'HpetNeededForC3PowerState' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'MwaitAvailable' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'GuestDebuggingAvailable' : [ 0xc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PerformanceMonitorsAvailable' : [ 0xc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'CpuDynamicPartitioningAvailable' : [ 0xc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'XmmRegistersForFastHypercallAvailable' : [ 0xc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'GuestIdleAvailable' : [ 0xc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'HypervisorSleepStateSupportAvailable' : [ 0xc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NumaDistanceQueryAvailable' : [ 0xc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'FrequencyMsrsAvailable' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SyntheticMachineCheckAvailable' : [ 0xc, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'GuestCrashMsrsAvailable' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DebugMsrsAvailable' : [ 0xc, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Npiep1Available' : [ 0xc, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DisableHypervisorAvailable' : [ 0xc, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long')]], +} ], + '_HV_HYPERVISOR_HARDWARE_FEATURES' : [ 0x10, { + 'ApicOverlayAssistInUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MsrBitmapsInUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ArchitecturalPerformanceCountersInUse' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SecondLevelAddressTranslationInUse' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DmaRemappingInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'InterruptRemappingInUse' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'MemoryPatrolScrubberPresent' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], + 'ReservedEbx' : [ 0x4, ['unsigned long']], + 'ReservedEcx' : [ 0x8, ['unsigned long']], + 'ReservedEdx' : [ 0xc, ['unsigned long']], +} ], + '_HV_ENLIGHTENMENT_INFORMATION' : [ 0x10, { + 'UseHypercallForAddressSpaceSwitch' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UseHypercallForLocalFlush' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UseHypercallForRemoteFlush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UseApicMsrs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UseMsrForReset' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'UseRelaxedTiming' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UseDmaRemapping' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UseInterruptRemapping' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UseX2ApicMsrs' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DeprecateAutoEoi' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], + 'LongSpinWaitCount' : [ 0x4, ['unsigned long']], + 'ReservedEcx' : [ 0x8, ['unsigned long']], + 'ReservedEdx' : [ 0xc, ['unsigned long']], +} ], + '_HV_IMPLEMENTATION_LIMITS' : [ 0x10, { + 'MaxVirtualProcessorCount' : [ 0x0, ['unsigned long']], + 'MaxLogicalProcessorCount' : [ 0x4, ['unsigned long']], + 'MaxInterruptMappingCount' : [ 0x8, ['unsigned long']], + 'ReservedEdx' : [ 0xc, ['unsigned long']], +} ], + '_HV_PARTITION_PRIVILEGE_MASK' : [ 0x8, { + 'AsUINT64' : [ 0x0, ['unsigned long long']], + 'AccessVpRunTimeMsr' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'AccessPartitionReferenceCounter' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'AccessSynicMsrs' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'AccessSyntheticTimerMsrs' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'AccessApicMsrs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'AccessHypercallMsrs' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'AccessVpIndex' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AccessResetMsr' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'AccessStatsMsr' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'AccessPartitionReferenceTsc' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'AccessGuestIdleMsr' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'AccessFrequencyMsrs' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'AccessDebugMsrs' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long long')]], + 'CreatePartitions' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'AccessPartitionId' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 34, native_type='unsigned long long')]], + 'AccessMemoryPool' : [ 0x0, ['BitField', dict(start_bit = 34, end_bit = 35, native_type='unsigned long long')]], + 'AdjustMessageBuffers' : [ 0x0, ['BitField', dict(start_bit = 35, end_bit = 36, native_type='unsigned long long')]], + 'PostMessages' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], + 'SignalEvents' : [ 0x0, ['BitField', dict(start_bit = 37, end_bit = 38, native_type='unsigned long long')]], + 'CreatePort' : [ 0x0, ['BitField', dict(start_bit = 38, end_bit = 39, native_type='unsigned long long')]], + 'ConnectPort' : [ 0x0, ['BitField', dict(start_bit = 39, end_bit = 40, native_type='unsigned long long')]], + 'AccessStats' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 41, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 41, end_bit = 43, native_type='unsigned long long')]], + 'Debugging' : [ 0x0, ['BitField', dict(start_bit = 43, end_bit = 44, native_type='unsigned long long')]], + 'CpuManagement' : [ 0x0, ['BitField', dict(start_bit = 44, end_bit = 45, native_type='unsigned long long')]], + 'ConfigureProfiler' : [ 0x0, ['BitField', dict(start_bit = 45, end_bit = 46, native_type='unsigned long long')]], + 'EnableExpandedStackwalking' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 47, native_type='unsigned long long')]], + 'Reserved3' : [ 0x0, ['BitField', dict(start_bit = 47, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KTIMER_TABLE' : [ 0x2200, { + 'TimerExpiry' : [ 0x0, ['array', 64, ['pointer64', ['_KTIMER']]]], + 'TimerEntries' : [ 0x200, ['array', 256, ['_KTIMER_TABLE_ENTRY']]], +} ], + '_KTIMER_TABLE_ENTRY' : [ 0x20, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['_LIST_ENTRY']], + 'Time' : [ 0x18, ['_ULARGE_INTEGER']], +} ], + '_XSTATE_SAVE' : [ 0x38, { + 'Prev' : [ 0x0, ['pointer64', ['_XSTATE_SAVE']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Level' : [ 0x10, ['unsigned char']], + 'XStateContext' : [ 0x18, ['_XSTATE_CONTEXT']], +} ], + '_XSAVE_AREA' : [ 0x240, { + 'LegacyState' : [ 0x0, ['_XSAVE_FORMAT']], + 'Header' : [ 0x200, ['_XSAVE_AREA_HEADER']], +} ], + '_KSHARED_READY_QUEUE' : [ 0x268, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'ReadySummary' : [ 0x8, ['unsigned long']], + 'ReadyListHead' : [ 0x10, ['array', 32, ['_LIST_ENTRY']]], + 'RunningSummary' : [ 0x210, ['array', 64, ['unsigned char']]], + 'Span' : [ 0x250, ['unsigned long']], + 'LowProcIndex' : [ 0x254, ['unsigned long']], + 'QueueIndex' : [ 0x258, ['unsigned long']], + 'ProcCount' : [ 0x25c, ['unsigned long']], + 'Affinity' : [ 0x260, ['unsigned long long']], +} ], + '_KEXCEPTION_FRAME' : [ 0x140, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'Spare1' : [ 0x28, ['unsigned long long']], + 'Xmm6' : [ 0x30, ['_M128A']], + 'Xmm7' : [ 0x40, ['_M128A']], + 'Xmm8' : [ 0x50, ['_M128A']], + 'Xmm9' : [ 0x60, ['_M128A']], + 'Xmm10' : [ 0x70, ['_M128A']], + 'Xmm11' : [ 0x80, ['_M128A']], + 'Xmm12' : [ 0x90, ['_M128A']], + 'Xmm13' : [ 0xa0, ['_M128A']], + 'Xmm14' : [ 0xb0, ['_M128A']], + 'Xmm15' : [ 0xc0, ['_M128A']], + 'TrapFrame' : [ 0xd0, ['unsigned long long']], + 'OutputBuffer' : [ 0xd8, ['unsigned long long']], + 'OutputLength' : [ 0xe0, ['unsigned long long']], + 'Spare2' : [ 0xe8, ['unsigned long long']], + 'MxCsr' : [ 0xf0, ['unsigned long long']], + 'Rbp' : [ 0xf8, ['unsigned long long']], + 'Rbx' : [ 0x100, ['unsigned long long']], + 'Rdi' : [ 0x108, ['unsigned long long']], + 'Rsi' : [ 0x110, ['unsigned long long']], + 'R12' : [ 0x118, ['unsigned long long']], + 'R13' : [ 0x120, ['unsigned long long']], + 'R14' : [ 0x128, ['unsigned long long']], + 'R15' : [ 0x130, ['unsigned long long']], + 'Return' : [ 0x138, ['unsigned long long']], +} ], + '_KTRAP_FRAME' : [ 0x190, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5' : [ 0x20, ['unsigned long long']], + 'PreviousMode' : [ 0x28, ['unsigned char']], + 'PreviousIrql' : [ 0x29, ['unsigned char']], + 'FaultIndicator' : [ 0x2a, ['unsigned char']], + 'ExceptionActive' : [ 0x2b, ['unsigned char']], + 'MxCsr' : [ 0x2c, ['unsigned long']], + 'Rax' : [ 0x30, ['unsigned long long']], + 'Rcx' : [ 0x38, ['unsigned long long']], + 'Rdx' : [ 0x40, ['unsigned long long']], + 'R8' : [ 0x48, ['unsigned long long']], + 'R9' : [ 0x50, ['unsigned long long']], + 'R10' : [ 0x58, ['unsigned long long']], + 'R11' : [ 0x60, ['unsigned long long']], + 'GsBase' : [ 0x68, ['unsigned long long']], + 'GsSwap' : [ 0x68, ['unsigned long long']], + 'Xmm0' : [ 0x70, ['_M128A']], + 'Xmm1' : [ 0x80, ['_M128A']], + 'Xmm2' : [ 0x90, ['_M128A']], + 'Xmm3' : [ 0xa0, ['_M128A']], + 'Xmm4' : [ 0xb0, ['_M128A']], + 'Xmm5' : [ 0xc0, ['_M128A']], + 'FaultAddress' : [ 0xd0, ['unsigned long long']], + 'ContextRecord' : [ 0xd0, ['unsigned long long']], + 'TimeStampCKCL' : [ 0xd0, ['unsigned long long']], + 'Dr0' : [ 0xd8, ['unsigned long long']], + 'Dr1' : [ 0xe0, ['unsigned long long']], + 'Dr2' : [ 0xe8, ['unsigned long long']], + 'Dr3' : [ 0xf0, ['unsigned long long']], + 'Dr6' : [ 0xf8, ['unsigned long long']], + 'Dr7' : [ 0x100, ['unsigned long long']], + 'DebugControl' : [ 0x108, ['unsigned long long']], + 'LastBranchToRip' : [ 0x110, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x118, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x120, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x128, ['unsigned long long']], + 'LastBranchControl' : [ 0x108, ['unsigned long long']], + 'LastBranchMSR' : [ 0x110, ['unsigned long']], + 'SegDs' : [ 0x130, ['unsigned short']], + 'SegEs' : [ 0x132, ['unsigned short']], + 'SegFs' : [ 0x134, ['unsigned short']], + 'SegGs' : [ 0x136, ['unsigned short']], + 'TrapFrame' : [ 0x138, ['unsigned long long']], + 'Rbx' : [ 0x140, ['unsigned long long']], + 'Rdi' : [ 0x148, ['unsigned long long']], + 'Rsi' : [ 0x150, ['unsigned long long']], + 'Rbp' : [ 0x158, ['unsigned long long']], + 'ErrorCode' : [ 0x160, ['unsigned long long']], + 'ExceptionFrame' : [ 0x160, ['unsigned long long']], + 'TimeStampKlog' : [ 0x160, ['unsigned long long']], + 'Rip' : [ 0x168, ['unsigned long long']], + 'SegCs' : [ 0x170, ['unsigned short']], + 'Fill0' : [ 0x172, ['unsigned char']], + 'Logging' : [ 0x173, ['unsigned char']], + 'Fill1' : [ 0x174, ['array', 2, ['unsigned short']]], + 'EFlags' : [ 0x178, ['unsigned long']], + 'Fill2' : [ 0x17c, ['unsigned long']], + 'Rsp' : [ 0x180, ['unsigned long long']], + 'SegSs' : [ 0x188, ['unsigned short']], + 'Fill3' : [ 0x18a, ['unsigned short']], + 'Fill4' : [ 0x18c, ['unsigned long']], +} ], + '_MCGEN_TRACE_CONTEXT' : [ 0x48, { + 'RegistrationHandle' : [ 0x0, ['unsigned long long']], + 'Logger' : [ 0x8, ['unsigned long long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'IsEnabled' : [ 0x24, ['unsigned long']], + 'Level' : [ 0x28, ['unsigned char']], + 'Reserve' : [ 0x29, ['unsigned char']], + 'EnableBitsCount' : [ 0x2a, ['unsigned short']], + 'EnableBitMask' : [ 0x30, ['pointer64', ['unsigned long']]], + 'EnableKeyWords' : [ 0x38, ['pointer64', ['unsigned long long']]], + 'EnableLevel' : [ 0x40, ['pointer64', ['unsigned char']]], +} ], + '_EVENT_FILTER_DESCRIPTOR' : [ 0x10, { + 'Ptr' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], +} ], + '_SID' : [ 0xc, { + 'Revision' : [ 0x0, ['unsigned char']], + 'SubAuthorityCount' : [ 0x1, ['unsigned char']], + 'IdentifierAuthority' : [ 0x2, ['_SID_IDENTIFIER_AUTHORITY']], + 'SubAuthority' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x50, { + 'DispatchedList' : [ 0x0, ['_LIST_ENTRY']], + 'DispatchedCount' : [ 0x10, ['unsigned long']], + 'CompletedList' : [ 0x18, ['_LIST_ENTRY']], + 'CompletedSemaphore' : [ 0x28, ['_KSEMAPHORE']], + 'SpinLock' : [ 0x48, ['unsigned long long']], +} ], + '_KSEMAPHORE' : [ 0x20, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'Limit' : [ 0x18, ['long']], +} ], + '_DEVOBJ_EXTENSION' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'PowerFlags' : [ 0x10, ['unsigned long']], + 'Dope' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT_POWER_EXTENSION']]], + 'ExtensionFlags' : [ 0x20, ['unsigned long']], + 'DeviceNode' : [ 0x28, ['pointer64', ['void']]], + 'AttachedTo' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'StartIoCount' : [ 0x38, ['long']], + 'StartIoKey' : [ 0x3c, ['long']], + 'StartIoFlags' : [ 0x40, ['unsigned long']], + 'Vpb' : [ 0x48, ['pointer64', ['_VPB']]], + 'DependencyNode' : [ 0x50, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x58, ['pointer64', ['void']]], +} ], + '__unnamed_1805' : [ 0x8, { + 'LegacyDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'PendingDeviceRelations' : [ 0x0, ['pointer64', ['_DEVICE_RELATIONS']]], + 'Information' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_1807' : [ 0x8, { + 'NextResourceDeviceNode' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], +} ], + '__unnamed_180b' : [ 0x20, { + 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], + 'ListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'SerialNumber' : [ 0x18, ['pointer64', ['unsigned short']]], +} ], + '_DEVICE_NODE' : [ 0x2c8, { + 'Sibling' : [ 0x0, ['pointer64', ['_DEVICE_NODE']]], + 'Child' : [ 0x8, ['pointer64', ['_DEVICE_NODE']]], + 'Parent' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'LastChild' : [ 0x18, ['pointer64', ['_DEVICE_NODE']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'InstancePath' : [ 0x28, ['_UNICODE_STRING']], + 'ServiceName' : [ 0x38, ['_UNICODE_STRING']], + 'PendingIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'FxDevice' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'FxDeviceLock' : [ 0x58, ['long']], + 'FxRemoveEvent' : [ 0x60, ['_KEVENT']], + 'FxActivationCount' : [ 0x78, ['long']], + 'FxSleepCount' : [ 0x7c, ['long']], + 'Plugin' : [ 0x80, ['pointer64', ['_POP_FX_PLUGIN']]], + 'Level' : [ 0x88, ['unsigned long']], + 'CurrentPowerState' : [ 0x8c, ['_POWER_STATE']], + 'Notify' : [ 0x90, ['_PO_DEVICE_NOTIFY']], + 'PoIrpManager' : [ 0xf8, ['_PO_IRP_MANAGER']], + 'UniqueId' : [ 0x118, ['_UNICODE_STRING']], + 'PowerFlags' : [ 0x128, ['unsigned long']], + 'State' : [ 0x12c, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'PreviousState' : [ 0x130, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'StateHistory' : [ 0x134, ['array', -80, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]]], + 'StateHistoryEntry' : [ 0x184, ['unsigned long']], + 'CompletionStatus' : [ 0x188, ['long']], + 'Flags' : [ 0x18c, ['unsigned long']], + 'UserFlags' : [ 0x190, ['unsigned long']], + 'Problem' : [ 0x194, ['unsigned long']], + 'ProblemStatus' : [ 0x198, ['long']], + 'ResourceList' : [ 0x1a0, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'ResourceListTranslated' : [ 0x1a8, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'DuplicatePDO' : [ 0x1b0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ResourceRequirements' : [ 0x1b8, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'InterfaceType' : [ 0x1c0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x1c4, ['unsigned long']], + 'ChildInterfaceType' : [ 0x1c8, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'ChildBusNumber' : [ 0x1cc, ['unsigned long']], + 'ChildBusTypeIndex' : [ 0x1d0, ['unsigned short']], + 'RemovalPolicy' : [ 0x1d2, ['unsigned char']], + 'HardwareRemovalPolicy' : [ 0x1d3, ['unsigned char']], + 'TargetDeviceNotify' : [ 0x1d8, ['_LIST_ENTRY']], + 'DeviceArbiterList' : [ 0x1e8, ['_LIST_ENTRY']], + 'DeviceTranslatorList' : [ 0x1f8, ['_LIST_ENTRY']], + 'NoTranslatorMask' : [ 0x208, ['unsigned short']], + 'QueryTranslatorMask' : [ 0x20a, ['unsigned short']], + 'NoArbiterMask' : [ 0x20c, ['unsigned short']], + 'QueryArbiterMask' : [ 0x20e, ['unsigned short']], + 'OverUsed1' : [ 0x210, ['__unnamed_1805']], + 'OverUsed2' : [ 0x218, ['__unnamed_1807']], + 'BootResources' : [ 0x220, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'BootResourcesTranslated' : [ 0x228, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'CapabilityFlags' : [ 0x230, ['unsigned long']], + 'DockInfo' : [ 0x238, ['__unnamed_180b']], + 'DisableableDepends' : [ 0x258, ['unsigned long']], + 'PendedSetInterfaceState' : [ 0x260, ['_LIST_ENTRY']], + 'LegacyBusListEntry' : [ 0x270, ['_LIST_ENTRY']], + 'DriverUnloadRetryCount' : [ 0x280, ['unsigned long']], + 'PreviousParent' : [ 0x288, ['pointer64', ['_DEVICE_NODE']]], + 'DeletedChildren' : [ 0x290, ['unsigned long']], + 'NumaNodeIndex' : [ 0x294, ['unsigned long']], + 'ContainerID' : [ 0x298, ['_GUID']], + 'OverrideFlags' : [ 0x2a8, ['unsigned char']], + 'DeviceIdsHash' : [ 0x2ac, ['unsigned long']], + 'RequiresUnloadedDriver' : [ 0x2b0, ['unsigned char']], + 'PendingEjectRelations' : [ 0x2b8, ['pointer64', ['_PENDING_RELATIONS_LIST_ENTRY']]], + 'StateFlags' : [ 0x2c0, ['unsigned long']], +} ], + '_GROUP_AFFINITY' : [ 0x10, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Group' : [ 0x8, ['unsigned short']], + 'Reserved' : [ 0xa, ['array', 3, ['unsigned short']]], +} ], + '_KAFFINITY_EX' : [ 0xa8, { + 'Count' : [ 0x0, ['unsigned short']], + 'Size' : [ 0x2, ['unsigned short']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Bitmap' : [ 0x8, ['array', 20, ['unsigned long long']]], +} ], + '_PNP_ASSIGN_RESOURCES_CONTEXT' : [ 0x10, { + 'IncludeFailedDevices' : [ 0x0, ['unsigned long']], + 'DeviceCount' : [ 0x4, ['unsigned long']], + 'DeviceList' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_PNP_RESOURCE_REQUEST' : [ 0x40, { + 'PhysicalDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x8, ['unsigned long']], + 'AllocationType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Priority' : [ 0x10, ['unsigned long']], + 'Position' : [ 0x14, ['unsigned long']], + 'ResourceRequirements' : [ 0x18, ['pointer64', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], + 'ReqList' : [ 0x20, ['pointer64', ['void']]], + 'ResourceAssignment' : [ 0x28, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'TranslatedResourceAssignment' : [ 0x30, ['pointer64', ['_CM_RESOURCE_LIST']]], + 'Status' : [ 0x38, ['long']], +} ], + '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { + 'ListSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'SlotNumber' : [ 0xc, ['unsigned long']], + 'Reserved' : [ 0x10, ['array', 3, ['unsigned long']]], + 'AlternativeLists' : [ 0x1c, ['unsigned long']], + 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], +} ], + '_EXCEPTION_RECORD64' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long long']], + 'ExceptionAddress' : [ 0x10, ['unsigned long long']], + 'NumberParameters' : [ 0x18, ['unsigned long']], + '__unusedAlignment' : [ 0x1c, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_EXCEPTION_RECORD32' : [ 0x50, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['unsigned long']], + 'ExceptionAddress' : [ 0xc, ['unsigned long']], + 'NumberParameters' : [ 0x10, ['unsigned long']], + 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], +} ], + '_DBGKM_EXCEPTION64' : [ 0xa0, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD64']], + 'FirstChance' : [ 0x98, ['unsigned long']], +} ], + '_DBGKM_EXCEPTION32' : [ 0x54, { + 'ExceptionRecord' : [ 0x0, ['_EXCEPTION_RECORD32']], + 'FirstChance' : [ 0x50, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'DbgArgPointer' : [ 0xc, ['unsigned long']], + 'TempSegCs' : [ 0x10, ['unsigned long']], + 'TempEsp' : [ 0x14, ['unsigned long']], + 'Dr0' : [ 0x18, ['unsigned long']], + 'Dr1' : [ 0x1c, ['unsigned long']], + 'Dr2' : [ 0x20, ['unsigned long']], + 'Dr3' : [ 0x24, ['unsigned long']], + 'Dr6' : [ 0x28, ['unsigned long']], + 'Dr7' : [ 0x2c, ['unsigned long']], + 'SegGs' : [ 0x30, ['unsigned long']], + 'SegEs' : [ 0x34, ['unsigned long']], + 'SegDs' : [ 0x38, ['unsigned long']], + 'Edx' : [ 0x3c, ['unsigned long']], + 'Ecx' : [ 0x40, ['unsigned long']], + 'Eax' : [ 0x44, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x48, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x49, ['unsigned char']], + 'Reserved' : [ 0x4a, ['array', 2, ['unsigned char']]], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_X86_KTRAP_FRAME_BLUE' : [ 0x8c, { + 'DbgEbp' : [ 0x0, ['unsigned long']], + 'DbgEip' : [ 0x4, ['unsigned long']], + 'DbgArgMark' : [ 0x8, ['unsigned long']], + 'TempSegCs' : [ 0xc, ['unsigned short']], + 'Logging' : [ 0xe, ['unsigned char']], + 'FrameType' : [ 0xf, ['unsigned char']], + 'TempEsp' : [ 0x10, ['unsigned long']], + 'Dr0' : [ 0x14, ['unsigned long']], + 'Dr1' : [ 0x18, ['unsigned long']], + 'Dr2' : [ 0x1c, ['unsigned long']], + 'Dr3' : [ 0x20, ['unsigned long']], + 'Dr6' : [ 0x24, ['unsigned long']], + 'Dr7' : [ 0x28, ['unsigned long']], + 'SegGs' : [ 0x2c, ['unsigned long']], + 'SegEs' : [ 0x30, ['unsigned long']], + 'SegDs' : [ 0x34, ['unsigned long']], + 'Edx' : [ 0x38, ['unsigned long']], + 'Ecx' : [ 0x3c, ['unsigned long']], + 'Eax' : [ 0x40, ['unsigned long']], + 'PreviousPreviousMode' : [ 0x44, ['unsigned char']], + 'EntropyQueueDpc' : [ 0x45, ['unsigned char']], + 'Reserved' : [ 0x46, ['array', 2, ['unsigned char']]], + 'MxCsr' : [ 0x48, ['unsigned long']], + 'ExceptionList' : [ 0x4c, ['unsigned long']], + 'SegFs' : [ 0x50, ['unsigned long']], + 'Edi' : [ 0x54, ['unsigned long']], + 'Esi' : [ 0x58, ['unsigned long']], + 'Ebx' : [ 0x5c, ['unsigned long']], + 'Ebp' : [ 0x60, ['unsigned long']], + 'ErrCode' : [ 0x64, ['unsigned long']], + 'Eip' : [ 0x68, ['unsigned long']], + 'SegCs' : [ 0x6c, ['unsigned long']], + 'EFlags' : [ 0x70, ['unsigned long']], + 'HardwareEsp' : [ 0x74, ['unsigned long']], + 'HardwareSegSs' : [ 0x78, ['unsigned long']], + 'V86Es' : [ 0x7c, ['unsigned long']], + 'V86Ds' : [ 0x80, ['unsigned long']], + 'V86Fs' : [ 0x84, ['unsigned long']], + 'V86Gs' : [ 0x88, ['unsigned long']], +} ], + '_DBGKD_LOAD_SYMBOLS64' : [ 0x28, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x8, ['unsigned long long']], + 'ProcessId' : [ 0x10, ['unsigned long long']], + 'CheckSum' : [ 0x18, ['unsigned long']], + 'SizeOfImage' : [ 0x1c, ['unsigned long']], + 'UnloadSymbols' : [ 0x20, ['unsigned char']], +} ], + '_DBGKD_LOAD_SYMBOLS32' : [ 0x18, { + 'PathNameLength' : [ 0x0, ['unsigned long']], + 'BaseOfDll' : [ 0x4, ['unsigned long']], + 'ProcessId' : [ 0x8, ['unsigned long']], + 'CheckSum' : [ 0xc, ['unsigned long']], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'UnloadSymbols' : [ 0x14, ['unsigned char']], +} ], + '_DBGKD_READ_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesRead' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesRead' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY64' : [ 0x10, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long long']], + 'TransferCount' : [ 0x8, ['unsigned long']], + 'ActualBytesWritten' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_WRITE_MEMORY32' : [ 0xc, { + 'TargetBaseAddress' : [ 0x0, ['unsigned long']], + 'TransferCount' : [ 0x4, ['unsigned long']], + 'ActualBytesWritten' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT64' : [ 0x10, { + 'BreakPointAddress' : [ 0x0, ['unsigned long long']], + 'BreakPointHandle' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_WRITE_BREAKPOINT32' : [ 0x8, { + 'BreakPointAddress' : [ 0x0, ['unsigned long']], + 'BreakPointHandle' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO64' : [ 0x10, { + 'IoAddress' : [ 0x0, ['unsigned long long']], + 'DataSize' : [ 0x8, ['unsigned long']], + 'DataValue' : [ 0xc, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO32' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'IoAddress' : [ 0x4, ['unsigned long']], + 'DataValue' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED64' : [ 0x20, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long long']], + 'DataValue' : [ 0x18, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_IO_EXTENDED32' : [ 0x18, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'InterfaceType' : [ 0x4, ['unsigned long']], + 'BusNumber' : [ 0x8, ['unsigned long']], + 'AddressSpace' : [ 0xc, ['unsigned long']], + 'IoAddress' : [ 0x10, ['unsigned long']], + 'DataValue' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL32' : [ 0x4, { + 'SpecialCall' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_SET_SPECIAL_CALL64' : [ 0x8, { + 'SpecialCall' : [ 0x0, ['unsigned long long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT32' : [ 0x8, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_SET_INTERNAL_BREAKPOINT64' : [ 0x10, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT64' : [ 0x20, { + 'BreakpointAddress' : [ 0x0, ['unsigned long long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'Calls' : [ 0xc, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0x10, ['unsigned long']], + 'MinInstructions' : [ 0x14, ['unsigned long']], + 'MaxInstructions' : [ 0x18, ['unsigned long']], + 'TotalInstructions' : [ 0x1c, ['unsigned long']], +} ], + '_DBGKD_GET_INTERNAL_BREAKPOINT32' : [ 0x1c, { + 'BreakpointAddress' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'Calls' : [ 0x8, ['unsigned long']], + 'MaxCallsPerPeriod' : [ 0xc, ['unsigned long']], + 'MinInstructions' : [ 0x10, ['unsigned long']], + 'MaxInstructions' : [ 0x14, ['unsigned long']], + 'TotalInstructions' : [ 0x18, ['unsigned long']], +} ], + '__unnamed_18c2' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT64']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO64']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED64']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL64']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT64']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT64']], + 'GetVersion64' : [ 0x0, ['_DBGKD_GET_VERSION64']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetSetBusData' : [ 0x0, ['_DBGKD_GET_SET_BUS_DATA']], + 'FillMemory' : [ 0x0, ['_DBGKD_FILL_MEMORY']], + 'QueryMemory' : [ 0x0, ['_DBGKD_QUERY_MEMORY']], + 'SwitchPartition' : [ 0x0, ['_DBGKD_SWITCH_PARTITION']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE64' : [ 0x38, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0x10, ['__unnamed_18c2']], +} ], + '__unnamed_18c9' : [ 0x28, { + 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], + 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], + 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], + 'WriteMemory64' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], + 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], + 'SetContext' : [ 0x0, ['_DBGKD_SET_CONTEXT']], + 'WriteBreakPoint' : [ 0x0, ['_DBGKD_WRITE_BREAKPOINT32']], + 'RestoreBreakPoint' : [ 0x0, ['_DBGKD_RESTORE_BREAKPOINT']], + 'Continue' : [ 0x0, ['_DBGKD_CONTINUE']], + 'Continue2' : [ 0x0, ['_DBGKD_CONTINUE2']], + 'ReadWriteIo' : [ 0x0, ['_DBGKD_READ_WRITE_IO32']], + 'ReadWriteIoExtended' : [ 0x0, ['_DBGKD_READ_WRITE_IO_EXTENDED32']], + 'QuerySpecialCalls' : [ 0x0, ['_DBGKD_QUERY_SPECIAL_CALLS']], + 'SetSpecialCall' : [ 0x0, ['_DBGKD_SET_SPECIAL_CALL32']], + 'SetInternalBreakpoint' : [ 0x0, ['_DBGKD_SET_INTERNAL_BREAKPOINT32']], + 'GetInternalBreakpoint' : [ 0x0, ['_DBGKD_GET_INTERNAL_BREAKPOINT32']], + 'GetVersion32' : [ 0x0, ['_DBGKD_GET_VERSION32']], + 'BreakPointEx' : [ 0x0, ['_DBGKD_BREAKPOINTEX']], + 'ReadWriteMsr' : [ 0x0, ['_DBGKD_READ_WRITE_MSR']], + 'SearchMemory' : [ 0x0, ['_DBGKD_SEARCH_MEMORY']], + 'GetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], + 'SetContextEx' : [ 0x0, ['_DBGKD_CONTEXT_EX']], +} ], + '_DBGKD_MANIPULATE_STATE32' : [ 0x34, { + 'ApiNumber' : [ 0x0, ['unsigned long']], + 'ProcessorLevel' : [ 0x4, ['unsigned short']], + 'Processor' : [ 0x6, ['unsigned short']], + 'ReturnStatus' : [ 0x8, ['long']], + 'u' : [ 0xc, ['__unnamed_18c9']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], +} ], + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_AMD64_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], +} ], + '_PROCESSOR_POWER_STATE' : [ 0x1e0, { + 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], + 'IdleAccounting' : [ 0x8, ['pointer64', ['_PROC_IDLE_ACCOUNTING']]], + 'IdleTimeLast' : [ 0x10, ['unsigned long long']], + 'IdleTimeTotal' : [ 0x18, ['unsigned long long']], + 'IdleTimeEntry' : [ 0x20, ['unsigned long long']], + 'Reserved' : [ 0x28, ['unsigned long long']], + 'IdlePolicy' : [ 0x30, ['_PROC_IDLE_POLICY']], + 'Synchronization' : [ 0x38, ['_PPM_IDLE_SYNCHRONIZATION_STATE']], + 'PerfFeedback' : [ 0x40, ['_PROC_FEEDBACK']], + 'Hypervisor' : [ 0xb0, ['Enumeration', dict(target = 'long', choices = {0: 'ProcHypervisorNone', 1: 'ProcHypervisorPresent', 2: 'ProcHypervisorPower'})]], + 'LastSysTime' : [ 0xb4, ['unsigned long']], + 'WmiDispatchPtr' : [ 0xb8, ['unsigned long long']], + 'WmiInterfaceEnabled' : [ 0xc0, ['long']], + 'FFHThrottleStateInfo' : [ 0xc8, ['_PPM_FFH_THROTTLE_STATE_INFO']], + 'PerfActionDpc' : [ 0xe8, ['_KDPC']], + 'PerfActionMask' : [ 0x128, ['long']], + 'HvIdleCheck' : [ 0x130, ['_PROC_IDLE_SNAP']], + 'PerfCheck' : [ 0x140, ['_PROC_PERF_SNAP']], + 'Domain' : [ 0x180, ['pointer64', ['_PROC_PERF_DOMAIN']]], + 'PerfConstraint' : [ 0x188, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'Concurrency' : [ 0x190, ['pointer64', ['_PPM_CONCURRENCY_ACCOUNTING']]], + 'Load' : [ 0x198, ['pointer64', ['_PROC_PERF_LOAD']]], + 'PerfHistory' : [ 0x1a0, ['pointer64', ['_PROC_PERF_HISTORY']]], + 'GuaranteedPerformancePercent' : [ 0x1a8, ['unsigned char']], + 'HvTargetState' : [ 0x1a9, ['unsigned char']], + 'Parked' : [ 0x1aa, ['unsigned char']], + 'OverUtilized' : [ 0x1ab, ['unsigned char']], + 'LatestPerformancePercent' : [ 0x1ac, ['unsigned long']], + 'LatestAffinitizedPercent' : [ 0x1b0, ['unsigned long']], + 'ExpectedUtility' : [ 0x1b4, ['unsigned long']], + 'Utility' : [ 0x1b8, ['array', 3, ['_PROC_PERF_UTILITY']]], +} ], + '_PROC_PERF_UTILITY' : [ 0xc, { + 'Affinitized' : [ 0x0, ['unsigned long']], + 'Performance' : [ 0x4, ['unsigned long']], + 'Total' : [ 0x8, ['unsigned long']], +} ], + '_CPU_INFO' : [ 0x10, { + 'AsUINT32' : [ 0x0, ['array', 4, ['unsigned long']]], + 'Eax' : [ 0x0, ['unsigned long']], + 'Ebx' : [ 0x4, ['unsigned long']], + 'Ecx' : [ 0x8, ['unsigned long']], + 'Edx' : [ 0xc, ['unsigned long']], +} ], + '_POP_FX_COMPONENT_FLAGS' : [ 0x8, { + 'Value' : [ 0x0, ['long']], + 'Value2' : [ 0x4, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'Idling' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'CriticalIdleOverride' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ResidentOverride' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CompleteIdleStatePending' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_FX_DEVICE_STATUS' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'SystemTransition' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PepD0Notify' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IdleTimerOn' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'IgnoreIdleTimeout' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'IrpInUse' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'IrpPending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DPNRDeviceNotified' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DPNRReceivedFromPep' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_POP_RW_LOCK' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], +} ], + '_VOLUME_CACHE_MAP' : [ 0xd0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteCode' : [ 0x2, ['short']], + 'UseCount' : [ 0x4, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'VolumeCacheMapLinks' : [ 0x10, ['_LIST_ENTRY']], + 'DirtyPages' : [ 0x20, ['unsigned long long']], + 'LogHandleContext' : [ 0x28, ['_LOG_HANDLE_CONTEXT']], + 'Flags' : [ 0xc0, ['unsigned long']], + 'PagesQueuedToDisk' : [ 0xc4, ['unsigned long']], + 'LoggedPagesQueuedToDisk' : [ 0xc8, ['unsigned long']], +} ], + '_SHARED_CACHE_MAP' : [ 0x208, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'OpenCount' : [ 0x4, ['unsigned long']], + 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], + 'BcbList' : [ 0x10, ['_LIST_ENTRY']], + 'SectionSize' : [ 0x20, ['_LARGE_INTEGER']], + 'ValidDataLength' : [ 0x28, ['_LARGE_INTEGER']], + 'ValidDataGoal' : [ 0x30, ['_LARGE_INTEGER']], + 'InitialVacbs' : [ 0x38, ['array', 4, ['pointer64', ['_VACB']]]], + 'Vacbs' : [ 0x58, ['pointer64', ['pointer64', ['_VACB']]]], + 'FileObjectFastRef' : [ 0x60, ['_EX_FAST_REF']], + 'VacbLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'DirtyPages' : [ 0x70, ['unsigned long']], + 'LoggedStreamLinks' : [ 0x78, ['_LIST_ENTRY']], + 'SharedCacheMapLinks' : [ 0x88, ['_LIST_ENTRY']], + 'Flags' : [ 0x98, ['unsigned long']], + 'Status' : [ 0x9c, ['long']], + 'Mbcb' : [ 0xa0, ['pointer64', ['_MBCB']]], + 'Section' : [ 0xa8, ['pointer64', ['void']]], + 'CreateEvent' : [ 0xb0, ['pointer64', ['_KEVENT']]], + 'WaitOnActiveCount' : [ 0xb8, ['pointer64', ['_KEVENT']]], + 'PagesToWrite' : [ 0xc0, ['unsigned long']], + 'BeyondLastFlush' : [ 0xc8, ['long long']], + 'Callbacks' : [ 0xd0, ['pointer64', ['_CACHE_MANAGER_CALLBACKS']]], + 'LazyWriteContext' : [ 0xd8, ['pointer64', ['void']]], + 'PrivateList' : [ 0xe0, ['_LIST_ENTRY']], + 'V1' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V1']], + 'V2' : [ 0xf0, ['_LOGGED_STREAM_CALLBACK_V2']], + 'LargestLSN' : [ 0x100, ['_LARGE_INTEGER']], + 'DirtyPageThreshold' : [ 0x108, ['unsigned long']], + 'LazyWritePassCount' : [ 0x10c, ['unsigned long']], + 'UninitializeEvent' : [ 0x110, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'BcbLock' : [ 0x118, ['_FAST_MUTEX']], + 'LastUnmapBehindOffset' : [ 0x150, ['_LARGE_INTEGER']], + 'Event' : [ 0x158, ['_KEVENT']], + 'HighWaterMappingOffset' : [ 0x170, ['_LARGE_INTEGER']], + 'PrivateCacheMap' : [ 0x178, ['_PRIVATE_CACHE_MAP']], + 'WriteBehindWorkQueueEntry' : [ 0x1f0, ['pointer64', ['void']]], + 'VolumeCacheMap' : [ 0x1f8, ['pointer64', ['_VOLUME_CACHE_MAP']]], + 'ProcImagePathHash' : [ 0x200, ['unsigned long']], + 'WritesInProgress' : [ 0x204, ['unsigned long']], +} ], + '__unnamed_1971' : [ 0x10, { + 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], + 'ActiveCount' : [ 0x0, ['unsigned short']], + 'Links' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_VACB' : [ 0x28, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'Overlay' : [ 0x10, ['__unnamed_1971']], + 'ArrayHead' : [ 0x20, ['pointer64', ['_VACB_ARRAY_HEADER']]], +} ], + '__unnamed_1992' : [ 0x8, { + 'FileObject' : [ 0x0, ['pointer64', ['_FILE_OBJECT']]], +} ], + '__unnamed_1994' : [ 0x8, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], +} ], + '__unnamed_1996' : [ 0x8, { + 'Event' : [ 0x0, ['pointer64', ['_KEVENT']]], +} ], + '__unnamed_1998' : [ 0x4, { + 'Reason' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_199a' : [ 0x30, { + 'SharedCacheMap' : [ 0x0, ['pointer64', ['_SHARED_CACHE_MAP']]], + 'IoStatus' : [ 0x8, ['pointer64', ['_IO_STATUS_BLOCK']]], + 'CallerWaitEvent' : [ 0x10, ['_KEVENT']], + 'IsLowPriWriteBehind' : [ 0x28, ['unsigned char']], +} ], + '__unnamed_199c' : [ 0x30, { + 'Read' : [ 0x0, ['__unnamed_1992']], + 'Write' : [ 0x0, ['__unnamed_1994']], + 'Event' : [ 0x0, ['__unnamed_1996']], + 'Notification' : [ 0x0, ['__unnamed_1998']], + 'LowPriWrite' : [ 0x0, ['__unnamed_199a']], +} ], + '_WORK_QUEUE_ENTRY' : [ 0x48, { + 'WorkQueueLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Parameters' : [ 0x10, ['__unnamed_199c']], + 'Function' : [ 0x40, ['unsigned char']], +} ], + '_CC_EXTERNAL_CACHE_INFO' : [ 0x30, { + 'Callback' : [ 0x0, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x8, ['_DIRTY_PAGE_STATISTICS']], + 'Links' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_LOG_HANDLE_CONTEXT' : [ 0x98, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], + 'QueryLogHandleInfoRoutine' : [ 0x10, ['pointer64', ['void']]], + 'DirtyPageStatistics' : [ 0x18, ['_DIRTY_PAGE_STATISTICS']], + 'DirtyPageThresholds' : [ 0x30, ['_DIRTY_PAGE_THRESHOLDS']], + 'AdditionalPagesToWrite' : [ 0x68, ['unsigned long']], + 'CcLWScanDPThreshold' : [ 0x6c, ['unsigned long']], + 'LargestLsnForCurrentLWScan' : [ 0x70, ['_LARGE_INTEGER']], + 'RelatedFileObject' : [ 0x78, ['pointer64', ['_FILE_OBJECT']]], + 'LargestLsnFileObjectKey' : [ 0x80, ['unsigned long long']], + 'LastLWTimeStamp' : [ 0x88, ['_LARGE_INTEGER']], + 'Flags' : [ 0x90, ['unsigned long']], +} ], + '_MBCB' : [ 0xc0, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeIsInZone' : [ 0x2, ['short']], + 'PagesToWrite' : [ 0x4, ['unsigned long']], + 'DirtyPages' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], + 'BitmapRanges' : [ 0x10, ['_LIST_ENTRY']], + 'ResumeWritePage' : [ 0x20, ['long long']], + 'MostRecentlyDirtiedPage' : [ 0x28, ['long long']], + 'BitmapRange1' : [ 0x30, ['_BITMAP_RANGE']], + 'BitmapRange2' : [ 0x60, ['_BITMAP_RANGE']], + 'BitmapRange3' : [ 0x90, ['_BITMAP_RANGE']], +} ], + '_BITMAP_RANGE' : [ 0x30, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'BasePage' : [ 0x10, ['long long']], + 'FirstDirtyPage' : [ 0x18, ['unsigned long']], + 'LastDirtyPage' : [ 0x1c, ['unsigned long']], + 'DirtyPages' : [ 0x20, ['unsigned long']], + 'Bitmap' : [ 0x28, ['pointer64', ['unsigned long']]], +} ], + 'VACB_LEVEL_ALLOCATION_LIST' : [ 0x20, { + 'VacbLevelList' : [ 0x0, ['_LIST_ENTRY']], + 'VacbLevelWithBcbListHeads' : [ 0x10, ['pointer64', ['void']]], + 'VacbLevelsAllocated' : [ 0x18, ['unsigned long']], +} ], + '_VACB_LEVEL_REFERENCE' : [ 0x8, { + 'Reference' : [ 0x0, ['long']], + 'SpecialReference' : [ 0x4, ['long']], +} ], + '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { + 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], + 'Event' : [ 0x8, ['_KEVENT']], +} ], + '_HEAP_LIST_LOOKUP' : [ 0x38, { + 'ExtendedLookup' : [ 0x0, ['pointer64', ['_HEAP_LIST_LOOKUP']]], + 'ArraySize' : [ 0x8, ['unsigned long']], + 'ExtraItem' : [ 0xc, ['unsigned long']], + 'ItemCount' : [ 0x10, ['unsigned long']], + 'OutOfRangeItems' : [ 0x14, ['unsigned long']], + 'BaseIndex' : [ 0x18, ['unsigned long']], + 'ListHead' : [ 0x20, ['pointer64', ['_LIST_ENTRY']]], + 'ListsInUseUlong' : [ 0x28, ['pointer64', ['unsigned long']]], + 'ListHints' : [ 0x30, ['pointer64', ['pointer64', ['_LIST_ENTRY']]]], +} ], + '_HEAP' : [ 0x298, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], + 'Flags' : [ 0x70, ['unsigned long']], + 'ForceFlags' : [ 0x74, ['unsigned long']], + 'CompatibilityFlags' : [ 0x78, ['unsigned long']], + 'EncodeFlagMask' : [ 0x7c, ['unsigned long']], + 'Encoding' : [ 0x80, ['_HEAP_ENTRY']], + 'Interceptor' : [ 0x90, ['unsigned long']], + 'VirtualMemoryThreshold' : [ 0x94, ['unsigned long']], + 'Signature' : [ 0x98, ['unsigned long']], + 'SegmentReserve' : [ 0xa0, ['unsigned long long']], + 'SegmentCommit' : [ 0xa8, ['unsigned long long']], + 'DeCommitFreeBlockThreshold' : [ 0xb0, ['unsigned long long']], + 'DeCommitTotalFreeThreshold' : [ 0xb8, ['unsigned long long']], + 'TotalFreeSize' : [ 0xc0, ['unsigned long long']], + 'MaximumAllocationSize' : [ 0xc8, ['unsigned long long']], + 'ProcessHeapsListIndex' : [ 0xd0, ['unsigned short']], + 'HeaderValidateLength' : [ 0xd2, ['unsigned short']], + 'HeaderValidateCopy' : [ 0xd8, ['pointer64', ['void']]], + 'NextAvailableTagIndex' : [ 0xe0, ['unsigned short']], + 'MaximumTagIndex' : [ 0xe2, ['unsigned short']], + 'TagEntries' : [ 0xe8, ['pointer64', ['_HEAP_TAG_ENTRY']]], + 'UCRList' : [ 0xf0, ['_LIST_ENTRY']], + 'AlignRound' : [ 0x100, ['unsigned long long']], + 'AlignMask' : [ 0x108, ['unsigned long long']], + 'VirtualAllocdBlocks' : [ 0x110, ['_LIST_ENTRY']], + 'SegmentList' : [ 0x120, ['_LIST_ENTRY']], + 'AllocatorBackTraceIndex' : [ 0x130, ['unsigned short']], + 'NonDedicatedListLength' : [ 0x134, ['unsigned long']], + 'BlocksIndex' : [ 0x138, ['pointer64', ['void']]], + 'UCRIndex' : [ 0x140, ['pointer64', ['void']]], + 'PseudoTagEntries' : [ 0x148, ['pointer64', ['_HEAP_PSEUDO_TAG_ENTRY']]], + 'FreeLists' : [ 0x150, ['_LIST_ENTRY']], + 'LockVariable' : [ 0x160, ['pointer64', ['_HEAP_LOCK']]], + 'CommitRoutine' : [ 0x168, ['pointer64', ['void']]], + 'FrontEndHeap' : [ 0x170, ['pointer64', ['void']]], + 'FrontHeapLockCount' : [ 0x178, ['unsigned short']], + 'FrontEndHeapType' : [ 0x17a, ['unsigned char']], + 'RequestedFrontEndHeapType' : [ 0x17b, ['unsigned char']], + 'FrontEndHeapUsageData' : [ 0x180, ['pointer64', ['unsigned short']]], + 'FrontEndHeapMaximumIndex' : [ 0x188, ['unsigned short']], + 'FrontEndHeapStatusBitmap' : [ 0x18a, ['array', 129, ['unsigned char']]], + 'Counters' : [ 0x210, ['_HEAP_COUNTERS']], + 'TuningParameters' : [ 0x288, ['_HEAP_TUNING_PARAMETERS']], +} ], + '__unnamed_1a07' : [ 0x68, { + 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], + 'Resource' : [ 0x0, ['_ERESOURCE']], +} ], + '_HEAP_LOCK' : [ 0x68, { + 'Lock' : [ 0x0, ['__unnamed_1a07']], +} ], + '_HEAP_ENTRY' : [ 0x10, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_SEGMENT' : [ 0x70, { + 'Entry' : [ 0x0, ['_HEAP_ENTRY']], + 'SegmentSignature' : [ 0x10, ['unsigned long']], + 'SegmentFlags' : [ 0x14, ['unsigned long']], + 'SegmentListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'Heap' : [ 0x28, ['pointer64', ['_HEAP']]], + 'BaseAddress' : [ 0x30, ['pointer64', ['void']]], + 'NumberOfPages' : [ 0x38, ['unsigned long']], + 'FirstEntry' : [ 0x40, ['pointer64', ['_HEAP_ENTRY']]], + 'LastValidEntry' : [ 0x48, ['pointer64', ['_HEAP_ENTRY']]], + 'NumberOfUnCommittedPages' : [ 0x50, ['unsigned long']], + 'NumberOfUnCommittedRanges' : [ 0x54, ['unsigned long']], + 'SegmentAllocatorBackTraceIndex' : [ 0x58, ['unsigned short']], + 'Reserved' : [ 0x5a, ['unsigned short']], + 'UCRSegmentList' : [ 0x60, ['_LIST_ENTRY']], +} ], + '_HEAP_VIRTUAL_ALLOC_ENTRY' : [ 0x40, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'ExtraStuff' : [ 0x10, ['_HEAP_ENTRY_EXTRA']], + 'CommitSize' : [ 0x20, ['unsigned long long']], + 'ReserveSize' : [ 0x28, ['unsigned long long']], + 'BusyBlock' : [ 0x30, ['_HEAP_ENTRY']], +} ], + '_HEAP_FREE_ENTRY' : [ 0x20, { + 'PreviousBlockPrivateData' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned short']], + 'Flags' : [ 0xa, ['unsigned char']], + 'SmallTagIndex' : [ 0xb, ['unsigned char']], + 'SubSegmentCode' : [ 0x8, ['unsigned long']], + 'PreviousSize' : [ 0xc, ['unsigned short']], + 'SegmentOffset' : [ 0xe, ['unsigned char']], + 'LFHFlags' : [ 0xe, ['unsigned char']], + 'UnusedBytes' : [ 0xf, ['unsigned char']], + 'CompactHeader' : [ 0x8, ['unsigned long long']], + 'Reserved' : [ 0x0, ['pointer64', ['void']]], + 'FunctionIndex' : [ 0x8, ['unsigned short']], + 'ContextValue' : [ 0xa, ['unsigned short']], + 'InterceptorValue' : [ 0x8, ['unsigned long']], + 'UnusedBytesLength' : [ 0xc, ['unsigned short']], + 'EntryOffset' : [ 0xe, ['unsigned char']], + 'ExtendedBlockSignature' : [ 0xf, ['unsigned char']], + 'ReservedForAlignment' : [ 0x0, ['pointer64', ['void']]], + 'Code1' : [ 0x8, ['unsigned long']], + 'Code2' : [ 0xc, ['unsigned short']], + 'Code3' : [ 0xe, ['unsigned char']], + 'Code4' : [ 0xf, ['unsigned char']], + 'Code234' : [ 0xc, ['unsigned long']], + 'AgregateCode' : [ 0x8, ['unsigned long long']], + 'FreeList' : [ 0x10, ['_LIST_ENTRY']], +} ], + '__unnamed_1a59' : [ 0x4, { + 'DataLength' : [ 0x0, ['short']], + 'TotalLength' : [ 0x2, ['short']], +} ], + '__unnamed_1a5b' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a59']], + 'Length' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_1a5d' : [ 0x4, { + 'Type' : [ 0x0, ['short']], + 'DataInfoOffset' : [ 0x2, ['short']], +} ], + '__unnamed_1a5f' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1a5d']], + 'ZeroInit' : [ 0x0, ['unsigned long']], +} ], + '_PORT_MESSAGE' : [ 0x28, { + 'u1' : [ 0x0, ['__unnamed_1a5b']], + 'u2' : [ 0x4, ['__unnamed_1a5f']], + 'ClientId' : [ 0x8, ['_CLIENT_ID']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x18, ['unsigned long']], + 'ClientViewSize' : [ 0x20, ['unsigned long long']], + 'CallbackId' : [ 0x20, ['unsigned long']], +} ], + '_ALPC_MESSAGE_ATTRIBUTES' : [ 0x8, { + 'AllocatedAttributes' : [ 0x0, ['unsigned long']], + 'ValidAttributes' : [ 0x4, ['unsigned long']], +} ], + '_ALPC_HANDLE_ENTRY' : [ 0x8, { + 'Object' : [ 0x0, ['pointer64', ['void']]], +} ], + '_BLOB_TYPE' : [ 0x30, { + 'ResourceId' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BLOB_TYPE_UNKNOWN', 1: 'BLOB_TYPE_CONNECTION_INFO', 2: 'BLOB_TYPE_MESSAGE', 3: 'BLOB_TYPE_SECURITY_CONTEXT', 4: 'BLOB_TYPE_SECTION', 5: 'BLOB_TYPE_REGION', 6: 'BLOB_TYPE_VIEW', 7: 'BLOB_TYPE_RESERVE', 8: 'BLOB_TYPE_DIRECT_TRANSFER', 9: 'BLOB_TYPE_HANDLE_DATA', 10: 'BLOB_TYPE_MAX_ID'})]], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'LookasideIndex' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Counters' : [ 0x10, ['pointer64', ['_BLOB_COUNTERS']]], + 'DeleteProcedure' : [ 0x18, ['pointer64', ['void']]], + 'DestroyProcedure' : [ 0x20, ['pointer64', ['void']]], + 'UsualSize' : [ 0x28, ['unsigned long long']], +} ], + '__unnamed_1a7a' : [ 0x1, { + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], +} ], + '__unnamed_1a7c' : [ 0x1, { + 's1' : [ 0x0, ['__unnamed_1a7a']], + 'Flags' : [ 0x0, ['unsigned char']], +} ], + '_BLOB' : [ 0x30, { + 'ResourceList' : [ 0x0, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x0, ['_SLIST_ENTRY']], + 'u1' : [ 0x10, ['__unnamed_1a7c']], + 'ResourceId' : [ 0x11, ['unsigned char']], + 'CachedReferences' : [ 0x12, ['short']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Lock' : [ 0x20, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1a8e' : [ 0x4, { + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1a90' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a8e']], +} ], + '_KALPC_SECTION' : [ 0x48, { + 'SectionObject' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'HandleTable' : [ 0x10, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'SectionHandle' : [ 0x18, ['pointer64', ['void']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x28, ['pointer64', ['_ALPC_PORT']]], + 'u1' : [ 0x30, ['__unnamed_1a90']], + 'NumberOfRegions' : [ 0x34, ['unsigned long']], + 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], +} ], + '__unnamed_1a99' : [ 0x4, { + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], +} ], + '__unnamed_1a9b' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1a99']], +} ], + '_KALPC_REGION' : [ 0x58, { + 'RegionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Section' : [ 0x10, ['pointer64', ['_KALPC_SECTION']]], + 'Offset' : [ 0x18, ['unsigned long long']], + 'Size' : [ 0x20, ['unsigned long long']], + 'ViewSize' : [ 0x28, ['unsigned long long']], + 'u1' : [ 0x30, ['__unnamed_1a9b']], + 'NumberOfViews' : [ 0x34, ['unsigned long']], + 'ViewListHead' : [ 0x38, ['_LIST_ENTRY']], + 'ReadOnlyView' : [ 0x48, ['pointer64', ['_KALPC_VIEW']]], + 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], +} ], + '__unnamed_1aa1' : [ 0x4, { + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], +} ], + '__unnamed_1aa3' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1aa1']], +} ], + '_KALPC_VIEW' : [ 0x60, { + 'ViewListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Region' : [ 0x10, ['pointer64', ['_KALPC_REGION']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'OwnerProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'Address' : [ 0x28, ['pointer64', ['void']]], + 'Size' : [ 0x30, ['unsigned long long']], + 'SecureViewHandle' : [ 0x38, ['pointer64', ['void']]], + 'WriteAccessHandle' : [ 0x40, ['pointer64', ['void']]], + 'u1' : [ 0x48, ['__unnamed_1aa3']], + 'NumberOfOwnerMessages' : [ 0x4c, ['unsigned long']], + 'ProcessViewListEntry' : [ 0x50, ['_LIST_ENTRY']], +} ], + '_ALPC_COMMUNICATION_INFO' : [ 0x48, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'ServerCommunicationPort' : [ 0x8, ['pointer64', ['_ALPC_PORT']]], + 'ClientCommunicationPort' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'CommunicationList' : [ 0x18, ['_LIST_ENTRY']], + 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], + 'CloseMessage' : [ 0x40, ['pointer64', ['_KALPC_MESSAGE']]], +} ], + '__unnamed_1ac1' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], +} ], + '__unnamed_1ac3' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1ac1']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_ALPC_PORT' : [ 0x1c0, { + 'PortListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'OwnerProcess' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'CompletionPort' : [ 0x20, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x28, ['pointer64', ['void']]], + 'CompletionPacketLookaside' : [ 0x30, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], + 'PortContext' : [ 0x38, ['pointer64', ['void']]], + 'StaticSecurity' : [ 0x40, ['_SECURITY_CLIENT_CONTEXT']], + 'IncomingQueueLock' : [ 0x88, ['_EX_PUSH_LOCK']], + 'MainQueue' : [ 0x90, ['_LIST_ENTRY']], + 'LargeMessageQueue' : [ 0xa0, ['_LIST_ENTRY']], + 'PendingQueueLock' : [ 0xb0, ['_EX_PUSH_LOCK']], + 'PendingQueue' : [ 0xb8, ['_LIST_ENTRY']], + 'WaitQueueLock' : [ 0xc8, ['_EX_PUSH_LOCK']], + 'WaitQueue' : [ 0xd0, ['_LIST_ENTRY']], + 'Semaphore' : [ 0xe0, ['pointer64', ['_KSEMAPHORE']]], + 'DummyEvent' : [ 0xe0, ['pointer64', ['_KEVENT']]], + 'PortAttributes' : [ 0xe8, ['_ALPC_PORT_ATTRIBUTES']], + 'ResourceListLock' : [ 0x130, ['_EX_PUSH_LOCK']], + 'ResourceListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PortObjectLock' : [ 0x148, ['_EX_PUSH_LOCK']], + 'CompletionList' : [ 0x150, ['pointer64', ['_ALPC_COMPLETION_LIST']]], + 'CallbackObject' : [ 0x158, ['pointer64', ['_CALLBACK_OBJECT']]], + 'CallbackContext' : [ 0x160, ['pointer64', ['void']]], + 'CanceledQueue' : [ 0x168, ['_LIST_ENTRY']], + 'SequenceNo' : [ 0x178, ['long']], + 'ReferenceNo' : [ 0x17c, ['long']], + 'ReferenceNoWait' : [ 0x180, ['pointer64', ['_PALPC_PORT_REFERENCE_WAIT_BLOCK']]], + 'u1' : [ 0x188, ['__unnamed_1ac3']], + 'TargetQueuePort' : [ 0x190, ['pointer64', ['_ALPC_PORT']]], + 'TargetSequencePort' : [ 0x198, ['pointer64', ['_ALPC_PORT']]], + 'CachedMessage' : [ 0x1a0, ['pointer64', ['_KALPC_MESSAGE']]], + 'MainQueueLength' : [ 0x1a8, ['unsigned long']], + 'LargeMessageQueueLength' : [ 0x1ac, ['unsigned long']], + 'PendingQueueLength' : [ 0x1b0, ['unsigned long']], + 'CanceledQueueLength' : [ 0x1b4, ['unsigned long']], + 'WaitQueueLength' : [ 0x1b8, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST' : [ 0xa0, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'OwnerProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'CompletionListLock' : [ 0x18, ['_EX_PUSH_LOCK']], + 'Mdl' : [ 0x20, ['pointer64', ['_MDL']]], + 'UserVa' : [ 0x28, ['pointer64', ['void']]], + 'UserLimit' : [ 0x30, ['pointer64', ['void']]], + 'DataUserVa' : [ 0x38, ['pointer64', ['void']]], + 'SystemVa' : [ 0x40, ['pointer64', ['void']]], + 'TotalSize' : [ 0x48, ['unsigned long long']], + 'Header' : [ 0x50, ['pointer64', ['_ALPC_COMPLETION_LIST_HEADER']]], + 'List' : [ 0x58, ['pointer64', ['void']]], + 'ListSize' : [ 0x60, ['unsigned long long']], + 'Bitmap' : [ 0x68, ['pointer64', ['void']]], + 'BitmapSize' : [ 0x70, ['unsigned long long']], + 'Data' : [ 0x78, ['pointer64', ['void']]], + 'DataSize' : [ 0x80, ['unsigned long long']], + 'BitmapLimit' : [ 0x88, ['unsigned long']], + 'BitmapNextHint' : [ 0x8c, ['unsigned long']], + 'ConcurrencyCount' : [ 0x90, ['unsigned long']], + 'AttributeFlags' : [ 0x94, ['unsigned long']], + 'AttributeSize' : [ 0x98, ['unsigned long']], +} ], + '_OBJECT_ATTRIBUTES' : [ 0x30, { + 'Length' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ObjectName' : [ 0x10, ['pointer64', ['_UNICODE_STRING']]], + 'Attributes' : [ 0x18, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQualityOfService' : [ 0x28, ['pointer64', ['void']]], +} ], + '_OBJECT_TYPE' : [ 0xd8, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'Name' : [ 0x10, ['_UNICODE_STRING']], + 'DefaultObject' : [ 0x20, ['pointer64', ['void']]], + 'Index' : [ 0x28, ['unsigned char']], + 'TotalNumberOfObjects' : [ 0x2c, ['unsigned long']], + 'TotalNumberOfHandles' : [ 0x30, ['unsigned long']], + 'HighWaterNumberOfObjects' : [ 0x34, ['unsigned long']], + 'HighWaterNumberOfHandles' : [ 0x38, ['unsigned long']], + 'TypeInfo' : [ 0x40, ['_OBJECT_TYPE_INITIALIZER']], + 'TypeLock' : [ 0xb8, ['_EX_PUSH_LOCK']], + 'Key' : [ 0xc0, ['unsigned long']], + 'CallbackList' : [ 0xc8, ['_LIST_ENTRY']], +} ], + '_PALPC_PORT_REFERENCE_WAIT_BLOCK' : [ 0x20, { + 'DesiredReferenceNoEvent' : [ 0x0, ['_KEVENT']], + 'DesiredReferenceNo' : [ 0x18, ['long']], +} ], + '_PORT_MESSAGE32' : [ 0x18, { + 'u1' : [ 0x0, ['__unnamed_1a5b']], + 'u2' : [ 0x4, ['__unnamed_1a5f']], + 'ClientId' : [ 0x8, ['_CLIENT_ID32']], + 'DoNotUseThisField' : [ 0x8, ['double']], + 'MessageId' : [ 0x10, ['unsigned long']], + 'ClientViewSize' : [ 0x14, ['unsigned long']], + 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_1aeb' : [ 0x4, { + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], +} ], + '__unnamed_1aed' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1aeb']], + 'State' : [ 0x0, ['unsigned long']], +} ], + '_KALPC_MESSAGE' : [ 0x100, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'PortQueue' : [ 0x10, ['pointer64', ['_ALPC_PORT']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'WaitingThread' : [ 0x20, ['pointer64', ['_ETHREAD']]], + 'u1' : [ 0x28, ['__unnamed_1aed']], + 'SequenceNo' : [ 0x2c, ['long']], + 'QuotaProcess' : [ 0x30, ['pointer64', ['_EPROCESS']]], + 'QuotaBlock' : [ 0x30, ['pointer64', ['void']]], + 'CancelSequencePort' : [ 0x38, ['pointer64', ['_ALPC_PORT']]], + 'CancelQueuePort' : [ 0x40, ['pointer64', ['_ALPC_PORT']]], + 'CancelSequenceNo' : [ 0x48, ['long']], + 'CancelListEntry' : [ 0x50, ['_LIST_ENTRY']], + 'Reserve' : [ 0x60, ['pointer64', ['_KALPC_RESERVE']]], + 'MessageAttributes' : [ 0x68, ['_KALPC_MESSAGE_ATTRIBUTES']], + 'DataUserVa' : [ 0xa0, ['pointer64', ['void']]], + 'CommunicationInfo' : [ 0xa8, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'ConnectionPort' : [ 0xb0, ['pointer64', ['_ALPC_PORT']]], + 'ServerThread' : [ 0xb8, ['pointer64', ['_ETHREAD']]], + 'WakeReference' : [ 0xc0, ['pointer64', ['void']]], + 'ExtensionBuffer' : [ 0xc8, ['pointer64', ['void']]], + 'ExtensionBufferSize' : [ 0xd0, ['unsigned long long']], + 'PortMessage' : [ 0xd8, ['_PORT_MESSAGE']], +} ], + '_ALPC_DISPATCH_CONTEXT' : [ 0x38, { + 'PortObject' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'Message' : [ 0x8, ['pointer64', ['_KALPC_MESSAGE']]], + 'CommunicationInfo' : [ 0x10, ['pointer64', ['_ALPC_COMMUNICATION_INFO']]], + 'TargetThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'TargetPort' : [ 0x20, ['pointer64', ['_ALPC_PORT']]], + 'Flags' : [ 0x28, ['unsigned long']], + 'TotalLength' : [ 0x2c, ['unsigned short']], + 'Type' : [ 0x2e, ['unsigned short']], + 'DataInfoOffset' : [ 0x30, ['unsigned short']], + 'SignalCompletion' : [ 0x32, ['unsigned char']], + 'PostedToCompletionList' : [ 0x33, ['unsigned char']], +} ], + '_REMOTE_PORT_VIEW' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'ViewSize' : [ 0x8, ['unsigned long long']], + 'ViewBase' : [ 0x10, ['pointer64', ['void']]], +} ], + '_KALPC_RESERVE' : [ 0x28, { + 'OwnerPort' : [ 0x0, ['pointer64', ['_ALPC_PORT']]], + 'HandleTable' : [ 0x8, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Message' : [ 0x18, ['pointer64', ['_KALPC_MESSAGE']]], + 'Active' : [ 0x20, ['long']], +} ], + '_KALPC_HANDLE_DATA' : [ 0x30, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ObjectType' : [ 0x4, ['unsigned long']], + 'DuplicateContext' : [ 0x8, ['_OB_DUPLICATE_OBJECT_STATE']], +} ], + '_KALPC_MESSAGE_ATTRIBUTES' : [ 0x38, { + 'ClientContext' : [ 0x0, ['pointer64', ['void']]], + 'ServerContext' : [ 0x8, ['pointer64', ['void']]], + 'PortContext' : [ 0x10, ['pointer64', ['void']]], + 'CancelPortContext' : [ 0x18, ['pointer64', ['void']]], + 'SecurityData' : [ 0x20, ['pointer64', ['_KALPC_SECURITY_DATA']]], + 'View' : [ 0x28, ['pointer64', ['_KALPC_VIEW']]], + 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], +} ], + '__unnamed_1b2f' : [ 0x4, { + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], +} ], + '__unnamed_1b31' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1b2f']], +} ], + '_KALPC_SECURITY_DATA' : [ 0x70, { + 'HandleTable' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_TABLE']]], + 'ContextHandle' : [ 0x8, ['pointer64', ['void']]], + 'OwningProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'OwnerPort' : [ 0x18, ['pointer64', ['_ALPC_PORT']]], + 'DynamicSecurity' : [ 0x20, ['_SECURITY_CLIENT_CONTEXT']], + 'u1' : [ 0x68, ['__unnamed_1b31']], +} ], + '_IO_MINI_COMPLETION_PACKET_USER' : [ 0x50, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PacketType' : [ 0x10, ['unsigned long']], + 'KeyContext' : [ 0x18, ['pointer64', ['void']]], + 'ApcContext' : [ 0x20, ['pointer64', ['void']]], + 'IoStatus' : [ 0x28, ['long']], + 'IoStatusInformation' : [ 0x30, ['unsigned long long']], + 'MiniPacketCallback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'Allocated' : [ 0x48, ['unsigned char']], +} ], + '_IOP_IRP_EXTENSION' : [ 0x28, { + 'ExtensionFlags' : [ 0x0, ['unsigned short']], + 'Allocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PropagateId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'TimeStamped' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SpareBits' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 16, native_type='unsigned short')]], + 'TypesAllocated' : [ 0x2, ['unsigned short']], + 'GenericExtension' : [ 0x4, ['array', 4, ['unsigned char']]], + 'VerifierContext' : [ 0x8, ['pointer64', ['void']]], + 'ActivityId' : [ 0x10, ['_GUID']], + 'Timestamp' : [ 0x20, ['_LARGE_INTEGER']], +} ], + '_DRIVER_OBJECT' : [ 0x150, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'DriverStart' : [ 0x18, ['pointer64', ['void']]], + 'DriverSize' : [ 0x20, ['unsigned long']], + 'DriverSection' : [ 0x28, ['pointer64', ['void']]], + 'DriverExtension' : [ 0x30, ['pointer64', ['_DRIVER_EXTENSION']]], + 'DriverName' : [ 0x38, ['_UNICODE_STRING']], + 'HardwareDatabase' : [ 0x48, ['pointer64', ['_UNICODE_STRING']]], + 'FastIoDispatch' : [ 0x50, ['pointer64', ['_FAST_IO_DISPATCH']]], + 'DriverInit' : [ 0x58, ['pointer64', ['void']]], + 'DriverStartIo' : [ 0x60, ['pointer64', ['void']]], + 'DriverUnload' : [ 0x68, ['pointer64', ['void']]], + 'MajorFunction' : [ 0x70, ['array', 28, ['pointer64', ['void']]]], +} ], + '_FILE_SEGMENT_ELEMENT' : [ 0x8, { + 'Buffer' : [ 0x0, ['pointer64', ['void']]], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_RELATIVE_SYMLINK_INFO' : [ 0x20, { + 'ExposedNamespaceLength' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'DeviceNameLength' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'InteriorMountPoint' : [ 0x8, ['pointer64', ['_RELATIVE_SYMLINK_INFO']]], + 'OpenedName' : [ 0x10, ['_UNICODE_STRING']], +} ], + '_ECP_LIST' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x4, ['unsigned long']], + 'EcpList' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_IOP_FILE_OBJECT_EXTENSION' : [ 0x48, { + 'FoExtFlags' : [ 0x0, ['unsigned long']], + 'FoExtPerTypeExtension' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], + 'FoIoPriorityHint' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'IopIoPriorityNotSet', 1: 'IopIoPriorityVeryLow', 2: 'IopIoPriorityLow', 3: 'IopIoPriorityNormal', 4: 'IopIoPriorityHigh', 5: 'IopIoPriorityCritical', 6: 'MaxIopIoPriorityTypes'})]], +} ], + '_OPEN_PACKET' : [ 0xb8, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FinalStatus' : [ 0x10, ['long']], + 'Information' : [ 0x18, ['unsigned long long']], + 'ParseCheck' : [ 0x20, ['unsigned long']], + 'RelatedFileObject' : [ 0x28, ['pointer64', ['_FILE_OBJECT']]], + 'ReferencedDeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'OriginalAttributes' : [ 0x30, ['pointer64', ['_OBJECT_ATTRIBUTES']]], + 'AllocationSize' : [ 0x38, ['_LARGE_INTEGER']], + 'CreateOptions' : [ 0x40, ['unsigned long']], + 'FileAttributes' : [ 0x44, ['unsigned short']], + 'ShareAccess' : [ 0x46, ['unsigned short']], + 'EaBuffer' : [ 0x48, ['pointer64', ['void']]], + 'EaLength' : [ 0x50, ['unsigned long']], + 'Options' : [ 0x54, ['unsigned long']], + 'Disposition' : [ 0x58, ['unsigned long']], + 'BasicInformation' : [ 0x60, ['pointer64', ['_FILE_BASIC_INFORMATION']]], + 'NetworkInformation' : [ 0x68, ['pointer64', ['_FILE_NETWORK_OPEN_INFORMATION']]], + 'CreateFileType' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'CreateFileTypeNone', 1: 'CreateFileTypeNamedPipe', 2: 'CreateFileTypeMailslot'})]], + 'MailslotOrPipeParameters' : [ 0x78, ['pointer64', ['void']]], + 'Override' : [ 0x80, ['unsigned char']], + 'QueryOnly' : [ 0x81, ['unsigned char']], + 'DeleteOnly' : [ 0x82, ['unsigned char']], + 'FullAttributes' : [ 0x83, ['unsigned char']], + 'LocalFileObject' : [ 0x88, ['pointer64', ['_DUMMY_FILE_OBJECT']]], + 'InternalFlags' : [ 0x90, ['unsigned long']], + 'AccessMode' : [ 0x94, ['unsigned char']], + 'DriverCreateContext' : [ 0x98, ['_IO_DRIVER_CREATE_CONTEXT']], +} ], + '_ETW_SYSTEMTIME' : [ 0x10, { + 'Year' : [ 0x0, ['unsigned short']], + 'Month' : [ 0x2, ['unsigned short']], + 'DayOfWeek' : [ 0x4, ['unsigned short']], + 'Day' : [ 0x6, ['unsigned short']], + 'Hour' : [ 0x8, ['unsigned short']], + 'Minute' : [ 0xa, ['unsigned short']], + 'Second' : [ 0xc, ['unsigned short']], + 'Milliseconds' : [ 0xe, ['unsigned short']], +} ], + '_TIME_FIELDS' : [ 0x10, { + 'Year' : [ 0x0, ['short']], + 'Month' : [ 0x2, ['short']], + 'Day' : [ 0x4, ['short']], + 'Hour' : [ 0x6, ['short']], + 'Minute' : [ 0x8, ['short']], + 'Second' : [ 0xa, ['short']], + 'Milliseconds' : [ 0xc, ['short']], + 'Weekday' : [ 0xe, ['short']], +} ], + '__unnamed_1bf6' : [ 0x4, { + 'MajorVersion' : [ 0x0, ['unsigned char']], + 'MinorVersion' : [ 0x1, ['unsigned char']], + 'SubVersion' : [ 0x2, ['unsigned char']], + 'SubMinorVersion' : [ 0x3, ['unsigned char']], +} ], + '_TRACE_LOGFILE_HEADER' : [ 0x118, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'VersionDetail' : [ 0x4, ['__unnamed_1bf6']], + 'ProviderVersion' : [ 0x8, ['unsigned long']], + 'NumberOfProcessors' : [ 0xc, ['unsigned long']], + 'EndTime' : [ 0x10, ['_LARGE_INTEGER']], + 'TimerResolution' : [ 0x18, ['unsigned long']], + 'MaximumFileSize' : [ 0x1c, ['unsigned long']], + 'LogFileMode' : [ 0x20, ['unsigned long']], + 'BuffersWritten' : [ 0x24, ['unsigned long']], + 'LogInstanceGuid' : [ 0x28, ['_GUID']], + 'StartBuffers' : [ 0x28, ['unsigned long']], + 'PointerSize' : [ 0x2c, ['unsigned long']], + 'EventsLost' : [ 0x30, ['unsigned long']], + 'CpuSpeedInMHz' : [ 0x34, ['unsigned long']], + 'LoggerName' : [ 0x38, ['pointer64', ['unsigned short']]], + 'LogFileName' : [ 0x40, ['pointer64', ['unsigned short']]], + 'TimeZone' : [ 0x48, ['_RTL_TIME_ZONE_INFORMATION']], + 'BootTime' : [ 0xf8, ['_LARGE_INTEGER']], + 'PerfFreq' : [ 0x100, ['_LARGE_INTEGER']], + 'StartTime' : [ 0x108, ['_LARGE_INTEGER']], + 'ReservedFlags' : [ 0x110, ['unsigned long']], + 'BuffersLost' : [ 0x114, ['unsigned long']], +} ], + '_TlgProvider_t' : [ 0x40, { + 'LevelPlus1' : [ 0x0, ['unsigned long']], + 'ProviderMetadataPtr' : [ 0x8, ['pointer64', ['unsigned short']]], + 'KeywordAny' : [ 0x10, ['unsigned long long']], + 'KeywordAll' : [ 0x18, ['unsigned long long']], + 'RegHandle' : [ 0x20, ['unsigned long long']], + 'EnableCallback' : [ 0x28, ['pointer64', ['void']]], + 'CallbackContext' : [ 0x30, ['pointer64', ['void']]], + 'AnnotationFunc' : [ 0x38, ['pointer64', ['void']]], +} ], + '_TlgProviderMetadata_t' : [ 0x13, { + 'Type' : [ 0x0, ['unsigned char']], + 'ProviderId' : [ 0x1, ['_GUID']], + 'RemainingSize' : [ 0x11, ['unsigned short']], +} ], + '_WMI_LOGGER_CONTEXT' : [ 0x390, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'BufferSize' : [ 0x4, ['unsigned long']], + 'MaximumEventSize' : [ 0x8, ['unsigned long']], + 'LoggerMode' : [ 0xc, ['unsigned long']], + 'AcceptNewEvents' : [ 0x10, ['long']], + 'EventMarker' : [ 0x14, ['array', 2, ['unsigned long']]], + 'ErrorMarker' : [ 0x1c, ['unsigned long']], + 'SizeMask' : [ 0x20, ['unsigned long']], + 'GetCpuClock' : [ 0x28, ['pointer64', ['void']]], + 'LoggerThread' : [ 0x30, ['pointer64', ['_ETHREAD']]], + 'LoggerStatus' : [ 0x38, ['long']], + 'FailureReason' : [ 0x3c, ['unsigned long']], + 'BufferQueue' : [ 0x40, ['_ETW_BUFFER_QUEUE']], + 'OverflowQueue' : [ 0x58, ['_ETW_BUFFER_QUEUE']], + 'GlobalList' : [ 0x70, ['_LIST_ENTRY']], + 'ProviderBinaryList' : [ 0x80, ['_LIST_ENTRY']], + 'BatchedBufferList' : [ 0x90, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'CurrentBuffer' : [ 0x90, ['_EX_FAST_REF']], + 'LoggerName' : [ 0x98, ['_UNICODE_STRING']], + 'LogFileName' : [ 0xa8, ['_UNICODE_STRING']], + 'LogFilePattern' : [ 0xb8, ['_UNICODE_STRING']], + 'NewLogFileName' : [ 0xc8, ['_UNICODE_STRING']], + 'ClockType' : [ 0xd8, ['unsigned long']], + 'LastFlushedBuffer' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'FlushThreshold' : [ 0xe4, ['unsigned long']], + 'ByteOffset' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumBuffers' : [ 0xf0, ['unsigned long']], + 'BuffersAvailable' : [ 0xf4, ['long']], + 'NumberOfBuffers' : [ 0xf8, ['long']], + 'MaximumBuffers' : [ 0xfc, ['unsigned long']], + 'EventsLost' : [ 0x100, ['unsigned long']], + 'PeakBuffersCount' : [ 0x104, ['long']], + 'BuffersWritten' : [ 0x108, ['unsigned long']], + 'LogBuffersLost' : [ 0x10c, ['unsigned long']], + 'RealTimeBuffersDelivered' : [ 0x110, ['unsigned long']], + 'RealTimeBuffersLost' : [ 0x114, ['unsigned long']], + 'SequencePtr' : [ 0x118, ['pointer64', ['long']]], + 'LocalSequence' : [ 0x120, ['unsigned long']], + 'InstanceGuid' : [ 0x124, ['_GUID']], + 'MaximumFileSize' : [ 0x134, ['unsigned long']], + 'FileCounter' : [ 0x138, ['long']], + 'PoolType' : [ 0x13c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'ReferenceTime' : [ 0x140, ['_ETW_REF_CLOCK']], + 'CollectionOn' : [ 0x150, ['long']], + 'ProviderInfoSize' : [ 0x154, ['unsigned long']], + 'Consumers' : [ 0x158, ['_LIST_ENTRY']], + 'NumConsumers' : [ 0x168, ['unsigned long']], + 'TransitionConsumer' : [ 0x170, ['pointer64', ['_ETW_REALTIME_CONSUMER']]], + 'RealtimeLogfileHandle' : [ 0x178, ['pointer64', ['void']]], + 'RealtimeLogfileName' : [ 0x180, ['_UNICODE_STRING']], + 'RealtimeWriteOffset' : [ 0x190, ['_LARGE_INTEGER']], + 'RealtimeReadOffset' : [ 0x198, ['_LARGE_INTEGER']], + 'RealtimeLogfileSize' : [ 0x1a0, ['_LARGE_INTEGER']], + 'RealtimeLogfileUsage' : [ 0x1a8, ['unsigned long long']], + 'RealtimeMaximumFileSize' : [ 0x1b0, ['unsigned long long']], + 'RealtimeBuffersSaved' : [ 0x1b8, ['unsigned long']], + 'RealtimeReferenceTime' : [ 0x1c0, ['_ETW_REF_CLOCK']], + 'NewRTEventsLost' : [ 0x1d0, ['Enumeration', dict(target = 'long', choices = {0: 'EtwRtEventNoLoss', 1: 'EtwRtEventLost', 2: 'EtwRtBufferLost', 3: 'EtwRtBackupLost', 4: 'EtwRtEventLossMax'})]], + 'LoggerEvent' : [ 0x1d8, ['_KEVENT']], + 'FlushEvent' : [ 0x1f0, ['_KEVENT']], + 'FlushTimeOutTimer' : [ 0x208, ['_KTIMER']], + 'LoggerDpc' : [ 0x248, ['_KDPC']], + 'LoggerMutex' : [ 0x288, ['_KMUTANT']], + 'LoggerLock' : [ 0x2c0, ['_EX_PUSH_LOCK']], + 'BufferListSpinLock' : [ 0x2c8, ['unsigned long long']], + 'BufferListPushLock' : [ 0x2c8, ['_EX_PUSH_LOCK']], + 'ClientSecurityContext' : [ 0x2d0, ['_SECURITY_CLIENT_CONTEXT']], + 'TokenAccessInformation' : [ 0x318, ['pointer64', ['_TOKEN_ACCESS_INFORMATION']]], + 'SecurityDescriptor' : [ 0x320, ['_EX_FAST_REF']], + 'StartTime' : [ 0x328, ['_LARGE_INTEGER']], + 'LogFileHandle' : [ 0x330, ['pointer64', ['void']]], + 'BufferSequenceNumber' : [ 0x338, ['long long']], + 'Flags' : [ 0x340, ['unsigned long']], + 'Persistent' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x340, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x340, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x340, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x340, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x340, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PebsTracing' : [ 0x340, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PmcCounters' : [ 0x340, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageAlignBuffers' : [ 0x340, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SpareFlags1' : [ 0x340, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'SystemLoggerIndex' : [ 0x340, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'StackCaching' : [ 0x340, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareFlags2' : [ 0x340, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'RequestFlag' : [ 0x344, ['unsigned long']], + 'DbgRequestNewFie' : [ 0x344, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgRequestUpdateFile' : [ 0x344, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgRequestFlush' : [ 0x344, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgRequestDisableRealtime' : [ 0x344, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgRequestDisconnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgRequestConnectConsumer' : [ 0x344, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgRequestNotifyConsumer' : [ 0x344, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DbgRequestUpdateHeader' : [ 0x344, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'DbgRequestDefferdFlush' : [ 0x344, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DbgRequestDefferdFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DbgRequestFlushTimer' : [ 0x344, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DbgRequestUpdateDebugger' : [ 0x344, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DbgSpareRequestFlags' : [ 0x344, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], + 'HookIdMap' : [ 0x348, ['_RTL_BITMAP']], + 'StackCache' : [ 0x358, ['pointer64', ['_ETW_STACK_CACHE']]], + 'PmcData' : [ 0x360, ['pointer64', ['_ETW_PMC_SUPPORT']]], + 'WinRtProviderBinaryList' : [ 0x368, ['_LIST_ENTRY']], + 'ScratchArray' : [ 0x378, ['pointer64', ['pointer64', ['_WMI_BUFFER_HEADER']]]], + 'DisallowedGuids' : [ 0x380, ['_DISALLOWED_GUIDS']], +} ], + '_ETW_PMC_SUPPORT' : [ 0x28, { + 'Source' : [ 0x0, ['array', -16, ['Enumeration', dict(target = 'long', choices = {0: 'ProfileTime', 1: 'ProfileAlignmentFixup', 2: 'ProfileTotalIssues', 3: 'ProfilePipelineDry', 4: 'ProfileLoadInstructions', 5: 'ProfilePipelineFrozen', 6: 'ProfileBranchInstructions', 7: 'ProfileTotalNonissues', 8: 'ProfileDcacheMisses', 9: 'ProfileIcacheMisses', 10: 'ProfileCacheMisses', 11: 'ProfileBranchMispredictions', 12: 'ProfileStoreInstructions', 13: 'ProfileFpInstructions', 14: 'ProfileIntegerInstructions', 15: 'Profile2Issue', 16: 'Profile3Issue', 17: 'Profile4Issue', 18: 'ProfileSpecialInstructions', 19: 'ProfileTotalCycles', 20: 'ProfileIcacheIssues', 21: 'ProfileDcacheAccesses', 22: 'ProfileMemoryBarrierCycles', 23: 'ProfileLoadLinkedIssues', 24: 'ProfileMaximum'})]]], + 'HookIdCount' : [ 0x10, ['unsigned long']], + 'HookId' : [ 0x14, ['array', 4, ['unsigned short']]], + 'CountersCount' : [ 0x1c, ['unsigned long']], + 'ProcessorCtrs' : [ 0x20, ['array', 1, ['pointer64', ['_HAL_PMC_COUNTERS']]]], +} ], + '_ETW_LOGGER_HANDLE' : [ 0x1, { + 'DereferenceAndLeave' : [ 0x0, ['unsigned char']], +} ], + '_LUID_AND_ATTRIBUTES' : [ 0xc, { + 'Luid' : [ 0x0, ['_LUID']], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_TOKEN' : [ 0x478, { + 'TokenSource' : [ 0x0, ['_TOKEN_SOURCE']], + 'TokenId' : [ 0x10, ['_LUID']], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'ParentTokenId' : [ 0x20, ['_LUID']], + 'ExpirationTime' : [ 0x28, ['_LARGE_INTEGER']], + 'TokenLock' : [ 0x30, ['pointer64', ['_ERESOURCE']]], + 'ModifiedId' : [ 0x38, ['_LUID']], + 'Privileges' : [ 0x40, ['_SEP_TOKEN_PRIVILEGES']], + 'AuditPolicy' : [ 0x58, ['_SEP_AUDIT_POLICY']], + 'SessionId' : [ 0x78, ['unsigned long']], + 'UserAndGroupCount' : [ 0x7c, ['unsigned long']], + 'RestrictedSidCount' : [ 0x80, ['unsigned long']], + 'VariableLength' : [ 0x84, ['unsigned long']], + 'DynamicCharged' : [ 0x88, ['unsigned long']], + 'DynamicAvailable' : [ 0x8c, ['unsigned long']], + 'DefaultOwnerIndex' : [ 0x90, ['unsigned long']], + 'UserAndGroups' : [ 0x98, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedSids' : [ 0xa0, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'PrimaryGroup' : [ 0xa8, ['pointer64', ['void']]], + 'DynamicPart' : [ 0xb0, ['pointer64', ['unsigned long']]], + 'DefaultDacl' : [ 0xb8, ['pointer64', ['_ACL']]], + 'TokenType' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0xc4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'TokenFlags' : [ 0xc8, ['unsigned long']], + 'TokenInUse' : [ 0xcc, ['unsigned char']], + 'IntegrityLevelIndex' : [ 0xd0, ['unsigned long']], + 'MandatoryPolicy' : [ 0xd4, ['unsigned long']], + 'LogonSession' : [ 0xd8, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'OriginatingLogonSession' : [ 0xe0, ['_LUID']], + 'SidHash' : [ 0xe8, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedSidHash' : [ 0x1f8, ['_SID_AND_ATTRIBUTES_HASH']], + 'pSecurityAttributes' : [ 0x308, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'Package' : [ 0x310, ['pointer64', ['void']]], + 'Capabilities' : [ 0x318, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'CapabilityCount' : [ 0x320, ['unsigned long']], + 'CapabilitiesHash' : [ 0x328, ['_SID_AND_ATTRIBUTES_HASH']], + 'LowboxNumberEntry' : [ 0x438, ['pointer64', ['_SEP_LOWBOX_NUMBER_ENTRY']]], + 'LowboxHandlesEntry' : [ 0x440, ['pointer64', ['_SEP_LOWBOX_HANDLES_ENTRY']]], + 'pClaimAttributes' : [ 0x448, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'TrustLevelSid' : [ 0x450, ['pointer64', ['void']]], + 'TrustLinkedToken' : [ 0x458, ['pointer64', ['_TOKEN']]], + 'IntegrityLevelSidValue' : [ 0x460, ['pointer64', ['void']]], + 'TokenSidValues' : [ 0x468, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], + 'VariablePart' : [ 0x470, ['unsigned long long']], +} ], + '_SEP_LOGON_SESSION_REFERENCES' : [ 0x80, { + 'Next' : [ 0x0, ['pointer64', ['_SEP_LOGON_SESSION_REFERENCES']]], + 'LogonId' : [ 0x8, ['_LUID']], + 'BuddyLogonId' : [ 0x10, ['_LUID']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'Flags' : [ 0x20, ['unsigned long']], + 'pDeviceMap' : [ 0x28, ['pointer64', ['_DEVICE_MAP']]], + 'Token' : [ 0x30, ['pointer64', ['void']]], + 'AccountName' : [ 0x38, ['_UNICODE_STRING']], + 'AuthorityName' : [ 0x48, ['_UNICODE_STRING']], + 'LowBoxHandlesTable' : [ 0x58, ['_SEP_LOWBOX_HANDLES_TABLE']], + 'SharedDataLock' : [ 0x68, ['_EX_PUSH_LOCK']], + 'SharedClaimAttributes' : [ 0x70, ['pointer64', ['_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION']]], + 'SharedSidValues' : [ 0x78, ['pointer64', ['_SEP_SID_VALUES_BLOCK']]], +} ], + '_PS_PROTECTION' : [ 0x1, { + 'Level' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Audit' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Signer' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_OBJECT_HEADER' : [ 0x38, { + 'PointerCount' : [ 0x0, ['long long']], + 'HandleCount' : [ 0x8, ['long long']], + 'NextToFree' : [ 0x8, ['pointer64', ['void']]], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], + 'TypeIndex' : [ 0x18, ['unsigned char']], + 'TraceFlags' : [ 0x19, ['unsigned char']], + 'DbgRefTrace' : [ 0x19, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgTracePermanent' : [ 0x19, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'InfoMask' : [ 0x1a, ['unsigned char']], + 'Flags' : [ 0x1b, ['unsigned char']], + 'NewObject' : [ 0x1b, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'KernelObject' : [ 0x1b, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelOnlyAccess' : [ 0x1b, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ExclusiveObject' : [ 0x1b, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PermanentObject' : [ 0x1b, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DefaultSecurityQuota' : [ 0x1b, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SingleHandleEntry' : [ 0x1b, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DeletedInline' : [ 0x1b, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare' : [ 0x1c, ['unsigned long']], + 'ObjectCreateInfo' : [ 0x20, ['pointer64', ['_OBJECT_CREATE_INFORMATION']]], + 'QuotaBlockCharged' : [ 0x20, ['pointer64', ['void']]], + 'SecurityDescriptor' : [ 0x28, ['pointer64', ['void']]], + 'Body' : [ 0x30, ['_QUAD']], +} ], + '_OBJECT_HEADER_QUOTA_INFO' : [ 0x20, { + 'PagedPoolCharge' : [ 0x0, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x4, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x8, ['unsigned long']], + 'SecurityDescriptorQuotaBlock' : [ 0x10, ['pointer64', ['void']]], + 'Reserved' : [ 0x18, ['unsigned long long']], +} ], + '_OBJECT_HEADER_PROCESS_INFO' : [ 0x10, { + 'ExclusiveProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBJECT_HEADER_HANDLE_INFO' : [ 0x10, { + 'HandleCountDataBase' : [ 0x0, ['pointer64', ['_OBJECT_HANDLE_COUNT_DATABASE']]], + 'SingleEntry' : [ 0x0, ['_OBJECT_HANDLE_COUNT_ENTRY']], +} ], + '_OBJECT_HEADER_NAME_INFO' : [ 0x20, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Name' : [ 0x8, ['_UNICODE_STRING']], + 'ReferenceCount' : [ 0x18, ['long']], +} ], + '_OBJECT_HEADER_CREATOR_INFO' : [ 0x20, { + 'TypeList' : [ 0x0, ['_LIST_ENTRY']], + 'CreatorUniqueProcess' : [ 0x10, ['pointer64', ['void']]], + 'CreatorBackTraceIndex' : [ 0x18, ['unsigned short']], + 'Reserved' : [ 0x1a, ['unsigned short']], +} ], + '_OBJECT_HEADER_AUDIT_INFO' : [ 0x10, { + 'SecurityDescriptor' : [ 0x0, ['pointer64', ['void']]], + 'Reserved' : [ 0x8, ['unsigned long long']], +} ], + '_OBP_LOOKUP_CONTEXT' : [ 0x28, { + 'Directory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'EntryLink' : [ 0x10, ['pointer64', ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'HashValue' : [ 0x18, ['unsigned long']], + 'HashIndex' : [ 0x1c, ['unsigned short']], + 'DirectoryLocked' : [ 0x1e, ['unsigned char']], + 'LockedExclusive' : [ 0x1f, ['unsigned char']], + 'LockStateSignature' : [ 0x20, ['unsigned long']], +} ], + '_OBJECT_DIRECTORY' : [ 0x150, { + 'HashBuckets' : [ 0x0, ['array', 37, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]]], + 'Lock' : [ 0x128, ['_EX_PUSH_LOCK']], + 'DeviceMap' : [ 0x130, ['pointer64', ['_DEVICE_MAP']]], + 'ShadowDirectory' : [ 0x130, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'SessionId' : [ 0x138, ['unsigned long']], + 'NamespaceEntry' : [ 0x140, ['pointer64', ['void']]], + 'Flags' : [ 0x148, ['unsigned long']], +} ], + '_WHEAP_INFO_BLOCK' : [ 0x18, { + 'ErrorSourceCount' : [ 0x0, ['unsigned long']], + 'ErrorSourceTable' : [ 0x8, ['pointer64', ['_WHEAP_ERROR_SOURCE_TABLE']]], + 'WorkQueue' : [ 0x10, ['pointer64', ['_WHEAP_WORK_QUEUE']]], +} ], + '_WHEAP_ERROR_SOURCE' : [ 0x428, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FailedAllocations' : [ 0x10, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x14, ['unsigned long']], + 'ErrorCount' : [ 0x18, ['long']], + 'RecordCount' : [ 0x1c, ['unsigned long']], + 'RecordLength' : [ 0x20, ['unsigned long']], + 'PoolTag' : [ 0x24, ['unsigned long']], + 'Type' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'Records' : [ 0x30, ['pointer64', ['_WHEAP_ERROR_RECORD_WRAPPER']]], + 'Context' : [ 0x38, ['pointer64', ['void']]], + 'SectionCount' : [ 0x40, ['unsigned long']], + 'SectionLength' : [ 0x44, ['unsigned long']], + 'TickCountAtLastError' : [ 0x48, ['_LARGE_INTEGER']], + 'AccumulatedErrors' : [ 0x50, ['unsigned long']], + 'TotalErrors' : [ 0x54, ['unsigned long']], + 'Deferred' : [ 0x58, ['unsigned char']], + 'Descriptor' : [ 0x59, ['_WHEA_ERROR_SOURCE_DESCRIPTOR']], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER' : [ 0xf0, { + 'WorkEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Length' : [ 0x10, ['unsigned long']], + 'ProcessorNumber' : [ 0x14, ['unsigned long']], + 'Flags' : [ 0x18, ['_WHEAP_ERROR_RECORD_WRAPPER_FLAGS']], + 'InUse' : [ 0x1c, ['long']], + 'ErrorSource' : [ 0x20, ['pointer64', ['_WHEAP_ERROR_SOURCE']]], + 'ErrorRecord' : [ 0x28, ['_WHEA_ERROR_RECORD']], +} ], + '_KSECONDARY_IDT_ENTRY' : [ 0x30, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'ConnectLock' : [ 0x8, ['_KEVENT']], + 'LineMasked' : [ 0x20, ['unsigned char']], + 'InterruptList' : [ 0x28, ['pointer64', ['_KINTERRUPT']]], +} ], + '_WNF_STATE_NAME' : [ 0x8, { + 'Data' : [ 0x0, ['array', 2, ['unsigned long']]], +} ], + '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { + 'ImpersonationData' : [ 0x0, ['unsigned long long']], + 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + 'ArmControlSet' : [ 0x0, ['_ARM_DBGKD_CONTROL_SET']], + 'ArmCeControlSet' : [ 0x0, ['_ARMCE_DBGKD_CONTROL_SET']], + 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], +} ], + '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { + 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], +} ], + '_POP_FX_PLUGIN' : [ 0xb0, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Version' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x18, ['unsigned long long']], + 'WorkQueue' : [ 0x20, ['_KQUEUE']], + 'AcceptDeviceNotification' : [ 0x60, ['pointer64', ['void']]], + 'AcceptProcessorNotification' : [ 0x68, ['pointer64', ['void']]], + 'WorkOrderCount' : [ 0x70, ['unsigned long']], + 'WorkOrders' : [ 0x78, ['array', 1, ['_POP_FX_WORK_ORDER']]], +} ], + '_ARM_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_LPCP_MESSAGE' : [ 0x50, { + 'Entry' : [ 0x0, ['_LIST_ENTRY']], + 'FreeEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Reserved0' : [ 0x8, ['unsigned long']], + 'SenderPort' : [ 0x10, ['pointer64', ['void']]], + 'RepliedToThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'PortContext' : [ 0x20, ['pointer64', ['void']]], + 'Request' : [ 0x28, ['_PORT_MESSAGE']], +} ], + '_HARDWARE_PTE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_ALPC_PORT_ATTRIBUTES' : [ 0x48, { + 'Flags' : [ 0x0, ['unsigned long']], + 'SecurityQos' : [ 0x4, ['_SECURITY_QUALITY_OF_SERVICE']], + 'MaxMessageLength' : [ 0x10, ['unsigned long long']], + 'MemoryBandwidth' : [ 0x18, ['unsigned long long']], + 'MaxPoolUsage' : [ 0x20, ['unsigned long long']], + 'MaxSectionSize' : [ 0x28, ['unsigned long long']], + 'MaxViewSize' : [ 0x30, ['unsigned long long']], + 'MaxTotalSectionSize' : [ 0x38, ['unsigned long long']], + 'DupObjectTypes' : [ 0x40, ['unsigned long']], + 'Reserved' : [ 0x44, ['unsigned long']], +} ], + '_KSTACK_COUNT' : [ 0x4, { + 'Value' : [ 0x0, ['long']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], +} ], + '_KENTROPY_TIMING_STATE' : [ 0x150, { + 'EntropyCount' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['array', 64, ['unsigned long']]], + 'Dpc' : [ 0x108, ['_KDPC']], + 'LastDeliveredBuffer' : [ 0x148, ['unsigned long']], +} ], + '_DISPATCHER_HEADER' : [ 0x18, { + 'Lock' : [ 0x0, ['long']], + 'LockNV' : [ 0x0, ['long']], + 'Type' : [ 0x0, ['unsigned char']], + 'Signalling' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'Reserved1' : [ 0x3, ['unsigned char']], + 'TimerType' : [ 0x0, ['unsigned char']], + 'TimerControlFlags' : [ 0x1, ['unsigned char']], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Wake' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'Hand' : [ 0x2, ['unsigned char']], + 'TimerMiscFlags' : [ 0x3, ['unsigned char']], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Timer2Type' : [ 0x0, ['unsigned char']], + 'Timer2Flags' : [ 0x1, ['unsigned char']], + 'Timer2Inserted' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Timer2Expiring' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Timer2CancelPending' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Timer2SetPending' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Timer2Running' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Timer2Disabled' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Timer2ReservedFlags' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Timer2Reserved1' : [ 0x2, ['unsigned char']], + 'Timer2Reserved2' : [ 0x3, ['unsigned char']], + 'QueueType' : [ 0x0, ['unsigned char']], + 'QueueControlFlags' : [ 0x1, ['unsigned char']], + 'Abandoned' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DisableIncrement' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'QueueReservedControlFlags' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'QueueSize' : [ 0x2, ['unsigned char']], + 'QueueReserved' : [ 0x3, ['unsigned char']], + 'ThreadType' : [ 0x0, ['unsigned char']], + 'ThreadReserved' : [ 0x1, ['unsigned char']], + 'ThreadControlFlags' : [ 0x2, ['unsigned char']], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupScheduling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'AffinitySet' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ThreadReservedControlFlags' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'DebugActive' : [ 0x3, ['unsigned char']], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Minimal' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved4' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MutantType' : [ 0x0, ['unsigned char']], + 'MutantSize' : [ 0x1, ['unsigned char']], + 'DpcActive' : [ 0x2, ['unsigned char']], + 'MutantReserved' : [ 0x3, ['unsigned char']], + 'SignalState' : [ 0x4, ['long']], + 'WaitListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_VI_POOL_ENTRY' : [ 0x20, { + 'PageHeader' : [ 0x0, ['_VI_POOL_PAGE_HEADER']], + 'InUse' : [ 0x0, ['_VI_POOL_ENTRY_INUSE']], + 'NextFree' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], +} ], + '_MM_PAGE_ACCESS_INFO' : [ 0x8, { + 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], + 'FileOffset' : [ 0x0, ['unsigned long long']], + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'PointerProtoPte' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MI_CONTROL_AREA_WAIT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_CONTROL_AREA_WAIT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'WaitResponse' : [ 0xc, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], +} ], + '_TraceLoggingMetadata_t' : [ 0x10, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned short']], + 'Version' : [ 0x6, ['unsigned char']], + 'Flags' : [ 0x7, ['unsigned char']], + 'Magic' : [ 0x8, ['unsigned long long']], +} ], + '_HEAP_COUNTERS' : [ 0x78, { + 'TotalMemoryReserved' : [ 0x0, ['unsigned long long']], + 'TotalMemoryCommitted' : [ 0x8, ['unsigned long long']], + 'TotalMemoryLargeUCR' : [ 0x10, ['unsigned long long']], + 'TotalSizeInVirtualBlocks' : [ 0x18, ['unsigned long long']], + 'TotalSegments' : [ 0x20, ['unsigned long']], + 'TotalUCRs' : [ 0x24, ['unsigned long']], + 'CommittOps' : [ 0x28, ['unsigned long']], + 'DeCommitOps' : [ 0x2c, ['unsigned long']], + 'LockAcquires' : [ 0x30, ['unsigned long']], + 'LockCollisions' : [ 0x34, ['unsigned long']], + 'CommitRate' : [ 0x38, ['unsigned long']], + 'DecommittRate' : [ 0x3c, ['unsigned long']], + 'CommitFailures' : [ 0x40, ['unsigned long']], + 'InBlockCommitFailures' : [ 0x44, ['unsigned long']], + 'PollIntervalCounter' : [ 0x48, ['unsigned long']], + 'DecommitsSinceLastCheck' : [ 0x4c, ['unsigned long']], + 'HeapPollInterval' : [ 0x50, ['unsigned long']], + 'AllocAndFreeOps' : [ 0x54, ['unsigned long']], + 'AllocationIndicesActive' : [ 0x58, ['unsigned long']], + 'InBlockDeccommits' : [ 0x5c, ['unsigned long']], + 'InBlockDeccomitSize' : [ 0x60, ['unsigned long long']], + 'HighWatermarkSize' : [ 0x68, ['unsigned long long']], + 'LastPolledSize' : [ 0x70, ['unsigned long long']], +} ], + '_PPM_FFH_THROTTLE_STATE_INFO' : [ 0x20, { + 'EnableLogging' : [ 0x0, ['unsigned char']], + 'MismatchCount' : [ 0x4, ['unsigned long']], + 'Initialized' : [ 0x8, ['unsigned char']], + 'LastValue' : [ 0x10, ['unsigned long long']], + 'LastLogTickCount' : [ 0x18, ['_LARGE_INTEGER']], +} ], + '_SYSPTES_HEADER' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Count' : [ 0x10, ['unsigned long long']], + 'NumberOfEntries' : [ 0x18, ['unsigned long long']], + 'NumberOfEntriesPeak' : [ 0x20, ['unsigned long long']], +} ], + '_EXCEPTION_RECORD' : [ 0x98, { + 'ExceptionCode' : [ 0x0, ['long']], + 'ExceptionFlags' : [ 0x4, ['unsigned long']], + 'ExceptionRecord' : [ 0x8, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ExceptionAddress' : [ 0x10, ['pointer64', ['void']]], + 'NumberParameters' : [ 0x18, ['unsigned long']], + 'ExceptionInformation' : [ 0x20, ['array', 15, ['unsigned long long']]], +} ], + '_MI_ACTIVE_WSLE_LISTHEAD' : [ 0x10, { + 'Flink' : [ 0x0, ['unsigned long long']], + 'Blink' : [ 0x8, ['unsigned long long']], +} ], + '_PPM_IDLE_SYNCHRONIZATION_STATE' : [ 0x4, { + 'AsLong' : [ 0x0, ['long']], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='long')]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_PENDING_RELATIONS_LIST_ENTRY' : [ 0x70, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'WorkItem' : [ 0x10, ['_WORK_QUEUE_ITEM']], + 'DeviceEvent' : [ 0x30, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'DeviceObject' : [ 0x38, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationsList' : [ 0x40, ['pointer64', ['_RELATION_LIST']]], + 'EjectIrp' : [ 0x48, ['pointer64', ['_IRP']]], + 'Lock' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'IRPLOCK_CANCELABLE', 1: 'IRPLOCK_CANCEL_STARTED', 2: 'IRPLOCK_CANCEL_COMPLETE', 3: 'IRPLOCK_COMPLETED'})]], + 'Problem' : [ 0x54, ['unsigned long']], + 'ProfileChangingEject' : [ 0x58, ['unsigned char']], + 'DisplaySafeRemovalDialog' : [ 0x59, ['unsigned char']], + 'LightestSleepState' : [ 0x5c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DockInterface' : [ 0x60, ['pointer64', ['DOCK_INTERFACE']]], + 'DequeuePending' : [ 0x68, ['unsigned char']], + 'DeleteType' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'QueryRemoveDevice', 1: 'CancelRemoveDevice', 2: 'RemoveDevice', 3: 'SurpriseRemoveDevice', 4: 'EjectDevice', 5: 'RemoveFailedDevice', 6: 'RemoveUnstartedFailedDevice', 7: 'MaxDeviceDeleteType'})]], +} ], + '_TOKEN_ACCESS_INFORMATION' : [ 0x50, { + 'SidHash' : [ 0x0, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'RestrictedSidHash' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'Privileges' : [ 0x10, ['pointer64', ['_TOKEN_PRIVILEGES']]], + 'AuthenticationId' : [ 0x18, ['_LUID']], + 'TokenType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {1: 'TokenPrimary', 2: 'TokenImpersonation'})]], + 'ImpersonationLevel' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'MandatoryPolicy' : [ 0x28, ['_TOKEN_MANDATORY_POLICY']], + 'Flags' : [ 0x2c, ['unsigned long']], + 'AppContainerNumber' : [ 0x30, ['unsigned long']], + 'PackageSid' : [ 0x38, ['pointer64', ['void']]], + 'CapabilitiesHash' : [ 0x40, ['pointer64', ['_SID_AND_ATTRIBUTES_HASH']]], + 'TrustLevelSid' : [ 0x48, ['pointer64', ['void']]], +} ], + '_CELL_DATA' : [ 0x50, { + 'u' : [ 0x0, ['_u']], +} ], + '_INITIAL_PRIVILEGE_SET' : [ 0x2c, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 3, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_HEAP_TUNING_PARAMETERS' : [ 0x10, { + 'CommittThresholdShift' : [ 0x0, ['unsigned long']], + 'MaxPreCommittThreshold' : [ 0x8, ['unsigned long long']], +} ], + '_MMWSLE_NONDIRECT_HASH' : [ 0x10, { + 'Key' : [ 0x0, ['pointer64', ['void']]], + 'Index' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_WORK_ORDER' : [ 0x38, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'WorkCount' : [ 0x20, ['long']], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'WatchdogTimerInfo' : [ 0x30, ['pointer64', ['_POP_FX_WORK_ORDER_WATCHDOG_INFO']]], +} ], + '_KAPC' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned char']], + 'SpareByte0' : [ 0x1, ['unsigned char']], + 'Size' : [ 0x2, ['unsigned char']], + 'SpareByte1' : [ 0x3, ['unsigned char']], + 'SpareLong0' : [ 0x4, ['unsigned long']], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'ApcListEntry' : [ 0x10, ['_LIST_ENTRY']], + 'KernelRoutine' : [ 0x20, ['pointer64', ['void']]], + 'RundownRoutine' : [ 0x28, ['pointer64', ['void']]], + 'NormalRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Reserved' : [ 0x20, ['array', 3, ['pointer64', ['void']]]], + 'NormalContext' : [ 0x38, ['pointer64', ['void']]], + 'SystemArgument1' : [ 0x40, ['pointer64', ['void']]], + 'SystemArgument2' : [ 0x48, ['pointer64', ['void']]], + 'ApcStateIndex' : [ 0x50, ['unsigned char']], + 'ApcMode' : [ 0x51, ['unsigned char']], + 'Inserted' : [ 0x52, ['unsigned char']], +} ], + '_KTIMER_EXPIRATION_TRACE' : [ 0x10, { + 'InterruptTime' : [ 0x0, ['unsigned long long']], + 'PerformanceCounter' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { + 'Va' : [ 0x0, ['unsigned long long']], + 'Key' : [ 0x8, ['unsigned long']], + 'PoolType' : [ 0xc, ['unsigned long']], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], +} ], + 'tagSWITCH_CONTEXT_DATA' : [ 0x48, { + 'ullOsMaxVersionTested' : [ 0x0, ['unsigned long long']], + 'ullContextMinimum' : [ 0x8, ['unsigned long long']], + 'guPlatform' : [ 0x10, ['_GUID']], + 'guMinPlatform' : [ 0x20, ['_GUID']], + 'ulContextSource' : [ 0x30, ['unsigned long']], + 'ulElementCount' : [ 0x34, ['unsigned long']], + 'guElements' : [ 0x38, ['array', 1, ['_GUID']]], +} ], + '_WHEAP_ERROR_SOURCE_TABLE' : [ 0x30, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Count' : [ 0x4, ['long']], + 'Items' : [ 0x8, ['_LIST_ENTRY']], + 'InsertLock' : [ 0x18, ['_KEVENT']], +} ], + '_TEB_ACTIVE_FRAME' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned long']], + 'Previous' : [ 0x8, ['pointer64', ['_TEB_ACTIVE_FRAME']]], + 'Context' : [ 0x10, ['pointer64', ['_TEB_ACTIVE_FRAME_CONTEXT']]], +} ], + '_FILE_GET_QUOTA_INFORMATION' : [ 0x14, { + 'NextEntryOffset' : [ 0x0, ['unsigned long']], + 'SidLength' : [ 0x4, ['unsigned long']], + 'Sid' : [ 0x8, ['_SID']], +} ], + '_ACCESS_REASONS' : [ 0x80, { + 'Data' : [ 0x0, ['array', 32, ['unsigned long']]], +} ], + '_CM_KEY_BODY' : [ 0x58, { + 'Type' : [ 0x0, ['unsigned long']], + 'KeyControlBlock' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], + 'ProcessID' : [ 0x18, ['pointer64', ['void']]], + 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], + 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], + 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], +} ], + '_KWAIT_BLOCK' : [ 0x30, { + 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'WaitType' : [ 0x10, ['unsigned char']], + 'BlockState' : [ 0x11, ['unsigned char']], + 'WaitKey' : [ 0x12, ['unsigned short']], + 'SpareLong' : [ 0x14, ['long']], + 'Thread' : [ 0x18, ['pointer64', ['_KTHREAD']]], + 'NotificationQueue' : [ 0x18, ['pointer64', ['_KQUEUE']]], + 'Object' : [ 0x20, ['pointer64', ['void']]], + 'SparePtr' : [ 0x28, ['pointer64', ['void']]], +} ], + '_MMPTE_PROTOTYPE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'DemandFillProto' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'HiberVerifyConverted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Combined' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_THERMAL_INFORMATION_EX' : [ 0x50, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'SamplingPeriod' : [ 0xc, ['unsigned long']], + 'CurrentTemperature' : [ 0x10, ['unsigned long']], + 'PassiveTripPoint' : [ 0x14, ['unsigned long']], + 'CriticalTripPoint' : [ 0x18, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x1c, ['unsigned char']], + 'ActiveTripPoint' : [ 0x20, ['array', 10, ['unsigned long']]], + 'S4TransitionTripPoint' : [ 0x48, ['unsigned long']], + 'MinimumThrottle' : [ 0x4c, ['unsigned long']], +} ], + '__unnamed_1dce' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], +} ], + '__unnamed_1dd0' : [ 0x4, { + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], +} ], + '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { + 'File' : [ 0x0, ['__unnamed_1dce']], + 'Private' : [ 0x0, ['__unnamed_1dd0']], +} ], + '_PPM_CONCURRENCY_ACCOUNTING' : [ 0x28, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Processors' : [ 0x8, ['unsigned long']], + 'ActiveProcessors' : [ 0xc, ['unsigned long']], + 'LastUpdateTime' : [ 0x10, ['unsigned long long']], + 'TotalTime' : [ 0x18, ['unsigned long long']], + 'AccumulatedTime' : [ 0x20, ['array', 1, ['unsigned long long']]], +} ], + '_VI_VERIFIER_ISSUE' : [ 0x20, { + 'IssueType' : [ 0x0, ['unsigned long long']], + 'Address' : [ 0x8, ['pointer64', ['void']]], + 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], +} ], + '_MMSUBSECTION_FLAGS' : [ 0x4, { + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'OnDereferenceList' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], +} ], + '_EXCEPTION_POINTERS' : [ 0x10, { + 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], + 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], +} ], + '_KMUTANT' : [ 0x38, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'MutantListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'OwnerThread' : [ 0x28, ['pointer64', ['_KTHREAD']]], + 'Abandoned' : [ 0x30, ['unsigned char']], + 'ApcDisable' : [ 0x31, ['unsigned char']], +} ], + '_OBJECT_REF_INFO' : [ 0x28, { + 'ObjectHeader' : [ 0x0, ['pointer64', ['_OBJECT_HEADER']]], + 'NextRef' : [ 0x8, ['pointer64', ['void']]], + 'ImageFileName' : [ 0x10, ['array', 16, ['unsigned char']]], + 'NextPos' : [ 0x20, ['unsigned short']], + 'MaxStacks' : [ 0x22, ['unsigned short']], + 'StackInfo' : [ 0x24, ['array', 0, ['_OBJECT_REF_STACK_INFO']]], +} ], + '_HBIN' : [ 0x20, { + 'Signature' : [ 0x0, ['unsigned long']], + 'FileOffset' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['array', 2, ['unsigned long']]], + 'TimeStamp' : [ 0x14, ['_LARGE_INTEGER']], + 'Spare' : [ 0x1c, ['unsigned long']], +} ], + '_MI_IMAGE_SECURITY_REFERENCE' : [ 0x10, { + 'SecurityContext' : [ 0x0, ['_IMAGE_SECURITY_CONTEXT']], + 'DynamicRelocations' : [ 0x8, ['pointer64', ['void']]], +} ], + '_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION' : [ 0x260, { + 'DeviceGroupsCount' : [ 0x0, ['unsigned long']], + 'pDeviceGroups' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'RestrictedDeviceGroupsCount' : [ 0x10, ['unsigned long']], + 'pRestrictedDeviceGroups' : [ 0x18, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'DeviceGroupsHash' : [ 0x20, ['_SID_AND_ATTRIBUTES_HASH']], + 'RestrictedDeviceGroupsHash' : [ 0x130, ['_SID_AND_ATTRIBUTES_HASH']], + 'pUserSecurityAttributes' : [ 0x240, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pDeviceSecurityAttributes' : [ 0x248, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedUserSecurityAttributes' : [ 0x250, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], + 'pRestrictedDeviceSecurityAttributes' : [ 0x258, ['pointer64', ['_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION']]], +} ], + '_HEAP_TAG_ENTRY' : [ 0x48, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], + 'TagIndex' : [ 0x10, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x12, ['unsigned short']], + 'TagName' : [ 0x14, ['array', 24, ['wchar']]], +} ], + '_SECURITY_QUALITY_OF_SERVICE' : [ 0xc, { + 'Length' : [ 0x0, ['unsigned long']], + 'ImpersonationLevel' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'ContextTrackingMode' : [ 0x8, ['unsigned char']], + 'EffectiveOnly' : [ 0x9, ['unsigned char']], +} ], + '_MMWSLE_FREE_ENTRY' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 28, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_NT_TIB' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'StackBase' : [ 0x8, ['pointer64', ['void']]], + 'StackLimit' : [ 0x10, ['pointer64', ['void']]], + 'SubSystemTib' : [ 0x18, ['pointer64', ['void']]], + 'FiberData' : [ 0x20, ['pointer64', ['void']]], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['pointer64', ['void']]], + 'Self' : [ 0x30, ['pointer64', ['_NT_TIB']]], +} ], + '_LEARNING_MODE_DATA' : [ 0x8, { + 'Settings' : [ 0x0, ['unsigned long']], + 'Enabled' : [ 0x4, ['unsigned char']], + 'PermissiveModeEnabled' : [ 0x5, ['unsigned char']], +} ], + '_WHEA_REVISION' : [ 0x2, { + 'MinorRevision' : [ 0x0, ['unsigned char']], + 'MajorRevision' : [ 0x1, ['unsigned char']], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_EJOB' : [ 0x4b0, { + 'Event' : [ 0x0, ['_KEVENT']], + 'JobLinks' : [ 0x18, ['_LIST_ENTRY']], + 'ProcessListHead' : [ 0x28, ['_LIST_ENTRY']], + 'JobLock' : [ 0x38, ['_ERESOURCE']], + 'TotalUserTime' : [ 0xa0, ['_LARGE_INTEGER']], + 'TotalKernelTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'TotalCycleTime' : [ 0xb0, ['_LARGE_INTEGER']], + 'ThisPeriodTotalUserTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'ThisPeriodTotalKernelTime' : [ 0xc0, ['_LARGE_INTEGER']], + 'TotalContextSwitches' : [ 0xc8, ['unsigned long long']], + 'TotalPageFaultCount' : [ 0xd0, ['unsigned long']], + 'TotalProcesses' : [ 0xd4, ['unsigned long']], + 'ActiveProcesses' : [ 0xd8, ['unsigned long']], + 'TotalTerminatedProcesses' : [ 0xdc, ['unsigned long']], + 'PerProcessUserTimeLimit' : [ 0xe0, ['_LARGE_INTEGER']], + 'PerJobUserTimeLimit' : [ 0xe8, ['_LARGE_INTEGER']], + 'MinimumWorkingSetSize' : [ 0xf0, ['unsigned long long']], + 'MaximumWorkingSetSize' : [ 0xf8, ['unsigned long long']], + 'LimitFlags' : [ 0x100, ['unsigned long']], + 'ActiveProcessLimit' : [ 0x104, ['unsigned long']], + 'Affinity' : [ 0x108, ['_KAFFINITY_EX']], + 'AccessState' : [ 0x1b0, ['pointer64', ['_JOB_ACCESS_STATE']]], + 'AccessStateQuotaReference' : [ 0x1b8, ['pointer64', ['void']]], + 'UIRestrictionsClass' : [ 0x1c0, ['unsigned long']], + 'EndOfJobTimeAction' : [ 0x1c4, ['unsigned long']], + 'CompletionPort' : [ 0x1c8, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x1d0, ['pointer64', ['void']]], + 'CompletionCount' : [ 0x1d8, ['unsigned long long']], + 'SessionId' : [ 0x1e0, ['unsigned long']], + 'SchedulingClass' : [ 0x1e4, ['unsigned long']], + 'ReadOperationCount' : [ 0x1e8, ['unsigned long long']], + 'WriteOperationCount' : [ 0x1f0, ['unsigned long long']], + 'OtherOperationCount' : [ 0x1f8, ['unsigned long long']], + 'ReadTransferCount' : [ 0x200, ['unsigned long long']], + 'WriteTransferCount' : [ 0x208, ['unsigned long long']], + 'OtherTransferCount' : [ 0x210, ['unsigned long long']], + 'DiskIoInfo' : [ 0x218, ['_PROCESS_DISK_COUNTERS']], + 'ProcessMemoryLimit' : [ 0x240, ['unsigned long long']], + 'JobMemoryLimit' : [ 0x248, ['unsigned long long']], + 'PeakProcessMemoryUsed' : [ 0x250, ['unsigned long long']], + 'PeakJobMemoryUsed' : [ 0x258, ['unsigned long long']], + 'EffectiveAffinity' : [ 0x260, ['_KAFFINITY_EX']], + 'EffectivePerProcessUserTimeLimit' : [ 0x308, ['_LARGE_INTEGER']], + 'EffectiveMinimumWorkingSetSize' : [ 0x310, ['unsigned long long']], + 'EffectiveMaximumWorkingSetSize' : [ 0x318, ['unsigned long long']], + 'EffectiveProcessMemoryLimit' : [ 0x320, ['unsigned long long']], + 'EffectiveProcessMemoryLimitJob' : [ 0x328, ['pointer64', ['_EJOB']]], + 'EffectivePerProcessUserTimeLimitJob' : [ 0x330, ['pointer64', ['_EJOB']]], + 'EffectiveLimitFlags' : [ 0x338, ['unsigned long']], + 'EffectiveSchedulingClass' : [ 0x33c, ['unsigned long']], + 'EffectiveFreezeCount' : [ 0x340, ['unsigned long']], + 'EffectiveBackgroundCount' : [ 0x344, ['unsigned long']], + 'EffectiveSwapCount' : [ 0x348, ['unsigned long']], + 'EffectiveNotificationLimitCount' : [ 0x34c, ['unsigned long']], + 'EffectivePriorityClass' : [ 0x350, ['unsigned char']], + 'PriorityClass' : [ 0x351, ['unsigned char']], + 'Reserved1' : [ 0x352, ['array', 2, ['unsigned char']]], + 'CompletionFilter' : [ 0x354, ['unsigned long']], + 'WakeChannel' : [ 0x358, ['_WNF_STATE_NAME']], + 'WakeInfo' : [ 0x358, ['_PS_WAKE_INFORMATION']], + 'WakeFilter' : [ 0x390, ['_JOBOBJECT_WAKE_FILTER']], + 'LowEdgeLatchFilter' : [ 0x398, ['unsigned long']], + 'OwnedHighEdgeFilters' : [ 0x39c, ['unsigned long']], + 'NotificationLink' : [ 0x3a0, ['pointer64', ['_EJOB']]], + 'CurrentJobMemoryUsed' : [ 0x3a8, ['unsigned long long']], + 'NotificationInfo' : [ 0x3b0, ['pointer64', ['_JOB_NOTIFICATION_INFORMATION']]], + 'NotificationInfoQuotaReference' : [ 0x3b8, ['pointer64', ['void']]], + 'NotificationPacket' : [ 0x3c0, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'CpuRateControl' : [ 0x3c8, ['pointer64', ['_JOB_CPU_RATE_CONTROL']]], + 'EffectiveSchedulingGroup' : [ 0x3d0, ['pointer64', ['void']]], + 'ReadyTime' : [ 0x3d8, ['unsigned long long']], + 'MemoryLimitsLock' : [ 0x3e0, ['_EX_PUSH_LOCK']], + 'SiblingJobLinks' : [ 0x3e8, ['_LIST_ENTRY']], + 'ChildJobListHead' : [ 0x3f8, ['_LIST_ENTRY']], + 'ParentJob' : [ 0x408, ['pointer64', ['_EJOB']]], + 'RootJob' : [ 0x410, ['pointer64', ['_EJOB']]], + 'IteratorListHead' : [ 0x418, ['_LIST_ENTRY']], + 'AncestorCount' : [ 0x428, ['unsigned long long']], + 'Ancestors' : [ 0x430, ['pointer64', ['pointer64', ['_EJOB']]]], + 'Accounting' : [ 0x438, ['_EPROCESS_VALUES']], + 'ShadowActiveProcessCount' : [ 0x488, ['unsigned long']], + 'SequenceNumber' : [ 0x48c, ['unsigned long']], + 'TimerListLock' : [ 0x490, ['unsigned long long']], + 'TimerListHead' : [ 0x498, ['_LIST_ENTRY']], + 'JobFlags' : [ 0x4a8, ['unsigned long']], + 'CloseDone' : [ 0x4a8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MultiGroup' : [ 0x4a8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OutstandingNotification' : [ 0x4a8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NotificationInProgress' : [ 0x4a8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UILimits' : [ 0x4a8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CpuRateControlActive' : [ 0x4a8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OwnCpuRateControl' : [ 0x4a8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Terminating' : [ 0x4a8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'WorkingSetLock' : [ 0x4a8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'JobFrozen' : [ 0x4a8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Background' : [ 0x4a8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeNotificationAllocated' : [ 0x4a8, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeNotificationEnabled' : [ 0x4a8, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeNotificationPending' : [ 0x4a8, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'LimitNotificationRequired' : [ 0x4a8, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ZeroCountNotificationRequired' : [ 0x4a8, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'CycleTimeNotificationRequired' : [ 0x4a8, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'CycleTimeNotificationPending' : [ 0x4a8, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'TimersVirtualized' : [ 0x4a8, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'JobSwapped' : [ 0x4a8, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ViolationDetected' : [ 0x4a8, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'EmptyJobNotified' : [ 0x4a8, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoSystemCharge' : [ 0x4a8, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DropNoWakeCharges' : [ 0x4a8, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'NoWakeChargePolicyDecided' : [ 0x4a8, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SpareJobFlags' : [ 0x4a8, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], + 'EffectiveHighEdgeFilters' : [ 0x4ac, ['unsigned long']], +} ], + '_PPM_IDLE_STATES' : [ 0x318, { + 'InterfaceVersion' : [ 0x0, ['unsigned char']], + 'ForceIdle' : [ 0x1, ['unsigned char']], + 'EstimateIdleDuration' : [ 0x2, ['unsigned char']], + 'ExitLatencyTraceEnabled' : [ 0x3, ['unsigned char']], + 'NonInterruptibleTransition' : [ 0x4, ['unsigned char']], + 'ExitLatencyCountdown' : [ 0x8, ['unsigned long']], + 'TargetState' : [ 0xc, ['unsigned long']], + 'ActualState' : [ 0x10, ['unsigned long']], + 'OldState' : [ 0x14, ['unsigned long']], + 'OverrideIndex' : [ 0x18, ['unsigned long']], + 'ProcessorIdleCount' : [ 0x1c, ['unsigned long']], + 'Type' : [ 0x20, ['unsigned long']], + 'ReasonFlags' : [ 0x24, ['unsigned short']], + 'InitiateWakeStamp' : [ 0x28, ['unsigned long long']], + 'PreviousStatus' : [ 0x30, ['long']], + 'PreviousCancelReason' : [ 0x34, ['unsigned long']], + 'PrimaryProcessorMask' : [ 0x38, ['_KAFFINITY_EX']], + 'SecondaryProcessorMask' : [ 0xe0, ['_KAFFINITY_EX']], + 'IdlePrepare' : [ 0x188, ['pointer64', ['void']]], + 'IdleExecute' : [ 0x190, ['pointer64', ['void']]], + 'IdlePreselect' : [ 0x198, ['pointer64', ['void']]], + 'IdleTest' : [ 0x1a0, ['pointer64', ['void']]], + 'IdleComplete' : [ 0x1a8, ['pointer64', ['void']]], + 'IdleCancel' : [ 0x1b0, ['pointer64', ['void']]], + 'IdleIsHalted' : [ 0x1b8, ['pointer64', ['void']]], + 'IdleInitiateWake' : [ 0x1c0, ['pointer64', ['void']]], + 'QueryPlatformStateResidency' : [ 0x1c8, ['pointer64', ['void']]], + 'PrepareInfo' : [ 0x1d0, ['_PROCESSOR_IDLE_PREPARE_INFO']], + 'Tracing' : [ 0x238, ['pointer64', ['_PERFINFO_PPM_STATE_SELECTION']]], + 'State' : [ 0x240, ['array', 1, ['_PPM_IDLE_STATE']]], +} ], + '_PEB' : [ 0x388, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['pointer64', ['void']]], + 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], + 'ProcessParameters' : [ 0x20, ['pointer64', ['_RTL_USER_PROCESS_PARAMETERS']]], + 'SubSystemData' : [ 0x28, ['pointer64', ['void']]], + 'ProcessHeap' : [ 0x30, ['pointer64', ['void']]], + 'FastPebLock' : [ 0x38, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], + 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], + 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['pointer64', ['void']]], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['pointer64', ['void']]], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['pointer64', ['void']]], + 'SparePvoid0' : [ 0x90, ['pointer64', ['void']]], + 'ReadOnlyStaticServerData' : [ 0x98, ['pointer64', ['pointer64', ['void']]]], + 'AnsiCodePageData' : [ 0xa0, ['pointer64', ['void']]], + 'OemCodePageData' : [ 0xa8, ['pointer64', ['void']]], + 'UnicodeCaseTableData' : [ 0xb0, ['pointer64', ['void']]], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['pointer64', ['pointer64', ['void']]]], + 'GdiSharedHandleTable' : [ 0xf8, ['pointer64', ['void']]], + 'ProcessStarterHelper' : [ 0x100, ['pointer64', ['void']]], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['pointer64', ['void']]], + 'TlsExpansionBitmap' : [ 0x238, ['pointer64', ['void']]], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['pointer64', ['void']]], + 'AppCompatInfo' : [ 0x2e0, ['pointer64', ['void']]], + 'CSDVersion' : [ 0x2e8, ['_UNICODE_STRING']], + 'ActivationContextData' : [ 0x2f8, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'ProcessAssemblyStorageMap' : [ 0x300, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'SystemDefaultActivationContextData' : [ 0x308, ['pointer64', ['_ACTIVATION_CONTEXT_DATA']]], + 'SystemAssemblyStorageMap' : [ 0x310, ['pointer64', ['_ASSEMBLY_STORAGE_MAP']]], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['pointer64', ['_FLS_CALLBACK_INFO']]], + 'FlsListHead' : [ 0x328, ['_LIST_ENTRY']], + 'FlsBitmap' : [ 0x338, ['pointer64', ['void']]], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['pointer64', ['void']]], + 'WerShipAssertPtr' : [ 0x360, ['pointer64', ['void']]], + 'pUnused' : [ 0x368, ['pointer64', ['void']]], + 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], +} ], + '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SegmentEntry' : [ 0x10, ['_LIST_ENTRY']], + 'Address' : [ 0x20, ['pointer64', ['void']]], + 'Size' : [ 0x28, ['unsigned long long']], +} ], + '_ETW_REALTIME_CONSUMER' : [ 0x98, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'ProcessHandle' : [ 0x10, ['pointer64', ['void']]], + 'ProcessObject' : [ 0x18, ['pointer64', ['_EPROCESS']]], + 'NextNotDelivered' : [ 0x20, ['pointer64', ['void']]], + 'RealtimeConnectContext' : [ 0x28, ['pointer64', ['void']]], + 'DisconnectEvent' : [ 0x30, ['pointer64', ['_KEVENT']]], + 'DataAvailableEvent' : [ 0x38, ['pointer64', ['_KEVENT']]], + 'UserBufferCount' : [ 0x40, ['pointer64', ['unsigned long']]], + 'UserBufferListHead' : [ 0x48, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'BuffersLost' : [ 0x50, ['unsigned long']], + 'EmptyBuffersCount' : [ 0x54, ['unsigned long']], + 'LoggerId' : [ 0x58, ['unsigned short']], + 'Flags' : [ 0x5a, ['unsigned char']], + 'ShutDownRequested' : [ 0x5a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'NewBuffersLost' : [ 0x5a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Disconnected' : [ 0x5a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Notified' : [ 0x5a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Wow' : [ 0x5a, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReservedBufferSpaceBitMap' : [ 0x60, ['_RTL_BITMAP']], + 'ReservedBufferSpace' : [ 0x70, ['pointer64', ['unsigned char']]], + 'ReservedBufferSpaceSize' : [ 0x78, ['unsigned long']], + 'UserPagesAllocated' : [ 0x7c, ['unsigned long']], + 'UserPagesReused' : [ 0x80, ['unsigned long']], + 'EventsLostCount' : [ 0x88, ['pointer64', ['unsigned long']]], + 'BuffersLostCount' : [ 0x90, ['pointer64', ['unsigned long']]], +} ], + '_POOL_DESCRIPTOR' : [ 0x1140, { + 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'PagedLock' : [ 0x8, ['_FAST_MUTEX']], + 'NonPagedLock' : [ 0x8, ['unsigned long long']], + 'RunningAllocs' : [ 0x40, ['long']], + 'RunningDeAllocs' : [ 0x44, ['long']], + 'TotalBigPages' : [ 0x48, ['long']], + 'ThreadsProcessingDeferrals' : [ 0x4c, ['long']], + 'TotalBytes' : [ 0x50, ['unsigned long long']], + 'PoolIndex' : [ 0x80, ['unsigned long']], + 'TotalPages' : [ 0xc0, ['long']], + 'PendingFrees' : [ 0x100, ['_SINGLE_LIST_ENTRY']], + 'PendingFreeDepth' : [ 0x108, ['long']], + 'ListHeads' : [ 0x140, ['array', 256, ['_LIST_ENTRY']]], +} ], + '_TOKEN_MANDATORY_POLICY' : [ 0x4, { + 'Policy' : [ 0x0, ['unsigned long']], +} ], + '_BLOB_COUNTERS' : [ 0x8, { + 'CreatedObjects' : [ 0x0, ['unsigned long']], + 'DeletedObjects' : [ 0x4, ['unsigned long']], +} ], + '_KGATE' : [ 0x18, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], +} ], + '_WHEA_ERROR_RECORD_HEADER' : [ 0x80, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Revision' : [ 0x4, ['_WHEA_REVISION']], + 'SignatureEnd' : [ 0x6, ['unsigned long']], + 'SectionCount' : [ 0xa, ['unsigned short']], + 'Severity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSevRecoverable', 1: 'WheaErrSevFatal', 2: 'WheaErrSevCorrected', 3: 'WheaErrSevInformational'})]], + 'ValidBits' : [ 0x10, ['_WHEA_ERROR_RECORD_HEADER_VALIDBITS']], + 'Length' : [ 0x14, ['unsigned long']], + 'Timestamp' : [ 0x18, ['_WHEA_TIMESTAMP']], + 'PlatformId' : [ 0x20, ['_GUID']], + 'PartitionId' : [ 0x30, ['_GUID']], + 'CreatorId' : [ 0x40, ['_GUID']], + 'NotifyType' : [ 0x50, ['_GUID']], + 'RecordId' : [ 0x60, ['unsigned long long']], + 'Flags' : [ 0x68, ['_WHEA_ERROR_RECORD_HEADER_FLAGS']], + 'PersistenceInfo' : [ 0x6c, ['_WHEA_PERSISTENCE_INFO']], + 'Reserved' : [ 0x74, ['array', 12, ['unsigned char']]], +} ], + '_ALPC_PROCESS_CONTEXT' : [ 0x20, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'ViewListHead' : [ 0x8, ['_LIST_ENTRY']], + 'PagedPoolQuotaCache' : [ 0x18, ['unsigned long long']], +} ], + '_DRIVER_EXTENSION' : [ 0x50, { + 'DriverObject' : [ 0x0, ['pointer64', ['_DRIVER_OBJECT']]], + 'AddDevice' : [ 0x8, ['pointer64', ['void']]], + 'Count' : [ 0x10, ['unsigned long']], + 'ServiceKeyName' : [ 0x18, ['_UNICODE_STRING']], + 'ClientDriverExtension' : [ 0x28, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], + 'KseCallbacks' : [ 0x38, ['pointer64', ['void']]], + 'DvCallbacks' : [ 0x40, ['pointer64', ['void']]], + 'VerifierContext' : [ 0x48, ['pointer64', ['void']]], +} ], + '_PRIVILEGE_SET' : [ 0x14, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Control' : [ 0x4, ['unsigned long']], + 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_WHEAP_WORK_QUEUE' : [ 0x88, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ListLock' : [ 0x10, ['unsigned long long']], + 'ItemCount' : [ 0x18, ['long']], + 'Dpc' : [ 0x20, ['_KDPC']], + 'WorkItem' : [ 0x60, ['_WORK_QUEUE_ITEM']], + 'WorkRoutine' : [ 0x80, ['pointer64', ['void']]], +} ], + '_CM_NOTIFY_BLOCK' : [ 0x58, { + 'HiveList' : [ 0x0, ['_LIST_ENTRY']], + 'PostList' : [ 0x10, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], +} ], + '_KINTERRUPT' : [ 0x100, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'InterruptListEntry' : [ 0x8, ['_LIST_ENTRY']], + 'ServiceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'MessageServiceRoutine' : [ 0x20, ['pointer64', ['void']]], + 'MessageIndex' : [ 0x28, ['unsigned long']], + 'ServiceContext' : [ 0x30, ['pointer64', ['void']]], + 'SpinLock' : [ 0x38, ['unsigned long long']], + 'TickCount' : [ 0x40, ['unsigned long']], + 'ActualLock' : [ 0x48, ['pointer64', ['unsigned long long']]], + 'DispatchAddress' : [ 0x50, ['pointer64', ['void']]], + 'Vector' : [ 0x58, ['unsigned long']], + 'Irql' : [ 0x5c, ['unsigned char']], + 'SynchronizeIrql' : [ 0x5d, ['unsigned char']], + 'FloatingSave' : [ 0x5e, ['unsigned char']], + 'Connected' : [ 0x5f, ['unsigned char']], + 'Number' : [ 0x60, ['unsigned long']], + 'ShareVector' : [ 0x64, ['unsigned char']], + 'EmulateActiveBoth' : [ 0x65, ['unsigned char']], + 'ActiveCount' : [ 0x66, ['unsigned short']], + 'InternalState' : [ 0x68, ['long']], + 'Mode' : [ 0x6c, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'Polarity' : [ 0x70, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'ServiceCount' : [ 0x74, ['unsigned long']], + 'DispatchCount' : [ 0x78, ['unsigned long']], + 'PassiveEvent' : [ 0x80, ['pointer64', ['_KEVENT']]], + 'TrapFrame' : [ 0x88, ['pointer64', ['_KTRAP_FRAME']]], + 'DispatchCode' : [ 0x90, ['array', 4, ['unsigned long']]], + 'DisconnectData' : [ 0xa0, ['pointer64', ['void']]], + 'ServiceThread' : [ 0xa8, ['pointer64', ['_KTHREAD']]], + 'IsrDpcStats' : [ 0xb0, ['_ISRDPCSTATS']], + 'ConnectionData' : [ 0xf0, ['pointer64', ['_INTERRUPT_CONNECTION_DATA']]], + 'Padding' : [ 0xf8, ['array', 8, ['unsigned char']]], +} ], + '_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION' : [ 0x30, { + 'SecurityAttributeCount' : [ 0x0, ['unsigned long']], + 'SecurityAttributesList' : [ 0x8, ['_LIST_ENTRY']], + 'WorkingSecurityAttributeCount' : [ 0x18, ['unsigned long']], + 'WorkingSecurityAttributesList' : [ 0x20, ['_LIST_ENTRY']], +} ], + '_IMAGE_FILE_HEADER' : [ 0x14, { + 'Machine' : [ 0x0, ['unsigned short']], + 'NumberOfSections' : [ 0x2, ['unsigned short']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'PointerToSymbolTable' : [ 0x8, ['unsigned long']], + 'NumberOfSymbols' : [ 0xc, ['unsigned long']], + 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], + 'Characteristics' : [ 0x12, ['unsigned short']], +} ], + '_HIVE_LIST_ENTRY' : [ 0x88, { + 'FileName' : [ 0x0, ['pointer64', ['unsigned short']]], + 'BaseName' : [ 0x8, ['pointer64', ['unsigned short']]], + 'RegRootName' : [ 0x10, ['pointer64', ['unsigned short']]], + 'CmHive' : [ 0x18, ['pointer64', ['_CMHIVE']]], + 'HHiveFlags' : [ 0x20, ['unsigned long']], + 'CmHiveFlags' : [ 0x24, ['unsigned long']], + 'CmKcbCacheSize' : [ 0x28, ['unsigned long']], + 'CmHive2' : [ 0x30, ['pointer64', ['_CMHIVE']]], + 'HiveMounted' : [ 0x38, ['unsigned char']], + 'ThreadFinished' : [ 0x39, ['unsigned char']], + 'ThreadStarted' : [ 0x3a, ['unsigned char']], + 'Allocate' : [ 0x3b, ['unsigned char']], + 'WinPERequired' : [ 0x3c, ['unsigned char']], + 'StartEvent' : [ 0x40, ['_KEVENT']], + 'FinishedEvent' : [ 0x58, ['_KEVENT']], + 'MountLock' : [ 0x70, ['_KEVENT']], +} ], + '_HMAP_DIRECTORY' : [ 0x2000, { + 'Directory' : [ 0x0, ['array', 1024, ['pointer64', ['_HMAP_TABLE']]]], +} ], + '_CONTEXT' : [ 0x4d0, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'P5Home' : [ 0x20, ['unsigned long long']], + 'P6Home' : [ 0x28, ['unsigned long long']], + 'ContextFlags' : [ 0x30, ['unsigned long']], + 'MxCsr' : [ 0x34, ['unsigned long']], + 'SegCs' : [ 0x38, ['unsigned short']], + 'SegDs' : [ 0x3a, ['unsigned short']], + 'SegEs' : [ 0x3c, ['unsigned short']], + 'SegFs' : [ 0x3e, ['unsigned short']], + 'SegGs' : [ 0x40, ['unsigned short']], + 'SegSs' : [ 0x42, ['unsigned short']], + 'EFlags' : [ 0x44, ['unsigned long']], + 'Dr0' : [ 0x48, ['unsigned long long']], + 'Dr1' : [ 0x50, ['unsigned long long']], + 'Dr2' : [ 0x58, ['unsigned long long']], + 'Dr3' : [ 0x60, ['unsigned long long']], + 'Dr6' : [ 0x68, ['unsigned long long']], + 'Dr7' : [ 0x70, ['unsigned long long']], + 'Rax' : [ 0x78, ['unsigned long long']], + 'Rcx' : [ 0x80, ['unsigned long long']], + 'Rdx' : [ 0x88, ['unsigned long long']], + 'Rbx' : [ 0x90, ['unsigned long long']], + 'Rsp' : [ 0x98, ['unsigned long long']], + 'Rbp' : [ 0xa0, ['unsigned long long']], + 'Rsi' : [ 0xa8, ['unsigned long long']], + 'Rdi' : [ 0xb0, ['unsigned long long']], + 'R8' : [ 0xb8, ['unsigned long long']], + 'R9' : [ 0xc0, ['unsigned long long']], + 'R10' : [ 0xc8, ['unsigned long long']], + 'R11' : [ 0xd0, ['unsigned long long']], + 'R12' : [ 0xd8, ['unsigned long long']], + 'R13' : [ 0xe0, ['unsigned long long']], + 'R14' : [ 0xe8, ['unsigned long long']], + 'R15' : [ 0xf0, ['unsigned long long']], + 'Rip' : [ 0xf8, ['unsigned long long']], + 'FltSave' : [ 0x100, ['_XSAVE_FORMAT']], + 'Header' : [ 0x100, ['array', 2, ['_M128A']]], + 'Legacy' : [ 0x120, ['array', 8, ['_M128A']]], + 'Xmm0' : [ 0x1a0, ['_M128A']], + 'Xmm1' : [ 0x1b0, ['_M128A']], + 'Xmm2' : [ 0x1c0, ['_M128A']], + 'Xmm3' : [ 0x1d0, ['_M128A']], + 'Xmm4' : [ 0x1e0, ['_M128A']], + 'Xmm5' : [ 0x1f0, ['_M128A']], + 'Xmm6' : [ 0x200, ['_M128A']], + 'Xmm7' : [ 0x210, ['_M128A']], + 'Xmm8' : [ 0x220, ['_M128A']], + 'Xmm9' : [ 0x230, ['_M128A']], + 'Xmm10' : [ 0x240, ['_M128A']], + 'Xmm11' : [ 0x250, ['_M128A']], + 'Xmm12' : [ 0x260, ['_M128A']], + 'Xmm13' : [ 0x270, ['_M128A']], + 'Xmm14' : [ 0x280, ['_M128A']], + 'Xmm15' : [ 0x290, ['_M128A']], + 'VectorRegister' : [ 0x300, ['array', 26, ['_M128A']]], + 'VectorControl' : [ 0x4a0, ['unsigned long long']], + 'DebugControl' : [ 0x4a8, ['unsigned long long']], + 'LastBranchToRip' : [ 0x4b0, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x4b8, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x4c0, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], +} ], + '_ALPC_HANDLE_TABLE' : [ 0x18, { + 'Handles' : [ 0x0, ['pointer64', ['_ALPC_HANDLE_ENTRY']]], + 'TotalHandles' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned long']], + 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], +} ], + '__unnamed_1ea0' : [ 0x3a4, { + 'XpfMceDescriptor' : [ 0x0, ['_WHEA_XPF_MCE_DESCRIPTOR']], + 'XpfCmcDescriptor' : [ 0x0, ['_WHEA_XPF_CMC_DESCRIPTOR']], + 'XpfNmiDescriptor' : [ 0x0, ['_WHEA_XPF_NMI_DESCRIPTOR']], + 'IpfMcaDescriptor' : [ 0x0, ['_WHEA_IPF_MCA_DESCRIPTOR']], + 'IpfCmcDescriptor' : [ 0x0, ['_WHEA_IPF_CMC_DESCRIPTOR']], + 'IpfCpeDescriptor' : [ 0x0, ['_WHEA_IPF_CPE_DESCRIPTOR']], + 'AerRootportDescriptor' : [ 0x0, ['_WHEA_AER_ROOTPORT_DESCRIPTOR']], + 'AerEndpointDescriptor' : [ 0x0, ['_WHEA_AER_ENDPOINT_DESCRIPTOR']], + 'AerBridgeDescriptor' : [ 0x0, ['_WHEA_AER_BRIDGE_DESCRIPTOR']], + 'GenErrDescriptor' : [ 0x0, ['_WHEA_GENERIC_ERROR_DESCRIPTOR']], +} ], + '_WHEA_ERROR_SOURCE_DESCRIPTOR' : [ 0x3cc, { + 'Length' : [ 0x0, ['unsigned long']], + 'Version' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'WheaErrSrcTypeMCE', 1: 'WheaErrSrcTypeCMC', 2: 'WheaErrSrcTypeCPE', 3: 'WheaErrSrcTypeNMI', 4: 'WheaErrSrcTypePCIe', 5: 'WheaErrSrcTypeGeneric', 6: 'WheaErrSrcTypeINIT', 7: 'WheaErrSrcTypeBOOT', 8: 'WheaErrSrcTypeSCIGeneric', 9: 'WheaErrSrcTypeIPFMCA', 10: 'WheaErrSrcTypeIPFCMC', 11: 'WheaErrSrcTypeIPFCPE', 12: 'WheaErrSrcTypeMax'})]], + 'State' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {1: 'WheaErrSrcStateStopped', 2: 'WheaErrSrcStateStarted'})]], + 'MaxRawDataLength' : [ 0x10, ['unsigned long']], + 'NumRecordsToPreallocate' : [ 0x14, ['unsigned long']], + 'MaxSectionsPerRecord' : [ 0x18, ['unsigned long']], + 'ErrorSourceId' : [ 0x1c, ['unsigned long']], + 'PlatformErrorSourceId' : [ 0x20, ['unsigned long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Info' : [ 0x28, ['__unnamed_1ea0']], +} ], + '_MMPTE_HARDWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], +} ], + '_IO_COMPLETION_CONTEXT' : [ 0x10, { + 'Port' : [ 0x0, ['pointer64', ['void']]], + 'Key' : [ 0x8, ['pointer64', ['void']]], +} ], + '_EX_WORK_QUEUE' : [ 0x2d0, { + 'WorkPriQueue' : [ 0x0, ['_KPRIQUEUE']], + 'Node' : [ 0x2b0, ['pointer64', ['_ENODE']]], + 'WorkItemsProcessed' : [ 0x2b8, ['unsigned long']], + 'WorkItemsProcessedLastPass' : [ 0x2bc, ['unsigned long']], + 'ThreadCount' : [ 0x2c0, ['long']], + 'MinThreads' : [ 0x2c4, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='long')]], + 'TryFailed' : [ 0x2c4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'MaxThreads' : [ 0x2c8, ['long']], + 'QueueIndex' : [ 0x2cc, ['Enumeration', dict(target = 'long', choices = {0: 'ExPoolUntrusted', 1: 'ExPoolTrusted', 8: 'ExPoolMax'})]], +} ], + '_IOV_FORCED_PENDING_TRACE' : [ 0x200, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x10, ['array', 62, ['pointer64', ['void']]]], +} ], + '_IOP_IRP_EXTENSION_STATUS' : [ 0xc, { + 'Flags' : [ 0x0, ['unsigned long']], + 'ActivityId' : [ 0x4, ['unsigned long']], + 'IoTracking' : [ 0x8, ['unsigned long']], +} ], + '_DBGKD_SET_CONTEXT' : [ 0x4, { + 'ContextFlags' : [ 0x0, ['unsigned long']], +} ], + '_VI_POOL_ENTRY_INUSE' : [ 0x20, { + 'VirtualAddress' : [ 0x0, ['pointer64', ['void']]], + 'CallingAddress' : [ 0x8, ['pointer64', ['void']]], + 'NumberOfBytes' : [ 0x10, ['unsigned long long']], + 'Tag' : [ 0x18, ['unsigned long long']], +} ], + '_INTERFACE' : [ 0x20, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], +} ], + '_ACL' : [ 0x8, { + 'AclRevision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'AclSize' : [ 0x2, ['unsigned short']], + 'AceCount' : [ 0x4, ['unsigned short']], + 'Sbz2' : [ 0x6, ['unsigned short']], +} ], + '_LAZY_WRITER' : [ 0x88, { + 'ScanDpc' : [ 0x0, ['_KDPC']], + 'ScanTimer' : [ 0x40, ['_KTIMER']], + 'ScanActive' : [ 0x80, ['unsigned char']], + 'OtherWork' : [ 0x81, ['unsigned char']], + 'PendingTeardownScan' : [ 0x82, ['unsigned char']], + 'PendingPeriodicScan' : [ 0x83, ['unsigned char']], + 'PendingLowMemoryScan' : [ 0x84, ['unsigned char']], + 'PendingPowerScan' : [ 0x85, ['unsigned char']], + 'PendingCoalescingFlushScan' : [ 0x86, ['unsigned char']], +} ], + '_PI_BUS_EXTENSION' : [ 0x70, { + 'Flags' : [ 0x0, ['unsigned long']], + 'NumberCSNs' : [ 0x4, ['unsigned char']], + 'ReadDataPort' : [ 0x8, ['pointer64', ['unsigned char']]], + 'DataPortMapped' : [ 0x10, ['unsigned char']], + 'AddressPort' : [ 0x18, ['pointer64', ['unsigned char']]], + 'AddrPortMapped' : [ 0x20, ['unsigned char']], + 'CommandPort' : [ 0x28, ['pointer64', ['unsigned char']]], + 'CmdPortMapped' : [ 0x30, ['unsigned char']], + 'NextSlotNumber' : [ 0x34, ['unsigned long']], + 'DeviceList' : [ 0x38, ['_SINGLE_LIST_ENTRY']], + 'CardList' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PhysicalBusDevice' : [ 0x48, ['pointer64', ['_DEVICE_OBJECT']]], + 'FunctionalBusDevice' : [ 0x50, ['pointer64', ['_DEVICE_OBJECT']]], + 'AttachedDevice' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'BusNumber' : [ 0x60, ['unsigned long']], + 'SystemPowerState' : [ 0x64, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DevicePowerState' : [ 0x68, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_DEVICE_DESCRIPTION' : [ 0x40, { + 'Version' : [ 0x0, ['unsigned long']], + 'Master' : [ 0x4, ['unsigned char']], + 'ScatterGather' : [ 0x5, ['unsigned char']], + 'DemandMode' : [ 0x6, ['unsigned char']], + 'AutoInitialize' : [ 0x7, ['unsigned char']], + 'Dma32BitAddresses' : [ 0x8, ['unsigned char']], + 'IgnoreCount' : [ 0x9, ['unsigned char']], + 'Reserved1' : [ 0xa, ['unsigned char']], + 'Dma64BitAddresses' : [ 0xb, ['unsigned char']], + 'BusNumber' : [ 0xc, ['unsigned long']], + 'DmaChannel' : [ 0x10, ['unsigned long']], + 'InterfaceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'DmaWidth' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'Width8Bits', 1: 'Width16Bits', 2: 'Width32Bits', 3: 'Width64Bits', 4: 'WidthNoWrap', 5: 'MaximumDmaWidth'})]], + 'DmaSpeed' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'Compatible', 1: 'TypeA', 2: 'TypeB', 3: 'TypeC', 4: 'TypeF', 5: 'MaximumDmaSpeed'})]], + 'MaximumLength' : [ 0x20, ['unsigned long']], + 'DmaPort' : [ 0x24, ['unsigned long']], + 'DmaAddressWidth' : [ 0x28, ['unsigned long']], + 'DmaControllerInstance' : [ 0x2c, ['unsigned long']], + 'DmaRequestLine' : [ 0x30, ['unsigned long']], + 'DeviceAddress' : [ 0x38, ['_LARGE_INTEGER']], +} ], + '_SID_AND_ATTRIBUTES' : [ 0x10, { + 'Sid' : [ 0x0, ['pointer64', ['void']]], + 'Attributes' : [ 0x8, ['unsigned long']], +} ], + '_SID_IDENTIFIER_AUTHORITY' : [ 0x6, { + 'Value' : [ 0x0, ['array', 6, ['unsigned char']]], +} ], + '_PROCESS_DISK_COUNTERS' : [ 0x28, { + 'BytesRead' : [ 0x0, ['unsigned long long']], + 'BytesWritten' : [ 0x8, ['unsigned long long']], + 'ReadOperationCount' : [ 0x10, ['unsigned long long']], + 'WriteOperationCount' : [ 0x18, ['unsigned long long']], + 'FlushOperationCount' : [ 0x20, ['unsigned long long']], +} ], + '_IO_WORKITEM' : [ 0x50, { + 'WorkItem' : [ 0x0, ['_WORK_QUEUE_ITEM']], + 'Routine' : [ 0x20, ['pointer64', ['void']]], + 'IoObject' : [ 0x28, ['pointer64', ['void']]], + 'Context' : [ 0x30, ['pointer64', ['void']]], + 'Type' : [ 0x38, ['unsigned long']], + 'ActivityId' : [ 0x3c, ['_GUID']], +} ], + '_MMWSLE_HASH' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long long']], +} ], + '_JOBOBJECT_WAKE_FILTER' : [ 0x8, { + 'HighEdgeFilter' : [ 0x0, ['unsigned long']], + 'LowEdgeFilter' : [ 0x4, ['unsigned long']], +} ], + '_UNEXPECTED_INTERRUPT' : [ 0x8, { + 'PushImm' : [ 0x0, ['unsigned char']], + 'Vector' : [ 0x1, ['unsigned char']], + 'PushRbp' : [ 0x2, ['unsigned char']], + 'JmpOp' : [ 0x3, ['unsigned char']], + 'JmpOffset' : [ 0x4, ['long']], +} ], + '_POP_FX_WORK_ORDER_WATCHDOG_INFO' : [ 0x88, { + 'Timer' : [ 0x0, ['_KTIMER']], + 'Dpc' : [ 0x40, ['_KDPC']], + 'WorkOrder' : [ 0x80, ['pointer64', ['_POP_FX_WORK_ORDER']]], +} ], + '_DBGKD_FILL_MEMORY' : [ 0x10, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Flags' : [ 0xc, ['unsigned short']], + 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_HEAP_STOP_ON_VALUES' : [ 0x30, { + 'AllocAddress' : [ 0x0, ['unsigned long long']], + 'AllocTag' : [ 0x8, ['_HEAP_STOP_ON_TAG']], + 'ReAllocAddress' : [ 0x10, ['unsigned long long']], + 'ReAllocTag' : [ 0x18, ['_HEAP_STOP_ON_TAG']], + 'FreeAddress' : [ 0x20, ['unsigned long long']], + 'FreeTag' : [ 0x28, ['_HEAP_STOP_ON_TAG']], +} ], + '_HEAP_PSEUDO_TAG_ENTRY' : [ 0x10, { + 'Allocs' : [ 0x0, ['unsigned long']], + 'Frees' : [ 0x4, ['unsigned long']], + 'Size' : [ 0x8, ['unsigned long long']], +} ], + '_CALL_HASH_ENTRY' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'CallersAddress' : [ 0x10, ['pointer64', ['void']]], + 'CallersCaller' : [ 0x18, ['pointer64', ['void']]], + 'CallCount' : [ 0x20, ['unsigned long']], +} ], + '_VF_TRACKER_STAMP' : [ 0x10, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_TRACK_IRQL' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['void']]], + 'OldIrql' : [ 0x8, ['unsigned char']], + 'NewIrql' : [ 0x9, ['unsigned char']], + 'Processor' : [ 0xa, ['unsigned short']], + 'TickCount' : [ 0xc, ['unsigned long']], + 'StackTrace' : [ 0x10, ['array', 5, ['pointer64', ['void']]]], +} ], + '_SESSION_LOWBOX_MAP' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SessionId' : [ 0x10, ['unsigned long']], + 'LowboxMap' : [ 0x18, ['_SEP_LOWBOX_NUMBER_MAPPING']], +} ], + '_PROCESSOR_PROFILE_CONTROL_AREA' : [ 0x60, { + 'PebsDsSaveArea' : [ 0x0, ['_PEBS_DS_SAVE_AREA']], +} ], + '_PEB_LDR_DATA' : [ 0x58, { + 'Length' : [ 0x0, ['unsigned long']], + 'Initialized' : [ 0x4, ['unsigned char']], + 'SsHandle' : [ 0x8, ['pointer64', ['void']]], + 'InLoadOrderModuleList' : [ 0x10, ['_LIST_ENTRY']], + 'InMemoryOrderModuleList' : [ 0x20, ['_LIST_ENTRY']], + 'InInitializationOrderModuleList' : [ 0x30, ['_LIST_ENTRY']], + 'EntryInProgress' : [ 0x40, ['pointer64', ['void']]], + 'ShutdownInProgress' : [ 0x48, ['unsigned char']], + 'ShutdownThreadId' : [ 0x50, ['pointer64', ['void']]], +} ], + '_PNP_DEVICE_EVENT_ENTRY' : [ 0xa8, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Argument' : [ 0x10, ['unsigned long']], + 'CallerEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'Callback' : [ 0x20, ['pointer64', ['void']]], + 'Context' : [ 0x28, ['pointer64', ['void']]], + 'VetoType' : [ 0x30, ['pointer64', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], + 'VetoName' : [ 0x38, ['pointer64', ['_UNICODE_STRING']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'Lock' : [ 0x44, ['unsigned long']], + 'Cancel' : [ 0x48, ['unsigned char']], + 'Parent' : [ 0x50, ['pointer64', ['_PNP_DEVICE_EVENT_ENTRY']]], + 'Data' : [ 0x58, ['_PLUGPLAY_EVENT_BLOCK']], +} ], + '_PROC_IDLE_POLICY' : [ 0x5, { + 'PromotePercent' : [ 0x0, ['unsigned char']], + 'DemotePercent' : [ 0x1, ['unsigned char']], + 'PromotePercentBase' : [ 0x2, ['unsigned char']], + 'DemotePercentBase' : [ 0x3, ['unsigned char']], + 'AllowScaling' : [ 0x4, ['unsigned char']], +} ], + '_HEAP_STOP_ON_TAG' : [ 0x4, { + 'HeapAndTagIndex' : [ 0x0, ['unsigned long']], + 'TagIndex' : [ 0x0, ['unsigned short']], + 'HeapIndex' : [ 0x2, ['unsigned short']], +} ], + '_PS_WAKE_INFORMATION' : [ 0x38, { + 'NotificationChannel' : [ 0x0, ['unsigned long long']], + 'WakeCounters' : [ 0x8, ['array', 5, ['unsigned long long']]], + 'NoWakeCounter' : [ 0x30, ['unsigned long long']], +} ], + '_RH_OP_CONTEXT' : [ 0x48, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OplockRequestIrp' : [ 0x10, ['pointer64', ['_IRP']]], + 'OplockRequestFileObject' : [ 0x18, ['pointer64', ['_FILE_OBJECT']]], + 'OplockRequestProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], + 'OplockOwnerThread' : [ 0x28, ['pointer64', ['_ETHREAD']]], + 'Flags' : [ 0x30, ['unsigned long']], + 'AtomicLinks' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_DBGKD_GET_CONTEXT' : [ 0x4, { + 'Unused' : [ 0x0, ['unsigned long']], +} ], + '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x10, { + 'Flags' : [ 0x0, ['unsigned long']], + 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_ISRDPCSTATS' : [ 0x40, { + 'IsrTime' : [ 0x0, ['unsigned long long']], + 'IsrTimeStart' : [ 0x8, ['unsigned long long']], + 'IsrCount' : [ 0x10, ['unsigned long long']], + 'DpcTime' : [ 0x18, ['unsigned long long']], + 'DpcTimeStart' : [ 0x20, ['unsigned long long']], + 'DpcCount' : [ 0x28, ['unsigned long long']], + 'IsrActive' : [ 0x30, ['unsigned char']], + 'Reserved' : [ 0x31, ['array', 15, ['unsigned char']]], +} ], + '_RTL_BITMAP_EX' : [ 0x10, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long long']], + 'Buffer' : [ 0x8, ['pointer64', ['unsigned long long']]], +} ], + '_XSTATE_CONFIGURATION' : [ 0x218, { + 'EnabledFeatures' : [ 0x0, ['unsigned long long']], + 'EnabledVolatileFeatures' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'OptimizedSave' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Features' : [ 0x18, ['array', 64, ['_XSTATE_FEATURE']]], +} ], + '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { + 'RefCount' : [ 0x0, ['unsigned long']], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], + 'ConvKey' : [ 0x10, ['unsigned long']], + 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x20, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x28, ['unsigned long']], + 'KcbPushlock' : [ 0x30, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x38, ['pointer64', ['_KTHREAD']]], + 'SharedCount' : [ 0x38, ['long']], + 'SlotHint' : [ 0x40, ['unsigned long']], + 'ParentKcb' : [ 0x48, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NameBlock' : [ 0x50, ['pointer64', ['_CM_NAME_CONTROL_BLOCK']]], + 'CachedSecurity' : [ 0x58, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], + 'ValueCache' : [ 0x60, ['_CACHED_CHILD_LIST']], + 'IndexHint' : [ 0x70, ['pointer64', ['_CM_INDEX_HINT_BLOCK']]], + 'HashKey' : [ 0x70, ['unsigned long']], + 'SubKeyCount' : [ 0x70, ['unsigned long']], + 'KeyBodyListHead' : [ 0x78, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x78, ['_LIST_ENTRY']], + 'KeyBodyArray' : [ 0x88, ['array', 4, ['pointer64', ['_CM_KEY_BODY']]]], + 'KcbLastWriteTime' : [ 0xa8, ['_LARGE_INTEGER']], + 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], + 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], + 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], + 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], + 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], + 'Stolen' : [ 0xd8, ['pointer64', ['unsigned char']]], + 'TransKCBOwner' : [ 0xe8, ['pointer64', ['_CM_TRANS']]], + 'KCBLock' : [ 0xf0, ['_CM_INTENT_LOCK']], + 'KeyLock' : [ 0x100, ['_CM_INTENT_LOCK']], + 'TransValueCache' : [ 0x110, ['_CHILD_LIST']], + 'TransValueListOwner' : [ 0x118, ['pointer64', ['_CM_TRANS']]], + 'FullKCBName' : [ 0x120, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_KLOCK_ENTRY' : [ 0x60, { + 'TreeNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'FreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'ThreadUnsafe' : [ 0x18, ['pointer64', ['void']]], + 'HeadNodeByte' : [ 0x18, ['unsigned char']], + 'Reserved1' : [ 0x19, ['array', 6, ['unsigned char']]], + 'AcquiredByte' : [ 0x1f, ['unsigned char']], + 'LockState' : [ 0x20, ['_KLOCK_ENTRY_LOCK_STATE']], + 'LockUnsafe' : [ 0x20, ['pointer64', ['void']]], + 'WaitingAndBusyByte' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x21, ['array', 6, ['unsigned char']]], + 'InTreeByte' : [ 0x27, ['unsigned char']], + 'SessionState' : [ 0x28, ['pointer64', ['void']]], + 'SessionId' : [ 0x28, ['unsigned long']], + 'SessionPad' : [ 0x2c, ['unsigned long']], + 'OwnerTree' : [ 0x30, ['_RTL_RB_TREE']], + 'WaiterTree' : [ 0x40, ['_RTL_RB_TREE']], + 'CpuPriorityKey' : [ 0x30, ['unsigned char']], + 'EntryLock' : [ 0x50, ['unsigned long long']], + 'AllBoosts' : [ 0x58, ['unsigned short']], + 'IoBoost' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'CpuBoostsBitmap' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'IoNormalPriorityWaiterCount' : [ 0x5a, ['unsigned short']], + 'IoPriorityBit' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'AbSpare' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'SparePad' : [ 0x5d, ['array', 3, ['unsigned char']]], +} ], + '_MMPTE_SOFTWARE' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'InStore' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'PageFileReserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'PageFileAllocated' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 25, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_1f44' : [ 0x10, { + 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], +} ], + '_MMMOD_WRITER_MDL_ENTRY' : [ 0x100, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'u' : [ 0x10, ['__unnamed_1f44']], + 'Irp' : [ 0x20, ['pointer64', ['_IRP']]], + 'u1' : [ 0x28, ['_MODWRITER_FLAGS']], + 'StoreWriteRefCount' : [ 0x2c, ['unsigned long']], + 'StoreWriteCompletionApc' : [ 0x30, ['_KAPC']], + 'ByteCount' : [ 0x88, ['unsigned long']], + 'PagingFile' : [ 0x90, ['pointer64', ['_MMPAGING_FILE']]], + 'File' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0xa0, ['pointer64', ['_CONTROL_AREA']]], + 'FileResource' : [ 0xa8, ['pointer64', ['_ERESOURCE']]], + 'WriteOffset' : [ 0xb0, ['_LARGE_INTEGER']], + 'IssueTime' : [ 0xb8, ['_LARGE_INTEGER']], + 'PointerMdl' : [ 0xc0, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0xc8, ['_MDL']], + 'Page' : [ 0xf8, ['array', 1, ['unsigned long long']]], +} ], + '_CM_RESOURCE_LIST' : [ 0x28, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['array', 1, ['_CM_FULL_RESOURCE_DESCRIPTOR']]], +} ], + '_TOKEN_PRIVILEGES' : [ 0x10, { + 'PrivilegeCount' : [ 0x0, ['unsigned long']], + 'Privileges' : [ 0x4, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], +} ], + '_POOL_TRACKER_TABLE' : [ 0x28, { + 'Key' : [ 0x0, ['long']], + 'NonPagedAllocs' : [ 0x4, ['unsigned long']], + 'NonPagedFrees' : [ 0x8, ['unsigned long']], + 'NonPagedBytes' : [ 0x10, ['unsigned long long']], + 'PagedAllocs' : [ 0x18, ['unsigned long']], + 'PagedFrees' : [ 0x1c, ['unsigned long']], + 'PagedBytes' : [ 0x20, ['unsigned long long']], +} ], + '_CM_FULL_RESOURCE_DESCRIPTOR' : [ 0x24, { + 'InterfaceType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WMI_BUFFER_HEADER' : [ 0x48, { + 'BufferSize' : [ 0x0, ['unsigned long']], + 'SavedOffset' : [ 0x4, ['unsigned long']], + 'CurrentOffset' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'SequenceNumber' : [ 0x18, ['long long']], + 'ClockType' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], + 'Frequency' : [ 0x20, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], + 'SlistEntry' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'NextBuffer' : [ 0x20, ['pointer64', ['_WMI_BUFFER_HEADER']]], + 'ClientContext' : [ 0x28, ['_ETW_BUFFER_CONTEXT']], + 'State' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'EtwBufferStateFree', 1: 'EtwBufferStateGeneralLogging', 2: 'EtwBufferStateCSwitch', 3: 'EtwBufferStateFlush', 4: 'EtwBufferStateMaximum'})]], + 'Offset' : [ 0x30, ['unsigned long']], + 'BufferFlag' : [ 0x34, ['unsigned short']], + 'BufferType' : [ 0x36, ['unsigned short']], + 'Padding1' : [ 0x38, ['array', 4, ['unsigned long']]], + 'ReferenceTime' : [ 0x38, ['_ETW_REF_CLOCK']], + 'GlobalEntry' : [ 0x38, ['_LIST_ENTRY']], + 'Pointer0' : [ 0x38, ['pointer64', ['void']]], + 'Pointer1' : [ 0x40, ['pointer64', ['void']]], +} ], + '_POWER_SEQUENCE' : [ 0xc, { + 'SequenceD1' : [ 0x0, ['unsigned long']], + 'SequenceD2' : [ 0x4, ['unsigned long']], + 'SequenceD3' : [ 0x8, ['unsigned long']], +} ], + '_EPROCESS_VALUES' : [ 0x50, { + 'KernelTime' : [ 0x0, ['unsigned long long']], + 'UserTime' : [ 0x8, ['unsigned long long']], + 'CycleTime' : [ 0x10, ['unsigned long long']], + 'ContextSwitches' : [ 0x18, ['unsigned long long']], + 'ReadOperationCount' : [ 0x20, ['long long']], + 'WriteOperationCount' : [ 0x28, ['long long']], + 'OtherOperationCount' : [ 0x30, ['long long']], + 'ReadTransferCount' : [ 0x38, ['long long']], + 'WriteTransferCount' : [ 0x40, ['long long']], + 'OtherTransferCount' : [ 0x48, ['long long']], +} ], + '_OBJECT_REF_STACK_INFO' : [ 0xc, { + 'Sequence' : [ 0x0, ['unsigned long']], + 'Index' : [ 0x4, ['unsigned short']], + 'NumTraces' : [ 0x6, ['unsigned short']], + 'Tag' : [ 0x8, ['unsigned long']], +} ], + '_PPC_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_MMPFNENTRY' : [ 0x2, { + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'OnProtectedStandby' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Spare' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_SEGMENT_OBJECT' : [ 0x40, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SizeOfSegment' : [ 0x10, ['_LARGE_INTEGER']], + 'NonExtendedPtes' : [ 0x18, ['unsigned long']], + 'ImageCommitment' : [ 0x1c, ['unsigned long']], + 'ControlArea' : [ 0x20, ['pointer64', ['_CONTROL_AREA']]], + 'Subsection' : [ 0x28, ['pointer64', ['_SUBSECTION']]], + 'MmSectionFlags' : [ 0x30, ['pointer64', ['_MMSECTION_FLAGS']]], + 'MmSubSectionFlags' : [ 0x38, ['pointer64', ['_MMSUBSECTION_FLAGS']]], +} ], + '_PCW_CALLBACK_INFORMATION' : [ 0x28, { + 'AddCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'RemoveCounter' : [ 0x0, ['_PCW_COUNTER_INFORMATION']], + 'EnumerateInstances' : [ 0x0, ['_PCW_MASK_INFORMATION']], + 'CollectData' : [ 0x0, ['_PCW_MASK_INFORMATION']], +} ], + '_TOKEN_SOURCE' : [ 0x10, { + 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], + 'SourceIdentifier' : [ 0x8, ['_LUID']], +} ], + '_CMHIVE' : [ 0x1360, { + 'Hive' : [ 0x0, ['_HHIVE']], + 'FileHandles' : [ 0x5a8, ['array', 6, ['pointer64', ['void']]]], + 'NotifyList' : [ 0x5d8, ['_LIST_ENTRY']], + 'HiveList' : [ 0x5e8, ['_LIST_ENTRY']], + 'PreloadedHiveList' : [ 0x5f8, ['_LIST_ENTRY']], + 'HiveRundown' : [ 0x608, ['_EX_RUNDOWN_REF']], + 'ParseCacheEntries' : [ 0x610, ['_LIST_ENTRY']], + 'KcbCacheTable' : [ 0x620, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'KcbCacheTableSize' : [ 0x628, ['unsigned long']], + 'DeletedKcbTable' : [ 0x630, ['pointer64', ['_CM_KEY_HASH_TABLE_ENTRY']]], + 'DeletedKcbTableSize' : [ 0x638, ['unsigned long']], + 'Identity' : [ 0x63c, ['unsigned long']], + 'HiveLock' : [ 0x640, ['pointer64', ['_FAST_MUTEX']]], + 'WriterLock' : [ 0x648, ['pointer64', ['_FAST_MUTEX']]], + 'FlusherLock' : [ 0x650, ['pointer64', ['_ERESOURCE']]], + 'FlushDirtyVector' : [ 0x658, ['_RTL_BITMAP']], + 'FlushDirtyVectorSize' : [ 0x668, ['unsigned long']], + 'FlushLogEntry' : [ 0x670, ['pointer64', ['unsigned char']]], + 'FlushLogEntrySize' : [ 0x678, ['unsigned long']], + 'FlushHiveTruncated' : [ 0x67c, ['unsigned long']], + 'FlushBaseBlockDirty' : [ 0x680, ['unsigned char']], + 'CapturedUnreconciledVector' : [ 0x688, ['_RTL_BITMAP']], + 'CapturedUnreconciledVectorSize' : [ 0x698, ['unsigned long']], + 'UnreconciledOffsetArray' : [ 0x6a0, ['pointer64', ['CMP_OFFSET_ARRAY']]], + 'UnreconciledOffsetArrayCount' : [ 0x6a8, ['unsigned long']], + 'UnreconciledBaseBlock' : [ 0x6b0, ['pointer64', ['_HBASE_BLOCK']]], + 'SecurityLock' : [ 0x6b8, ['_EX_PUSH_LOCK']], + 'UseCount' : [ 0x6c0, ['unsigned long']], + 'LastShrinkHiveSize' : [ 0x6c4, ['unsigned long']], + 'ActualFileSize' : [ 0x6c8, ['_LARGE_INTEGER']], + 'LogFileSizes' : [ 0x6d0, ['array', 2, ['_LARGE_INTEGER']]], + 'FileFullPath' : [ 0x6e0, ['_UNICODE_STRING']], + 'FileUserName' : [ 0x6f0, ['_UNICODE_STRING']], + 'HiveRootPath' : [ 0x700, ['_UNICODE_STRING']], + 'SecurityCount' : [ 0x710, ['unsigned long']], + 'SecurityCacheSize' : [ 0x714, ['unsigned long']], + 'SecurityHitHint' : [ 0x718, ['long']], + 'SecurityCache' : [ 0x720, ['pointer64', ['_CM_KEY_SECURITY_CACHE_ENTRY']]], + 'SecurityHash' : [ 0x728, ['array', 64, ['_LIST_ENTRY']]], + 'UnloadEventCount' : [ 0xb28, ['unsigned long']], + 'UnloadEventArray' : [ 0xb30, ['pointer64', ['pointer64', ['_KEVENT']]]], + 'RootKcb' : [ 0xb38, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Frozen' : [ 0xb40, ['unsigned char']], + 'UnloadWorkItem' : [ 0xb48, ['pointer64', ['_CM_WORKITEM']]], + 'UnloadWorkItemHolder' : [ 0xb50, ['_CM_WORKITEM']], + 'GrowOnlyMode' : [ 0xb78, ['unsigned char']], + 'GrowOffset' : [ 0xb7c, ['unsigned long']], + 'KcbConvertListHead' : [ 0xb80, ['_LIST_ENTRY']], + 'KnodeConvertListHead' : [ 0xb90, ['_LIST_ENTRY']], + 'CellRemapArray' : [ 0xba0, ['pointer64', ['_CM_CELL_REMAP_BLOCK']]], + 'DirtyVectorLog' : [ 0xba8, ['_CM_DIRTY_VECTOR_LOG']], + 'Flags' : [ 0x10b0, ['unsigned long']], + 'TrustClassEntry' : [ 0x10b8, ['_LIST_ENTRY']], + 'DirtyTime' : [ 0x10c8, ['unsigned long long']], + 'UnreconciledTime' : [ 0x10d0, ['unsigned long long']], + 'CmRm' : [ 0x10d8, ['pointer64', ['_CM_RM']]], + 'CmRmInitFailPoint' : [ 0x10e0, ['unsigned long']], + 'CmRmInitFailStatus' : [ 0x10e4, ['long']], + 'CreatorOwner' : [ 0x10e8, ['pointer64', ['_KTHREAD']]], + 'RundownThread' : [ 0x10f0, ['pointer64', ['_KTHREAD']]], + 'LastWriteTime' : [ 0x10f8, ['_LARGE_INTEGER']], + 'FlushQueue' : [ 0x1100, ['_HIVE_WRITE_WAIT_QUEUE']], + 'ReconcileQueue' : [ 0x1118, ['_HIVE_WRITE_WAIT_QUEUE']], + 'FlushFlags' : [ 0x1130, ['unsigned long']], + 'FlushActive' : [ 0x1130, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReconcileActive' : [ 0x1130, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PrimaryFilePurged' : [ 0x1130, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DiskFileBad' : [ 0x1130, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PrimaryFileSizeBeforeLastFlush' : [ 0x1134, ['unsigned long']], + 'ReferenceCount' : [ 0x1138, ['long']], + 'UnloadHistoryIndex' : [ 0x113c, ['long']], + 'UnloadHistory' : [ 0x1140, ['array', 128, ['unsigned long']]], + 'BootStart' : [ 0x1340, ['unsigned long']], + 'UnaccessedStart' : [ 0x1344, ['unsigned long']], + 'UnaccessedEnd' : [ 0x1348, ['unsigned long']], + 'LoadedKeyCount' : [ 0x134c, ['unsigned long']], + 'HandleClosePending' : [ 0x1350, ['unsigned long']], + 'HandleClosePendingEvent' : [ 0x1358, ['_EX_PUSH_LOCK']], +} ], + '_DBGKD_QUERY_MEMORY' : [ 0x18, { + 'Address' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['unsigned long long']], + 'AddressSpace' : [ 0x10, ['unsigned long']], + 'Flags' : [ 0x14, ['unsigned long']], +} ], + '_DIRTY_PAGE_THRESHOLDS' : [ 0x38, { + 'DirtyPageThreshold' : [ 0x0, ['unsigned long long']], + 'DirtyPageThresholdTop' : [ 0x8, ['unsigned long long']], + 'DirtyPageThresholdBottom' : [ 0x10, ['unsigned long long']], + 'DirtyPageTarget' : [ 0x18, ['unsigned long']], + 'AggregateAvailablePages' : [ 0x20, ['unsigned long long']], + 'AggregateDirtyPages' : [ 0x28, ['unsigned long long']], + 'AvailableHistory' : [ 0x30, ['unsigned long']], +} ], + 'DOCK_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ProfileDepartureSetMode' : [ 0x20, ['pointer64', ['void']]], + 'ProfileDepartureUpdate' : [ 0x28, ['pointer64', ['void']]], +} ], + 'CMP_OFFSET_ARRAY' : [ 0x18, { + 'FileOffset' : [ 0x0, ['unsigned long']], + 'DataBuffer' : [ 0x8, ['pointer64', ['void']]], + 'DataLength' : [ 0x10, ['unsigned long']], +} ], + '_MMSUPPORT_FLAGS' : [ 0x4, { + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ForceCredits' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['unsigned char']], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SvmEnabled' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'ImageBase' : [ 0x18, ['unsigned long long']], + 'SectionAlignment' : [ 0x20, ['unsigned long']], + 'FileAlignment' : [ 0x24, ['unsigned long']], + 'MajorOperatingSystemVersion' : [ 0x28, ['unsigned short']], + 'MinorOperatingSystemVersion' : [ 0x2a, ['unsigned short']], + 'MajorImageVersion' : [ 0x2c, ['unsigned short']], + 'MinorImageVersion' : [ 0x2e, ['unsigned short']], + 'MajorSubsystemVersion' : [ 0x30, ['unsigned short']], + 'MinorSubsystemVersion' : [ 0x32, ['unsigned short']], + 'Win32VersionValue' : [ 0x34, ['unsigned long']], + 'SizeOfImage' : [ 0x38, ['unsigned long']], + 'SizeOfHeaders' : [ 0x3c, ['unsigned long']], + 'CheckSum' : [ 0x40, ['unsigned long']], + 'Subsystem' : [ 0x44, ['unsigned short']], + 'DllCharacteristics' : [ 0x46, ['unsigned short']], + 'SizeOfStackReserve' : [ 0x48, ['unsigned long long']], + 'SizeOfStackCommit' : [ 0x50, ['unsigned long long']], + 'SizeOfHeapReserve' : [ 0x58, ['unsigned long long']], + 'SizeOfHeapCommit' : [ 0x60, ['unsigned long long']], + 'LoaderFlags' : [ 0x68, ['unsigned long']], + 'NumberOfRvaAndSizes' : [ 0x6c, ['unsigned long']], + 'DataDirectory' : [ 0x70, ['array', 16, ['_IMAGE_DATA_DIRECTORY']]], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Size' : [ 0x8, ['unsigned long']], + 'ActiveCount' : [ 0xc, ['unsigned long']], + 'PendingNullCount' : [ 0x10, ['unsigned long']], + 'PendingCheckCompletionListCount' : [ 0x14, ['unsigned long']], + 'PendingDelete' : [ 0x18, ['unsigned long']], + 'FreeListHead' : [ 0x20, ['_SINGLE_LIST_ENTRY']], + 'CompletionPort' : [ 0x28, ['pointer64', ['void']]], + 'CompletionKey' : [ 0x30, ['pointer64', ['void']]], + 'Entry' : [ 0x38, ['array', 1, ['_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY']]], +} ], + '_TERMINATION_PORT' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_TERMINATION_PORT']]], + 'Port' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MEMORY_ALLOCATION_DESCRIPTOR' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'MemoryType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LoaderExceptionBlock', 1: 'LoaderSystemBlock', 2: 'LoaderFree', 3: 'LoaderBad', 4: 'LoaderLoadedProgram', 5: 'LoaderFirmwareTemporary', 6: 'LoaderFirmwarePermanent', 7: 'LoaderOsloaderHeap', 8: 'LoaderOsloaderStack', 9: 'LoaderSystemCode', 10: 'LoaderHalCode', 11: 'LoaderBootDriver', 12: 'LoaderConsoleInDriver', 13: 'LoaderConsoleOutDriver', 14: 'LoaderStartupDpcStack', 15: 'LoaderStartupKernelStack', 16: 'LoaderStartupPanicStack', 17: 'LoaderStartupPcrPage', 18: 'LoaderStartupPdrPage', 19: 'LoaderRegistryData', 20: 'LoaderMemoryData', 21: 'LoaderNlsData', 22: 'LoaderSpecialMemory', 23: 'LoaderBBTMemory', 24: 'LoaderReserve', 25: 'LoaderXIPRom', 26: 'LoaderHALCachedMemory', 27: 'LoaderLargePageFiller', 28: 'LoaderErrorLogMemory', 29: 'LoaderMaximum'})]], + 'BasePage' : [ 0x18, ['unsigned long long']], + 'PageCount' : [ 0x20, ['unsigned long long']], +} ], + '_CM_INTENT_LOCK' : [ 0x10, { + 'OwnerCount' : [ 0x0, ['unsigned long']], + 'OwnerTable' : [ 0x8, ['pointer64', ['pointer64', ['_CM_KCB_UOW']]]], +} ], + '_PROC_IDLE_ACCOUNTING' : [ 0x3f8, { + 'StateCount' : [ 0x0, ['unsigned long']], + 'TotalTransitions' : [ 0x4, ['unsigned long']], + 'ResetCount' : [ 0x8, ['unsigned long']], + 'AbortCount' : [ 0xc, ['unsigned long']], + 'StartTime' : [ 0x10, ['unsigned long long']], + 'PriorIdleTime' : [ 0x18, ['unsigned long long']], + 'TimeUnit' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PpmIdleBucketTimeInQpc', 1: 'PpmIdleBucketTimeIn100ns', 2: 'PpmIdleBucketTimeMaximum'})]], + 'State' : [ 0x28, ['array', 1, ['_PROC_IDLE_STATE_ACCOUNTING']]], +} ], + '_THERMAL_INFORMATION' : [ 0x58, { + 'ThermalStamp' : [ 0x0, ['unsigned long']], + 'ThermalConstant1' : [ 0x4, ['unsigned long']], + 'ThermalConstant2' : [ 0x8, ['unsigned long']], + 'Processors' : [ 0x10, ['unsigned long long']], + 'SamplingPeriod' : [ 0x18, ['unsigned long']], + 'CurrentTemperature' : [ 0x1c, ['unsigned long']], + 'PassiveTripPoint' : [ 0x20, ['unsigned long']], + 'CriticalTripPoint' : [ 0x24, ['unsigned long']], + 'ActiveTripPointCount' : [ 0x28, ['unsigned char']], + 'ActiveTripPoint' : [ 0x2c, ['array', 10, ['unsigned long']]], +} ], + '_SEP_LOWBOX_NUMBER_MAPPING' : [ 0x28, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Bitmap' : [ 0x8, ['_RTL_BITMAP']], + 'HashTable' : [ 0x18, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], + 'Active' : [ 0x20, ['unsigned char']], +} ], + '_MAPPED_FILE_SEGMENT' : [ 0x30, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], +} ], + '_TEB64' : [ 0x1820, { + 'NtTib' : [ 0x0, ['_NT_TIB64']], + 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], + 'ClientId' : [ 0x40, ['_CLIENT_ID64']], + 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], + 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], + 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], + 'LastErrorValue' : [ 0x68, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], + 'CsrClientThread' : [ 0x70, ['unsigned long long']], + 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], + 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0x100, ['unsigned long long']], + 'CurrentLocale' : [ 0x108, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], + 'SystemReserved1' : [ 0x110, ['array', 54, ['unsigned long long']]], + 'ExceptionCode' : [ 0x2c0, ['long']], + 'Padding0' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], + 'SpareBytes' : [ 0x2d0, ['array', 24, ['unsigned char']]], + 'TxFsContext' : [ 0x2e8, ['unsigned long']], + 'Padding1' : [ 0x2ec, ['array', 4, ['unsigned char']]], + 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], + 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], + 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], + 'GdiClientPID' : [ 0x7f0, ['unsigned long']], + 'GdiClientTID' : [ 0x7f4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], + 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], + 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], + 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], + 'glReserved2' : [ 0x1220, ['unsigned long long']], + 'glSectionInfo' : [ 0x1228, ['unsigned long long']], + 'glSection' : [ 0x1230, ['unsigned long long']], + 'glTable' : [ 0x1238, ['unsigned long long']], + 'glCurrentRC' : [ 0x1240, ['unsigned long long']], + 'glContext' : [ 0x1248, ['unsigned long long']], + 'LastStatusValue' : [ 0x1250, ['unsigned long']], + 'Padding2' : [ 0x1254, ['array', 4, ['unsigned char']]], + 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], + 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], + 'Padding3' : [ 0x1472, ['array', 6, ['unsigned char']]], + 'DeallocationStack' : [ 0x1478, ['unsigned long long']], + 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], + 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], + 'Vdm' : [ 0x1690, ['unsigned long long']], + 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], + 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], + 'HardErrorMode' : [ 0x16b0, ['unsigned long']], + 'Padding4' : [ 0x16b4, ['array', 4, ['unsigned char']]], + 'Instrumentation' : [ 0x16b8, ['array', 11, ['unsigned long long']]], + 'ActivityId' : [ 0x1710, ['_GUID']], + 'SubProcessTag' : [ 0x1720, ['unsigned long long']], + 'PerflibData' : [ 0x1728, ['unsigned long long']], + 'EtwTraceData' : [ 0x1730, ['unsigned long long']], + 'WinSockData' : [ 0x1738, ['unsigned long long']], + 'GdiBatchCount' : [ 0x1740, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0x1744, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0x1744, ['unsigned long']], + 'ReservedPad0' : [ 0x1744, ['unsigned char']], + 'ReservedPad1' : [ 0x1745, ['unsigned char']], + 'ReservedPad2' : [ 0x1746, ['unsigned char']], + 'IdealProcessor' : [ 0x1747, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], + 'Padding5' : [ 0x174c, ['array', 4, ['unsigned char']]], + 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], + 'ReservedForOle' : [ 0x1758, ['unsigned long long']], + 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], + 'Padding6' : [ 0x1764, ['array', 4, ['unsigned char']]], + 'SavedPriorityState' : [ 0x1768, ['unsigned long long']], + 'ReservedForCodeCoverage' : [ 0x1770, ['unsigned long long']], + 'ThreadPoolData' : [ 0x1778, ['unsigned long long']], + 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], + 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], + 'BStoreLimit' : [ 0x1790, ['unsigned long long']], + 'MuiGeneration' : [ 0x1798, ['unsigned long']], + 'IsImpersonating' : [ 0x179c, ['unsigned long']], + 'NlsCache' : [ 0x17a0, ['unsigned long long']], + 'pShimData' : [ 0x17a8, ['unsigned long long']], + 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0x17b2, ['unsigned short']], + 'Padding7' : [ 0x17b4, ['array', 4, ['unsigned char']]], + 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], + 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], + 'FlsData' : [ 0x17c8, ['unsigned long long']], + 'PreferredLanguages' : [ 0x17d0, ['unsigned long long']], + 'UserPrefLanguages' : [ 0x17d8, ['unsigned long long']], + 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], + 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], + 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0x17ee, ['unsigned short']], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], + 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], + 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], + 'LockCount' : [ 0x1808, ['unsigned long']], + 'SpareUlong0' : [ 0x180c, ['unsigned long']], + 'ResourceRetValue' : [ 0x1810, ['unsigned long long']], + 'ReservedForWdf' : [ 0x1818, ['unsigned long long']], +} ], + '_GDI_TEB_BATCH' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '_MM_DRIVER_VERIFIER_DATA' : [ 0xa0, { + 'Level' : [ 0x0, ['unsigned long']], + 'RaiseIrqls' : [ 0x4, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x8, ['unsigned long']], + 'SynchronizeExecutions' : [ 0xc, ['unsigned long']], + 'AllocationsAttempted' : [ 0x10, ['unsigned long']], + 'AllocationsSucceeded' : [ 0x14, ['unsigned long']], + 'AllocationsSucceededSpecialPool' : [ 0x18, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x1c, ['unsigned long']], + 'TrimRequests' : [ 0x20, ['unsigned long']], + 'Trims' : [ 0x24, ['unsigned long']], + 'AllocationsFailed' : [ 0x28, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x2c, ['unsigned long']], + 'Loads' : [ 0x30, ['unsigned long']], + 'Unloads' : [ 0x34, ['unsigned long']], + 'UnTrackedPool' : [ 0x38, ['unsigned long']], + 'UserTrims' : [ 0x3c, ['unsigned long']], + 'CurrentPagedPoolAllocations' : [ 0x40, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x44, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x48, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x4c, ['unsigned long']], + 'PagedBytes' : [ 0x50, ['unsigned long long']], + 'NonPagedBytes' : [ 0x58, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x60, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x68, ['unsigned long long']], + 'BurstAllocationsFailedDeliberately' : [ 0x70, ['unsigned long']], + 'SessionTrims' : [ 0x74, ['unsigned long']], + 'OptionChanges' : [ 0x78, ['unsigned long']], + 'VerifyMode' : [ 0x7c, ['unsigned long']], + 'PreviousBucketName' : [ 0x80, ['_UNICODE_STRING']], + 'ActivityCounter' : [ 0x90, ['unsigned long']], + 'PreviousActivityCounter' : [ 0x94, ['unsigned long']], + 'WorkerTrimRequests' : [ 0x98, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE' : [ 0x1810, { + 'CurrentSize' : [ 0x0, ['unsigned long']], + 'MaximumSize' : [ 0x4, ['unsigned long']], + 'Epoch' : [ 0x8, ['unsigned long']], + 'Overflow' : [ 0xc, ['unsigned char']], + 'TableEntry' : [ 0x10, ['array', 256, ['_INVERTED_FUNCTION_TABLE_ENTRY']]], +} ], + '_HIVE_WRITE_WAIT_QUEUE' : [ 0x18, { + 'ActiveThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'WaitList' : [ 0x8, ['pointer64', ['_HIVE_WAIT_PACKET']]], + 'OwnerBoosted' : [ 0x10, ['unsigned long']], +} ], + '_VI_FAULT_TRACE' : [ 0x48, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_GENERIC_MAPPING' : [ 0x10, { + 'GenericRead' : [ 0x0, ['unsigned long']], + 'GenericWrite' : [ 0x4, ['unsigned long']], + 'GenericExecute' : [ 0x8, ['unsigned long']], + 'GenericAll' : [ 0xc, ['unsigned long']], +} ], + '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0x18, { + 'CountEntries' : [ 0x0, ['unsigned long']], + 'HandleCountEntries' : [ 0x8, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_UMS_CONTROL_BLOCK' : [ 0x90, { + 'UmsContext' : [ 0x0, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'CompletionListEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'CompletionListEvent' : [ 0x10, ['pointer64', ['_KEVENT']]], + 'ServiceSequenceNumber' : [ 0x18, ['unsigned long']], + 'UmsQueue' : [ 0x20, ['_KQUEUE']], + 'QueueEntry' : [ 0x60, ['_LIST_ENTRY']], + 'YieldingUmsContext' : [ 0x70, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], + 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], + 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], + 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], + 'UmsWaitEvent' : [ 0x30, ['_KEVENT']], + 'StagingArea' : [ 0x48, ['pointer64', ['void']]], + 'UmsPrimaryDeliveredContext' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsFlags' : [ 0x50, ['unsigned long']], + 'TebSelector' : [ 0x88, ['unsigned short']], +} ], + '_OWNER_ENTRY' : [ 0x10, { + 'OwnerThread' : [ 0x0, ['unsigned long long']], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'TableSize' : [ 0x8, ['unsigned long']], +} ], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], +} ], + '_ETIMER' : [ 0x138, { + 'KeTimer' : [ 0x0, ['_KTIMER']], + 'Lock' : [ 0x40, ['unsigned long long']], + 'TimerApc' : [ 0x48, ['_KAPC']], + 'TimerDpc' : [ 0xa0, ['_KDPC']], + 'ActiveTimerListEntry' : [ 0xe0, ['_LIST_ENTRY']], + 'Period' : [ 0xf0, ['unsigned long']], + 'TimerFlags' : [ 0xf4, ['unsigned char']], + 'ApcAssociated' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FlushDpcs' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Paused' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Spare1' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], + 'DueTimeType' : [ 0xf5, ['unsigned char']], + 'Spare2' : [ 0xf6, ['unsigned short']], + 'WakeReason' : [ 0xf8, ['pointer64', ['_DIAGNOSTIC_CONTEXT']]], + 'WakeTimerListEntry' : [ 0x100, ['_LIST_ENTRY']], + 'VirtualizedTimerCookie' : [ 0x110, ['pointer64', ['void']]], + 'VirtualizedTimerLinks' : [ 0x118, ['_LIST_ENTRY']], + 'DueTime' : [ 0x128, ['unsigned long long']], + 'CoalescingWindow' : [ 0x130, ['unsigned long']], +} ], + '_PROC_PERF_SNAP' : [ 0x40, { + 'Time' : [ 0x0, ['unsigned long long']], + 'LastTime' : [ 0x8, ['unsigned long long']], + 'Active' : [ 0x10, ['unsigned long long']], + 'LastActive' : [ 0x18, ['unsigned long long']], + 'FrequencyScaledActive' : [ 0x20, ['unsigned long long']], + 'PerformanceScaledActive' : [ 0x28, ['unsigned long long']], + 'CyclesActive' : [ 0x30, ['unsigned long long']], + 'CyclesAffinitized' : [ 0x38, ['unsigned long long']], +} ], + '_OBJECT_DIRECTORY_ENTRY' : [ 0x18, { + 'ChainLink' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY_ENTRY']]], + 'Object' : [ 0x8, ['pointer64', ['void']]], + 'HashValue' : [ 0x10, ['unsigned long']], +} ], + '_LOCK_TRACKER' : [ 0x90, { + 'LockTrackerNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'Mdl' : [ 0x18, ['pointer64', ['_MDL']]], + 'StartVa' : [ 0x20, ['pointer64', ['void']]], + 'Count' : [ 0x28, ['unsigned long long']], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'StackTrace' : [ 0x40, ['array', 8, ['pointer64', ['void']]]], + 'Who' : [ 0x80, ['unsigned long']], + 'Process' : [ 0x88, ['pointer64', ['_EPROCESS']]], +} ], + '_POOL_BLOCK_HEAD' : [ 0x20, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'List' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_EXHANDLE' : [ 0x8, { + 'TagBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'Index' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'GenericHandleOverlay' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], +} ], + '_XSTATE_FEATURE' : [ 0x8, { + 'Offset' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DBGKD_CONTEXT_EX' : [ 0xc, { + 'Offset' : [ 0x0, ['unsigned long']], + 'ByteCount' : [ 0x4, ['unsigned long']], + 'BytesCopied' : [ 0x8, ['unsigned long']], +} ], + '_CM_DIRTY_VECTOR_LOG' : [ 0x508, { + 'Next' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], + 'Log' : [ 0x8, ['array', 16, ['_CM_DIRTY_VECTOR_LOG_ENTRY']]], +} ], + '_ARBITER_INSTANCE' : [ 0x150, { + 'Signature' : [ 0x0, ['unsigned long']], + 'MutexEvent' : [ 0x8, ['pointer64', ['_KEVENT']]], + 'Name' : [ 0x10, ['pointer64', ['unsigned short']]], + 'OrderingName' : [ 0x18, ['pointer64', ['unsigned short']]], + 'ResourceType' : [ 0x20, ['long']], + 'Allocation' : [ 0x28, ['pointer64', ['_RTL_RANGE_LIST']]], + 'PossibleAllocation' : [ 0x30, ['pointer64', ['_RTL_RANGE_LIST']]], + 'OrderingList' : [ 0x38, ['_ARBITER_ORDERING_LIST']], + 'ReservedList' : [ 0x48, ['_ARBITER_ORDERING_LIST']], + 'ReferenceCount' : [ 0x58, ['long']], + 'Interface' : [ 0x60, ['pointer64', ['_ARBITER_INTERFACE']]], + 'AllocationStackMaxSize' : [ 0x68, ['unsigned long']], + 'AllocationStack' : [ 0x70, ['pointer64', ['_ARBITER_ALLOCATION_STATE']]], + 'UnpackRequirement' : [ 0x78, ['pointer64', ['void']]], + 'PackResource' : [ 0x80, ['pointer64', ['void']]], + 'UnpackResource' : [ 0x88, ['pointer64', ['void']]], + 'ScoreRequirement' : [ 0x90, ['pointer64', ['void']]], + 'TestAllocation' : [ 0x98, ['pointer64', ['void']]], + 'RetestAllocation' : [ 0xa0, ['pointer64', ['void']]], + 'CommitAllocation' : [ 0xa8, ['pointer64', ['void']]], + 'RollbackAllocation' : [ 0xb0, ['pointer64', ['void']]], + 'BootAllocation' : [ 0xb8, ['pointer64', ['void']]], + 'QueryArbitrate' : [ 0xc0, ['pointer64', ['void']]], + 'QueryConflict' : [ 0xc8, ['pointer64', ['void']]], + 'AddReserved' : [ 0xd0, ['pointer64', ['void']]], + 'StartArbiter' : [ 0xd8, ['pointer64', ['void']]], + 'PreprocessEntry' : [ 0xe0, ['pointer64', ['void']]], + 'AllocateEntry' : [ 0xe8, ['pointer64', ['void']]], + 'GetNextAllocationRange' : [ 0xf0, ['pointer64', ['void']]], + 'FindSuitableRange' : [ 0xf8, ['pointer64', ['void']]], + 'AddAllocation' : [ 0x100, ['pointer64', ['void']]], + 'BacktrackAllocation' : [ 0x108, ['pointer64', ['void']]], + 'OverrideConflict' : [ 0x110, ['pointer64', ['void']]], + 'InitializeRangeList' : [ 0x118, ['pointer64', ['void']]], + 'TransactionInProgress' : [ 0x120, ['unsigned char']], + 'TransactionEvent' : [ 0x128, ['pointer64', ['_KEVENT']]], + 'Extension' : [ 0x130, ['pointer64', ['void']]], + 'BusDeviceObject' : [ 0x138, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictCallbackContext' : [ 0x140, ['pointer64', ['void']]], + 'ConflictCallback' : [ 0x148, ['pointer64', ['void']]], +} ], + '_KDEVICE_QUEUE_ENTRY' : [ 0x18, { + 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'SortKey' : [ 0x10, ['unsigned long']], + 'Inserted' : [ 0x14, ['unsigned char']], +} ], + '__unnamed_2059' : [ 0x4, { + 'UserData' : [ 0x0, ['unsigned long']], + 'Next' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_205b' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2059']], +} ], + '__unnamed_205d' : [ 0x4, { + 'NewCell' : [ 0x0, ['__unnamed_205b']], +} ], + '_HCELL' : [ 0x8, { + 'Size' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_205d']], +} ], + '_WHEA_GENERIC_ERROR_DESCRIPTOR' : [ 0x34, { + 'Type' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned char']], + 'Enabled' : [ 0x3, ['unsigned char']], + 'ErrStatusBlockLength' : [ 0x4, ['unsigned long']], + 'RelatedErrorSourceId' : [ 0x8, ['unsigned long']], + 'ErrStatusAddressSpaceID' : [ 0xc, ['unsigned char']], + 'ErrStatusAddressBitWidth' : [ 0xd, ['unsigned char']], + 'ErrStatusAddressBitOffset' : [ 0xe, ['unsigned char']], + 'ErrStatusAddressAccessSize' : [ 0xf, ['unsigned char']], + 'ErrStatusAddress' : [ 0x10, ['_LARGE_INTEGER']], + 'Notify' : [ 0x18, ['_WHEA_NOTIFICATION_DESCRIPTOR']], +} ], + '_HMAP_TABLE' : [ 0x3000, { + 'Table' : [ 0x0, ['array', 512, ['_HMAP_ENTRY']]], +} ], + '_SEP_LOWBOX_HANDLES_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'HandleCount' : [ 0x28, ['unsigned long']], + 'Handles' : [ 0x30, ['pointer64', ['pointer64', ['void']]]], +} ], + '_PROC_PERF_CONSTRAINT' : [ 0x58, { + 'Prcb' : [ 0x0, ['pointer64', ['_KPRCB']]], + 'PerfContext' : [ 0x8, ['unsigned long long']], + 'PlatformCap' : [ 0x10, ['unsigned long']], + 'ThermalCap' : [ 0x14, ['unsigned long']], + 'LimitReasons' : [ 0x18, ['unsigned long']], + 'PlatformCapStartTime' : [ 0x20, ['unsigned long long']], + 'TargetPercent' : [ 0x28, ['unsigned long']], + 'DesiredPercent' : [ 0x2c, ['unsigned long']], + 'SelectedPercent' : [ 0x30, ['unsigned long']], + 'SelectedFrequency' : [ 0x34, ['unsigned long']], + 'PreviousFrequency' : [ 0x38, ['unsigned long']], + 'PreviousPercent' : [ 0x3c, ['unsigned long']], + 'LatestFrequencyPercent' : [ 0x40, ['unsigned long']], + 'SelectedState' : [ 0x48, ['unsigned long long']], + 'Force' : [ 0x50, ['unsigned char']], +} ], + '__unnamed_2072' : [ 0x20, { + 'CallerCompletion' : [ 0x0, ['pointer64', ['void']]], + 'CallerContext' : [ 0x8, ['pointer64', ['void']]], + 'CallerDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SystemWake' : [ 0x18, ['unsigned char']], +} ], + '__unnamed_2075' : [ 0x10, { + 'NotifyDevice' : [ 0x0, ['pointer64', ['_PO_DEVICE_NOTIFY']]], + 'FxDeviceActivated' : [ 0x8, ['unsigned char']], +} ], + '_POP_IRP_DATA' : [ 0xf8, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'Pdo' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'CurrentDevice' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], + 'WatchdogStart' : [ 0x30, ['unsigned long long']], + 'WatchdogTimer' : [ 0x38, ['_KTIMER']], + 'WatchdogDpc' : [ 0x78, ['_KDPC']], + 'MinorFunction' : [ 0xb8, ['unsigned char']], + 'PowerStateType' : [ 0xbc, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], + 'PowerState' : [ 0xc0, ['_POWER_STATE']], + 'WatchdogEnabled' : [ 0xc4, ['unsigned char']], + 'FxDevice' : [ 0xc8, ['pointer64', ['_POP_FX_DEVICE']]], + 'SystemTransition' : [ 0xd0, ['unsigned char']], + 'NotifyPEP' : [ 0xd1, ['unsigned char']], + 'Device' : [ 0xd8, ['__unnamed_2072']], + 'System' : [ 0xd8, ['__unnamed_2075']], +} ], + '_IMAGE_DATA_DIRECTORY' : [ 0x8, { + 'VirtualAddress' : [ 0x0, ['unsigned long']], + 'Size' : [ 0x4, ['unsigned long']], +} ], + '_DEVICE_CAPABILITIES' : [ 0x40, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'WakeFromInterrupt' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], + 'Address' : [ 0x8, ['unsigned long']], + 'UINumber' : [ 0xc, ['unsigned long']], + 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], + 'SystemWake' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceWake' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'D1Latency' : [ 0x34, ['unsigned long']], + 'D2Latency' : [ 0x38, ['unsigned long']], + 'D3Latency' : [ 0x3c, ['unsigned long']], +} ], + '_MI_USER_VA_INFO' : [ 0x128, { + 'NumberOfCommittedPageTables' : [ 0x0, ['unsigned long']], + 'PhysicalMappingCount' : [ 0x4, ['unsigned long']], + 'VadBitMapHint' : [ 0x8, ['unsigned long']], + 'LastAllocationSizeHint' : [ 0xc, ['unsigned long']], + 'LastAllocationSize' : [ 0x10, ['unsigned long']], + 'LowestBottomUpVadBit' : [ 0x14, ['unsigned long']], + 'VadBitMapSize' : [ 0x18, ['unsigned long']], + 'VadBitMapCommitment' : [ 0x1c, ['unsigned long']], + 'MaximumLastVadBit' : [ 0x20, ['unsigned long']], + 'VadsBeingDeleted' : [ 0x24, ['long']], + 'LastVadDeletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'VadBitBuffer' : [ 0x30, ['pointer64', ['unsigned long']]], + 'LowestBottomUpAllocationAddress' : [ 0x38, ['pointer64', ['void']]], + 'HighestTopDownAllocationAddress' : [ 0x40, ['pointer64', ['void']]], + 'FreeTebHint' : [ 0x48, ['pointer64', ['void']]], + 'NumaAware' : [ 0x50, ['unsigned char']], + 'PrivateFixupVadCount' : [ 0x58, ['unsigned long long']], + 'CfgBitMap' : [ 0x60, ['array', 3, ['_MI_CFG_BITMAP_INFO']]], + 'CommittedPageTableBufferForTopLevel' : [ 0xc0, ['array', 8, ['unsigned long']]], + 'CommittedPageTableBitmaps' : [ 0xe0, ['array', 3, ['_RTL_BITMAP']]], + 'PageTableBitmapPages' : [ 0x110, ['array', 3, ['unsigned long']]], + 'FreeUmsTebHint' : [ 0x120, ['pointer64', ['void']]], +} ], + '_PROC_FEEDBACK' : [ 0x70, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'CyclesLast' : [ 0x8, ['unsigned long long']], + 'CyclesActive' : [ 0x10, ['unsigned long long']], + 'Counters' : [ 0x18, ['array', 2, ['pointer64', ['_PROC_FEEDBACK_COUNTER']]]], + 'LastUpdateTime' : [ 0x28, ['unsigned long long']], + 'UnscaledTime' : [ 0x30, ['unsigned long long']], + 'UnaccountedTime' : [ 0x38, ['long long']], + 'ScaledTime' : [ 0x40, ['array', 2, ['unsigned long long']]], + 'UnaccountedKernelTime' : [ 0x50, ['unsigned long long']], + 'PerformanceScaledKernelTime' : [ 0x58, ['unsigned long long']], + 'UserTimeLast' : [ 0x60, ['unsigned long']], + 'KernelTimeLast' : [ 0x64, ['unsigned long']], + 'KernelTimesIndex' : [ 0x68, ['unsigned char']], +} ], + '__unnamed_208a' : [ 0x18, { + 'Length' : [ 0x0, ['unsigned long']], + 'Alignment' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_208e' : [ 0x18, { + 'MinimumVector' : [ 0x0, ['unsigned long']], + 'MaximumVector' : [ 0x4, ['unsigned long']], + 'AffinityPolicy' : [ 0x8, ['unsigned short']], + 'Group' : [ 0xa, ['unsigned short']], + 'PriorityPolicy' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'IrqPriorityUndefined', 1: 'IrqPriorityLow', 2: 'IrqPriorityNormal', 3: 'IrqPriorityHigh'})]], + 'TargetedProcessors' : [ 0x10, ['unsigned long long']], +} ], + '__unnamed_2090' : [ 0x8, { + 'MinimumChannel' : [ 0x0, ['unsigned long']], + 'MaximumChannel' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2092' : [ 0x10, { + 'RequestLine' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Channel' : [ 0x8, ['unsigned long']], + 'TransferWidth' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_2094' : [ 0xc, { + 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], +} ], + '__unnamed_2096' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned long']], + 'MinBusNumber' : [ 0x4, ['unsigned long']], + 'MaxBusNumber' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '__unnamed_2098' : [ 0xc, { + 'Priority' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_209a' : [ 0x18, { + 'Length40' : [ 0x0, ['unsigned long']], + 'Alignment40' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_209c' : [ 0x18, { + 'Length48' : [ 0x0, ['unsigned long']], + 'Alignment48' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_209e' : [ 0x18, { + 'Length64' : [ 0x0, ['unsigned long']], + 'Alignment64' : [ 0x4, ['unsigned long']], + 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], + 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], +} ], + '__unnamed_20a0' : [ 0xc, { + 'Class' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'Reserved1' : [ 0x2, ['unsigned char']], + 'Reserved2' : [ 0x3, ['unsigned char']], + 'IdLowPart' : [ 0x4, ['unsigned long']], + 'IdHighPart' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_20a2' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_208a']], + 'Memory' : [ 0x0, ['__unnamed_208a']], + 'Interrupt' : [ 0x0, ['__unnamed_208e']], + 'Dma' : [ 0x0, ['__unnamed_2090']], + 'DmaV3' : [ 0x0, ['__unnamed_2092']], + 'Generic' : [ 0x0, ['__unnamed_208a']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2094']], + 'BusNumber' : [ 0x0, ['__unnamed_2096']], + 'ConfigData' : [ 0x0, ['__unnamed_2098']], + 'Memory40' : [ 0x0, ['__unnamed_209a']], + 'Memory48' : [ 0x0, ['__unnamed_209c']], + 'Memory64' : [ 0x0, ['__unnamed_209e']], + 'Connection' : [ 0x0, ['__unnamed_20a0']], +} ], + '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { + 'Option' : [ 0x0, ['unsigned char']], + 'Type' : [ 0x1, ['unsigned char']], + 'ShareDisposition' : [ 0x2, ['unsigned char']], + 'Spare1' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['unsigned short']], + 'Spare2' : [ 0x6, ['unsigned short']], + 'u' : [ 0x8, ['__unnamed_20a2']], +} ], + '_POP_THERMAL_ZONE' : [ 0x1f0, { + 'PolicyDevice' : [ 0x0, ['_POP_POLICY_DEVICE']], + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], + 'State' : [ 0x40, ['unsigned char']], + 'Flags' : [ 0x41, ['unsigned char']], + 'Removing' : [ 0x42, ['unsigned char']], + 'Mode' : [ 0x43, ['unsigned char']], + 'PendingMode' : [ 0x44, ['unsigned char']], + 'ActivePoint' : [ 0x45, ['unsigned char']], + 'PendingActivePoint' : [ 0x46, ['unsigned char']], + 'Critical' : [ 0x47, ['unsigned char']], + 'HighPrecisionThrottle' : [ 0x48, ['long']], + 'Throttle' : [ 0x4c, ['long']], + 'PendingThrottle' : [ 0x50, ['long']], + 'ThrottleReasons' : [ 0x54, ['unsigned long']], + 'LastTime' : [ 0x58, ['unsigned long long']], + 'SampleRate' : [ 0x60, ['unsigned long']], + 'LastTemp' : [ 0x64, ['unsigned long']], + 'PassiveTimer' : [ 0x68, ['_KTIMER']], + 'PassiveDpc' : [ 0xa8, ['_KDPC']], + 'Info' : [ 0xe8, ['_THERMAL_INFORMATION_EX']], + 'InfoLastUpdateTime' : [ 0x138, ['_LARGE_INTEGER']], + 'Policy' : [ 0x140, ['_THERMAL_POLICY']], + 'PolicyDriver' : [ 0x154, ['unsigned char']], + 'Metrics' : [ 0x158, ['_POP_THERMAL_ZONE_METRICS']], + 'WorkItem' : [ 0x188, ['_WORK_QUEUE_ITEM']], + 'Lock' : [ 0x1a8, ['_POP_RW_LOCK']], + 'ZoneStopped' : [ 0x1b8, ['_KEVENT']], + 'TemperatureUpdated' : [ 0x1d0, ['_KEVENT']], + 'InstanceId' : [ 0x1e8, ['unsigned long']], +} ], + '_MMPTE_LIST' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 28, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 64, native_type='unsigned long long')]], +} ], + '_VI_POOL_PAGE_HEADER' : [ 0x18, { + 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], + 'VerifierEntry' : [ 0x8, ['pointer64', ['void']]], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_HANDLE_TRACE_DEBUG_INFO' : [ 0xf0, { + 'RefCount' : [ 0x0, ['long']], + 'TableSize' : [ 0x4, ['unsigned long']], + 'BitMaskFlags' : [ 0x8, ['unsigned long']], + 'CloseCompactionLock' : [ 0x10, ['_FAST_MUTEX']], + 'CurrentStackIndex' : [ 0x48, ['unsigned long']], + 'TraceDb' : [ 0x50, ['array', 1, ['_HANDLE_TRACE_DB_ENTRY']]], +} ], + '_HHIVE' : [ 0x5a8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'GetCellRoutine' : [ 0x8, ['pointer64', ['void']]], + 'Allocate' : [ 0x10, ['pointer64', ['void']]], + 'Free' : [ 0x18, ['pointer64', ['void']]], + 'FileWrite' : [ 0x20, ['pointer64', ['void']]], + 'FileRead' : [ 0x28, ['pointer64', ['void']]], + 'HiveLoadFailure' : [ 0x30, ['pointer64', ['void']]], + 'BaseBlock' : [ 0x38, ['pointer64', ['_HBASE_BLOCK']]], + 'DirtyVector' : [ 0x40, ['_RTL_BITMAP']], + 'DirtyCount' : [ 0x50, ['unsigned long']], + 'DirtyAlloc' : [ 0x54, ['unsigned long']], + 'UnreconciledVector' : [ 0x58, ['_RTL_BITMAP']], + 'UnreconciledCount' : [ 0x68, ['unsigned long']], + 'BaseBlockAlloc' : [ 0x6c, ['unsigned long']], + 'Cluster' : [ 0x70, ['unsigned long']], + 'Flat' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ReadOnly' : [ 0x74, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x74, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'DirtyFlag' : [ 0x75, ['unsigned char']], + 'HvBinHeadersUse' : [ 0x78, ['unsigned long']], + 'HvFreeCellsUse' : [ 0x7c, ['unsigned long']], + 'HvUsedCellsUse' : [ 0x80, ['unsigned long']], + 'CmUsedCellsUse' : [ 0x84, ['unsigned long']], + 'HiveFlags' : [ 0x88, ['unsigned long']], + 'CurrentLog' : [ 0x8c, ['unsigned long']], + 'CurrentLogSequence' : [ 0x90, ['unsigned long']], + 'CurrentLogMinimumSequence' : [ 0x94, ['unsigned long']], + 'CurrentLogOffset' : [ 0x98, ['unsigned long']], + 'MinimumLogSequence' : [ 0x9c, ['unsigned long']], + 'LogFileSizeCap' : [ 0xa0, ['unsigned long']], + 'LogDataPresent' : [ 0xa4, ['array', 2, ['unsigned char']]], + 'PrimaryFileValid' : [ 0xa6, ['unsigned char']], + 'BaseBlockDirty' : [ 0xa7, ['unsigned char']], + 'FirstLogFile' : [ 0xa8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'SecondLogFile' : [ 0xa8, ['BitField', dict(start_bit = 3, end_bit = 6, native_type='unsigned short')]], + 'HeaderRecovered' : [ 0xa8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'LegacyRecoveryIndicated' : [ 0xa8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RecoveryInformationReserved' : [ 0xa8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'RecoveryInformation' : [ 0xa8, ['unsigned short']], + 'LogEntriesRecovered' : [ 0xaa, ['array', 2, ['unsigned char']]], + 'RefreshCount' : [ 0xac, ['unsigned long']], + 'StorageTypeCount' : [ 0xb0, ['unsigned long']], + 'Version' : [ 0xb4, ['unsigned long']], + 'Storage' : [ 0xb8, ['array', 2, ['_DUAL']]], +} ], + '_WHEA_XPF_NMI_DESCRIPTOR' : [ 0x3, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], +} ], + '_CM_WORKITEM' : [ 0x28, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Private' : [ 0x10, ['unsigned long']], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Parameter' : [ 0x20, ['pointer64', ['void']]], +} ], + '_POP_THERMAL_ZONE_METRICS' : [ 0x30, { + 'ActiveCount' : [ 0x0, ['unsigned long']], + 'PassiveCount' : [ 0x4, ['unsigned long']], + 'LastActiveStartTime' : [ 0x8, ['unsigned long long']], + 'AverageActiveTime' : [ 0x10, ['unsigned long long']], + 'LastPassiveStartTime' : [ 0x18, ['unsigned long long']], + 'AveragePassiveTime' : [ 0x20, ['unsigned long long']], + 'StartTickSinceLastReset' : [ 0x28, ['_LARGE_INTEGER']], +} ], + '_CM_TRANS' : [ 0xa8, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBUoWListHead' : [ 0x10, ['_LIST_ENTRY']], + 'LazyCommitListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KtmTrans' : [ 0x30, ['pointer64', ['void']]], + 'CmRm' : [ 0x38, ['pointer64', ['_CM_RM']]], + 'KtmEnlistmentObject' : [ 0x40, ['pointer64', ['_KENLISTMENT']]], + 'KtmEnlistmentHandle' : [ 0x48, ['pointer64', ['void']]], + 'KtmUow' : [ 0x50, ['_GUID']], + 'StartLsn' : [ 0x60, ['unsigned long long']], + 'TransState' : [ 0x68, ['unsigned long']], + 'HiveCount' : [ 0x6c, ['unsigned long']], + 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], +} ], + '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_RTL_RANGE_LIST' : [ 0x20, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], + 'Count' : [ 0x14, ['unsigned long']], + 'Stamp' : [ 0x18, ['unsigned long']], +} ], + '_RTL_TIME_ZONE_INFORMATION' : [ 0xac, { + 'Bias' : [ 0x0, ['long']], + 'StandardName' : [ 0x4, ['array', 32, ['wchar']]], + 'StandardStart' : [ 0x44, ['_TIME_FIELDS']], + 'StandardBias' : [ 0x54, ['long']], + 'DaylightName' : [ 0x58, ['array', 32, ['wchar']]], + 'DaylightStart' : [ 0x98, ['_TIME_FIELDS']], + 'DaylightBias' : [ 0xa8, ['long']], +} ], + '_OBJECT_CREATE_INFORMATION' : [ 0x40, { + 'Attributes' : [ 0x0, ['unsigned long']], + 'RootDirectory' : [ 0x8, ['pointer64', ['void']]], + 'ProbeMode' : [ 0x10, ['unsigned char']], + 'PagedPoolCharge' : [ 0x14, ['unsigned long']], + 'NonPagedPoolCharge' : [ 0x18, ['unsigned long']], + 'SecurityDescriptorCharge' : [ 0x1c, ['unsigned long']], + 'SecurityDescriptor' : [ 0x20, ['pointer64', ['void']]], + 'SecurityQos' : [ 0x28, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'SecurityQualityOfService' : [ 0x30, ['_SECURITY_QUALITY_OF_SERVICE']], +} ], + '_POOL_HACKER' : [ 0x30, { + 'Header' : [ 0x0, ['_POOL_HEADER']], + 'Contents' : [ 0x10, ['array', 8, ['unsigned long']]], +} ], + '_DISALLOWED_GUIDS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Guids' : [ 0x8, ['pointer64', ['_GUID']]], +} ], + '_PO_DIAG_STACK_RECORD' : [ 0x10, { + 'StackDepth' : [ 0x0, ['unsigned long']], + 'Stack' : [ 0x8, ['array', 1, ['pointer64', ['void']]]], +} ], + '_SECTION_OBJECT_POINTERS' : [ 0x18, { + 'DataSectionObject' : [ 0x0, ['pointer64', ['void']]], + 'SharedCacheMap' : [ 0x8, ['pointer64', ['void']]], + 'ImageSectionObject' : [ 0x10, ['pointer64', ['void']]], +} ], + '_SEP_AUDIT_POLICY' : [ 0x1e, { + 'AdtTokenPolicy' : [ 0x0, ['_TOKEN_AUDIT_POLICY']], + 'PolicySetStatus' : [ 0x1d, ['unsigned char']], +} ], + '__unnamed_20f7' : [ 0x4, { + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_20f9' : [ 0x20, { + 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], + 'Flags' : [ 0x0, ['__unnamed_20f7']], +} ], + '_VF_TARGET_DRIVER' : [ 0x38, { + 'TreeNode' : [ 0x0, ['_VF_AVL_TREE_NODE']], + 'u1' : [ 0x10, ['__unnamed_20f9']], + 'VerifiedData' : [ 0x30, ['pointer64', ['_VF_TARGET_VERIFIED_DRIVER_DATA']]], +} ], + '__unnamed_2102' : [ 0x14, { + 'ClassGuid' : [ 0x0, ['_GUID']], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], +} ], + '__unnamed_2104' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2106' : [ 0x10, { + 'NotificationStructure' : [ 0x0, ['pointer64', ['void']]], + 'DeviceId' : [ 0x8, ['array', 1, ['wchar']]], +} ], + '__unnamed_2108' : [ 0x8, { + 'Notification' : [ 0x0, ['pointer64', ['void']]], +} ], + '__unnamed_210a' : [ 0x8, { + 'NotificationCode' : [ 0x0, ['unsigned long']], + 'NotificationData' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_210c' : [ 0x8, { + 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], +} ], + '__unnamed_210e' : [ 0x10, { + 'BlockedDriverGuid' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2110' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '__unnamed_2112' : [ 0x20, { + 'PowerSettingGuid' : [ 0x0, ['_GUID']], + 'Flags' : [ 0x10, ['unsigned long']], + 'SessionId' : [ 0x14, ['unsigned long']], + 'DataLength' : [ 0x18, ['unsigned long']], + 'Data' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '__unnamed_2114' : [ 0x20, { + 'DeviceClass' : [ 0x0, ['__unnamed_2102']], + 'TargetDevice' : [ 0x0, ['__unnamed_2104']], + 'InstallDevice' : [ 0x0, ['__unnamed_2104']], + 'CustomNotification' : [ 0x0, ['__unnamed_2106']], + 'ProfileNotification' : [ 0x0, ['__unnamed_2108']], + 'PowerNotification' : [ 0x0, ['__unnamed_210a']], + 'VetoNotification' : [ 0x0, ['__unnamed_210c']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_210e']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_2110']], + 'PowerSettingNotification' : [ 0x0, ['__unnamed_2112']], + 'PropertyChangeNotification' : [ 0x0, ['__unnamed_2104']], + 'DeviceInstanceNotification' : [ 0x0, ['__unnamed_2104']], +} ], + '_PLUGPLAY_EVENT_BLOCK' : [ 0x50, { + 'EventGuid' : [ 0x0, ['_GUID']], + 'EventCategory' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'HardwareProfileChangeEvent', 1: 'TargetDeviceChangeEvent', 2: 'DeviceClassChangeEvent', 3: 'CustomDeviceEvent', 4: 'DeviceInstallEvent', 5: 'DeviceArrivalEvent', 6: 'VetoEvent', 7: 'BlockedDriverEvent', 8: 'InvalidIDEvent', 9: 'DevicePropertyChangeEvent', 10: 'DeviceInstanceRemovalEvent', 11: 'DeviceInstanceStartedEvent', 12: 'MaxPlugEventCategory'})]], + 'Result' : [ 0x18, ['pointer64', ['unsigned long']]], + 'Flags' : [ 0x20, ['unsigned long']], + 'TotalSize' : [ 0x24, ['unsigned long']], + 'DeviceObject' : [ 0x28, ['pointer64', ['void']]], + 'u' : [ 0x30, ['__unnamed_2114']], +} ], + '_VF_SUSPECT_DRIVER_ENTRY' : [ 0x28, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Loads' : [ 0x10, ['unsigned long']], + 'Unloads' : [ 0x14, ['unsigned long']], + 'BaseName' : [ 0x18, ['_UNICODE_STRING']], +} ], + '_MMPTE_TIMESTAMP' : [ 0x8, { + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], +} ], + '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { + 'SidCount' : [ 0x0, ['unsigned long']], + 'SidAttr' : [ 0x8, ['pointer64', ['_SID_AND_ATTRIBUTES']]], + 'Hash' : [ 0x10, ['array', 32, ['unsigned long long']]], +} ], + '_XSTATE_CONTEXT' : [ 0x20, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Length' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Area' : [ 0x10, ['pointer64', ['_XSAVE_AREA']]], + 'Buffer' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROCESSOR_IDLE_PREPARE_INFO' : [ 0x68, { + 'Context' : [ 0x0, ['pointer64', ['void']]], + 'Constraints' : [ 0x8, ['_PROCESSOR_IDLE_CONSTRAINTS']], + 'DependencyCount' : [ 0x48, ['unsigned long']], + 'DependencyUsed' : [ 0x4c, ['unsigned long']], + 'DependencyArray' : [ 0x50, ['pointer64', ['_PROCESSOR_IDLE_DEPENDENCY']]], + 'PlatformIdleStateIndex' : [ 0x58, ['unsigned long']], + 'ProcessorIdleStateIndex' : [ 0x5c, ['unsigned long']], + 'IdleSelectFailureMask' : [ 0x60, ['unsigned long']], +} ], + '_XSAVE_FORMAT' : [ 0x200, { + 'ControlWord' : [ 0x0, ['unsigned short']], + 'StatusWord' : [ 0x2, ['unsigned short']], + 'TagWord' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'ErrorOpcode' : [ 0x6, ['unsigned short']], + 'ErrorOffset' : [ 0x8, ['unsigned long']], + 'ErrorSelector' : [ 0xc, ['unsigned short']], + 'Reserved2' : [ 0xe, ['unsigned short']], + 'DataOffset' : [ 0x10, ['unsigned long']], + 'DataSelector' : [ 0x14, ['unsigned short']], + 'Reserved3' : [ 0x16, ['unsigned short']], + 'MxCsr' : [ 0x18, ['unsigned long']], + 'MxCsr_Mask' : [ 0x1c, ['unsigned long']], + 'FloatRegisters' : [ 0x20, ['array', 8, ['_M128A']]], + 'XmmRegisters' : [ 0xa0, ['array', 16, ['_M128A']]], + 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], +} ], + '__unnamed_2130' : [ 0x1, { + 'AsUCHAR' : [ 0x0, ['unsigned char']], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], +} ], + 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { + 'Revision' : [ 0x0, ['unsigned long']], + 'MaxThrottle' : [ 0x4, ['unsigned char']], + 'MinThrottle' : [ 0x5, ['unsigned char']], + 'BusyAdjThreshold' : [ 0x6, ['unsigned char']], + 'Spare' : [ 0x7, ['unsigned char']], + 'Flags' : [ 0x7, ['__unnamed_2130']], + 'TimeCheck' : [ 0x8, ['unsigned long']], + 'IncreaseTime' : [ 0xc, ['unsigned long']], + 'DecreaseTime' : [ 0x10, ['unsigned long']], + 'IncreasePercent' : [ 0x14, ['unsigned long']], + 'DecreasePercent' : [ 0x18, ['unsigned long']], +} ], + '_BUS_EXTENSION_LIST' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['void']]], + 'BusExtension' : [ 0x8, ['pointer64', ['_PI_BUS_EXTENSION']]], +} ], + '_CACHED_CHILD_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'ValueList' : [ 0x8, ['unsigned long long']], + 'RealKcb' : [ 0x8, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], +} ], + '_KDEVICE_QUEUE' : [ 0x28, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], + 'Lock' : [ 0x18, ['unsigned long long']], + 'Busy' : [ 0x20, ['unsigned char']], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], +} ], + '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], + 'ContextAsUlong' : [ 0x0, ['unsigned long']], +} ], + '_PEBS_DS_SAVE_AREA' : [ 0x60, { + 'BtsBufferBase' : [ 0x0, ['unsigned long long']], + 'BtsIndex' : [ 0x8, ['unsigned long long']], + 'BtsAbsoluteMaximum' : [ 0x10, ['unsigned long long']], + 'BtsInterruptThreshold' : [ 0x18, ['unsigned long long']], + 'PebsBufferBase' : [ 0x20, ['unsigned long long']], + 'PebsIndex' : [ 0x28, ['unsigned long long']], + 'PebsAbsoluteMaximum' : [ 0x30, ['unsigned long long']], + 'PebsInterruptThreshold' : [ 0x38, ['unsigned long long']], + 'PebsCounterReset0' : [ 0x40, ['unsigned long long']], + 'PebsCounterReset1' : [ 0x48, ['unsigned long long']], + 'PebsCounterReset2' : [ 0x50, ['unsigned long long']], + 'PebsCounterReset3' : [ 0x58, ['unsigned long long']], +} ], + '_OBJECT_TYPE_INITIALIZER' : [ 0x78, { + 'Length' : [ 0x0, ['unsigned short']], + 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CacheAligned' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ObjectTypeCode' : [ 0x4, ['unsigned long']], + 'InvalidAttributes' : [ 0x8, ['unsigned long']], + 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], + 'ValidAccessMask' : [ 0x1c, ['unsigned long']], + 'RetainAccess' : [ 0x20, ['unsigned long']], + 'PoolType' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'DefaultPagedPoolCharge' : [ 0x28, ['unsigned long']], + 'DefaultNonPagedPoolCharge' : [ 0x2c, ['unsigned long']], + 'DumpProcedure' : [ 0x30, ['pointer64', ['void']]], + 'OpenProcedure' : [ 0x38, ['pointer64', ['void']]], + 'CloseProcedure' : [ 0x40, ['pointer64', ['void']]], + 'DeleteProcedure' : [ 0x48, ['pointer64', ['void']]], + 'ParseProcedure' : [ 0x50, ['pointer64', ['void']]], + 'SecurityProcedure' : [ 0x58, ['pointer64', ['void']]], + 'QueryNameProcedure' : [ 0x60, ['pointer64', ['void']]], + 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], + 'WaitObjectFlagMask' : [ 0x70, ['unsigned long']], + 'WaitObjectFlagOffset' : [ 0x74, ['unsigned short']], + 'WaitObjectPointerOffset' : [ 0x76, ['unsigned short']], +} ], + '__unnamed_2169' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], +} ], + '_SUBSECTION' : [ 0x38, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'SubsectionBase' : [ 0x8, ['pointer64', ['_MMPTE']]], + 'NextSubsection' : [ 0x10, ['pointer64', ['_SUBSECTION']]], + 'PtesInSubsection' : [ 0x18, ['unsigned long']], + 'UnusedPtes' : [ 0x20, ['unsigned long']], + 'GlobalPerSessionHead' : [ 0x20, ['_RTL_AVL_TREE']], + 'u' : [ 0x28, ['__unnamed_2169']], + 'StartingSector' : [ 0x2c, ['unsigned long']], + 'NumberOfFullSectors' : [ 0x30, ['unsigned long']], +} ], + '_KPROCESSOR_STATE' : [ 0x5b0, { + 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], + 'ContextFrame' : [ 0xe0, ['_CONTEXT']], +} ], + 'tagSWITCH_CONTEXT_ATTRIBUTE' : [ 0x18, { + 'ulContextUpdateCounter' : [ 0x0, ['unsigned long long']], + 'fAllowContextUpdate' : [ 0x8, ['long']], + 'fEnableTrace' : [ 0xc, ['long']], + 'EtwHandle' : [ 0x10, ['unsigned long long']], +} ], + '_IO_CLIENT_EXTENSION' : [ 0x10, { + 'NextExtension' : [ 0x0, ['pointer64', ['_IO_CLIENT_EXTENSION']]], + 'ClientIdentificationAddress' : [ 0x8, ['pointer64', ['void']]], +} ], + '_ETW_BUFFER_CONTEXT' : [ 0x4, { + 'ProcessorNumber' : [ 0x0, ['unsigned char']], + 'Alignment' : [ 0x1, ['unsigned char']], + 'ProcessorIndex' : [ 0x0, ['unsigned short']], + 'LoggerId' : [ 0x2, ['unsigned short']], +} ], + '_DIRTY_PAGE_STATISTICS' : [ 0x18, { + 'DirtyPages' : [ 0x0, ['unsigned long long']], + 'DirtyPagesLastScan' : [ 0x8, ['unsigned long long']], + 'DirtyPagesScheduledLastScan' : [ 0x10, ['unsigned long']], +} ], + '_PROC_IDLE_SNAP' : [ 0x10, { + 'Time' : [ 0x0, ['unsigned long long']], + 'Idle' : [ 0x8, ['unsigned long long']], +} ], + '_KERNEL_STACK_SEGMENT' : [ 0x20, { + 'StackBase' : [ 0x0, ['unsigned long long']], + 'StackLimit' : [ 0x8, ['unsigned long long']], + 'KernelStack' : [ 0x10, ['unsigned long long']], + 'InitialStack' : [ 0x18, ['unsigned long long']], +} ], + '_KEXECUTE_OPTIONS' : [ 0x1, { + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ExecuteOptions' : [ 0x0, ['unsigned char']], + 'ExecuteOptionsNV' : [ 0x0, ['unsigned char']], +} ], + '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { + 'Present' : [ 0x0, ['unsigned long long']], + 'Enabled' : [ 0x8, ['unsigned long long']], + 'EnabledByDefault' : [ 0x10, ['unsigned long long']], +} ], + '_WHEA_XPF_MCE_DESCRIPTOR' : [ 0x398, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Flags' : [ 0x4, ['_XPF_MCE_FLAGS']], + 'MCG_Capability' : [ 0x8, ['unsigned long long']], + 'MCG_GlobalControl' : [ 0x10, ['unsigned long long']], + 'Banks' : [ 0x18, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_ARBITER_ALLOCATION_STATE' : [ 0x50, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'CurrentMinimum' : [ 0x10, ['unsigned long long']], + 'CurrentMaximum' : [ 0x18, ['unsigned long long']], + 'Entry' : [ 0x20, ['pointer64', ['_ARBITER_LIST_ENTRY']]], + 'CurrentAlternative' : [ 0x28, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'AlternativeCount' : [ 0x30, ['unsigned long']], + 'Alternatives' : [ 0x38, ['pointer64', ['_ARBITER_ALTERNATIVE']]], + 'Flags' : [ 0x40, ['unsigned short']], + 'RangeAttributes' : [ 0x42, ['unsigned char']], + 'RangeAvailableAttributes' : [ 0x43, ['unsigned char']], + 'WorkSpace' : [ 0x48, ['unsigned long long']], +} ], + '_VACB_ARRAY_HEADER' : [ 0x10, { + 'VacbArrayIndex' : [ 0x0, ['unsigned long']], + 'MappingCount' : [ 0x4, ['unsigned long']], + 'HighestMappedIndex' : [ 0x8, ['unsigned long']], + 'Reserved' : [ 0xc, ['unsigned long']], +} ], + '_MMWSLENTRY' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'HighActiveFlink' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'HighActiveBlink' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 56, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], +} ], + '_DBGKD_SWITCH_PARTITION' : [ 0x4, { + 'Partition' : [ 0x0, ['unsigned long']], +} ], + '_REQUEST_MAILBOX' : [ 0x40, { + 'Next' : [ 0x0, ['pointer64', ['_REQUEST_MAILBOX']]], + 'RequestSummary' : [ 0x8, ['long long']], + 'RequestPacket' : [ 0x10, ['_KREQUEST_PACKET']], + 'NodeTargetCountAddr' : [ 0x30, ['pointer64', ['long']]], + 'NodeTargetCount' : [ 0x38, ['long']], +} ], + '_DBGKD_GET_VERSION32' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned short']], + 'Flags' : [ 0x6, ['unsigned short']], + 'KernBase' : [ 0x8, ['unsigned long']], + 'PsLoadedModuleList' : [ 0xc, ['unsigned long']], + 'MachineType' : [ 0x10, ['unsigned short']], + 'ThCallbackStack' : [ 0x12, ['unsigned short']], + 'NextCallback' : [ 0x14, ['unsigned short']], + 'FramePointer' : [ 0x16, ['unsigned short']], + 'KiCallUserMode' : [ 0x18, ['unsigned long']], + 'KeUserCallbackDispatcher' : [ 0x1c, ['unsigned long']], + 'BreakpointWithStatus' : [ 0x20, ['unsigned long']], + 'DebuggerDataList' : [ 0x24, ['unsigned long']], +} ], + '_WHEA_XPF_CMC_DESCRIPTOR' : [ 0x3a4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'NumberOfBanks' : [ 0x3, ['unsigned char']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'Notify' : [ 0x8, ['_WHEA_NOTIFICATION_DESCRIPTOR']], + 'Banks' : [ 0x24, ['array', 32, ['_WHEA_XPF_MC_BANK_DESCRIPTOR']]], +} ], + '_WHEA_TIMESTAMP' : [ 0x8, { + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], + 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], +} ], + '_PEB32' : [ 0x250, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Mutant' : [ 0x4, ['unsigned long']], + 'ImageBaseAddress' : [ 0x8, ['unsigned long']], + 'Ldr' : [ 0xc, ['unsigned long']], + 'ProcessParameters' : [ 0x10, ['unsigned long']], + 'SubSystemData' : [ 0x14, ['unsigned long']], + 'ProcessHeap' : [ 0x18, ['unsigned long']], + 'FastPebLock' : [ 0x1c, ['unsigned long']], + 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], + 'IFEOKey' : [ 0x24, ['unsigned long']], + 'CrossProcessFlags' : [ 0x28, ['unsigned long']], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], + 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], + 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], + 'ApiSetMap' : [ 0x38, ['unsigned long']], + 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], + 'TlsBitmap' : [ 0x40, ['unsigned long']], + 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x4c, ['unsigned long']], + 'SparePvoid0' : [ 0x50, ['unsigned long']], + 'ReadOnlyStaticServerData' : [ 0x54, ['unsigned long']], + 'AnsiCodePageData' : [ 0x58, ['unsigned long']], + 'OemCodePageData' : [ 0x5c, ['unsigned long']], + 'UnicodeCaseTableData' : [ 0x60, ['unsigned long']], + 'NumberOfProcessors' : [ 0x64, ['unsigned long']], + 'NtGlobalFlag' : [ 0x68, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], + 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], + 'NumberOfHeaps' : [ 0x88, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], + 'ProcessHeaps' : [ 0x90, ['unsigned long']], + 'GdiSharedHandleTable' : [ 0x94, ['unsigned long']], + 'ProcessStarterHelper' : [ 0x98, ['unsigned long']], + 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], + 'LoaderLock' : [ 0xa0, ['unsigned long']], + 'OSMajorVersion' : [ 0xa4, ['unsigned long']], + 'OSMinorVersion' : [ 0xa8, ['unsigned long']], + 'OSBuildNumber' : [ 0xac, ['unsigned short']], + 'OSCSDVersion' : [ 0xae, ['unsigned short']], + 'OSPlatformId' : [ 0xb0, ['unsigned long']], + 'ImageSubsystem' : [ 0xb4, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], + 'ActiveProcessAffinityMask' : [ 0xc0, ['unsigned long']], + 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x14c, ['unsigned long']], + 'TlsExpansionBitmap' : [ 0x150, ['unsigned long']], + 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x1d4, ['unsigned long']], + 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x1e8, ['unsigned long']], + 'AppCompatInfo' : [ 0x1ec, ['unsigned long']], + 'CSDVersion' : [ 0x1f0, ['_STRING32']], + 'ActivationContextData' : [ 0x1f8, ['unsigned long']], + 'ProcessAssemblyStorageMap' : [ 0x1fc, ['unsigned long']], + 'SystemDefaultActivationContextData' : [ 0x200, ['unsigned long']], + 'SystemAssemblyStorageMap' : [ 0x204, ['unsigned long']], + 'MinimumStackCommit' : [ 0x208, ['unsigned long']], + 'FlsCallback' : [ 0x20c, ['unsigned long']], + 'FlsListHead' : [ 0x210, ['LIST_ENTRY32']], + 'FlsBitmap' : [ 0x218, ['unsigned long']], + 'FlsBitmapBits' : [ 0x21c, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x22c, ['unsigned long']], + 'WerRegistrationData' : [ 0x230, ['unsigned long']], + 'WerShipAssertPtr' : [ 0x234, ['unsigned long']], + 'pUnused' : [ 0x238, ['unsigned long']], + 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], + 'TracingFlags' : [ 0x240, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x248, ['unsigned long long']], +} ], + '_VPB' : [ 0x60, { + 'Type' : [ 0x0, ['short']], + 'Size' : [ 0x2, ['short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'VolumeLabelLength' : [ 0x6, ['unsigned short']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'RealDevice' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'SerialNumber' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'VolumeLabel' : [ 0x20, ['array', 32, ['wchar']]], +} ], + '_CACHE_DESCRIPTOR' : [ 0xc, { + 'Level' : [ 0x0, ['unsigned char']], + 'Associativity' : [ 0x1, ['unsigned char']], + 'LineSize' : [ 0x2, ['unsigned short']], + 'Size' : [ 0x4, ['unsigned long']], + 'Type' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'CacheUnified', 1: 'CacheInstruction', 2: 'CacheData', 3: 'CacheTrace'})]], +} ], + '_IOP_IRP_STACK_PROFILER' : [ 0x54, { + 'Profile' : [ 0x0, ['array', 20, ['unsigned long']]], + 'TotalIrps' : [ 0x50, ['unsigned long']], +} ], + '_FILE_BASIC_INFORMATION' : [ 0x28, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x20, ['unsigned long']], +} ], + '_SECURITY_SUBJECT_CONTEXT' : [ 0x20, { + 'ClientToken' : [ 0x0, ['pointer64', ['void']]], + 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], + 'PrimaryToken' : [ 0x10, ['pointer64', ['void']]], + 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], +} ], + '_EVENT_HEADER' : [ 0x50, { + 'Size' : [ 0x0, ['unsigned short']], + 'HeaderType' : [ 0x2, ['unsigned short']], + 'Flags' : [ 0x4, ['unsigned short']], + 'EventProperty' : [ 0x6, ['unsigned short']], + 'ThreadId' : [ 0x8, ['unsigned long']], + 'ProcessId' : [ 0xc, ['unsigned long']], + 'TimeStamp' : [ 0x10, ['_LARGE_INTEGER']], + 'ProviderId' : [ 0x18, ['_GUID']], + 'EventDescriptor' : [ 0x28, ['_EVENT_DESCRIPTOR']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ProcessorTime' : [ 0x38, ['unsigned long long']], + 'ActivityId' : [ 0x40, ['_GUID']], +} ], + '_PF_KERNEL_GLOBALS' : [ 0x60, { + 'AccessBufferAgeThreshold' : [ 0x0, ['unsigned long long']], + 'AccessBufferRef' : [ 0x8, ['_EX_RUNDOWN_REF']], + 'AccessBufferExistsEvent' : [ 0x10, ['_KEVENT']], + 'AccessBufferMax' : [ 0x28, ['unsigned long']], + 'AccessBufferList' : [ 0x40, ['_SLIST_HEADER']], + 'StreamSequenceNumber' : [ 0x50, ['long']], + 'Flags' : [ 0x54, ['unsigned long']], + 'ScenarioPrefetchCount' : [ 0x58, ['long']], +} ], + '_CM_KEY_HASH_TABLE_ENTRY' : [ 0x18, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'Owner' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'Entry' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], +} ], + '_ARBITER_QUERY_ARBITRATE_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_ARBITER_BOOT_ALLOCATION_PARAMETERS' : [ 0x8, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], +} ], + '_KPRIQUEUE' : [ 0x2b0, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['array', 32, ['_LIST_ENTRY']]], + 'CurrentCount' : [ 0x218, ['array', 32, ['long']]], + 'MaximumCount' : [ 0x298, ['unsigned long']], + 'ThreadListHead' : [ 0x2a0, ['_LIST_ENTRY']], +} ], + '_EXCEPTION_REGISTRATION_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], + 'Handler' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WAITING_IRP' : [ 0x38, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'CompletionRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'Information' : [ 0x30, ['unsigned long']], + 'BreakAllRH' : [ 0x34, ['unsigned char']], +} ], + '_POP_SYSTEM_IDLE' : [ 0x40, { + 'AverageIdleness' : [ 0x0, ['long']], + 'LowestIdleness' : [ 0x4, ['long']], + 'Time' : [ 0x8, ['unsigned long']], + 'Timeout' : [ 0xc, ['unsigned long']], + 'LastUserInput' : [ 0x10, ['unsigned long']], + 'Action' : [ 0x14, ['POWER_ACTION_POLICY']], + 'MinState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SystemRequired' : [ 0x24, ['unsigned long']], + 'IdleWorker' : [ 0x28, ['unsigned char']], + 'Sampling' : [ 0x29, ['unsigned char']], + 'LastTick' : [ 0x30, ['unsigned long long']], + 'LastSystemRequiredTime' : [ 0x38, ['unsigned long']], +} ], + '_VF_TARGET_ALL_SHARED_EXPORT_THUNKS' : [ 0x20, { + 'SharedExportThunks' : [ 0x0, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'PoolSharedExportThunks' : [ 0x8, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'OrderDependentSharedExportThunks' : [ 0x10, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], + 'XdvSharedExportThunks' : [ 0x18, ['pointer64', ['_VERIFIER_SHARED_EXPORT_THUNK']]], +} ], + '_KSCHEDULING_GROUP' : [ 0x1c0, { + 'Value' : [ 0x0, ['unsigned short']], + 'Type' : [ 0x2, ['unsigned char']], + 'HardCap' : [ 0x3, ['unsigned char']], + 'RelativeWeight' : [ 0x4, ['unsigned long']], + 'QueryHistoryTimeStamp' : [ 0x8, ['unsigned long long']], + 'NotificationCycles' : [ 0x10, ['long long']], + 'SchedulingGroupList' : [ 0x18, ['_LIST_ENTRY']], + 'NotificationDpc' : [ 0x28, ['pointer64', ['_KDPC']]], + 'PerProcessor' : [ 0x40, ['array', 1, ['_KSCB']]], +} ], + '_ETW_REF_CLOCK' : [ 0x10, { + 'StartTime' : [ 0x0, ['_LARGE_INTEGER']], + 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], +} ], + '_OB_DUPLICATE_OBJECT_STATE' : [ 0x28, { + 'SourceProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'SourceHandle' : [ 0x8, ['pointer64', ['void']]], + 'Object' : [ 0x10, ['pointer64', ['void']]], + 'TargetAccess' : [ 0x18, ['unsigned long']], + 'ObjectInfo' : [ 0x1c, ['_HANDLE_TABLE_ENTRY_INFO']], + 'HandleAttributes' : [ 0x20, ['unsigned long']], +} ], + '_MMPTE_SUBSECTION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], +} ], + '_POWER_STATE' : [ 0x4, { + 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DeviceState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], +} ], + '_POP_IRP_WORKER_ENTRY' : [ 0x30, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'Irp' : [ 0x18, ['pointer64', ['_IRP']]], + 'Device' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'Static' : [ 0x28, ['unsigned char']], +} ], + '_POP_POLICY_DEVICE' : [ 0x40, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceType' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyDeviceMax'})]], + 'Notification' : [ 0x18, ['pointer64', ['void']]], + 'Name' : [ 0x20, ['_UNICODE_STRING']], + 'Device' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'Irp' : [ 0x38, ['pointer64', ['_IRP']]], +} ], + '__unnamed_21f1' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_21f3' : [ 0x10, { + 'Level' : [ 0x0, ['unsigned short']], + 'Group' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_21f5' : [ 0x10, { + 'Group' : [ 0x0, ['unsigned short']], + 'MessageCount' : [ 0x2, ['unsigned short']], + 'Vector' : [ 0x4, ['unsigned long']], + 'Affinity' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_21f7' : [ 0x10, { + 'Raw' : [ 0x0, ['__unnamed_21f5']], + 'Translated' : [ 0x0, ['__unnamed_21f3']], +} ], + '__unnamed_21f9' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'Port' : [ 0x4, ['unsigned long']], + 'Reserved1' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_21fb' : [ 0xc, { + 'Channel' : [ 0x0, ['unsigned long']], + 'RequestLine' : [ 0x4, ['unsigned long']], + 'TransferWidth' : [ 0x8, ['unsigned char']], + 'Reserved1' : [ 0x9, ['unsigned char']], + 'Reserved2' : [ 0xa, ['unsigned char']], + 'Reserved3' : [ 0xb, ['unsigned char']], +} ], + '__unnamed_21fd' : [ 0xc, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Reserved' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_21ff' : [ 0xc, { + 'DataSize' : [ 0x0, ['unsigned long']], + 'Reserved1' : [ 0x4, ['unsigned long']], + 'Reserved2' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2201' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length40' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2203' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length48' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2205' : [ 0xc, { + 'Start' : [ 0x0, ['_LARGE_INTEGER']], + 'Length64' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2207' : [ 0x10, { + 'Generic' : [ 0x0, ['__unnamed_21f1']], + 'Port' : [ 0x0, ['__unnamed_21f1']], + 'Interrupt' : [ 0x0, ['__unnamed_21f3']], + 'MessageInterrupt' : [ 0x0, ['__unnamed_21f7']], + 'Memory' : [ 0x0, ['__unnamed_21f1']], + 'Dma' : [ 0x0, ['__unnamed_21f9']], + 'DmaV3' : [ 0x0, ['__unnamed_21fb']], + 'DevicePrivate' : [ 0x0, ['__unnamed_2094']], + 'BusNumber' : [ 0x0, ['__unnamed_21fd']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_21ff']], + 'Memory40' : [ 0x0, ['__unnamed_2201']], + 'Memory48' : [ 0x0, ['__unnamed_2203']], + 'Memory64' : [ 0x0, ['__unnamed_2205']], + 'Connection' : [ 0x0, ['__unnamed_20a0']], +} ], + '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x14, { + 'Type' : [ 0x0, ['unsigned char']], + 'ShareDisposition' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['unsigned short']], + 'u' : [ 0x4, ['__unnamed_2207']], +} ], + '_OBJECT_HEADER_PADDING_INFO' : [ 0x4, { + 'PaddingAmount' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_220f' : [ 0x4, { + 'PhysicalAddress' : [ 0x0, ['unsigned long']], + 'VirtualSize' : [ 0x0, ['unsigned long']], +} ], + '_IMAGE_SECTION_HEADER' : [ 0x28, { + 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], + 'Misc' : [ 0x8, ['__unnamed_220f']], + 'VirtualAddress' : [ 0xc, ['unsigned long']], + 'SizeOfRawData' : [ 0x10, ['unsigned long']], + 'PointerToRawData' : [ 0x14, ['unsigned long']], + 'PointerToRelocations' : [ 0x18, ['unsigned long']], + 'PointerToLinenumbers' : [ 0x1c, ['unsigned long']], + 'NumberOfRelocations' : [ 0x20, ['unsigned short']], + 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], + 'Characteristics' : [ 0x24, ['unsigned long']], +} ], + '_INVERTED_FUNCTION_TABLE_ENTRY' : [ 0x18, { + 'FunctionTable' : [ 0x0, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'DynamicTable' : [ 0x0, ['pointer64', ['_DYNAMIC_FUNCTION_TABLE']]], + 'ImageBase' : [ 0x8, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x10, ['unsigned long']], + 'SizeOfTable' : [ 0x14, ['unsigned long']], +} ], + '_ARBITER_ADD_RESERVED_PARAMETERS' : [ 0x8, { + 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '__unnamed_221f' : [ 0x50, { + 'CellData' : [ 0x0, ['_CELL_DATA']], + 'List' : [ 0x0, ['array', 1, ['unsigned long long']]], +} ], + '_CM_CACHED_VALUE_INDEX' : [ 0x58, { + 'CellIndex' : [ 0x0, ['unsigned long']], + 'Data' : [ 0x8, ['__unnamed_221f']], +} ], + '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { + 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE_NODE' : [ 0x10, { + 'p' : [ 0x0, ['pointer64', ['void']]], + 'RangeSize' : [ 0x8, ['unsigned long long']], +} ], + '_POP_FX_DEVICE' : [ 0x218, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'IrpData' : [ 0x18, ['pointer64', ['_POP_IRP_DATA']]], + 'Status' : [ 0x20, ['_POP_FX_DEVICE_STATUS']], + 'PowerReqCall' : [ 0x24, ['long']], + 'PowerNotReqCall' : [ 0x28, ['long']], + 'Plugin' : [ 0x30, ['pointer64', ['_POP_FX_PLUGIN']]], + 'PluginHandle' : [ 0x38, ['pointer64', ['PEPHANDLE__']]], + 'MiniPlugin' : [ 0x40, ['pointer64', ['_POP_FX_PLUGIN']]], + 'MiniPluginHandle' : [ 0x48, ['pointer64', ['PEPHANDLE__']]], + 'DevNode' : [ 0x50, ['pointer64', ['_DEVICE_NODE']]], + 'DeviceObject' : [ 0x58, ['pointer64', ['_DEVICE_OBJECT']]], + 'TargetDevice' : [ 0x60, ['pointer64', ['_DEVICE_OBJECT']]], + 'Callbacks' : [ 0x68, ['_POP_FX_DRIVER_CALLBACKS']], + 'DriverContext' : [ 0xa0, ['pointer64', ['void']]], + 'RemoveLock' : [ 0xa8, ['_IO_REMOVE_LOCK']], + 'WorkOrder' : [ 0xc8, ['_POP_FX_WORK_ORDER']], + 'IdleLock' : [ 0x100, ['unsigned long long']], + 'IdleTimer' : [ 0x108, ['_KTIMER']], + 'IdleDpc' : [ 0x148, ['_KDPC']], + 'IdleTimeout' : [ 0x188, ['unsigned long long']], + 'IdleStamp' : [ 0x190, ['unsigned long long']], + 'NextIrpDeviceObject' : [ 0x198, ['pointer64', ['_DEVICE_OBJECT']]], + 'NextIrpPowerState' : [ 0x1a0, ['_POWER_STATE']], + 'NextIrpCallerCompletion' : [ 0x1a8, ['pointer64', ['void']]], + 'NextIrpCallerContext' : [ 0x1b0, ['pointer64', ['void']]], + 'IrpCompleteEvent' : [ 0x1b8, ['_KEVENT']], + 'PowerOnDumpDeviceCallback' : [ 0x1d0, ['pointer64', ['void']]], + 'Accounting' : [ 0x1d8, ['_POP_FX_ACCOUNTING']], + 'ComponentCount' : [ 0x208, ['unsigned long']], + 'Components' : [ 0x210, ['array', 1, ['pointer64', ['_POP_FX_COMPONENT']]]], +} ], + '__unnamed_2238' : [ 0x8, { + 'IdleTime' : [ 0x0, ['unsigned long']], + 'NonIdleTime' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_223a' : [ 0x8, { + 'Disk' : [ 0x0, ['__unnamed_2238']], +} ], + '_DEVICE_OBJECT_POWER_EXTENSION' : [ 0x58, { + 'IdleCount' : [ 0x0, ['unsigned long']], + 'BusyCount' : [ 0x4, ['unsigned long']], + 'BusyReference' : [ 0x8, ['unsigned long']], + 'TotalBusyCount' : [ 0xc, ['unsigned long']], + 'ConservationIdleTime' : [ 0x10, ['unsigned long']], + 'PerformanceIdleTime' : [ 0x14, ['unsigned long']], + 'DeviceObject' : [ 0x18, ['pointer64', ['_DEVICE_OBJECT']]], + 'IdleList' : [ 0x20, ['_LIST_ENTRY']], + 'IdleType' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceIdleNormal', 1: 'DeviceIdleDisk'})]], + 'IdleState' : [ 0x34, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'CurrentState' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], + 'Volume' : [ 0x40, ['_LIST_ENTRY']], + 'Specific' : [ 0x50, ['__unnamed_223a']], +} ], + '_ARBITER_RETEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_PROCESSOR_NUMBER' : [ 0x4, { + 'Group' : [ 0x0, ['unsigned short']], + 'Number' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_MI_TRIAGE_DUMP_DATA' : [ 0x28, { + 'BadPageCount' : [ 0x0, ['unsigned long long']], + 'BadPagesDetected' : [ 0x8, ['long']], + 'ZeroedPageSingleBitErrorsDetected' : [ 0xc, ['long']], + 'ScrubPasses' : [ 0x10, ['long']], + 'ScrubBadPagesFound' : [ 0x14, ['long']], + 'FeatureBits' : [ 0x18, ['unsigned long long']], + 'TimeZoneId' : [ 0x20, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_FS_FILTER_CALLBACKS' : [ 0x68, { + 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer64', ['void']]], + 'PostAcquireForSectionSynchronization' : [ 0x10, ['pointer64', ['void']]], + 'PreReleaseForSectionSynchronization' : [ 0x18, ['pointer64', ['void']]], + 'PostReleaseForSectionSynchronization' : [ 0x20, ['pointer64', ['void']]], + 'PreAcquireForCcFlush' : [ 0x28, ['pointer64', ['void']]], + 'PostAcquireForCcFlush' : [ 0x30, ['pointer64', ['void']]], + 'PreReleaseForCcFlush' : [ 0x38, ['pointer64', ['void']]], + 'PostReleaseForCcFlush' : [ 0x40, ['pointer64', ['void']]], + 'PreAcquireForModifiedPageWriter' : [ 0x48, ['pointer64', ['void']]], + 'PostAcquireForModifiedPageWriter' : [ 0x50, ['pointer64', ['void']]], + 'PreReleaseForModifiedPageWriter' : [ 0x58, ['pointer64', ['void']]], + 'PostReleaseForModifiedPageWriter' : [ 0x60, ['pointer64', ['void']]], +} ], + '_KENLISTMENT' : [ 0x1e0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'NamespaceLink' : [ 0x8, ['_KTMOBJECT_NAMESPACE_LINK']], + 'EnlistmentId' : [ 0x30, ['_GUID']], + 'Mutex' : [ 0x40, ['_KMUTANT']], + 'NextSameTx' : [ 0x78, ['_LIST_ENTRY']], + 'NextSameRm' : [ 0x88, ['_LIST_ENTRY']], + 'ResourceManager' : [ 0x98, ['pointer64', ['_KRESOURCEMANAGER']]], + 'Transaction' : [ 0xa0, ['pointer64', ['_KTRANSACTION']]], + 'State' : [ 0xa8, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], + 'Flags' : [ 0xac, ['unsigned long']], + 'NotificationMask' : [ 0xb0, ['unsigned long']], + 'Key' : [ 0xb8, ['pointer64', ['void']]], + 'KeyRefCount' : [ 0xc0, ['unsigned long']], + 'RecoveryInformation' : [ 0xc8, ['pointer64', ['void']]], + 'RecoveryInformationLength' : [ 0xd0, ['unsigned long']], + 'DynamicNameInformation' : [ 0xd8, ['pointer64', ['void']]], + 'DynamicNameInformationLength' : [ 0xe0, ['unsigned long']], + 'FinalNotification' : [ 0xe8, ['pointer64', ['_KTMNOTIFICATION_PACKET']]], + 'SupSubEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'SupSubEnlHandle' : [ 0xf8, ['pointer64', ['void']]], + 'SubordinateTxHandle' : [ 0x100, ['pointer64', ['void']]], + 'CrmEnlistmentEnId' : [ 0x108, ['_GUID']], + 'CrmEnlistmentTmId' : [ 0x118, ['_GUID']], + 'CrmEnlistmentRmId' : [ 0x128, ['_GUID']], + 'NextHistory' : [ 0x138, ['unsigned long']], + 'History' : [ 0x13c, ['array', 20, ['_KENLISTMENT_HISTORY']]], +} ], + '_ARBITER_INTERFACE' : [ 0x30, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'Context' : [ 0x8, ['pointer64', ['void']]], + 'InterfaceReference' : [ 0x10, ['pointer64', ['void']]], + 'InterfaceDereference' : [ 0x18, ['pointer64', ['void']]], + 'ArbiterHandler' : [ 0x20, ['pointer64', ['void']]], + 'Flags' : [ 0x28, ['unsigned long']], +} ], + '_KAPC_STATE' : [ 0x30, { + 'ApcListHead' : [ 0x0, ['array', 2, ['_LIST_ENTRY']]], + 'Process' : [ 0x20, ['pointer64', ['_KPROCESS']]], + 'InProgressFlags' : [ 0x28, ['unsigned char']], + 'KernelApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpecialApcInProgress' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KernelApcPending' : [ 0x29, ['unsigned char']], + 'UserApcPending' : [ 0x2a, ['unsigned char']], +} ], + '_DELAY_ACK_FO' : [ 0x18, { + 'Links' : [ 0x0, ['_LIST_ENTRY']], + 'OriginalFileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], +} ], + '_DEVICE_RELATIONS' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Objects' : [ 0x8, ['array', 1, ['pointer64', ['_DEVICE_OBJECT']]]], +} ], + '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { + 'Magic' : [ 0x0, ['unsigned short']], + 'MajorLinkerVersion' : [ 0x2, ['unsigned char']], + 'MinorLinkerVersion' : [ 0x3, ['unsigned char']], + 'SizeOfCode' : [ 0x4, ['unsigned long']], + 'SizeOfInitializedData' : [ 0x8, ['unsigned long']], + 'SizeOfUninitializedData' : [ 0xc, ['unsigned long']], + 'AddressOfEntryPoint' : [ 0x10, ['unsigned long']], + 'BaseOfCode' : [ 0x14, ['unsigned long']], + 'BaseOfData' : [ 0x18, ['unsigned long']], + 'BaseOfBss' : [ 0x1c, ['unsigned long']], + 'GprMask' : [ 0x20, ['unsigned long']], + 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], + 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_ALPC_COMPLETION_LIST_HEADER' : [ 0x180, { + 'StartMagic' : [ 0x0, ['unsigned long long']], + 'TotalSize' : [ 0x8, ['unsigned long']], + 'ListOffset' : [ 0xc, ['unsigned long']], + 'ListSize' : [ 0x10, ['unsigned long']], + 'BitmapOffset' : [ 0x14, ['unsigned long']], + 'BitmapSize' : [ 0x18, ['unsigned long']], + 'DataOffset' : [ 0x1c, ['unsigned long']], + 'DataSize' : [ 0x20, ['unsigned long']], + 'AttributeFlags' : [ 0x24, ['unsigned long']], + 'AttributeSize' : [ 0x28, ['unsigned long']], + 'State' : [ 0x40, ['_ALPC_COMPLETION_LIST_STATE']], + 'LastMessageId' : [ 0x48, ['unsigned long']], + 'LastCallbackId' : [ 0x4c, ['unsigned long']], + 'PostCount' : [ 0x80, ['unsigned long']], + 'ReturnCount' : [ 0xc0, ['unsigned long']], + 'LogSequenceNumber' : [ 0x100, ['unsigned long']], + 'UserLock' : [ 0x140, ['_RTL_SRWLOCK']], + 'EndMagic' : [ 0x148, ['unsigned long long']], +} ], + '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { + 'Characteristics' : [ 0x0, ['unsigned long']], + 'TimeDateStamp' : [ 0x4, ['unsigned long']], + 'MajorVersion' : [ 0x8, ['unsigned short']], + 'MinorVersion' : [ 0xa, ['unsigned short']], + 'Type' : [ 0xc, ['unsigned long']], + 'SizeOfData' : [ 0x10, ['unsigned long']], + 'AddressOfRawData' : [ 0x14, ['unsigned long']], + 'PointerToRawData' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_AER_ENDPOINT_DESCRIPTOR' : [ 0x20, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ENDPOINT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], +} ], + '_ETW_WMITRACE_WORK' : [ 0xf0, { + 'LoggerId' : [ 0x0, ['unsigned long']], + 'SpareUlong' : [ 0x4, ['unsigned long']], + 'LoggerName' : [ 0x8, ['array', 65, ['unsigned char']]], + 'FileName' : [ 0x49, ['array', 129, ['unsigned char']]], + 'MaximumFileSize' : [ 0xcc, ['unsigned long']], + 'MinBuffers' : [ 0xd0, ['unsigned long']], + 'MaxBuffers' : [ 0xd4, ['unsigned long']], + 'BufferSize' : [ 0xd8, ['unsigned long']], + 'Mode' : [ 0xdc, ['unsigned long']], + 'FlushTimer' : [ 0xe0, ['unsigned long']], + 'MatchAny' : [ 0x8, ['unsigned long long']], + 'MatchAll' : [ 0x10, ['unsigned long long']], + 'EnableProperty' : [ 0x18, ['unsigned long']], + 'Guid' : [ 0x1c, ['_GUID']], + 'Level' : [ 0x2c, ['unsigned char']], + 'Status' : [ 0xe8, ['long']], +} ], + '_DEVICE_MAP' : [ 0x40, { + 'DosDevicesDirectory' : [ 0x0, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'GlobalDosDevicesDirectory' : [ 0x8, ['pointer64', ['_OBJECT_DIRECTORY']]], + 'DosDevicesDirectoryHandle' : [ 0x10, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x18, ['long']], + 'DriveMap' : [ 0x1c, ['unsigned long']], + 'DriveType' : [ 0x20, ['array', 32, ['unsigned char']]], +} ], + '_CHILD_LIST' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_IO_RESOURCE_LIST' : [ 0x28, { + 'Version' : [ 0x0, ['unsigned short']], + 'Revision' : [ 0x2, ['unsigned short']], + 'Count' : [ 0x4, ['unsigned long']], + 'Descriptors' : [ 0x8, ['array', 1, ['_IO_RESOURCE_DESCRIPTOR']]], +} ], + '_ARMCE_DBGKD_CONTROL_SET' : [ 0xc, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], +} ], + '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_XSAVE_AREA_HEADER' : [ 0x40, { + 'Mask' : [ 0x0, ['unsigned long long']], + 'Reserved' : [ 0x8, ['array', 7, ['unsigned long long']]], +} ], + '_RTL_CRITICAL_SECTION' : [ 0x28, { + 'DebugInfo' : [ 0x0, ['pointer64', ['_RTL_CRITICAL_SECTION_DEBUG']]], + 'LockCount' : [ 0x8, ['long']], + 'RecursionCount' : [ 0xc, ['long']], + 'OwningThread' : [ 0x10, ['pointer64', ['void']]], + 'LockSemaphore' : [ 0x18, ['pointer64', ['void']]], + 'SpinCount' : [ 0x20, ['unsigned long long']], +} ], + '_PNP_DEVICE_COMPLETION_REQUEST' : [ 0x40, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceNode' : [ 0x10, ['pointer64', ['_DEVICE_NODE']]], + 'Context' : [ 0x18, ['pointer64', ['void']]], + 'CompletionState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {768: 'DeviceNodeUnspecified', 769: 'DeviceNodeUninitialized', 770: 'DeviceNodeInitialized', 771: 'DeviceNodeDriversAdded', 772: 'DeviceNodeResourcesAssigned', 773: 'DeviceNodeStartPending', 774: 'DeviceNodeStartCompletion', 775: 'DeviceNodeStartPostWork', 776: 'DeviceNodeStarted', 777: 'DeviceNodeQueryStopped', 778: 'DeviceNodeStopped', 779: 'DeviceNodeRestartCompletion', 780: 'DeviceNodeEnumeratePending', 781: 'DeviceNodeEnumerateCompletion', 782: 'DeviceNodeAwaitingQueuedDeletion', 783: 'DeviceNodeAwaitingQueuedRemoval', 784: 'DeviceNodeQueryRemoved', 785: 'DeviceNodeRemovePendingCloses', 786: 'DeviceNodeRemoved', 787: 'DeviceNodeDeletePendingCloses', 788: 'DeviceNodeDeleted', 789: 'MaxDeviceNodeState'})]], + 'IrpPended' : [ 0x24, ['unsigned long']], + 'Status' : [ 0x28, ['long']], + 'Information' : [ 0x30, ['pointer64', ['void']]], + 'ReferenceCount' : [ 0x38, ['long']], +} ], + '_KTSS64' : [ 0x68, { + 'Reserved0' : [ 0x0, ['unsigned long']], + 'Rsp0' : [ 0x4, ['unsigned long long']], + 'Rsp1' : [ 0xc, ['unsigned long long']], + 'Rsp2' : [ 0x14, ['unsigned long long']], + 'Ist' : [ 0x1c, ['array', 8, ['unsigned long long']]], + 'Reserved1' : [ 0x5c, ['unsigned long long']], + 'Reserved2' : [ 0x64, ['unsigned short']], + 'IoMapBase' : [ 0x66, ['unsigned short']], +} ], + '__unnamed_229f' : [ 0x8, { + 'Start' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_22a1' : [ 0x8, { + 'RangeCount' : [ 0x0, ['unsigned long']], + 'SetBitCount' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_22a3' : [ 0x8, { + 'Context1' : [ 0x0, ['unsigned long']], + 'Context2' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_22a5' : [ 0x8, { + 'DirtyVectorModifiedContext' : [ 0x0, ['__unnamed_229f']], + 'DirtyDataCaptureContext' : [ 0x0, ['__unnamed_22a1']], + 'Raw' : [ 0x0, ['__unnamed_22a3']], +} ], + '_CM_DIRTY_VECTOR_LOG_ENTRY' : [ 0x50, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'Operation' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DirtyVectorModified', 1: 'DirtyDataCaptureStart', 2: 'DirtyDataCaptureEnd'})]], + 'Data' : [ 0xc, ['__unnamed_22a5']], + 'Stack' : [ 0x18, ['array', 7, ['pointer64', ['void']]]], +} ], + '__unnamed_22ac' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], +} ], + '__unnamed_22af' : [ 0x4, { + 'LongFlags1' : [ 0x0, ['unsigned long']], + 'VadFlags1' : [ 0x0, ['_MMVAD_FLAGS1']], +} ], + '_MMVAD_SHORT' : [ 0x40, { + 'VadNode' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'NextVad' : [ 0x0, ['pointer64', ['_MMVAD_SHORT']]], + 'StartingVpn' : [ 0x18, ['unsigned long']], + 'EndingVpn' : [ 0x1c, ['unsigned long']], + 'StartingVpnHigh' : [ 0x20, ['unsigned char']], + 'EndingVpnHigh' : [ 0x21, ['unsigned char']], + 'CommitChargeHigh' : [ 0x22, ['unsigned char']], + 'LargeImageBias' : [ 0x23, ['unsigned char']], + 'ReferenceCount' : [ 0x24, ['long']], + 'PushLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u' : [ 0x30, ['__unnamed_22ac']], + 'u1' : [ 0x34, ['__unnamed_22af']], + 'EventList' : [ 0x38, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], +} ], + '_KLOCK_ENTRY_LOCK_STATE' : [ 0x10, { + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Busy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 63, native_type='unsigned long long')]], + 'InTree' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], + 'LockState' : [ 0x0, ['pointer64', ['void']]], + 'SessionState' : [ 0x8, ['pointer64', ['void']]], + 'SessionId' : [ 0x8, ['unsigned long']], + 'SessionPad' : [ 0xc, ['unsigned long']], +} ], + '_WAIT_CONTEXT_BLOCK' : [ 0x48, { + 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], + 'DmaWaitEntry' : [ 0x0, ['_LIST_ENTRY']], + 'NumberOfChannels' : [ 0x10, ['unsigned long']], + 'SyncCallback' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DmaContext' : [ 0x14, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x14, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'DeviceRoutine' : [ 0x18, ['pointer64', ['void']]], + 'DeviceContext' : [ 0x20, ['pointer64', ['void']]], + 'NumberOfMapRegisters' : [ 0x28, ['unsigned long']], + 'DeviceObject' : [ 0x30, ['pointer64', ['void']]], + 'CurrentIrp' : [ 0x38, ['pointer64', ['void']]], + 'BufferChainingDpc' : [ 0x40, ['pointer64', ['_KDPC']]], +} ], + '_SECTION_OBJECT' : [ 0x30, { + 'StartingVa' : [ 0x0, ['pointer64', ['void']]], + 'EndingVa' : [ 0x8, ['pointer64', ['void']]], + 'Parent' : [ 0x10, ['pointer64', ['void']]], + 'LeftChild' : [ 0x18, ['pointer64', ['void']]], + 'RightChild' : [ 0x20, ['pointer64', ['void']]], + 'Segment' : [ 0x28, ['pointer64', ['_SEGMENT_OBJECT']]], +} ], + '_CM_NAME_CONTROL_BLOCK' : [ 0x20, { + 'Compressed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RefCount' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], + 'NameHash' : [ 0x8, ['_CM_NAME_HASH']], + 'ConvKey' : [ 0x8, ['unsigned long']], + 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], + 'NameLength' : [ 0x18, ['unsigned short']], + 'Name' : [ 0x1a, ['array', 1, ['wchar']]], +} ], + '_u' : [ 0x50, { + 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], + 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], + 'KeySecurity' : [ 0x0, ['_CM_KEY_SECURITY']], + 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], + 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], + 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], + 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], +} ], + '_HBASE_BLOCK' : [ 0x1000, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Sequence1' : [ 0x4, ['unsigned long']], + 'Sequence2' : [ 0x8, ['unsigned long']], + 'TimeStamp' : [ 0xc, ['_LARGE_INTEGER']], + 'Major' : [ 0x14, ['unsigned long']], + 'Minor' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['unsigned long']], + 'Format' : [ 0x20, ['unsigned long']], + 'RootCell' : [ 0x24, ['unsigned long']], + 'Length' : [ 0x28, ['unsigned long']], + 'Cluster' : [ 0x2c, ['unsigned long']], + 'FileName' : [ 0x30, ['array', 64, ['unsigned char']]], + 'RmId' : [ 0x70, ['_GUID']], + 'LogId' : [ 0x80, ['_GUID']], + 'Flags' : [ 0x90, ['unsigned long']], + 'TmId' : [ 0x94, ['_GUID']], + 'GuidSignature' : [ 0xa4, ['unsigned long']], + 'LastReorganizeTime' : [ 0xa8, ['unsigned long long']], + 'Reserved1' : [ 0xb0, ['array', 83, ['unsigned long']]], + 'CheckSum' : [ 0x1fc, ['unsigned long']], + 'Reserved2' : [ 0x200, ['array', 882, ['unsigned long']]], + 'ThawTmId' : [ 0xfc8, ['_GUID']], + 'ThawRmId' : [ 0xfd8, ['_GUID']], + 'ThawLogId' : [ 0xfe8, ['_GUID']], + 'BootType' : [ 0xff8, ['unsigned long']], + 'BootRecover' : [ 0xffc, ['unsigned long']], +} ], + '_GENERAL_LOOKASIDE_POOL' : [ 0x60, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'SingleListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'AllocateHits' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'FreeHits' : [ 0x20, ['unsigned long']], + 'Type' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPoolBase', 1: 'PagedPool', 2: 'NonPagedPoolBaseMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolBaseCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolBaseCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 516: 'NonPagedPoolNxCacheAligned', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 512: 'NonPagedPoolNx', 544: 'NonPagedPoolSessionNx', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x28, ['unsigned long']], + 'Size' : [ 0x2c, ['unsigned long']], + 'AllocateEx' : [ 0x30, ['pointer64', ['void']]], + 'Allocate' : [ 0x30, ['pointer64', ['void']]], + 'FreeEx' : [ 0x38, ['pointer64', ['void']]], + 'Free' : [ 0x38, ['pointer64', ['void']]], + 'ListEntry' : [ 0x40, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x50, ['unsigned long']], + 'LastAllocateMisses' : [ 0x54, ['unsigned long']], + 'LastAllocateHits' : [ 0x54, ['unsigned long']], + 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], +} ], + '_RTL_DYNAMIC_HASH_TABLE_ENTRY' : [ 0x18, { + 'Linkage' : [ 0x0, ['_LIST_ENTRY']], + 'Signature' : [ 0x10, ['unsigned long long']], +} ], + '_M128A' : [ 0x10, { + 'Low' : [ 0x0, ['unsigned long long']], + 'High' : [ 0x8, ['long long']], +} ], + '_HEAP_LOOKASIDE' : [ 0x40, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x10, ['unsigned short']], + 'MaximumDepth' : [ 0x12, ['unsigned short']], + 'TotalAllocates' : [ 0x14, ['unsigned long']], + 'AllocateMisses' : [ 0x18, ['unsigned long']], + 'TotalFrees' : [ 0x1c, ['unsigned long']], + 'FreeMisses' : [ 0x20, ['unsigned long']], + 'LastTotalAllocates' : [ 0x24, ['unsigned long']], + 'LastAllocateMisses' : [ 0x28, ['unsigned long']], + 'Counters' : [ 0x2c, ['array', 2, ['unsigned long']]], +} ], + '_KTIMER' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'DueTime' : [ 0x18, ['_ULARGE_INTEGER']], + 'TimerListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'Dpc' : [ 0x30, ['pointer64', ['_KDPC']]], + 'Processor' : [ 0x38, ['unsigned long']], + 'Period' : [ 0x3c, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x4, ['long']], + 'PushLock' : [ 0x8, ['_EX_PUSH_LOCK']], + 'ExHandleTable' : [ 0x10, ['pointer64', ['_HANDLE_TABLE']]], + 'Flags' : [ 0x18, ['unsigned long']], + 'NumberOfBuckets' : [ 0x1c, ['unsigned long']], + 'Buckets' : [ 0x20, ['array', 1, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]]], +} ], + '__unnamed_22f4' : [ 0x10, { + 'ProgrammedTime' : [ 0x0, ['unsigned long long']], + 'TimerInfo' : [ 0x8, ['pointer64', ['_DIAGNOSTIC_BUFFER']]], +} ], + '_POP_POWER_ACTION' : [ 0xe0, { + 'Updates' : [ 0x0, ['unsigned char']], + 'State' : [ 0x1, ['unsigned char']], + 'Shutdown' : [ 0x2, ['unsigned char']], + 'Action' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'LightestState' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Flags' : [ 0xc, ['unsigned long']], + 'Status' : [ 0x10, ['long']], + 'DeviceType' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyDeviceMax'})]], + 'DeviceTypeFlags' : [ 0x18, ['unsigned long']], + 'IrpMinor' : [ 0x1c, ['unsigned char']], + 'Waking' : [ 0x1d, ['unsigned char']], + 'SystemState' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'NextSystemState' : [ 0x24, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'EffectiveSystemState' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'CurrentSystemState' : [ 0x2c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ShutdownBugCode' : [ 0x30, ['pointer64', ['_POP_SHUTDOWN_BUG_CHECK']]], + 'DevState' : [ 0x38, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], + 'HiberContext' : [ 0x40, ['pointer64', ['_POP_HIBER_CONTEXT']]], + 'WakeTime' : [ 0x48, ['unsigned long long']], + 'SleepTime' : [ 0x50, ['unsigned long long']], + 'WakeAlarmSignaled' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'PoAc', 1: 'PoDc', 2: 'PoHot', 3: 'PoConditionMaximum'})]], + 'WakeAlarm' : [ 0x60, ['array', 3, ['__unnamed_22f4']]], + 'FilteredCapabilities' : [ 0x90, ['SYSTEM_POWER_CAPABILITIES']], +} ], + '_CM_KEY_VALUE' : [ 0x18, { + 'Signature' : [ 0x0, ['unsigned short']], + 'NameLength' : [ 0x2, ['unsigned short']], + 'DataLength' : [ 0x4, ['unsigned long']], + 'Data' : [ 0x8, ['unsigned long']], + 'Type' : [ 0xc, ['unsigned long']], + 'Flags' : [ 0x10, ['unsigned short']], + 'Spare' : [ 0x12, ['unsigned short']], + 'Name' : [ 0x14, ['array', 1, ['wchar']]], +} ], + '_CM_KEY_HASH' : [ 0x20, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_KEY_HASH']]], + 'KeyHive' : [ 0x10, ['pointer64', ['_HHIVE']]], + 'KeyCell' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_CMC_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_PROCESSOR_IDLE_DEPENDENCY' : [ 0x8, { + 'ProcessorIndex' : [ 0x0, ['unsigned long']], + 'ExpectedState' : [ 0x4, ['unsigned char']], + 'AllowDeeperStates' : [ 0x5, ['unsigned char']], + 'LooseDependency' : [ 0x6, ['unsigned char']], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], +} ], + '_PO_DEVICE_NOTIFY' : [ 0x68, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'PowerChildren' : [ 0x10, ['_LIST_ENTRY']], + 'PowerParents' : [ 0x20, ['_LIST_ENTRY']], + 'TargetDevice' : [ 0x30, ['pointer64', ['_DEVICE_OBJECT']]], + 'OrderLevel' : [ 0x38, ['unsigned char']], + 'DeviceObject' : [ 0x40, ['pointer64', ['_DEVICE_OBJECT']]], + 'DeviceName' : [ 0x48, ['pointer64', ['unsigned short']]], + 'DriverName' : [ 0x50, ['pointer64', ['unsigned short']]], + 'ChildCount' : [ 0x58, ['unsigned long']], + 'ActiveChild' : [ 0x5c, ['unsigned long']], + 'ParentCount' : [ 0x60, ['unsigned long']], + 'ActiveParent' : [ 0x64, ['unsigned long']], +} ], + '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x10, { + 'Cell' : [ 0x0, ['unsigned long']], + 'CachedSecurity' : [ 0x8, ['pointer64', ['_CM_KEY_SECURITY_CACHE']]], +} ], + '_FS_FILTER_CALLBACK_DATA' : [ 0x40, { + 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], + 'Operation' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'FileObject' : [ 0x10, ['pointer64', ['_FILE_OBJECT']]], + 'Parameters' : [ 0x18, ['_FS_FILTER_PARAMETERS']], +} ], + '_WHEA_AER_ROOTPORT_DESCRIPTOR' : [ 0x24, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_ROOTPORT_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'RootErrorCommand' : [ 0x20, ['unsigned long']], +} ], + '_PROC_IDLE_STATE_ACCOUNTING' : [ 0x3d0, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'CancelCount' : [ 0x8, ['unsigned long']], + 'FailureCount' : [ 0xc, ['unsigned long']], + 'SuccessCount' : [ 0x10, ['unsigned long']], + 'InvalidBucketIndex' : [ 0x14, ['unsigned long']], + 'MinTime' : [ 0x18, ['unsigned long long']], + 'MaxTime' : [ 0x20, ['unsigned long long']], + 'SelectionStatistics' : [ 0x28, ['_PPM_SELECTION_STATISTICS']], + 'IdleTimeBuckets' : [ 0x90, ['array', 26, ['_PROC_IDLE_STATE_BUCKET']]], +} ], + '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { + 'PageHashes' : [ 0x0, ['pointer64', ['void']]], + 'Value' : [ 0x0, ['unsigned long long']], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KENLISTMENT_HISTORY' : [ 0x8, { + 'Notification' : [ 0x0, ['unsigned long']], + 'NewState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'KEnlistmentUninitialized', 256: 'KEnlistmentActive', 258: 'KEnlistmentPrepared', 259: 'KEnlistmentInDoubt', 260: 'KEnlistmentCommitted', 261: 'KEnlistmentCommittedNotify', 262: 'KEnlistmentCommitRequested', 257: 'KEnlistmentPreparing', 264: 'KEnlistmentDelegated', 265: 'KEnlistmentDelegatedDisconnected', 266: 'KEnlistmentPrePreparing', 263: 'KEnlistmentAborted', 268: 'KEnlistmentRecovering', 269: 'KEnlistmentAborting', 270: 'KEnlistmentReadOnly', 271: 'KEnlistmentOutcomeUnavailable', 272: 'KEnlistmentOffline', 273: 'KEnlistmentPrePrepared', 274: 'KEnlistmentInitialized', 267: 'KEnlistmentForgotten'})]], +} ], + '_FAST_IO_DISPATCH' : [ 0xe0, { + 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], + 'FastIoCheckIfPossible' : [ 0x8, ['pointer64', ['void']]], + 'FastIoRead' : [ 0x10, ['pointer64', ['void']]], + 'FastIoWrite' : [ 0x18, ['pointer64', ['void']]], + 'FastIoQueryBasicInfo' : [ 0x20, ['pointer64', ['void']]], + 'FastIoQueryStandardInfo' : [ 0x28, ['pointer64', ['void']]], + 'FastIoLock' : [ 0x30, ['pointer64', ['void']]], + 'FastIoUnlockSingle' : [ 0x38, ['pointer64', ['void']]], + 'FastIoUnlockAll' : [ 0x40, ['pointer64', ['void']]], + 'FastIoUnlockAllByKey' : [ 0x48, ['pointer64', ['void']]], + 'FastIoDeviceControl' : [ 0x50, ['pointer64', ['void']]], + 'AcquireFileForNtCreateSection' : [ 0x58, ['pointer64', ['void']]], + 'ReleaseFileForNtCreateSection' : [ 0x60, ['pointer64', ['void']]], + 'FastIoDetachDevice' : [ 0x68, ['pointer64', ['void']]], + 'FastIoQueryNetworkOpenInfo' : [ 0x70, ['pointer64', ['void']]], + 'AcquireForModWrite' : [ 0x78, ['pointer64', ['void']]], + 'MdlRead' : [ 0x80, ['pointer64', ['void']]], + 'MdlReadComplete' : [ 0x88, ['pointer64', ['void']]], + 'PrepareMdlWrite' : [ 0x90, ['pointer64', ['void']]], + 'MdlWriteComplete' : [ 0x98, ['pointer64', ['void']]], + 'FastIoReadCompressed' : [ 0xa0, ['pointer64', ['void']]], + 'FastIoWriteCompressed' : [ 0xa8, ['pointer64', ['void']]], + 'MdlReadCompleteCompressed' : [ 0xb0, ['pointer64', ['void']]], + 'MdlWriteCompleteCompressed' : [ 0xb8, ['pointer64', ['void']]], + 'FastIoQueryOpen' : [ 0xc0, ['pointer64', ['void']]], + 'ReleaseForModWrite' : [ 0xc8, ['pointer64', ['void']]], + 'AcquireForCcFlush' : [ 0xd0, ['pointer64', ['void']]], + 'ReleaseForCcFlush' : [ 0xd8, ['pointer64', ['void']]], +} ], + '_PERFINFO_PPM_STATE_SELECTION' : [ 0xc, { + 'SelectedState' : [ 0x0, ['unsigned long']], + 'VetoedStates' : [ 0x4, ['unsigned long']], + 'VetoReason' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_KIDTENTRY64' : [ 0x10, { + 'OffsetLow' : [ 0x0, ['unsigned short']], + 'Selector' : [ 0x2, ['unsigned short']], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'OffsetMiddle' : [ 0x6, ['unsigned short']], + 'OffsetHigh' : [ 0x8, ['unsigned long']], + 'Reserved1' : [ 0xc, ['unsigned long']], + 'Alignment' : [ 0x0, ['unsigned long long']], +} ], + '_CM_CELL_REMAP_BLOCK' : [ 0x8, { + 'OldCell' : [ 0x0, ['unsigned long']], + 'NewCell' : [ 0x4, ['unsigned long']], +} ], + '_PI_RESOURCE_ARBITER_ENTRY' : [ 0x70, { + 'DeviceArbiterList' : [ 0x0, ['_LIST_ENTRY']], + 'ResourceType' : [ 0x10, ['unsigned char']], + 'ArbiterInterface' : [ 0x18, ['pointer64', ['_ARBITER_INTERFACE']]], + 'DeviceNode' : [ 0x20, ['pointer64', ['_DEVICE_NODE']]], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'BestResourceList' : [ 0x38, ['_LIST_ENTRY']], + 'BestConfig' : [ 0x48, ['_LIST_ENTRY']], + 'ActiveArbiterList' : [ 0x58, ['_LIST_ENTRY']], + 'State' : [ 0x68, ['unsigned char']], + 'ResourcesChanged' : [ 0x69, ['unsigned char']], +} ], + '_SECURITY_DESCRIPTOR' : [ 0x28, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x8, ['pointer64', ['void']]], + 'Group' : [ 0x10, ['pointer64', ['void']]], + 'Sacl' : [ 0x18, ['pointer64', ['_ACL']]], + 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], +} ], + '_MODWRITER_FLAGS' : [ 0x4, { + 'KeepForever' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPriority' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'ModifiedStoreWrite' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], +} ], + '_KQUEUE' : [ 0x40, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'EntryListHead' : [ 0x18, ['_LIST_ENTRY']], + 'CurrentCount' : [ 0x28, ['unsigned long']], + 'MaximumCount' : [ 0x2c, ['unsigned long']], + 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], +} ], + '_RTL_USER_PROCESS_PARAMETERS' : [ 0x410, { + 'MaximumLength' : [ 0x0, ['unsigned long']], + 'Length' : [ 0x4, ['unsigned long']], + 'Flags' : [ 0x8, ['unsigned long']], + 'DebugFlags' : [ 0xc, ['unsigned long']], + 'ConsoleHandle' : [ 0x10, ['pointer64', ['void']]], + 'ConsoleFlags' : [ 0x18, ['unsigned long']], + 'StandardInput' : [ 0x20, ['pointer64', ['void']]], + 'StandardOutput' : [ 0x28, ['pointer64', ['void']]], + 'StandardError' : [ 0x30, ['pointer64', ['void']]], + 'CurrentDirectory' : [ 0x38, ['_CURDIR']], + 'DllPath' : [ 0x50, ['_UNICODE_STRING']], + 'ImagePathName' : [ 0x60, ['_UNICODE_STRING']], + 'CommandLine' : [ 0x70, ['_UNICODE_STRING']], + 'Environment' : [ 0x80, ['pointer64', ['void']]], + 'StartingX' : [ 0x88, ['unsigned long']], + 'StartingY' : [ 0x8c, ['unsigned long']], + 'CountX' : [ 0x90, ['unsigned long']], + 'CountY' : [ 0x94, ['unsigned long']], + 'CountCharsX' : [ 0x98, ['unsigned long']], + 'CountCharsY' : [ 0x9c, ['unsigned long']], + 'FillAttribute' : [ 0xa0, ['unsigned long']], + 'WindowFlags' : [ 0xa4, ['unsigned long']], + 'ShowWindowFlags' : [ 0xa8, ['unsigned long']], + 'WindowTitle' : [ 0xb0, ['_UNICODE_STRING']], + 'DesktopInfo' : [ 0xc0, ['_UNICODE_STRING']], + 'ShellInfo' : [ 0xd0, ['_UNICODE_STRING']], + 'RuntimeData' : [ 0xe0, ['_UNICODE_STRING']], + 'CurrentDirectores' : [ 0xf0, ['array', 32, ['_RTL_DRIVE_LETTER_CURDIR']]], + 'EnvironmentSize' : [ 0x3f0, ['unsigned long long']], + 'EnvironmentVersion' : [ 0x3f8, ['unsigned long long']], + 'PackageDependencyData' : [ 0x400, ['pointer64', ['void']]], + 'ProcessGroupId' : [ 0x408, ['unsigned long']], +} ], + '_PHYSICAL_MEMORY_RUN' : [ 0x10, { + 'BasePage' : [ 0x0, ['unsigned long long']], + 'PageCount' : [ 0x8, ['unsigned long long']], +} ], + '_RTL_SRWLOCK' : [ 0x8, { + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], + 'Value' : [ 0x0, ['unsigned long long']], + 'Ptr' : [ 0x0, ['pointer64', ['void']]], +} ], + '_KTMOBJECT_NAMESPACE_LINK' : [ 0x28, { + 'Links' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'Expired' : [ 0x20, ['unsigned char']], +} ], + '_CACHE_MANAGER_CALLBACKS' : [ 0x20, { + 'AcquireForLazyWrite' : [ 0x0, ['pointer64', ['void']]], + 'ReleaseFromLazyWrite' : [ 0x8, ['pointer64', ['void']]], + 'AcquireForReadAhead' : [ 0x10, ['pointer64', ['void']]], + 'ReleaseFromReadAhead' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROC_PERF_LOAD' : [ 0x2, { + 'BusyPercentage' : [ 0x0, ['unsigned char']], + 'FrequencyPercentage' : [ 0x1, ['unsigned char']], +} ], + '_RTL_RANGE' : [ 0x28, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'UserData' : [ 0x10, ['pointer64', ['void']]], + 'Owner' : [ 0x18, ['pointer64', ['void']]], + 'Attributes' : [ 0x20, ['unsigned char']], + 'Flags' : [ 0x21, ['unsigned char']], +} ], + '_LOCK_HEADER' : [ 0x20, { + 'LockTree' : [ 0x0, ['_RTL_AVL_TREE']], + 'Count' : [ 0x8, ['unsigned long long']], + 'Lock' : [ 0x10, ['unsigned long long']], + 'Valid' : [ 0x18, ['unsigned long']], +} ], + '_WHEA_IPF_MCA_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_KSPECIAL_REGISTERS' : [ 0xe0, { + 'Cr0' : [ 0x0, ['unsigned long long']], + 'Cr2' : [ 0x8, ['unsigned long long']], + 'Cr3' : [ 0x10, ['unsigned long long']], + 'Cr4' : [ 0x18, ['unsigned long long']], + 'KernelDr0' : [ 0x20, ['unsigned long long']], + 'KernelDr1' : [ 0x28, ['unsigned long long']], + 'KernelDr2' : [ 0x30, ['unsigned long long']], + 'KernelDr3' : [ 0x38, ['unsigned long long']], + 'KernelDr6' : [ 0x40, ['unsigned long long']], + 'KernelDr7' : [ 0x48, ['unsigned long long']], + 'Gdtr' : [ 0x50, ['_KDESCRIPTOR']], + 'Idtr' : [ 0x60, ['_KDESCRIPTOR']], + 'Tr' : [ 0x70, ['unsigned short']], + 'Ldtr' : [ 0x72, ['unsigned short']], + 'MxCsr' : [ 0x74, ['unsigned long']], + 'DebugControl' : [ 0x78, ['unsigned long long']], + 'LastBranchToRip' : [ 0x80, ['unsigned long long']], + 'LastBranchFromRip' : [ 0x88, ['unsigned long long']], + 'LastExceptionToRip' : [ 0x90, ['unsigned long long']], + 'LastExceptionFromRip' : [ 0x98, ['unsigned long long']], + 'Cr8' : [ 0xa0, ['unsigned long long']], + 'MsrGsBase' : [ 0xa8, ['unsigned long long']], + 'MsrGsSwap' : [ 0xb0, ['unsigned long long']], + 'MsrStar' : [ 0xb8, ['unsigned long long']], + 'MsrLStar' : [ 0xc0, ['unsigned long long']], + 'MsrCStar' : [ 0xc8, ['unsigned long long']], + 'MsrSyscallMask' : [ 0xd0, ['unsigned long long']], + 'Xcr0' : [ 0xd8, ['unsigned long long']], +} ], + '_SYSTEM_POWER_POLICY' : [ 0xe8, { + 'Revision' : [ 0x0, ['unsigned long']], + 'PowerButton' : [ 0x4, ['POWER_ACTION_POLICY']], + 'SleepButton' : [ 0x10, ['POWER_ACTION_POLICY']], + 'LidClose' : [ 0x1c, ['POWER_ACTION_POLICY']], + 'LidOpenWake' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'Reserved' : [ 0x2c, ['unsigned long']], + 'Idle' : [ 0x30, ['POWER_ACTION_POLICY']], + 'IdleTimeout' : [ 0x3c, ['unsigned long']], + 'IdleSensitivity' : [ 0x40, ['unsigned char']], + 'DynamicThrottle' : [ 0x41, ['unsigned char']], + 'Spare2' : [ 0x42, ['array', 2, ['unsigned char']]], + 'MinSleep' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MaxSleep' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'ReducedLatencySleep' : [ 0x4c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'WinLogonFlags' : [ 0x50, ['unsigned long']], + 'Spare3' : [ 0x54, ['unsigned long']], + 'DozeS4Timeout' : [ 0x58, ['unsigned long']], + 'BroadcastCapacityResolution' : [ 0x5c, ['unsigned long']], + 'DischargePolicy' : [ 0x60, ['array', 4, ['SYSTEM_POWER_LEVEL']]], + 'VideoTimeout' : [ 0xc0, ['unsigned long']], + 'VideoDimDisplay' : [ 0xc4, ['unsigned char']], + 'VideoReserved' : [ 0xc8, ['array', 3, ['unsigned long']]], + 'SpindownTimeout' : [ 0xd4, ['unsigned long']], + 'OptimizeForPower' : [ 0xd8, ['unsigned char']], + 'FanThrottleTolerance' : [ 0xd9, ['unsigned char']], + 'ForcedThrottle' : [ 0xda, ['unsigned char']], + 'MinThrottle' : [ 0xdb, ['unsigned char']], + 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], +} ], + '_POOL_HEADER' : [ 0x10, { + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], + 'Ulong1' : [ 0x0, ['unsigned long']], + 'PoolTag' : [ 0x4, ['unsigned long']], + 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'AllocatorBackTraceIndex' : [ 0x8, ['unsigned short']], + 'PoolTagHash' : [ 0xa, ['unsigned short']], +} ], + '_PEB64' : [ 0x388, { + 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], + 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], + 'BeingDebugged' : [ 0x2, ['unsigned char']], + 'BitField' : [ 0x3, ['unsigned char']], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsPackagedProcess' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'IsAppContainer' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IsProtectedProcessLight' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Padding0' : [ 0x4, ['array', 4, ['unsigned char']]], + 'Mutant' : [ 0x8, ['unsigned long long']], + 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], + 'Ldr' : [ 0x18, ['unsigned long long']], + 'ProcessParameters' : [ 0x20, ['unsigned long long']], + 'SubSystemData' : [ 0x28, ['unsigned long long']], + 'ProcessHeap' : [ 0x30, ['unsigned long long']], + 'FastPebLock' : [ 0x38, ['unsigned long long']], + 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], + 'IFEOKey' : [ 0x48, ['unsigned long long']], + 'CrossProcessFlags' : [ 0x50, ['unsigned long']], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], + 'Padding1' : [ 0x54, ['array', 4, ['unsigned char']]], + 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], + 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], + 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], + 'AtlThunkSListPtr32' : [ 0x64, ['unsigned long']], + 'ApiSetMap' : [ 0x68, ['unsigned long long']], + 'TlsExpansionCounter' : [ 0x70, ['unsigned long']], + 'Padding2' : [ 0x74, ['array', 4, ['unsigned char']]], + 'TlsBitmap' : [ 0x78, ['unsigned long long']], + 'TlsBitmapBits' : [ 0x80, ['array', 2, ['unsigned long']]], + 'ReadOnlySharedMemoryBase' : [ 0x88, ['unsigned long long']], + 'SparePvoid0' : [ 0x90, ['unsigned long long']], + 'ReadOnlyStaticServerData' : [ 0x98, ['unsigned long long']], + 'AnsiCodePageData' : [ 0xa0, ['unsigned long long']], + 'OemCodePageData' : [ 0xa8, ['unsigned long long']], + 'UnicodeCaseTableData' : [ 0xb0, ['unsigned long long']], + 'NumberOfProcessors' : [ 0xb8, ['unsigned long']], + 'NtGlobalFlag' : [ 0xbc, ['unsigned long']], + 'CriticalSectionTimeout' : [ 0xc0, ['_LARGE_INTEGER']], + 'HeapSegmentReserve' : [ 0xc8, ['unsigned long long']], + 'HeapSegmentCommit' : [ 0xd0, ['unsigned long long']], + 'HeapDeCommitTotalFreeThreshold' : [ 0xd8, ['unsigned long long']], + 'HeapDeCommitFreeBlockThreshold' : [ 0xe0, ['unsigned long long']], + 'NumberOfHeaps' : [ 0xe8, ['unsigned long']], + 'MaximumNumberOfHeaps' : [ 0xec, ['unsigned long']], + 'ProcessHeaps' : [ 0xf0, ['unsigned long long']], + 'GdiSharedHandleTable' : [ 0xf8, ['unsigned long long']], + 'ProcessStarterHelper' : [ 0x100, ['unsigned long long']], + 'GdiDCAttributeList' : [ 0x108, ['unsigned long']], + 'Padding3' : [ 0x10c, ['array', 4, ['unsigned char']]], + 'LoaderLock' : [ 0x110, ['unsigned long long']], + 'OSMajorVersion' : [ 0x118, ['unsigned long']], + 'OSMinorVersion' : [ 0x11c, ['unsigned long']], + 'OSBuildNumber' : [ 0x120, ['unsigned short']], + 'OSCSDVersion' : [ 0x122, ['unsigned short']], + 'OSPlatformId' : [ 0x124, ['unsigned long']], + 'ImageSubsystem' : [ 0x128, ['unsigned long']], + 'ImageSubsystemMajorVersion' : [ 0x12c, ['unsigned long']], + 'ImageSubsystemMinorVersion' : [ 0x130, ['unsigned long']], + 'Padding4' : [ 0x134, ['array', 4, ['unsigned char']]], + 'ActiveProcessAffinityMask' : [ 0x138, ['unsigned long long']], + 'GdiHandleBuffer' : [ 0x140, ['array', 60, ['unsigned long']]], + 'PostProcessInitRoutine' : [ 0x230, ['unsigned long long']], + 'TlsExpansionBitmap' : [ 0x238, ['unsigned long long']], + 'TlsExpansionBitmapBits' : [ 0x240, ['array', 32, ['unsigned long']]], + 'SessionId' : [ 0x2c0, ['unsigned long']], + 'Padding5' : [ 0x2c4, ['array', 4, ['unsigned char']]], + 'AppCompatFlags' : [ 0x2c8, ['_ULARGE_INTEGER']], + 'AppCompatFlagsUser' : [ 0x2d0, ['_ULARGE_INTEGER']], + 'pShimData' : [ 0x2d8, ['unsigned long long']], + 'AppCompatInfo' : [ 0x2e0, ['unsigned long long']], + 'CSDVersion' : [ 0x2e8, ['_STRING64']], + 'ActivationContextData' : [ 0x2f8, ['unsigned long long']], + 'ProcessAssemblyStorageMap' : [ 0x300, ['unsigned long long']], + 'SystemDefaultActivationContextData' : [ 0x308, ['unsigned long long']], + 'SystemAssemblyStorageMap' : [ 0x310, ['unsigned long long']], + 'MinimumStackCommit' : [ 0x318, ['unsigned long long']], + 'FlsCallback' : [ 0x320, ['unsigned long long']], + 'FlsListHead' : [ 0x328, ['LIST_ENTRY64']], + 'FlsBitmap' : [ 0x338, ['unsigned long long']], + 'FlsBitmapBits' : [ 0x340, ['array', 4, ['unsigned long']]], + 'FlsHighIndex' : [ 0x350, ['unsigned long']], + 'WerRegistrationData' : [ 0x358, ['unsigned long long']], + 'WerShipAssertPtr' : [ 0x360, ['unsigned long long']], + 'pUnused' : [ 0x368, ['unsigned long long']], + 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], + 'TracingFlags' : [ 0x378, ['unsigned long']], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LibLoaderTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Padding6' : [ 0x37c, ['array', 4, ['unsigned char']]], + 'CsrServerReadOnlySharedMemoryBase' : [ 0x380, ['unsigned long long']], +} ], + '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { + 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], +} ], + '_HEAP_ENTRY_EXTRA' : [ 0x10, { + 'AllocatorBackTraceIndex' : [ 0x0, ['unsigned short']], + 'TagIndex' : [ 0x2, ['unsigned short']], + 'Settable' : [ 0x8, ['unsigned long long']], + 'ZeroInit' : [ 0x0, ['unsigned long long']], + 'ZeroInit1' : [ 0x8, ['unsigned long long']], +} ], + '_VF_POOL_TRACE' : [ 0x80, { + 'Address' : [ 0x0, ['pointer64', ['void']]], + 'Size' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '__unnamed_23ac' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], +} ], + '_MM_SESSION_SPACE' : [ 0x2000, { + 'ReferenceCount' : [ 0x0, ['long']], + 'u' : [ 0x4, ['__unnamed_23ac']], + 'SessionId' : [ 0x8, ['unsigned long']], + 'ProcessReferenceToSession' : [ 0xc, ['long']], + 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], + 'SessionPageDirectoryIndex' : [ 0x20, ['unsigned long long']], + 'NonPagablePages' : [ 0x28, ['unsigned long long']], + 'CommittedPages' : [ 0x30, ['unsigned long long']], + 'PagedPoolStart' : [ 0x38, ['pointer64', ['void']]], + 'PagedPoolEnd' : [ 0x40, ['pointer64', ['void']]], + 'SessionObject' : [ 0x48, ['pointer64', ['void']]], + 'SessionObjectHandle' : [ 0x50, ['pointer64', ['void']]], + 'SessionPoolAllocationFailures' : [ 0x58, ['array', 4, ['unsigned long']]], + 'ImageList' : [ 0x68, ['_LIST_ENTRY']], + 'LocaleId' : [ 0x78, ['unsigned long']], + 'AttachCount' : [ 0x7c, ['unsigned long']], + 'AttachGate' : [ 0x80, ['_KGATE']], + 'WsListEntry' : [ 0x98, ['_LIST_ENTRY']], + 'Lookaside' : [ 0xc0, ['array', 21, ['_GENERAL_LOOKASIDE']]], + 'Session' : [ 0xb40, ['_MMSESSION']], + 'PagedPoolInfo' : [ 0xb98, ['_MM_PAGED_POOL_INFO']], + 'Vm' : [ 0xc00, ['_MMSUPPORT']], + 'Wsle' : [ 0xce8, ['pointer64', ['_MMWSLE']]], + 'DriverUnload' : [ 0xcf0, ['_MI_SESSION_DRIVER_UNLOAD']], + 'PagedPool' : [ 0xd00, ['_POOL_DESCRIPTOR']], + 'PageDirectory' : [ 0x1e40, ['_MMPTE']], + 'SessionVaLock' : [ 0x1e48, ['_FAST_MUTEX']], + 'DynamicVaBitMap' : [ 0x1e80, ['_RTL_BITMAP']], + 'DynamicVaHint' : [ 0x1e90, ['unsigned long']], + 'SpecialPool' : [ 0x1e98, ['_MI_SPECIAL_POOL']], + 'SessionPteLock' : [ 0x1ee8, ['_FAST_MUTEX']], + 'PoolBigEntriesInUse' : [ 0x1f20, ['long']], + 'PagedPoolPdeCount' : [ 0x1f24, ['unsigned long']], + 'SpecialPoolPdeCount' : [ 0x1f28, ['unsigned long']], + 'DynamicSessionPdeCount' : [ 0x1f2c, ['unsigned long']], + 'SystemPteInfo' : [ 0x1f30, ['_MI_SYSTEM_PTE_TYPE']], + 'PoolTrackTableExpansion' : [ 0x1f98, ['pointer64', ['void']]], + 'PoolTrackTableExpansionSize' : [ 0x1fa0, ['unsigned long long']], + 'PoolTrackBigPages' : [ 0x1fa8, ['pointer64', ['void']]], + 'PoolTrackBigPagesSize' : [ 0x1fb0, ['unsigned long long']], + 'IoState' : [ 0x1fb8, ['Enumeration', dict(target = 'long', choices = {1: 'IoSessionStateCreated', 2: 'IoSessionStateInitialized', 3: 'IoSessionStateConnected', 4: 'IoSessionStateDisconnected', 5: 'IoSessionStateDisconnectedLoggedOn', 6: 'IoSessionStateLoggedOn', 7: 'IoSessionStateLoggedOff', 8: 'IoSessionStateTerminated', 9: 'IoSessionStateMax'})]], + 'IoStateSequence' : [ 0x1fbc, ['unsigned long']], + 'IoNotificationEvent' : [ 0x1fc0, ['_KEVENT']], + 'CreateTime' : [ 0x1fd8, ['unsigned long long']], +} ], + '_WHEA_XPF_MC_BANK_DESCRIPTOR' : [ 0x1c, { + 'BankNumber' : [ 0x0, ['unsigned char']], + 'ClearOnInitialization' : [ 0x1, ['unsigned char']], + 'StatusDataFormat' : [ 0x2, ['unsigned char']], + 'Flags' : [ 0x3, ['_XPF_MC_BANK_FLAGS']], + 'ControlMsr' : [ 0x4, ['unsigned long']], + 'StatusMsr' : [ 0x8, ['unsigned long']], + 'AddressMsr' : [ 0xc, ['unsigned long']], + 'MiscMsr' : [ 0x10, ['unsigned long']], + 'ControlData' : [ 0x14, ['unsigned long long']], +} ], + '__unnamed_23bc' : [ 0x4, { + 'LongFlags2' : [ 0x0, ['unsigned long']], + 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], +} ], + '__unnamed_23bf' : [ 0x8, { + 'SequentialVa' : [ 0x0, ['_MI_VAD_SEQUENTIAL_INFO']], + 'ExtendedInfo' : [ 0x0, ['pointer64', ['_MMEXTEND_INFO']]], +} ], + '_MMVAD' : [ 0x80, { + 'Core' : [ 0x0, ['_MMVAD_SHORT']], + 'u2' : [ 0x40, ['__unnamed_23bc']], + 'Subsection' : [ 0x48, ['pointer64', ['_SUBSECTION']]], + 'FirstPrototypePte' : [ 0x50, ['pointer64', ['_MMPTE']]], + 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], + 'ViewLinks' : [ 0x60, ['_LIST_ENTRY']], + 'VadsProcess' : [ 0x70, ['pointer64', ['_EPROCESS']]], + 'u4' : [ 0x78, ['__unnamed_23bf']], +} ], + '_SEP_SID_VALUES_BLOCK' : [ 0x20, { + 'BlockLength' : [ 0x0, ['unsigned long']], + 'ReferenceCount' : [ 0x8, ['long long']], + 'SidCount' : [ 0x10, ['unsigned long']], + 'SidValuesStart' : [ 0x18, ['unsigned long long']], +} ], + '_CM_RM' : [ 0x88, { + 'RmListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'TransactionListHead' : [ 0x10, ['_LIST_ENTRY']], + 'TmHandle' : [ 0x20, ['pointer64', ['void']]], + 'Tm' : [ 0x28, ['pointer64', ['void']]], + 'RmHandle' : [ 0x30, ['pointer64', ['void']]], + 'KtmRm' : [ 0x38, ['pointer64', ['void']]], + 'RefCount' : [ 0x40, ['unsigned long']], + 'ContainerNum' : [ 0x44, ['unsigned long']], + 'ContainerSize' : [ 0x48, ['unsigned long long']], + 'CmHive' : [ 0x50, ['pointer64', ['_CMHIVE']]], + 'LogFileObject' : [ 0x58, ['pointer64', ['void']]], + 'MarshallingContext' : [ 0x60, ['pointer64', ['void']]], + 'RmFlags' : [ 0x68, ['unsigned long']], + 'LogStartStatus1' : [ 0x6c, ['long']], + 'LogStartStatus2' : [ 0x70, ['long']], + 'BaseLsn' : [ 0x78, ['unsigned long long']], + 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], +} ], + '_NONOPAQUE_OPLOCK' : [ 0xa0, { + 'IrpExclusiveOplock' : [ 0x0, ['pointer64', ['_IRP']]], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'ExclusiveOplockOwner' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'ExclusiveOplockOwnerThread' : [ 0x18, ['pointer64', ['_ETHREAD']]], + 'WaiterPriority' : [ 0x20, ['unsigned char']], + 'IrpOplocksR' : [ 0x28, ['_LIST_ENTRY']], + 'IrpOplocksRH' : [ 0x38, ['_LIST_ENTRY']], + 'RHBreakQueue' : [ 0x48, ['_LIST_ENTRY']], + 'WaitingIrps' : [ 0x58, ['_LIST_ENTRY']], + 'DelayAckFileObjectQueue' : [ 0x68, ['_LIST_ENTRY']], + 'AtomicQueue' : [ 0x78, ['_LIST_ENTRY']], + 'DeleterParentKey' : [ 0x88, ['pointer64', ['_GUID']]], + 'OplockState' : [ 0x90, ['unsigned long']], + 'FastMutex' : [ 0x98, ['pointer64', ['_FAST_MUTEX']]], +} ], + '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { + 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_CLIENT_ID' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], + 'UniqueThread' : [ 0x8, ['pointer64', ['void']]], +} ], + '_WHEA_MEMORY_ERROR_SECTION' : [ 0x49, { + 'ValidBits' : [ 0x0, ['_WHEA_MEMORY_ERROR_SECTION_VALIDBITS']], + 'ErrorStatus' : [ 0x8, ['_WHEA_ERROR_STATUS']], + 'PhysicalAddress' : [ 0x10, ['unsigned long long']], + 'PhysicalAddressMask' : [ 0x18, ['unsigned long long']], + 'Node' : [ 0x20, ['unsigned short']], + 'Card' : [ 0x22, ['unsigned short']], + 'Module' : [ 0x24, ['unsigned short']], + 'Bank' : [ 0x26, ['unsigned short']], + 'Device' : [ 0x28, ['unsigned short']], + 'Row' : [ 0x2a, ['unsigned short']], + 'Column' : [ 0x2c, ['unsigned short']], + 'BitPosition' : [ 0x2e, ['unsigned short']], + 'RequesterId' : [ 0x30, ['unsigned long long']], + 'ResponderId' : [ 0x38, ['unsigned long long']], + 'TargetId' : [ 0x40, ['unsigned long long']], + 'ErrorType' : [ 0x48, ['unsigned char']], +} ], + '_KWAIT_STATUS_REGISTER' : [ 0x1, { + 'Flags' : [ 0x0, ['unsigned char']], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], + 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], + 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], + 'HashChainList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'StackTrace' : [ 0x38, ['array', 8, ['pointer64', ['void']]]], + 'LastAcquireTrace' : [ 0x78, ['array', 8, ['pointer64', ['void']]]], + 'LastReleaseTrace' : [ 0xb8, ['array', 8, ['pointer64', ['void']]]], +} ], + '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { + 'BusDataType' : [ 0x0, ['unsigned long']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'SlotNumber' : [ 0x8, ['unsigned long']], + 'Offset' : [ 0xc, ['unsigned long']], + 'Length' : [ 0x10, ['unsigned long']], +} ], + '_MMSECTION_FLAGS' : [ 0x4, { + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'AttemptingDelete' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'PrefetchCreated' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 26, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { + 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], + 'ClientToken' : [ 0x10, ['pointer64', ['void']]], + 'DirectlyAccessClientToken' : [ 0x18, ['unsigned char']], + 'DirectAccessEffectiveOnly' : [ 0x19, ['unsigned char']], + 'ServerIsRemote' : [ 0x1a, ['unsigned char']], + 'ClientTokenControl' : [ 0x1c, ['_TOKEN_CONTROL']], +} ], + '_MM_PAGED_POOL_INFO' : [ 0x68, { + 'Mutex' : [ 0x0, ['_FAST_MUTEX']], + 'PagedPoolAllocationMap' : [ 0x38, ['_RTL_BITMAP_EX']], + 'FirstPteForPagedPool' : [ 0x48, ['pointer64', ['_MMPTE']]], + 'MaximumSize' : [ 0x50, ['unsigned long long']], + 'PagedPoolHint' : [ 0x58, ['unsigned long long']], + 'AllocatedPagedPool' : [ 0x60, ['unsigned long long']], +} ], + '_NT_TIB64' : [ 0x38, { + 'ExceptionList' : [ 0x0, ['unsigned long long']], + 'StackBase' : [ 0x8, ['unsigned long long']], + 'StackLimit' : [ 0x10, ['unsigned long long']], + 'SubSystemTib' : [ 0x18, ['unsigned long long']], + 'FiberData' : [ 0x20, ['unsigned long long']], + 'Version' : [ 0x20, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], + 'Self' : [ 0x30, ['unsigned long long']], +} ], + '_MI_REVERSE_VIEW_MAP' : [ 0x28, { + 'ViewLinks' : [ 0x0, ['_LIST_ENTRY']], + 'SystemCacheVa' : [ 0x10, ['pointer64', ['void']]], + 'SessionViewVa' : [ 0x10, ['pointer64', ['void']]], + 'VadsProcess' : [ 0x10, ['pointer64', ['_EPROCESS']]], + 'Type' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'Subsection' : [ 0x18, ['pointer64', ['_SUBSECTION']]], + 'SubsectionType' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SectionOffset' : [ 0x20, ['unsigned long long']], +} ], + '_IO_SECURITY_CONTEXT' : [ 0x18, { + 'SecurityQos' : [ 0x0, ['pointer64', ['_SECURITY_QUALITY_OF_SERVICE']]], + 'AccessState' : [ 0x8, ['pointer64', ['_ACCESS_STATE']]], + 'DesiredAccess' : [ 0x10, ['unsigned long']], + 'FullCreateOptions' : [ 0x14, ['unsigned long']], +} ], + '_PROC_PERF_DOMAIN' : [ 0x158, { + 'Link' : [ 0x0, ['_LIST_ENTRY']], + 'Master' : [ 0x10, ['pointer64', ['_KPRCB']]], + 'Members' : [ 0x18, ['_KAFFINITY_EX']], + 'ProcessorCount' : [ 0xc0, ['unsigned long']], + 'Processors' : [ 0xc8, ['pointer64', ['_PROC_PERF_CONSTRAINT']]], + 'GetFFHThrottleState' : [ 0xd0, ['pointer64', ['void']]], + 'BoostPolicyHandler' : [ 0xd8, ['pointer64', ['void']]], + 'BoostModeHandler' : [ 0xe0, ['pointer64', ['void']]], + 'PerfSelectionHandler' : [ 0xe8, ['pointer64', ['void']]], + 'PerfControlHandler' : [ 0xf0, ['pointer64', ['void']]], + 'MaxFrequency' : [ 0xf8, ['unsigned long']], + 'NominalFrequency' : [ 0xfc, ['unsigned long']], + 'MaxPercent' : [ 0x100, ['unsigned long']], + 'MinPerfPercent' : [ 0x104, ['unsigned long']], + 'MinThrottlePercent' : [ 0x108, ['unsigned long']], + 'Coordination' : [ 0x10c, ['unsigned char']], + 'HardPlatformCap' : [ 0x10d, ['unsigned char']], + 'AffinitizeControl' : [ 0x10e, ['unsigned char']], + 'SelectedPercent' : [ 0x110, ['unsigned long']], + 'SelectedFrequency' : [ 0x114, ['unsigned long']], + 'DesiredPercent' : [ 0x118, ['unsigned long']], + 'MaxPolicyPercent' : [ 0x11c, ['unsigned long']], + 'MinPolicyPercent' : [ 0x120, ['unsigned long']], + 'ConstrainedMaxPercent' : [ 0x124, ['unsigned long']], + 'ConstrainedMinPercent' : [ 0x128, ['unsigned long']], + 'GuaranteedPercent' : [ 0x12c, ['unsigned long']], + 'TolerancePercent' : [ 0x130, ['unsigned long']], + 'SelectedState' : [ 0x138, ['unsigned long long']], + 'Force' : [ 0x140, ['unsigned char']], + 'PerfChangeTime' : [ 0x148, ['unsigned long long']], + 'PerfChangeIntervalCount' : [ 0x150, ['unsigned long']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], +} ], + '_HANDLE_TRACE_DB_ENTRY' : [ 0xa0, { + 'ClientId' : [ 0x0, ['_CLIENT_ID']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], + 'Type' : [ 0x18, ['unsigned long']], + 'StackTrace' : [ 0x20, ['array', 16, ['pointer64', ['void']]]], +} ], + '_WHEA_IPF_CPE_DESCRIPTOR' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], +} ], + '_DUMMY_FILE_OBJECT' : [ 0x110, { + 'ObjectHeader' : [ 0x0, ['_OBJECT_HEADER']], + 'FileObjectBody' : [ 0x38, ['array', 216, ['unsigned char']]], +} ], + '_RELATION_LIST' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'TagCount' : [ 0x4, ['unsigned long']], + 'FirstLevel' : [ 0x8, ['unsigned long']], + 'MaxLevel' : [ 0xc, ['unsigned long']], + 'Entries' : [ 0x10, ['array', 1, ['pointer64', ['_RELATION_LIST_ENTRY']]]], +} ], + '_IO_TIMER' : [ 0x30, { + 'Type' : [ 0x0, ['short']], + 'TimerFlag' : [ 0x2, ['short']], + 'TimerList' : [ 0x8, ['_LIST_ENTRY']], + 'TimerRoutine' : [ 0x18, ['pointer64', ['void']]], + 'Context' : [ 0x20, ['pointer64', ['void']]], + 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], +} ], + '_ETW_BUFFER_QUEUE' : [ 0x18, { + 'QueueHead' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueTail' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], + 'QueueEntry' : [ 0x10, ['_SINGLE_LIST_ENTRY']], +} ], + '_ARBITER_TEST_ALLOCATION_PARAMETERS' : [ 0x18, { + 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], + 'AllocateFromCount' : [ 0x8, ['unsigned long']], + 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], +} ], + '_MI_SPECIAL_POOL' : [ 0x50, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Paged' : [ 0x8, ['_MI_PTE_CHAIN_HEAD']], + 'NonPaged' : [ 0x20, ['_MI_PTE_CHAIN_HEAD']], + 'PagesInUse' : [ 0x38, ['unsigned long long']], + 'SpecialPoolPdes' : [ 0x40, ['_RTL_BITMAP']], +} ], + '_LOGGED_STREAM_CALLBACK_V2' : [ 0x8, { + 'LogHandleContext' : [ 0x0, ['pointer64', ['_LOG_HANDLE_CONTEXT']]], +} ], + '_ARBITER_QUERY_CONFLICT_PARAMETERS' : [ 0x20, { + 'PhysicalDeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'ConflictingResource' : [ 0x8, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'ConflictCount' : [ 0x10, ['pointer64', ['unsigned long']]], + 'Conflicts' : [ 0x18, ['pointer64', ['pointer64', ['_ARBITER_CONFLICT_INFO']]]], +} ], + '_POP_CURRENT_BROADCAST' : [ 0x18, { + 'InProgress' : [ 0x0, ['unsigned char']], + 'SystemContext' : [ 0x4, ['_SYSTEM_POWER_STATE_CONTEXT']], + 'PowerAction' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'DeviceState' : [ 0x10, ['pointer64', ['_POP_DEVICE_SYS_STATE']]], +} ], + '_PHYSICAL_MEMORY_DESCRIPTOR' : [ 0x20, { + 'NumberOfRuns' : [ 0x0, ['unsigned long']], + 'NumberOfPages' : [ 0x8, ['unsigned long long']], + 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], +} ], + 'PEPHANDLE__' : [ 0x4, { + 'unused' : [ 0x0, ['long']], +} ], + '__unnamed_242f' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHigh' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_2433' : [ 0x4, { + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '_KGDTENTRY64' : [ 0x10, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'Bytes' : [ 0x4, ['__unnamed_242f']], + 'Bits' : [ 0x4, ['__unnamed_2433']], + 'BaseUpper' : [ 0x8, ['unsigned long']], + 'MustBeZero' : [ 0xc, ['unsigned long']], + 'DataLow' : [ 0x0, ['long long']], + 'DataHigh' : [ 0x8, ['long long']], +} ], + '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { + 'Status' : [ 0x0, ['long']], + 'EventQueueMutex' : [ 0x8, ['_KMUTANT']], + 'Lock' : [ 0x40, ['_FAST_MUTEX']], + 'List' : [ 0x78, ['_LIST_ENTRY']], +} ], + '_IOV_IRP_TRACE' : [ 0x80, { + 'Irp' : [ 0x0, ['pointer64', ['_IRP']]], + 'Thread' : [ 0x8, ['pointer64', ['_KTHREAD']]], + 'KernelApcDisable' : [ 0x10, ['short']], + 'SpecialApcDisable' : [ 0x12, ['short']], + 'CombinedApcDisable' : [ 0x10, ['unsigned long']], + 'Irql' : [ 0x14, ['unsigned char']], + 'StackTrace' : [ 0x18, ['array', 13, ['pointer64', ['void']]]], +} ], + '_MAILSLOT_CREATE_PARAMETERS' : [ 0x18, { + 'MailslotQuota' : [ 0x0, ['unsigned long']], + 'MaximumMessageSize' : [ 0x4, ['unsigned long']], + 'ReadTimeout' : [ 0x8, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x10, ['unsigned char']], +} ], + '_PO_IRP_MANAGER' : [ 0x20, { + 'DeviceIrpQueue' : [ 0x0, ['_PO_IRP_QUEUE']], + 'SystemIrpQueue' : [ 0x10, ['_PO_IRP_QUEUE']], +} ], + '_DYNAMIC_FUNCTION_TABLE' : [ 0x58, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'FunctionTable' : [ 0x10, ['pointer64', ['_IMAGE_RUNTIME_FUNCTION_ENTRY']]], + 'TimeStamp' : [ 0x18, ['_LARGE_INTEGER']], + 'MinimumAddress' : [ 0x20, ['unsigned long long']], + 'MaximumAddress' : [ 0x28, ['unsigned long long']], + 'BaseAddress' : [ 0x30, ['unsigned long long']], + 'Callback' : [ 0x38, ['pointer64', ['void']]], + 'Context' : [ 0x40, ['pointer64', ['void']]], + 'OutOfProcessCallbackDll' : [ 0x48, ['pointer64', ['unsigned short']]], + 'Type' : [ 0x50, ['Enumeration', dict(target = 'long', choices = {0: 'RF_SORTED', 1: 'RF_UNSORTED', 2: 'RF_CALLBACK', 3: 'RF_KERNEL_DYNAMIC'})]], + 'EntryCount' : [ 0x54, ['unsigned long']], +} ], + '_SEP_LOWBOX_HANDLES_TABLE' : [ 0x10, { + 'Lock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'HashTable' : [ 0x8, ['pointer64', ['_RTL_DYNAMIC_HASH_TABLE']]], +} ], + '_CLIENT_ID64' : [ 0x10, { + 'UniqueProcess' : [ 0x0, ['unsigned long long']], + 'UniqueThread' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_2450' : [ 0x4, { + 'Level' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2452' : [ 0x4, { + 'Type' : [ 0x0, ['unsigned long']], +} ], + '_POP_ACTION_TRIGGER' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyDeviceMemory', 4: 'PolicyInitiatePowerActionAPI', 5: 'PolicySetPowerStateAPI', 6: 'PolicyImmediateDozeS4', 7: 'PolicySystemIdle', 8: 'PolicyDeviceWakeAlarm', 9: 'PolicyDeviceFan', 10: 'PolicyCsBatterySaver', 11: 'PolicyDeviceMax'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'Wait' : [ 0x8, ['pointer64', ['_POP_TRIGGER_WAIT']]], + 'Battery' : [ 0x10, ['__unnamed_2450']], + 'Button' : [ 0x10, ['__unnamed_2452']], +} ], + '_KDPC_DATA' : [ 0x28, { + 'DpcList' : [ 0x0, ['_KDPC_LIST']], + 'DpcLock' : [ 0x10, ['unsigned long long']], + 'DpcQueueDepth' : [ 0x18, ['long']], + 'DpcCount' : [ 0x1c, ['unsigned long']], + 'ActiveDpc' : [ 0x20, ['pointer64', ['_KDPC']]], +} ], + '_NAMED_PIPE_CREATE_PARAMETERS' : [ 0x28, { + 'NamedPipeType' : [ 0x0, ['unsigned long']], + 'ReadMode' : [ 0x4, ['unsigned long']], + 'CompletionMode' : [ 0x8, ['unsigned long']], + 'MaximumInstances' : [ 0xc, ['unsigned long']], + 'InboundQuota' : [ 0x10, ['unsigned long']], + 'OutboundQuota' : [ 0x14, ['unsigned long']], + 'DefaultTimeout' : [ 0x18, ['_LARGE_INTEGER']], + 'TimeoutSpecified' : [ 0x20, ['unsigned char']], +} ], + '_CM_BIG_DATA' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['unsigned long']], +} ], + '_KSCB' : [ 0x170, { + 'GenerationCycles' : [ 0x0, ['unsigned long long']], + 'UnderQuotaCycleTarget' : [ 0x8, ['unsigned long long']], + 'RankCycleTarget' : [ 0x10, ['unsigned long long']], + 'LongTermCycles' : [ 0x18, ['unsigned long long']], + 'LastReportedCycles' : [ 0x20, ['unsigned long long']], + 'OverQuotaHistory' : [ 0x28, ['unsigned long long']], + 'ReadyTime' : [ 0x30, ['unsigned long long']], + 'InsertTime' : [ 0x38, ['unsigned long long']], + 'PerProcessorList' : [ 0x40, ['_LIST_ENTRY']], + 'QueueNode' : [ 0x50, ['_RTL_BALANCED_NODE']], + 'Inserted' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OverQuota' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'HardCap' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'RankBias' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Spare1' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'Spare2' : [ 0x69, ['unsigned char']], + 'ReadySummary' : [ 0x6a, ['unsigned short']], + 'Rank' : [ 0x6c, ['unsigned long']], + 'ReadyListHead' : [ 0x70, ['array', 16, ['_LIST_ENTRY']]], +} ], + '__unnamed_2462' : [ 0x10, { + 'UserData' : [ 0x0, ['pointer64', ['void']]], + 'Owner' : [ 0x8, ['pointer64', ['void']]], +} ], + '__unnamed_2464' : [ 0x10, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], +} ], + '_RTLP_RANGE_LIST_ENTRY' : [ 0x38, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], + 'Allocated' : [ 0x10, ['__unnamed_2462']], + 'Merged' : [ 0x10, ['__unnamed_2464']], + 'Attributes' : [ 0x20, ['unsigned char']], + 'PublicFlags' : [ 0x21, ['unsigned char']], + 'PrivateFlags' : [ 0x22, ['unsigned short']], + 'ListEntry' : [ 0x28, ['_LIST_ENTRY']], +} ], + '_ALPC_COMPLETION_PACKET_LOOKASIDE_ENTRY' : [ 0x18, { + 'ListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Packet' : [ 0x8, ['pointer64', ['_IO_MINI_COMPLETION_PACKET_USER']]], + 'Lookaside' : [ 0x10, ['pointer64', ['_ALPC_COMPLETION_PACKET_LOOKASIDE']]], +} ], + '_PROC_PERF_HISTORY' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned long']], + 'Slot' : [ 0x4, ['unsigned long']], + 'HistoryList' : [ 0x8, ['array', 1, ['_PROC_PERF_HISTORY_ENTRY']]], +} ], + '_IMAGE_RUNTIME_FUNCTION_ENTRY' : [ 0xc, { + 'BeginAddress' : [ 0x0, ['unsigned long']], + 'EndAddress' : [ 0x4, ['unsigned long']], + 'UnwindInfoAddress' : [ 0x8, ['unsigned long']], + 'UnwindData' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2472' : [ 0x2, { + 'AsUSHORT' : [ 0x0, ['unsigned short']], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], +} ], + 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { + 'Revision' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['__unnamed_2472']], + 'PolicyCount' : [ 0x4, ['unsigned long']], + 'Policy' : [ 0x8, ['array', 3, ['PROCESSOR_IDLESTATE_INFO']]], +} ], + '_ACTIVATION_CONTEXT_STACK' : [ 0x28, { + 'ActiveFrame' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'FrameListCache' : [ 0x8, ['_LIST_ENTRY']], + 'Flags' : [ 0x18, ['unsigned long']], + 'NextCookieSequenceNumber' : [ 0x1c, ['unsigned long']], + 'StackId' : [ 0x20, ['unsigned long']], +} ], + '_RTL_DRIVE_LETTER_CURDIR' : [ 0x18, { + 'Flags' : [ 0x0, ['unsigned short']], + 'Length' : [ 0x2, ['unsigned short']], + 'TimeStamp' : [ 0x4, ['unsigned long']], + 'DosPath' : [ 0x8, ['_STRING']], +} ], + '_MI_PTE_CHAIN_HEAD' : [ 0x18, { + 'Flink' : [ 0x0, ['_MMPTE']], + 'Blink' : [ 0x8, ['_MMPTE']], + 'PteBase' : [ 0x10, ['pointer64', ['_MMPTE']]], +} ], + 'SYSTEM_POWER_CAPABILITIES' : [ 0x4c, { + 'PowerButtonPresent' : [ 0x0, ['unsigned char']], + 'SleepButtonPresent' : [ 0x1, ['unsigned char']], + 'LidPresent' : [ 0x2, ['unsigned char']], + 'SystemS1' : [ 0x3, ['unsigned char']], + 'SystemS2' : [ 0x4, ['unsigned char']], + 'SystemS3' : [ 0x5, ['unsigned char']], + 'SystemS4' : [ 0x6, ['unsigned char']], + 'SystemS5' : [ 0x7, ['unsigned char']], + 'HiberFilePresent' : [ 0x8, ['unsigned char']], + 'FullWake' : [ 0x9, ['unsigned char']], + 'VideoDimPresent' : [ 0xa, ['unsigned char']], + 'ApmPresent' : [ 0xb, ['unsigned char']], + 'UpsPresent' : [ 0xc, ['unsigned char']], + 'ThermalControl' : [ 0xd, ['unsigned char']], + 'ProcessorThrottle' : [ 0xe, ['unsigned char']], + 'ProcessorMinThrottle' : [ 0xf, ['unsigned char']], + 'ProcessorMaxThrottle' : [ 0x10, ['unsigned char']], + 'FastSystemS4' : [ 0x11, ['unsigned char']], + 'Hiberboot' : [ 0x12, ['unsigned char']], + 'WakeAlarmPresent' : [ 0x13, ['unsigned char']], + 'AoAc' : [ 0x14, ['unsigned char']], + 'DiskSpinDown' : [ 0x15, ['unsigned char']], + 'spare3' : [ 0x16, ['array', 8, ['unsigned char']]], + 'SystemBatteriesPresent' : [ 0x1e, ['unsigned char']], + 'BatteriesAreShortTerm' : [ 0x1f, ['unsigned char']], + 'BatteryScale' : [ 0x20, ['array', 3, ['BATTERY_REPORTING_SCALE']]], + 'AcOnLineWake' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SoftLidWake' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'RtcWake' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'MinDeviceWakeState' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '__unnamed_2486' : [ 0x8, { + 'ImageCommitment' : [ 0x0, ['unsigned long long']], + 'CreatingProcess' : [ 0x0, ['pointer64', ['_EPROCESS']]], +} ], + '__unnamed_248a' : [ 0x8, { + 'ImageInformation' : [ 0x0, ['pointer64', ['_MI_SECTION_IMAGE_INFORMATION']]], + 'FirstMappedVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_SEGMENT' : [ 0x48, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'TotalNumberOfPtes' : [ 0x8, ['unsigned long']], + 'SegmentFlags' : [ 0xc, ['_SEGMENT_FLAGS']], + 'NumberOfCommittedPages' : [ 0x10, ['unsigned long long']], + 'SizeOfSegment' : [ 0x18, ['unsigned long long']], + 'ExtendInfo' : [ 0x20, ['pointer64', ['_MMEXTEND_INFO']]], + 'BasedAddress' : [ 0x20, ['pointer64', ['void']]], + 'SegmentLock' : [ 0x28, ['_EX_PUSH_LOCK']], + 'u1' : [ 0x30, ['__unnamed_2486']], + 'u2' : [ 0x38, ['__unnamed_248a']], + 'PrototypePte' : [ 0x40, ['pointer64', ['_MMPTE']]], +} ], + '_DIAGNOSTIC_CONTEXT' : [ 0x20, { + 'CallerType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'Process' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ServiceTag' : [ 0x10, ['unsigned long']], + 'DeviceObject' : [ 0x8, ['pointer64', ['_DEVICE_OBJECT']]], + 'ReasonSize' : [ 0x18, ['unsigned long long']], +} ], + '__unnamed_2493' : [ 0x4, { + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2495' : [ 0x4, { + 'Flags' : [ 0x0, ['__unnamed_2493']], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VF_TARGET_VERIFIED_DRIVER_DATA' : [ 0x100, { + 'SuspectDriverEntry' : [ 0x0, ['pointer64', ['_VF_SUSPECT_DRIVER_ENTRY']]], + 'WMICallback' : [ 0x8, ['pointer64', ['void']]], + 'EtwHandlesListHead' : [ 0x10, ['_LIST_ENTRY']], + 'u1' : [ 0x20, ['__unnamed_2495']], + 'Signature' : [ 0x28, ['unsigned long long']], + 'PoolPageHeaders' : [ 0x30, ['_SLIST_HEADER']], + 'PoolTrackers' : [ 0x40, ['_SLIST_HEADER']], + 'CurrentPagedPoolAllocations' : [ 0x50, ['unsigned long']], + 'CurrentNonPagedPoolAllocations' : [ 0x54, ['unsigned long']], + 'PeakPagedPoolAllocations' : [ 0x58, ['unsigned long']], + 'PeakNonPagedPoolAllocations' : [ 0x5c, ['unsigned long']], + 'PagedBytes' : [ 0x60, ['unsigned long long']], + 'NonPagedBytes' : [ 0x68, ['unsigned long long']], + 'PeakPagedBytes' : [ 0x70, ['unsigned long long']], + 'PeakNonPagedBytes' : [ 0x78, ['unsigned long long']], + 'RaiseIrqls' : [ 0x80, ['unsigned long']], + 'AcquireSpinLocks' : [ 0x84, ['unsigned long']], + 'SynchronizeExecutions' : [ 0x88, ['unsigned long']], + 'AllocationsWithNoTag' : [ 0x8c, ['unsigned long']], + 'AllocationsFailed' : [ 0x90, ['unsigned long']], + 'AllocationsFailedDeliberately' : [ 0x94, ['unsigned long']], + 'LockedBytes' : [ 0x98, ['unsigned long long']], + 'PeakLockedBytes' : [ 0xa0, ['unsigned long long']], + 'MappedLockedBytes' : [ 0xa8, ['unsigned long long']], + 'PeakMappedLockedBytes' : [ 0xb0, ['unsigned long long']], + 'MappedIoSpaceBytes' : [ 0xb8, ['unsigned long long']], + 'PeakMappedIoSpaceBytes' : [ 0xc0, ['unsigned long long']], + 'PagesForMdlBytes' : [ 0xc8, ['unsigned long long']], + 'PeakPagesForMdlBytes' : [ 0xd0, ['unsigned long long']], + 'ContiguousMemoryBytes' : [ 0xd8, ['unsigned long long']], + 'PeakContiguousMemoryBytes' : [ 0xe0, ['unsigned long long']], + 'ContiguousMemoryListHead' : [ 0xe8, ['_LIST_ENTRY']], +} ], + '_MMVAD_FLAGS1' : [ 0x4, { + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_PRIVATE_CACHE_MAP' : [ 0x78, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'Flags' : [ 0x0, ['_PRIVATE_CACHE_MAP_FLAGS']], + 'ReadAheadMask' : [ 0x4, ['unsigned long']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'FileOffset1' : [ 0x10, ['_LARGE_INTEGER']], + 'BeyondLastByte1' : [ 0x18, ['_LARGE_INTEGER']], + 'FileOffset2' : [ 0x20, ['_LARGE_INTEGER']], + 'BeyondLastByte2' : [ 0x28, ['_LARGE_INTEGER']], + 'SequentialReadCount' : [ 0x30, ['unsigned long']], + 'ReadAheadLength' : [ 0x34, ['unsigned long']], + 'ReadAheadOffset' : [ 0x38, ['_LARGE_INTEGER']], + 'ReadAheadBeyondLastByte' : [ 0x40, ['_LARGE_INTEGER']], + 'PrevReadAheadBeyondLastByte' : [ 0x48, ['unsigned long long']], + 'ReadAheadSpinLock' : [ 0x50, ['unsigned long long']], + 'PipelinedReadAheadRequestSize' : [ 0x58, ['unsigned long']], + 'ReadAheadGrowth' : [ 0x5c, ['unsigned long']], + 'PrivateLinks' : [ 0x60, ['_LIST_ENTRY']], + 'ReadAheadWorkItem' : [ 0x70, ['pointer64', ['void']]], +} ], + '_CM_KEY_NODE' : [ 0x50, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Flags' : [ 0x2, ['unsigned short']], + 'LastWriteTime' : [ 0x4, ['_LARGE_INTEGER']], + 'AccessBits' : [ 0xc, ['unsigned long']], + 'Parent' : [ 0x10, ['unsigned long']], + 'SubKeyCounts' : [ 0x14, ['array', 2, ['unsigned long']]], + 'SubKeyLists' : [ 0x1c, ['array', 2, ['unsigned long']]], + 'ValueList' : [ 0x24, ['_CHILD_LIST']], + 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], + 'Security' : [ 0x2c, ['unsigned long']], + 'Class' : [ 0x30, ['unsigned long']], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'MaxClassLen' : [ 0x38, ['unsigned long']], + 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], + 'MaxValueDataLen' : [ 0x40, ['unsigned long']], + 'WorkVar' : [ 0x44, ['unsigned long']], + 'NameLength' : [ 0x48, ['unsigned short']], + 'ClassLength' : [ 0x4a, ['unsigned short']], + 'Name' : [ 0x4c, ['array', 1, ['wchar']]], +} ], + '_AER_ROOTPORT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'RootErrorCommandRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_PTE_TRACKER' : [ 0x80, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Mdl' : [ 0x10, ['pointer64', ['_MDL']]], + 'Count' : [ 0x18, ['unsigned long long']], + 'SystemVa' : [ 0x20, ['pointer64', ['void']]], + 'StartVa' : [ 0x28, ['pointer64', ['void']]], + 'Offset' : [ 0x30, ['unsigned long']], + 'Length' : [ 0x34, ['unsigned long']], + 'Page' : [ 0x38, ['unsigned long long']], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'StackTrace' : [ 0x48, ['array', 7, ['pointer64', ['void']]]], +} ], + '_KTHREAD_COUNTERS' : [ 0x1a8, { + 'WaitReasonBitMap' : [ 0x0, ['unsigned long long']], + 'UserData' : [ 0x8, ['pointer64', ['_THREAD_PERFORMANCE_DATA']]], + 'Flags' : [ 0x10, ['unsigned long']], + 'ContextSwitches' : [ 0x14, ['unsigned long']], + 'CycleTimeBias' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'HwCounter' : [ 0x28, ['array', 16, ['_COUNTER_READING']]], +} ], + '_SHARED_CACHE_MAP_LIST_CURSOR' : [ 0x18, { + 'SharedCacheMapLinks' : [ 0x0, ['_LIST_ENTRY']], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_DBGKD_GET_VERSION64' : [ 0x28, { + 'MajorVersion' : [ 0x0, ['unsigned short']], + 'MinorVersion' : [ 0x2, ['unsigned short']], + 'ProtocolVersion' : [ 0x4, ['unsigned char']], + 'KdSecondaryVersion' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'MachineType' : [ 0x8, ['unsigned short']], + 'MaxPacketType' : [ 0xa, ['unsigned char']], + 'MaxStateChange' : [ 0xb, ['unsigned char']], + 'MaxManipulate' : [ 0xc, ['unsigned char']], + 'Simulation' : [ 0xd, ['unsigned char']], + 'Unused' : [ 0xe, ['array', 1, ['unsigned short']]], + 'KernBase' : [ 0x10, ['unsigned long long']], + 'PsLoadedModuleList' : [ 0x18, ['unsigned long long']], + 'DebuggerDataList' : [ 0x20, ['unsigned long long']], +} ], + '_PROC_FEEDBACK_COUNTER' : [ 0x30, { + 'InstantaneousRead' : [ 0x0, ['pointer64', ['void']]], + 'DifferentialRead' : [ 0x0, ['pointer64', ['void']]], + 'LastActualCount' : [ 0x8, ['unsigned long long']], + 'LastReferenceCount' : [ 0x10, ['unsigned long long']], + 'CachedValue' : [ 0x18, ['unsigned long']], + 'Affinitized' : [ 0x20, ['unsigned char']], + 'Differential' : [ 0x21, ['unsigned char']], + 'DisableInterrupts' : [ 0x22, ['unsigned char']], + 'Context' : [ 0x28, ['unsigned long long']], +} ], + '_STRING32' : [ 0x8, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x4, ['unsigned long']], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCIES' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'States' : [ 0x8, ['array', 1, ['_PROCESSOR_PLATFORM_STATE_RESIDENCY']]], +} ], + '_HMAP_ENTRY' : [ 0x18, { + 'BlockAddress' : [ 0x0, ['unsigned long long']], + 'BinAddress' : [ 0x8, ['unsigned long long']], + 'MemAlloc' : [ 0x10, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_ENTRY' : [ 0x30, { + 'HashLink' : [ 0x0, ['pointer64', ['_RTL_ATOM_TABLE_ENTRY']]], + 'HandleIndex' : [ 0x8, ['unsigned short']], + 'Atom' : [ 0xa, ['unsigned short']], + 'Reference' : [ 0x10, ['_RTL_ATOM_TABLE_REFERENCE']], + 'NameLength' : [ 0x28, ['unsigned char']], + 'Name' : [ 0x2a, ['array', 1, ['wchar']]], +} ], + '_TXN_PARAMETER_BLOCK' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'TxFsContext' : [ 0x2, ['unsigned short']], + 'TransactionObject' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DUAL' : [ 0x278, { + 'Length' : [ 0x0, ['unsigned long']], + 'Map' : [ 0x8, ['pointer64', ['_HMAP_DIRECTORY']]], + 'SmallDir' : [ 0x10, ['pointer64', ['_HMAP_TABLE']]], + 'Guard' : [ 0x18, ['unsigned long']], + 'FreeDisplay' : [ 0x20, ['array', 24, ['_FREE_DISPLAY']]], + 'FreeBins' : [ 0x260, ['_LIST_ENTRY']], + 'FreeSummary' : [ 0x270, ['unsigned long']], +} ], + '_MI_VAD_SEQUENTIAL_INFO' : [ 0x8, { + 'Length' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned long long')]], + 'Vpn' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], +} ], + '_PNP_DEVICE_ACTION_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DeviceObject' : [ 0x10, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestType' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'AssignResources', 1: 'ClearDeviceProblem', 2: 'ClearProblem', 3: 'ClearEjectProblem', 4: 'HaltDevice', 5: 'QueryPowerRelations', 6: 'Rebalance', 7: 'ReenumerateBootDevices', 8: 'ReenumerateDeviceOnly', 9: 'ReenumerateDeviceTree', 10: 'ReenumerateRootDevices', 11: 'RequeryDeviceState', 12: 'ResetDevice', 13: 'ResourceRequirementsChanged', 14: 'RestartEnumeration', 15: 'SetDeviceProblem', 16: 'StartDevice', 17: 'StartSystemDevicesPass0', 18: 'StartSystemDevicesPass1', 19: 'NotifyTransportRelationsChange', 20: 'NotifyEjectionRelationsChange', 21: 'ConfigureDevice', 22: 'ConfigureDeviceClass', 23: 'ConfigureDeviceExtensions'})]], + 'ReorderingBarrier' : [ 0x1c, ['unsigned char']], + 'RequestArgument' : [ 0x20, ['unsigned long long']], + 'CompletionEvent' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'CompletionStatus' : [ 0x30, ['pointer64', ['long']]], +} ], + '_SEP_LOWBOX_NUMBER_ENTRY' : [ 0x38, { + 'HashEntry' : [ 0x0, ['_RTL_DYNAMIC_HASH_TABLE_ENTRY']], + 'ReferenceCount' : [ 0x18, ['long long']], + 'PackageSid' : [ 0x20, ['pointer64', ['void']]], + 'LowboxNumber' : [ 0x28, ['unsigned long']], + 'AtomTable' : [ 0x30, ['pointer64', ['void']]], +} ], + '_MI_CFG_BITMAP_INFO' : [ 0x20, { + 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], + 'RegionSize' : [ 0x8, ['unsigned long long']], + 'VadBaseAddress' : [ 0x10, ['pointer64', ['void']]], + 'BitmapVad' : [ 0x18, ['pointer64', ['_MMVAD']]], +} ], + '_COUNTER_READING' : [ 0x18, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PMCCounter', 1: 'MaxHardwareCounterType'})]], + 'Index' : [ 0x4, ['unsigned long']], + 'Start' : [ 0x8, ['unsigned long long']], + 'Total' : [ 0x10, ['unsigned long long']], +} ], + '_MMSESSION' : [ 0x58, { + 'SystemSpaceViewLock' : [ 0x0, ['_FAST_MUTEX']], + 'SystemSpaceViewLockPointer' : [ 0x38, ['pointer64', ['_FAST_MUTEX']]], + 'SystemSpaceViewTable' : [ 0x40, ['pointer64', ['_MMVIEW']]], + 'SystemSpaceHashSize' : [ 0x48, ['unsigned long']], + 'SystemSpaceHashEntries' : [ 0x4c, ['unsigned long']], + 'SystemSpaceHashKey' : [ 0x50, ['unsigned long']], + 'BitmapFailures' : [ 0x54, ['unsigned long']], +} ], + '_ETW_REG_ENTRY' : [ 0x70, { + 'RegList' : [ 0x0, ['_LIST_ENTRY']], + 'GroupRegList' : [ 0x10, ['_LIST_ENTRY']], + 'GuidEntry' : [ 0x20, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'GroupEntry' : [ 0x28, ['pointer64', ['_ETW_GUID_ENTRY']]], + 'ReplyQueue' : [ 0x30, ['pointer64', ['_ETW_REPLY_QUEUE']]], + 'ReplySlot' : [ 0x30, ['array', 4, ['pointer64', ['_ETW_QUEUE_ENTRY']]]], + 'Caller' : [ 0x30, ['pointer64', ['void']]], + 'SessionId' : [ 0x38, ['unsigned long']], + 'Process' : [ 0x50, ['pointer64', ['_EPROCESS']]], + 'CallbackContext' : [ 0x50, ['pointer64', ['void']]], + 'Callback' : [ 0x58, ['pointer64', ['void']]], + 'Index' : [ 0x60, ['unsigned short']], + 'Flags' : [ 0x62, ['unsigned char']], + 'DbgKernelRegistration' : [ 0x62, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DbgUserRegistration' : [ 0x62, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DbgReplyRegistration' : [ 0x62, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'DbgClassicRegistration' : [ 0x62, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'DbgSessionSpaceRegistration' : [ 0x62, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DbgModernRegistration' : [ 0x62, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DbgClosed' : [ 0x62, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'DbgInserted' : [ 0x62, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'EnableMask' : [ 0x63, ['unsigned char']], + 'GroupEnableMask' : [ 0x64, ['unsigned char']], + 'UseDescriptorType' : [ 0x65, ['unsigned char']], + 'Traits' : [ 0x68, ['pointer64', ['_ETW_PROVIDER_TRAITS']]], +} ], + '_LPCP_PORT_OBJECT' : [ 0x100, { + 'ConnectionPort' : [ 0x0, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'ConnectedPort' : [ 0x8, ['pointer64', ['_LPCP_PORT_OBJECT']]], + 'MsgQueue' : [ 0x10, ['_LPCP_PORT_QUEUE']], + 'Creator' : [ 0x30, ['_CLIENT_ID']], + 'ClientSectionBase' : [ 0x40, ['pointer64', ['void']]], + 'ServerSectionBase' : [ 0x48, ['pointer64', ['void']]], + 'PortContext' : [ 0x50, ['pointer64', ['void']]], + 'ClientThread' : [ 0x58, ['pointer64', ['_ETHREAD']]], + 'SecurityQos' : [ 0x60, ['_SECURITY_QUALITY_OF_SERVICE']], + 'StaticSecurity' : [ 0x70, ['_SECURITY_CLIENT_CONTEXT']], + 'LpcReplyChainHead' : [ 0xb8, ['_LIST_ENTRY']], + 'LpcDataInfoChainHead' : [ 0xc8, ['_LIST_ENTRY']], + 'ServerProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MappingProcess' : [ 0xd8, ['pointer64', ['_EPROCESS']]], + 'MaxMessageLength' : [ 0xe0, ['unsigned short']], + 'MaxConnectionInfoLength' : [ 0xe2, ['unsigned short']], + 'Flags' : [ 0xe4, ['unsigned long']], + 'WaitEvent' : [ 0xe8, ['_KEVENT']], +} ], + '_ARBITER_LIST_ENTRY' : [ 0x60, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'AlternativeCount' : [ 0x10, ['unsigned long']], + 'Alternatives' : [ 0x18, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'PhysicalDeviceObject' : [ 0x20, ['pointer64', ['_DEVICE_OBJECT']]], + 'RequestSource' : [ 0x28, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterRequestLegacyReported', 1: 'ArbiterRequestHalReported', 2: 'ArbiterRequestLegacyAssigned', 3: 'ArbiterRequestPnpDetected', 4: 'ArbiterRequestPnpEnumerated', -1: 'ArbiterRequestUndefined'})]], + 'Flags' : [ 0x2c, ['unsigned long']], + 'WorkSpace' : [ 0x30, ['long long']], + 'InterfaceType' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'Vmcs', 17: 'ACPIBus', 18: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], + 'SlotNumber' : [ 0x3c, ['unsigned long']], + 'BusNumber' : [ 0x40, ['unsigned long']], + 'Assignment' : [ 0x48, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], + 'SelectedAlternative' : [ 0x50, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Result' : [ 0x58, ['Enumeration', dict(target = 'long', choices = {0: 'ArbiterResultSuccess', 1: 'ArbiterResultExternalConflict', 2: 'ArbiterResultNullRequest', -1: 'ArbiterResultUndefined'})]], +} ], + '_ETW_PROVIDER_TRAITS' : [ 0x20, { + 'Node' : [ 0x0, ['_RTL_BALANCED_NODE']], + 'ReferenceCount' : [ 0x18, ['unsigned long']], + 'Traits' : [ 0x1c, ['array', 1, ['unsigned char']]], +} ], + '_INTERRUPT_CONNECTION_DATA' : [ 0xa8, { + 'Count' : [ 0x0, ['unsigned long']], + 'OriginalAffinity' : [ 0x8, ['_GROUP_AFFINITY']], + 'SteeringListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'SteeringListRoot' : [ 0x28, ['pointer64', ['void']]], + 'IsrTime' : [ 0x30, ['unsigned long long']], + 'DpcTime' : [ 0x38, ['unsigned long long']], + 'IsrLoad' : [ 0x40, ['unsigned long']], + 'DpcLoad' : [ 0x44, ['unsigned long']], + 'IsPrimaryInterrupt' : [ 0x48, ['unsigned char']], + 'InterruptObjectArray' : [ 0x50, ['pointer64', ['pointer64', ['_KINTERRUPT']]]], + 'InterruptObjectCount' : [ 0x58, ['unsigned long']], + 'Vectors' : [ 0x60, ['array', 1, ['_INTERRUPT_VECTOR_DATA']]], +} ], + '_LDR_DATA_TABLE_ENTRY' : [ 0x118, { + 'InLoadOrderLinks' : [ 0x0, ['_LIST_ENTRY']], + 'InMemoryOrderLinks' : [ 0x10, ['_LIST_ENTRY']], + 'InInitializationOrderLinks' : [ 0x20, ['_LIST_ENTRY']], + 'InProgressLinks' : [ 0x20, ['_LIST_ENTRY']], + 'DllBase' : [ 0x30, ['pointer64', ['void']]], + 'EntryPoint' : [ 0x38, ['pointer64', ['void']]], + 'SizeOfImage' : [ 0x40, ['unsigned long']], + 'FullDllName' : [ 0x48, ['_UNICODE_STRING']], + 'BaseDllName' : [ 0x58, ['_UNICODE_STRING']], + 'FlagGroup' : [ 0x68, ['array', 4, ['unsigned char']]], + 'Flags' : [ 0x68, ['unsigned long']], + 'PackagedBinary' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MarkedForRemoval' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ImageDll' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'LoadNotificationsSent' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'TelemetryEntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ProcessStaticImport' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'InLegacyLists' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'InIndexes' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ShimDll' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'InExceptionTable' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags1' : [ 0x68, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'LoadInProgress' : [ 0x68, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReservedFlags2' : [ 0x68, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'EntryProcessed' : [ 0x68, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ProtectDelayLoad' : [ 0x68, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ReservedFlags3' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 18, native_type='unsigned long')]], + 'DontCallForThreads' : [ 0x68, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'ProcessAttachCalled' : [ 0x68, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ProcessAttachFailed' : [ 0x68, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'CorDeferredValidate' : [ 0x68, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CorImage' : [ 0x68, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'DontRelocate' : [ 0x68, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'CorILOnly' : [ 0x68, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ReservedFlags5' : [ 0x68, ['BitField', dict(start_bit = 25, end_bit = 28, native_type='unsigned long')]], + 'Redirected' : [ 0x68, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ReservedFlags6' : [ 0x68, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'CompatDatabaseProcessed' : [ 0x68, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'ObsoleteLoadCount' : [ 0x6c, ['unsigned short']], + 'TlsIndex' : [ 0x6e, ['unsigned short']], + 'HashLinks' : [ 0x70, ['_LIST_ENTRY']], + 'TimeDateStamp' : [ 0x80, ['unsigned long']], + 'EntryPointActivationContext' : [ 0x88, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Lock' : [ 0x90, ['pointer64', ['void']]], + 'DdagNode' : [ 0x98, ['pointer64', ['_LDR_DDAG_NODE']]], + 'NodeModuleLink' : [ 0xa0, ['_LIST_ENTRY']], + 'SnapContext' : [ 0xb0, ['pointer64', ['_LDRP_DLL_SNAP_CONTEXT']]], + 'ParentDllBase' : [ 0xb8, ['pointer64', ['void']]], + 'SwitchBackContext' : [ 0xc0, ['pointer64', ['void']]], + 'BaseAddressIndexNode' : [ 0xc8, ['_RTL_BALANCED_NODE']], + 'MappingInfoIndexNode' : [ 0xe0, ['_RTL_BALANCED_NODE']], + 'OriginalBase' : [ 0xf8, ['unsigned long long']], + 'LoadTime' : [ 0x100, ['_LARGE_INTEGER']], + 'BaseNameHashValue' : [ 0x108, ['unsigned long']], + 'LoadReason' : [ 0x10c, ['Enumeration', dict(target = 'long', choices = {0: 'LoadReasonStaticDependency', 1: 'LoadReasonStaticForwarderDependency', 2: 'LoadReasonDynamicForwarderDependency', 3: 'LoadReasonDelayloadDependency', 4: 'LoadReasonDynamicLoad', 5: 'LoadReasonAsImageLoad', 6: 'LoadReasonAsDataLoad', -1: 'LoadReasonUnknown'})]], + 'ImplicitPathOptions' : [ 0x110, ['unsigned long']], +} ], + '_LDR_DDAG_NODE' : [ 0x50, { + 'Modules' : [ 0x0, ['_LIST_ENTRY']], + 'ServiceTagList' : [ 0x10, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'LoadCount' : [ 0x18, ['unsigned long']], + 'ReferenceCount' : [ 0x1c, ['unsigned long']], + 'DependencyCount' : [ 0x20, ['unsigned long']], + 'Dependencies' : [ 0x28, ['_LDRP_CSLIST']], + 'RemovalLink' : [ 0x28, ['_SINGLE_LIST_ENTRY']], + 'IncomingDependencies' : [ 0x30, ['_LDRP_CSLIST']], + 'State' : [ 0x38, ['Enumeration', dict(target = 'long', choices = {0: 'LdrModulesPlaceHolder', 1: 'LdrModulesMapping', 2: 'LdrModulesMapped', 3: 'LdrModulesWaitingForDependencies', 4: 'LdrModulesSnapping', 5: 'LdrModulesSnapped', 6: 'LdrModulesCondensed', 7: 'LdrModulesReadyToInit', 8: 'LdrModulesInitializing', 9: 'LdrModulesReadyToRun', '\xfb': 'LdrModulesMerged', '\xfd': 'LdrModulesSnapError', '\xfc': 'LdrModulesInitError', -1: 'LdrModulesUnloading', '\xfe': 'LdrModulesUnloaded'})]], + 'CondenseLink' : [ 0x40, ['_SINGLE_LIST_ENTRY']], + 'PreorderNumber' : [ 0x48, ['unsigned long']], + 'LowestLink' : [ 0x4c, ['unsigned long']], +} ], + '_POP_DEVICE_SYS_STATE' : [ 0x1d0, { + 'IrpMinor' : [ 0x0, ['unsigned char']], + 'SystemState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], + 'SpinLock' : [ 0x8, ['unsigned long long']], + 'Thread' : [ 0x10, ['pointer64', ['_KTHREAD']]], + 'AbortEvent' : [ 0x18, ['pointer64', ['_KEVENT']]], + 'ReadySemaphore' : [ 0x20, ['pointer64', ['_KSEMAPHORE']]], + 'FinishedSemaphore' : [ 0x28, ['pointer64', ['_KSEMAPHORE']]], + 'Order' : [ 0x30, ['_PO_DEVICE_NOTIFY_ORDER']], + 'Pending' : [ 0x1a8, ['_LIST_ENTRY']], + 'Status' : [ 0x1b8, ['long']], + 'FailedDevice' : [ 0x1c0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Waking' : [ 0x1c8, ['unsigned char']], + 'Cancelled' : [ 0x1c9, ['unsigned char']], + 'IgnoreErrors' : [ 0x1ca, ['unsigned char']], + 'IgnoreNotImplemented' : [ 0x1cb, ['unsigned char']], + 'TimeRefreshLockAcquired' : [ 0x1cc, ['unsigned char']], +} ], + '_SEGMENT_FLAGS' : [ 0x4, { + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned short')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'LockedPages' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned short')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned short')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], + 'Short0' : [ 0x0, ['unsigned short']], + 'FloppyMedia' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'DefaultProtectionMask' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Binary32' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ContainsDebug' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'UChar1' : [ 0x2, ['unsigned char']], + 'ILOnly' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ImageSigningType' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'ImageSigningLevel' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'UChar2' : [ 0x3, ['unsigned char']], +} ], + '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { + 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'StackTrace' : [ 0x8, ['array', 7, ['pointer64', ['void']]]], +} ], + '_LOGGED_STREAM_CALLBACK_V1' : [ 0x10, { + 'LogHandle' : [ 0x0, ['pointer64', ['void']]], + 'FlushToLsnRoutine' : [ 0x8, ['pointer64', ['void']]], +} ], + '_DIAGNOSTIC_BUFFER' : [ 0x28, { + 'Size' : [ 0x0, ['unsigned long long']], + 'CallerType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'KernelRequester', 1: 'UserProcessRequester', 2: 'UserSharedServiceRequester'})]], + 'ProcessImageNameOffset' : [ 0x10, ['unsigned long long']], + 'ProcessId' : [ 0x18, ['unsigned long']], + 'ServiceTag' : [ 0x1c, ['unsigned long']], + 'DeviceDescriptionOffset' : [ 0x10, ['unsigned long long']], + 'DevicePathOffset' : [ 0x18, ['unsigned long long']], + 'ReasonOffset' : [ 0x20, ['unsigned long long']], +} ], + '_CLIENT_ID32' : [ 0x8, { + 'UniqueProcess' : [ 0x0, ['unsigned long']], + 'UniqueThread' : [ 0x4, ['unsigned long']], +} ], + '_TEB32' : [ 0xfe8, { + 'NtTib' : [ 0x0, ['_NT_TIB32']], + 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], + 'ClientId' : [ 0x20, ['_CLIENT_ID32']], + 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], + 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], + 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['unsigned long']], + 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['unsigned long']], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'SystemReserved1' : [ 0xcc, ['array', 54, ['unsigned long']]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], + 'SpareBytes' : [ 0x1ac, ['array', 36, ['unsigned char']]], + 'TxFsContext' : [ 0x1d0, ['unsigned long']], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['unsigned long']], + 'glSectionInfo' : [ 0xbe0, ['unsigned long']], + 'glSection' : [ 0xbe4, ['unsigned long']], + 'glTable' : [ 0xbe8, ['unsigned long']], + 'glCurrentRC' : [ 0xbec, ['unsigned long']], + 'glContext' : [ 0xbf0, ['unsigned long']], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], + 'DeallocationStack' : [ 0xe0c, ['unsigned long']], + 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], + 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], + 'Vdm' : [ 0xf18, ['unsigned long']], + 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 9, ['unsigned long']]], + 'ActivityId' : [ 0xf50, ['_GUID']], + 'SubProcessTag' : [ 0xf60, ['unsigned long']], + 'PerflibData' : [ 0xf64, ['unsigned long']], + 'EtwTraceData' : [ 0xf68, ['unsigned long']], + 'WinSockData' : [ 0xf6c, ['unsigned long']], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'CurrentIdealProcessor' : [ 0xf74, ['_PROCESSOR_NUMBER']], + 'IdealProcessorValue' : [ 0xf74, ['unsigned long']], + 'ReservedPad0' : [ 0xf74, ['unsigned char']], + 'ReservedPad1' : [ 0xf75, ['unsigned char']], + 'ReservedPad2' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], + 'ReservedForOle' : [ 0xf80, ['unsigned long']], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SavedPriorityState' : [ 0xf88, ['unsigned long']], + 'ReservedForCodeCoverage' : [ 0xf8c, ['unsigned long']], + 'ThreadPoolData' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], + 'MuiGeneration' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['unsigned long']], + 'pShimData' : [ 0xfa4, ['unsigned long']], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned short']], + 'LowFragHeapDataSlot' : [ 0xfaa, ['unsigned short']], + 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], + 'ActiveFrame' : [ 0xfb0, ['unsigned long']], + 'FlsData' : [ 0xfb4, ['unsigned long']], + 'PreferredLanguages' : [ 0xfb8, ['unsigned long']], + 'UserPrefLanguages' : [ 0xfbc, ['unsigned long']], + 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], + 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], + 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], + 'SameTebFlags' : [ 0xfca, ['unsigned short']], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SessionAware' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], + 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], + 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], + 'LockCount' : [ 0xfd8, ['unsigned long']], + 'SpareUlong0' : [ 0xfdc, ['unsigned long']], + 'ResourceRetValue' : [ 0xfe0, ['unsigned long']], + 'ReservedForWdf' : [ 0xfe4, ['unsigned long']], +} ], + '_CM_KEY_INDEX' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Count' : [ 0x2, ['unsigned short']], + 'List' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_VI_DEADLOCK_THREAD' : [ 0x38, { + 'Thread' : [ 0x0, ['pointer64', ['_KTHREAD']]], + 'CurrentSpinNode' : [ 0x8, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'CurrentOtherNode' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x18, ['_LIST_ENTRY']], + 'NodeCount' : [ 0x28, ['unsigned long']], + 'PagingCount' : [ 0x2c, ['unsigned long']], + 'ThreadUsesEresources' : [ 0x30, ['unsigned char']], +} ], + '_PPM_IDLE_STATE' : [ 0xd8, { + 'DomainMembers' : [ 0x0, ['_KAFFINITY_EX']], + 'Latency' : [ 0xa8, ['unsigned long']], + 'BreakEvenDuration' : [ 0xac, ['unsigned long']], + 'Power' : [ 0xb0, ['unsigned long']], + 'StateFlags' : [ 0xb4, ['unsigned long']], + 'VetoAccounting' : [ 0xb8, ['_PPM_VETO_ACCOUNTING']], + 'StateType' : [ 0xd0, ['unsigned char']], + 'InterruptsEnabled' : [ 0xd1, ['unsigned char']], + 'Interruptible' : [ 0xd2, ['unsigned char']], + 'ContextRetained' : [ 0xd3, ['unsigned char']], + 'CacheCoherent' : [ 0xd4, ['unsigned char']], + 'WakesSpuriously' : [ 0xd5, ['unsigned char']], + 'PlatformOnly' : [ 0xd6, ['unsigned char']], + 'NoCState' : [ 0xd7, ['unsigned char']], +} ], + '_KRESOURCEMANAGER' : [ 0x250, { + 'NotificationAvailable' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'State' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'KResourceManagerUninitialized', 1: 'KResourceManagerOffline', 2: 'KResourceManagerOnline'})]], + 'Flags' : [ 0x20, ['unsigned long']], + 'Mutex' : [ 0x28, ['_KMUTANT']], + 'NamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'RmId' : [ 0x88, ['_GUID']], + 'NotificationQueue' : [ 0x98, ['_KQUEUE']], + 'NotificationMutex' : [ 0xd8, ['_KMUTANT']], + 'EnlistmentHead' : [ 0x110, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0x120, ['unsigned long']], + 'NotificationRoutine' : [ 0x128, ['pointer64', ['void']]], + 'Key' : [ 0x130, ['pointer64', ['void']]], + 'ProtocolListHead' : [ 0x138, ['_LIST_ENTRY']], + 'PendingPropReqListHead' : [ 0x148, ['_LIST_ENTRY']], + 'CRMListEntry' : [ 0x158, ['_LIST_ENTRY']], + 'Tm' : [ 0x168, ['pointer64', ['_KTM']]], + 'Description' : [ 0x170, ['_UNICODE_STRING']], + 'Enlistments' : [ 0x180, ['_KTMOBJECT_NAMESPACE']], + 'CompletionBinding' : [ 0x228, ['_KRESOURCEMANAGER_COMPLETION_BINDING']], +} ], + '_MMEXTEND_INFO' : [ 0x10, { + 'CommittedSize' : [ 0x0, ['unsigned long long']], + 'ReferenceCount' : [ 0x8, ['unsigned long']], +} ], + '_HANDLE_TABLE_FREE_LIST' : [ 0x40, { + 'FreeListLock' : [ 0x0, ['_EX_PUSH_LOCK']], + 'FirstFreeHandleEntry' : [ 0x8, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'LastFreeHandleEntry' : [ 0x10, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], + 'HandleCount' : [ 0x18, ['long']], + 'HighWaterMark' : [ 0x1c, ['unsigned long']], + 'Reserved' : [ 0x20, ['array', 8, ['unsigned long']]], +} ], + '_WHEAP_ERROR_RECORD_WRAPPER_FLAGS' : [ 0x4, { + 'Preallocated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'FromPersistentStore' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_GDI_TEB_BATCH64' : [ 0x4e8, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x8, ['unsigned long long']], + 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], +} ], + '__unnamed_2559' : [ 0x4, { + 'NodeSize' : [ 0x0, ['unsigned long']], + 'UseLookaside' : [ 0x0, ['unsigned long']], +} ], + '_VF_AVL_TREE' : [ 0x20, { + 'NodeRangeSize' : [ 0x0, ['unsigned long long']], + 'NodeCount' : [ 0x8, ['unsigned long long']], + 'Tables' : [ 0x10, ['pointer64', ['_VF_AVL_TABLE']]], + 'TablesNo' : [ 0x18, ['unsigned long']], + 'u1' : [ 0x1c, ['__unnamed_2559']], +} ], + '_FILE_NETWORK_OPEN_INFORMATION' : [ 0x38, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LastAccessTime' : [ 0x8, ['_LARGE_INTEGER']], + 'LastWriteTime' : [ 0x10, ['_LARGE_INTEGER']], + 'ChangeTime' : [ 0x18, ['_LARGE_INTEGER']], + 'AllocationSize' : [ 0x20, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x28, ['_LARGE_INTEGER']], + 'FileAttributes' : [ 0x30, ['unsigned long']], +} ], + '_POP_FX_ACCOUNTING' : [ 0x30, { + 'Lock' : [ 0x0, ['unsigned long long']], + 'Active' : [ 0x8, ['unsigned char']], + 'DripsRequiredState' : [ 0xc, ['unsigned long']], + 'Level' : [ 0x10, ['long']], + 'ActiveStamp' : [ 0x18, ['long long']], + 'CsActiveTime' : [ 0x20, ['unsigned long long']], + 'CriticalActiveTime' : [ 0x28, ['long long']], +} ], + '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], + 'ValidBits' : [ 0x0, ['unsigned long long']], +} ], + '_POP_TRIGGER_WAIT' : [ 0x38, { + 'Event' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Link' : [ 0x20, ['_LIST_ENTRY']], + 'Trigger' : [ 0x30, ['pointer64', ['_POP_ACTION_TRIGGER']]], +} ], + '_AER_ENDPOINT_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_RELATION_LIST_ENTRY' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned long']], + 'MaxCount' : [ 0x4, ['unsigned long']], + 'Devices' : [ 0x8, ['array', 1, ['_DEVICE_OBJECT_LIST_ENTRY']]], +} ], + '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { + 'TagIndex' : [ 0x0, ['unsigned short']], + 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_PROC_PERF_HISTORY_ENTRY' : [ 0x6, { + 'Utility' : [ 0x0, ['unsigned short']], + 'AffinitizedUtility' : [ 0x2, ['unsigned short']], + 'Frequency' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], +} ], + '_POP_FX_COMPONENT' : [ 0xf8, { + 'Id' : [ 0x0, ['_GUID']], + 'Index' : [ 0x10, ['unsigned long']], + 'WorkOrder' : [ 0x18, ['_POP_FX_WORK_ORDER']], + 'Device' : [ 0x50, ['pointer64', ['_POP_FX_DEVICE']]], + 'Flags' : [ 0x58, ['_POP_FX_COMPONENT_FLAGS']], + 'Resident' : [ 0x60, ['long']], + 'ActiveEvent' : [ 0x68, ['_KEVENT']], + 'IdleLock' : [ 0x80, ['unsigned long long']], + 'IdleConditionComplete' : [ 0x88, ['long']], + 'IdleStateComplete' : [ 0x8c, ['long']], + 'IdleStamp' : [ 0x90, ['unsigned long long']], + 'CurrentIdleState' : [ 0x98, ['unsigned long']], + 'IdleStateCount' : [ 0x9c, ['unsigned long']], + 'IdleStates' : [ 0xa0, ['pointer64', ['_POP_FX_IDLE_STATE']]], + 'DeepestWakeableIdleState' : [ 0xa8, ['unsigned long']], + 'ProviderCount' : [ 0xac, ['unsigned long']], + 'Providers' : [ 0xb0, ['pointer64', ['_POP_FX_PROVIDER']]], + 'IdleProviderCount' : [ 0xb8, ['unsigned long']], + 'DependentCount' : [ 0xbc, ['unsigned long']], + 'Dependents' : [ 0xc0, ['pointer64', ['_POP_FX_DEPENDENT']]], + 'Accounting' : [ 0xc8, ['_POP_FX_ACCOUNTING']], +} ], + '_PEP_CRASHDUMP_INFORMATION' : [ 0x10, { + 'DeviceHandle' : [ 0x0, ['pointer64', ['PEPHANDLE__']]], + 'DeviceContext' : [ 0x8, ['pointer64', ['void']]], +} ], + '_POP_FX_DRIVER_CALLBACKS' : [ 0x38, { + 'ComponentActive' : [ 0x0, ['pointer64', ['void']]], + 'ComponentIdle' : [ 0x8, ['pointer64', ['void']]], + 'ComponentIdleState' : [ 0x10, ['pointer64', ['void']]], + 'DevicePowerRequired' : [ 0x18, ['pointer64', ['void']]], + 'DevicePowerNotRequired' : [ 0x20, ['pointer64', ['void']]], + 'PowerControl' : [ 0x28, ['pointer64', ['void']]], + 'ComponentCriticalTransition' : [ 0x30, ['pointer64', ['void']]], +} ], + '_PROVIDER_BINARY_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ConsumersNotified' : [ 0x10, ['unsigned char']], + 'Spare' : [ 0x11, ['array', 3, ['unsigned char']]], + 'DebugIdSize' : [ 0x14, ['unsigned long']], + 'DebugId' : [ 0x18, ['_CVDD']], +} ], + '_VI_DEADLOCK_GLOBALS' : [ 0x8180, { + 'TimeAcquire' : [ 0x0, ['long long']], + 'TimeRelease' : [ 0x8, ['long long']], + 'ResourceDatabase' : [ 0x10, ['pointer64', ['_LIST_ENTRY']]], + 'ResourceDatabaseCount' : [ 0x18, ['unsigned long long']], + 'ResourceAddressRange' : [ 0x20, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'ThreadDatabase' : [ 0x4010, ['pointer64', ['_LIST_ENTRY']]], + 'ThreadDatabaseCount' : [ 0x4018, ['unsigned long long']], + 'ThreadAddressRange' : [ 0x4020, ['array', 1023, ['_VF_ADDRESS_RANGE']]], + 'AllocationFailures' : [ 0x8010, ['unsigned long']], + 'NodesTrimmedBasedOnAge' : [ 0x8014, ['unsigned long']], + 'NodesTrimmedBasedOnCount' : [ 0x8018, ['unsigned long']], + 'NodesSearched' : [ 0x801c, ['unsigned long']], + 'MaxNodesSearched' : [ 0x8020, ['unsigned long']], + 'SequenceNumber' : [ 0x8024, ['unsigned long']], + 'RecursionDepthLimit' : [ 0x8028, ['unsigned long']], + 'SearchedNodesLimit' : [ 0x802c, ['unsigned long']], + 'DepthLimitHits' : [ 0x8030, ['unsigned long']], + 'SearchLimitHits' : [ 0x8034, ['unsigned long']], + 'StackLimitHits' : [ 0x8038, ['unsigned long']], + 'ABC_ACB_Skipped' : [ 0x803c, ['unsigned long']], + 'OutOfOrderReleases' : [ 0x8040, ['unsigned long']], + 'NodesReleasedOutOfOrder' : [ 0x8044, ['unsigned long']], + 'TotalReleases' : [ 0x8048, ['unsigned long']], + 'RootNodesDeleted' : [ 0x804c, ['unsigned long']], + 'ForgetHistoryCounter' : [ 0x8050, ['unsigned long']], + 'Instigator' : [ 0x8058, ['pointer64', ['void']]], + 'NumberOfParticipants' : [ 0x8060, ['unsigned long']], + 'Participant' : [ 0x8068, ['array', 32, ['pointer64', ['_VI_DEADLOCK_NODE']]]], + 'ChildrenCountWatermark' : [ 0x8168, ['long']], + 'StackType' : [ 0x816c, ['Enumeration', dict(target = 'long', choices = {0: 'BugcheckStackLimits', 1: 'DPCStackLimits', 2: 'ExpandedStackLimits', 3: 'NormalStackLimits', 4: 'Win32kStackLimits', 5: 'SwapBusyStackLimits', 6: 'IsrStackLimits', 7: 'MaximumStackLimits'})]], + 'StackLowLimit' : [ 0x8170, ['unsigned long long']], + 'StackHighLimit' : [ 0x8178, ['unsigned long long']], +} ], + '_KTM' : [ 0x3c0, { + 'cookie' : [ 0x0, ['unsigned long']], + 'Mutex' : [ 0x8, ['_KMUTANT']], + 'State' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'KKtmUninitialized', 1: 'KKtmInitialized', 2: 'KKtmRecovering', 3: 'KKtmOnline', 4: 'KKtmRecoveryFailed', 5: 'KKtmOffline'})]], + 'NamespaceLink' : [ 0x48, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmIdentity' : [ 0x70, ['_GUID']], + 'Flags' : [ 0x80, ['unsigned long']], + 'VolatileFlags' : [ 0x84, ['unsigned long']], + 'LogFileName' : [ 0x88, ['_UNICODE_STRING']], + 'LogFileObject' : [ 0x98, ['pointer64', ['_FILE_OBJECT']]], + 'MarshallingContext' : [ 0xa0, ['pointer64', ['void']]], + 'LogManagementContext' : [ 0xa8, ['pointer64', ['void']]], + 'Transactions' : [ 0xb0, ['_KTMOBJECT_NAMESPACE']], + 'ResourceManagers' : [ 0x158, ['_KTMOBJECT_NAMESPACE']], + 'LsnOrderedMutex' : [ 0x200, ['_KMUTANT']], + 'LsnOrderedList' : [ 0x238, ['_LIST_ENTRY']], + 'CommitVirtualClock' : [ 0x248, ['_LARGE_INTEGER']], + 'CommitVirtualClockMutex' : [ 0x250, ['_FAST_MUTEX']], + 'BaseLsn' : [ 0x288, ['_CLS_LSN']], + 'CurrentReadLsn' : [ 0x290, ['_CLS_LSN']], + 'LastRecoveredLsn' : [ 0x298, ['_CLS_LSN']], + 'TmRmHandle' : [ 0x2a0, ['pointer64', ['void']]], + 'TmRm' : [ 0x2a8, ['pointer64', ['_KRESOURCEMANAGER']]], + 'LogFullNotifyEvent' : [ 0x2b0, ['_KEVENT']], + 'CheckpointWorkItem' : [ 0x2c8, ['_WORK_QUEUE_ITEM']], + 'CheckpointTargetLsn' : [ 0x2e8, ['_CLS_LSN']], + 'LogFullCompletedWorkItem' : [ 0x2f0, ['_WORK_QUEUE_ITEM']], + 'LogWriteResource' : [ 0x310, ['_ERESOURCE']], + 'LogFlags' : [ 0x378, ['unsigned long']], + 'LogFullStatus' : [ 0x37c, ['long']], + 'RecoveryStatus' : [ 0x380, ['long']], + 'LastCheckBaseLsn' : [ 0x388, ['_CLS_LSN']], + 'RestartOrderedList' : [ 0x390, ['_LIST_ENTRY']], + 'OfflineWorkItem' : [ 0x3a0, ['_WORK_QUEUE_ITEM']], +} ], + '_KTRANSACTION' : [ 0x2d8, { + 'OutcomeEvent' : [ 0x0, ['_KEVENT']], + 'cookie' : [ 0x18, ['unsigned long']], + 'Mutex' : [ 0x20, ['_KMUTANT']], + 'TreeTx' : [ 0x58, ['pointer64', ['_KTRANSACTION']]], + 'GlobalNamespaceLink' : [ 0x60, ['_KTMOBJECT_NAMESPACE_LINK']], + 'TmNamespaceLink' : [ 0x88, ['_KTMOBJECT_NAMESPACE_LINK']], + 'UOW' : [ 0xb0, ['_GUID']], + 'State' : [ 0xc0, ['Enumeration', dict(target = 'long', choices = {0: 'KTransactionUninitialized', 1: 'KTransactionActive', 2: 'KTransactionPreparing', 3: 'KTransactionPrepared', 4: 'KTransactionInDoubt', 5: 'KTransactionCommitted', 6: 'KTransactionAborted', 7: 'KTransactionDelegated', 8: 'KTransactionPrePreparing', 9: 'KTransactionForgotten', 10: 'KTransactionRecovering', 11: 'KTransactionPrePrepared'})]], + 'Flags' : [ 0xc4, ['unsigned long']], + 'EnlistmentHead' : [ 0xc8, ['_LIST_ENTRY']], + 'EnlistmentCount' : [ 0xd8, ['unsigned long']], + 'RecoverableEnlistmentCount' : [ 0xdc, ['unsigned long']], + 'PrePrepareRequiredEnlistmentCount' : [ 0xe0, ['unsigned long']], + 'PrepareRequiredEnlistmentCount' : [ 0xe4, ['unsigned long']], + 'OutcomeRequiredEnlistmentCount' : [ 0xe8, ['unsigned long']], + 'PendingResponses' : [ 0xec, ['unsigned long']], + 'SuperiorEnlistment' : [ 0xf0, ['pointer64', ['_KENLISTMENT']]], + 'LastLsn' : [ 0xf8, ['_CLS_LSN']], + 'PromotedEntry' : [ 0x100, ['_LIST_ENTRY']], + 'PromoterTransaction' : [ 0x110, ['pointer64', ['_KTRANSACTION']]], + 'PromotePropagation' : [ 0x118, ['pointer64', ['void']]], + 'IsolationLevel' : [ 0x120, ['unsigned long']], + 'IsolationFlags' : [ 0x124, ['unsigned long']], + 'Timeout' : [ 0x128, ['_LARGE_INTEGER']], + 'Description' : [ 0x130, ['_UNICODE_STRING']], + 'RollbackThread' : [ 0x140, ['pointer64', ['_KTHREAD']]], + 'RollbackWorkItem' : [ 0x148, ['_WORK_QUEUE_ITEM']], + 'RollbackDpc' : [ 0x168, ['_KDPC']], + 'RollbackTimer' : [ 0x1a8, ['_KTIMER']], + 'LsnOrderedEntry' : [ 0x1e8, ['_LIST_ENTRY']], + 'Outcome' : [ 0x1f8, ['Enumeration', dict(target = 'long', choices = {0: 'KTxOutcomeUninitialized', 1: 'KTxOutcomeUndetermined', 2: 'KTxOutcomeCommitted', 3: 'KTxOutcomeAborted', 4: 'KTxOutcomeUnavailable'})]], + 'Tm' : [ 0x200, ['pointer64', ['_KTM']]], + 'CommitReservation' : [ 0x208, ['long long']], + 'TransactionHistory' : [ 0x210, ['array', 10, ['_KTRANSACTION_HISTORY']]], + 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], + 'DTCPrivateInformation' : [ 0x268, ['pointer64', ['void']]], + 'DTCPrivateInformationLength' : [ 0x270, ['unsigned long']], + 'DTCPrivateInformationMutex' : [ 0x278, ['_KMUTANT']], + 'PromotedTxSelfHandle' : [ 0x2b0, ['pointer64', ['void']]], + 'PendingPromotionCount' : [ 0x2b8, ['unsigned long']], + 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], +} ], + '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'PipelineReadAheads' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], +} ], + '_CM_KCB_UOW' : [ 0x60, { + 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'KCBLock' : [ 0x10, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KeyLock' : [ 0x18, ['pointer64', ['_CM_INTENT_LOCK']]], + 'KCBListEntry' : [ 0x20, ['_LIST_ENTRY']], + 'KeyControlBlock' : [ 0x30, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'Transaction' : [ 0x38, ['pointer64', ['_CM_TRANS']]], + 'UoWState' : [ 0x40, ['unsigned long']], + 'ActionType' : [ 0x44, ['Enumeration', dict(target = 'long', choices = {0: 'UoWAddThisKey', 1: 'UoWAddChildKey', 2: 'UoWDeleteThisKey', 3: 'UoWDeleteChildKey', 4: 'UoWSetValueNew', 5: 'UoWSetValueExisting', 6: 'UoWDeleteValue', 7: 'UoWSetKeyUserFlags', 8: 'UoWSetLastWriteTime', 9: 'UoWSetSecurityDescriptor', 10: 'UoWRenameSubKey', 11: 'UoWRenameOldSubKey', 12: 'UoWRenameNewSubKey', 13: 'UoWIsolation', 14: 'UoWInvalid'})]], + 'StorageType' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'Stable', 1: 'Volatile', 2: 'InvalidStorage'})]], + 'ChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'VolatileKeyCell' : [ 0x50, ['unsigned long']], + 'OldValueCell' : [ 0x50, ['unsigned long']], + 'NewValueCell' : [ 0x54, ['unsigned long']], + 'UserFlags' : [ 0x50, ['unsigned long']], + 'LastWriteTime' : [ 0x50, ['_LARGE_INTEGER']], + 'TxSecurityCell' : [ 0x50, ['unsigned long']], + 'OldChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'NewChildKCB' : [ 0x58, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'OtherChildKCB' : [ 0x50, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], + 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], +} ], + '_MMPTE_TRANSITION' : [ 0x8, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '_KREQUEST_PACKET' : [ 0x20, { + 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], + 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], +} ], + '_PROCESSOR_IDLE_CONSTRAINTS' : [ 0x40, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'IdleTime' : [ 0x8, ['unsigned long long']], + 'ExpectedIdleDuration' : [ 0x10, ['unsigned long long']], + 'MaxIdleDuration' : [ 0x18, ['unsigned long long']], + 'OverrideState' : [ 0x20, ['unsigned long']], + 'TimeCheck' : [ 0x24, ['unsigned long']], + 'PromotePercent' : [ 0x28, ['unsigned char']], + 'DemotePercent' : [ 0x29, ['unsigned char']], + 'Parked' : [ 0x2a, ['unsigned char']], + 'Interruptible' : [ 0x2b, ['unsigned char']], + 'PlatformIdle' : [ 0x2c, ['unsigned char']], + 'IRHints' : [ 0x30, ['unsigned long']], + 'IRTruncatedHints' : [ 0x34, ['unsigned long']], + 'ExpectedWakeReason' : [ 0x38, ['unsigned char']], +} ], + '_VF_WATCHDOG_IRP' : [ 0x20, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'Irp' : [ 0x10, ['pointer64', ['_IRP']]], + 'DueTickCount' : [ 0x18, ['unsigned long']], + 'Inserted' : [ 0x1c, ['unsigned char']], + 'TrackedStackLocation' : [ 0x1d, ['unsigned char']], + 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], +} ], + '_MMVAD_FLAGS2' : [ 0x4, { + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Large' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'TrimBehind' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'NoValidationNeeded' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 32, native_type='unsigned long')]], +} ], + '_flags' : [ 0x1, { + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_25c8' : [ 0x8, { + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], +} ], + '__unnamed_25ca' : [ 0x8, { + 's1' : [ 0x0, ['__unnamed_25c8']], + 'Value' : [ 0x0, ['long long']], +} ], + '_ALPC_COMPLETION_LIST_STATE' : [ 0x8, { + 'u1' : [ 0x0, ['__unnamed_25ca']], +} ], + '_CM_KEY_SECURITY_CACHE' : [ 0x38, { + 'Cell' : [ 0x0, ['unsigned long']], + 'ConvKey' : [ 0x4, ['unsigned long']], + 'List' : [ 0x8, ['_LIST_ENTRY']], + 'DescriptorLength' : [ 0x18, ['unsigned long']], + 'RealRefCount' : [ 0x1c, ['unsigned long']], + 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_CM_NAME_HASH' : [ 0x18, { + 'ConvKey' : [ 0x0, ['unsigned long']], + 'NextHash' : [ 0x8, ['pointer64', ['_CM_NAME_HASH']]], + 'NameLength' : [ 0x10, ['unsigned short']], + 'Name' : [ 0x12, ['array', 1, ['wchar']]], +} ], + '_PROC_IDLE_STATE_BUCKET' : [ 0x20, { + 'TotalTime' : [ 0x0, ['unsigned long long']], + 'MinTime' : [ 0x8, ['unsigned long long']], + 'MaxTime' : [ 0x10, ['unsigned long long']], + 'Count' : [ 0x18, ['unsigned long']], +} ], + '_PO_IRP_QUEUE' : [ 0x10, { + 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], + 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], +} ], + '__unnamed_25dc' : [ 0x4, { + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'Whole' : [ 0x0, ['unsigned long']], +} ], + '_VI_DEADLOCK_NODE' : [ 0xd0, { + 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], + 'ChildrenList' : [ 0x8, ['_LIST_ENTRY']], + 'SiblingsList' : [ 0x18, ['_LIST_ENTRY']], + 'ResourceList' : [ 0x28, ['_LIST_ENTRY']], + 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], + 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], + 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], + 'u1' : [ 0x48, ['__unnamed_25dc']], + 'ChildrenCount' : [ 0x4c, ['long']], + 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], + 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], +} ], + 'PROCESSOR_IDLESTATE_INFO' : [ 0x8, { + 'TimeCheck' : [ 0x0, ['unsigned long']], + 'DemotePercent' : [ 0x4, ['unsigned char']], + 'PromotePercent' : [ 0x5, ['unsigned char']], + 'Spare' : [ 0x6, ['array', 2, ['unsigned char']]], +} ], + '_KTMOBJECT_NAMESPACE' : [ 0xa8, { + 'Table' : [ 0x0, ['_RTL_AVL_TABLE']], + 'Mutex' : [ 0x68, ['_KMUTANT']], + 'LinksOffset' : [ 0xa0, ['unsigned short']], + 'GuidOffset' : [ 0xa2, ['unsigned short']], + 'Expired' : [ 0xa4, ['unsigned char']], +} ], + '_LPCP_PORT_QUEUE' : [ 0x20, { + 'NonPagedPortQueue' : [ 0x0, ['pointer64', ['_LPCP_NONPAGED_PORT_QUEUE']]], + 'Semaphore' : [ 0x8, ['pointer64', ['_KSEMAPHORE']]], + 'ReceiveHead' : [ 0x10, ['_LIST_ENTRY']], +} ], + '_CM_KEY_REFERENCE' : [ 0x10, { + 'KeyCell' : [ 0x0, ['unsigned long']], + 'KeyHive' : [ 0x8, ['pointer64', ['_HHIVE']]], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + '_OBJECT_DUMP_CONTROL' : [ 0x10, { + 'Stream' : [ 0x0, ['pointer64', ['void']]], + 'Detail' : [ 0x8, ['unsigned long']], +} ], + '_EVENT_HEADER_EXTENDED_DATA_ITEM' : [ 0x10, { + 'Reserved1' : [ 0x0, ['unsigned short']], + 'ExtType' : [ 0x2, ['unsigned short']], + 'Linkage' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Reserved2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], + 'DataSize' : [ 0x6, ['unsigned short']], + 'DataPtr' : [ 0x8, ['unsigned long long']], +} ], + '_VF_ADDRESS_RANGE' : [ 0x10, { + 'Start' : [ 0x0, ['pointer64', ['unsigned char']]], + 'End' : [ 0x8, ['pointer64', ['unsigned char']]], +} ], + '_OBJECT_SYMBOLIC_LINK' : [ 0x20, { + 'CreationTime' : [ 0x0, ['_LARGE_INTEGER']], + 'LinkTarget' : [ 0x8, ['_UNICODE_STRING']], + 'DosDeviceDriveIndex' : [ 0x18, ['unsigned long']], + 'Flags' : [ 0x1c, ['unsigned long']], +} ], + '_LPCP_NONPAGED_PORT_QUEUE' : [ 0x28, { + 'Semaphore' : [ 0x0, ['_KSEMAPHORE']], + 'BackPointer' : [ 0x20, ['pointer64', ['_LPCP_PORT_OBJECT']]], +} ], + '_THERMAL_POLICY' : [ 0x14, { + 'Version' : [ 0x0, ['unsigned long']], + 'WaitForUpdate' : [ 0x4, ['unsigned char']], + 'Hibernate' : [ 0x5, ['unsigned char']], + 'Critical' : [ 0x6, ['unsigned char']], + 'ActivationReasons' : [ 0x8, ['unsigned long']], + 'PassiveLimit' : [ 0xc, ['unsigned long']], + 'ActiveLevel' : [ 0x10, ['unsigned long']], +} ], + '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x28, { + 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], + 'Port' : [ 0x10, ['pointer64', ['void']]], + 'Key' : [ 0x18, ['unsigned long long']], + 'BindingProcess' : [ 0x20, ['pointer64', ['_EPROCESS']]], +} ], + '_VF_TRACKER' : [ 0x10, { + 'TrackerFlags' : [ 0x0, ['unsigned long']], + 'TrackerSize' : [ 0x4, ['unsigned long']], + 'TrackerIndex' : [ 0x8, ['unsigned long']], + 'TraceDepth' : [ 0xc, ['unsigned long']], +} ], + '_CALL_PERFORMANCE_DATA' : [ 0x408, { + 'SpinLock' : [ 0x0, ['unsigned long long']], + 'HashTable' : [ 0x8, ['array', 64, ['_LIST_ENTRY']]], +} ], + '_RTL_UMS_CONTEXT' : [ 0x520, { + 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Context' : [ 0x10, ['_CONTEXT']], + 'Teb' : [ 0x4e0, ['pointer64', ['void']]], + 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Flags' : [ 0x4f0, ['long']], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], + 'ContextLock' : [ 0x4f8, ['unsigned long long']], + 'PrimaryUmsContext' : [ 0x500, ['pointer64', ['_RTL_UMS_CONTEXT']]], + 'SwitchCount' : [ 0x508, ['unsigned long']], + 'KernelYieldCount' : [ 0x50c, ['unsigned long']], + 'MixedYieldCount' : [ 0x510, ['unsigned long']], + 'YieldCount' : [ 0x514, ['unsigned long']], +} ], + '_ARBITER_ALTERNATIVE' : [ 0x40, { + 'Minimum' : [ 0x0, ['unsigned long long']], + 'Maximum' : [ 0x8, ['unsigned long long']], + 'Length' : [ 0x10, ['unsigned long long']], + 'Alignment' : [ 0x18, ['unsigned long long']], + 'Priority' : [ 0x20, ['long']], + 'Flags' : [ 0x24, ['unsigned long']], + 'Descriptor' : [ 0x28, ['pointer64', ['_IO_RESOURCE_DESCRIPTOR']]], + 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], +} ], + '_WHEA_ERROR_STATUS' : [ 0x8, { + 'ErrorStatus' : [ 0x0, ['unsigned long long']], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], +} ], + '_WHEA_PERSISTENCE_INFO' : [ 0x8, { + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], + 'AsULONGLONG' : [ 0x0, ['unsigned long long']], +} ], + '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { + 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], + 'InternalImageInformation' : [ 0x40, ['_MI_EXTRA_IMAGE_INFORMATION']], +} ], + '_STRING64' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'MaximumLength' : [ 0x2, ['unsigned short']], + 'Buffer' : [ 0x8, ['unsigned long long']], +} ], + '_STACK_TABLE' : [ 0x8088, { + 'NumStackTraces' : [ 0x0, ['unsigned short']], + 'TraceCapacity' : [ 0x2, ['unsigned short']], + 'StackTrace' : [ 0x8, ['array', 16, ['pointer64', ['_OBJECT_REF_TRACE']]]], + 'StackTableHash' : [ 0x88, ['array', 16381, ['unsigned short']]], +} ], + '_CM_INDEX_HINT_BLOCK' : [ 0x8, { + 'Count' : [ 0x0, ['unsigned long']], + 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], +} ], + '_TOKEN_CONTROL' : [ 0x28, { + 'TokenId' : [ 0x0, ['_LUID']], + 'AuthenticationId' : [ 0x8, ['_LUID']], + 'ModifiedId' : [ 0x10, ['_LUID']], + 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], +} ], + '_ETW_GUID_ENTRY' : [ 0x178, { + 'GuidList' : [ 0x0, ['_LIST_ENTRY']], + 'RefCount' : [ 0x10, ['long long']], + 'Guid' : [ 0x18, ['_GUID']], + 'RegListHead' : [ 0x28, ['_LIST_ENTRY']], + 'SecurityDescriptor' : [ 0x38, ['pointer64', ['void']]], + 'LastEnable' : [ 0x40, ['_ETW_LAST_ENABLE_INFO']], + 'MatchId' : [ 0x40, ['unsigned long long']], + 'ProviderEnableInfo' : [ 0x50, ['_TRACE_ENABLE_INFO']], + 'EnableInfo' : [ 0x70, ['array', 8, ['_TRACE_ENABLE_INFO']]], + 'FilterData' : [ 0x170, ['pointer64', ['_ETW_FILTER_HEADER']]], +} ], + '_KUMS_CONTEXT_HEADER' : [ 0x70, { + 'P1Home' : [ 0x0, ['unsigned long long']], + 'P2Home' : [ 0x8, ['unsigned long long']], + 'P3Home' : [ 0x10, ['unsigned long long']], + 'P4Home' : [ 0x18, ['unsigned long long']], + 'StackTop' : [ 0x20, ['pointer64', ['void']]], + 'StackSize' : [ 0x28, ['unsigned long long']], + 'RspOffset' : [ 0x30, ['unsigned long long']], + 'Rip' : [ 0x38, ['unsigned long long']], + 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], + 'Flags' : [ 0x48, ['unsigned long long']], + 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], + 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], + 'SourceThread' : [ 0x60, ['pointer64', ['_KTHREAD']]], + 'Return' : [ 0x68, ['unsigned long long']], +} ], + '_DEFERRED_WRITE' : [ 0x48, { + 'NodeTypeCode' : [ 0x0, ['short']], + 'NodeByteSize' : [ 0x2, ['short']], + 'FileObject' : [ 0x8, ['pointer64', ['_FILE_OBJECT']]], + 'BytesToWrite' : [ 0x10, ['unsigned long']], + 'DeferredWriteLinks' : [ 0x18, ['_LIST_ENTRY']], + 'Event' : [ 0x28, ['pointer64', ['_KEVENT']]], + 'PostRoutine' : [ 0x30, ['pointer64', ['void']]], + 'Context1' : [ 0x38, ['pointer64', ['void']]], + 'Context2' : [ 0x40, ['pointer64', ['void']]], +} ], + '__unnamed_2647' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2649' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2647']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_WHEA_PCI_SLOT_NUMBER' : [ 0x4, { + 'u' : [ 0x0, ['__unnamed_2649']], +} ], + '_ARBITER_ORDERING_LIST' : [ 0x10, { + 'Count' : [ 0x0, ['unsigned short']], + 'Maximum' : [ 0x2, ['unsigned short']], + 'Orderings' : [ 0x8, ['pointer64', ['_ARBITER_ORDERING']]], +} ], + '_SECTION_IMAGE_INFORMATION' : [ 0x40, { + 'TransferAddress' : [ 0x0, ['pointer64', ['void']]], + 'ZeroBits' : [ 0x8, ['unsigned long']], + 'MaximumStackSize' : [ 0x10, ['unsigned long long']], + 'CommittedStackSize' : [ 0x18, ['unsigned long long']], + 'SubSystemType' : [ 0x20, ['unsigned long']], + 'SubSystemMinorVersion' : [ 0x24, ['unsigned short']], + 'SubSystemMajorVersion' : [ 0x26, ['unsigned short']], + 'SubSystemVersion' : [ 0x24, ['unsigned long']], + 'GpValue' : [ 0x28, ['unsigned long']], + 'ImageCharacteristics' : [ 0x2c, ['unsigned short']], + 'DllCharacteristics' : [ 0x2e, ['unsigned short']], + 'Machine' : [ 0x30, ['unsigned short']], + 'ImageContainsCode' : [ 0x32, ['unsigned char']], + 'ImageFlags' : [ 0x33, ['unsigned char']], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'BaseBelow4gb' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], + 'LoaderFlags' : [ 0x34, ['unsigned long']], + 'ImageFileSize' : [ 0x38, ['unsigned long']], + 'CheckSum' : [ 0x3c, ['unsigned long']], +} ], + '_VF_AVL_TABLE' : [ 0xc0, { + 'RtlTable' : [ 0x0, ['_RTL_AVL_TABLE']], + 'ReservedNode' : [ 0x68, ['pointer64', ['_VF_AVL_TREE_NODE']]], + 'NodeToFree' : [ 0x70, ['pointer64', ['void']]], + 'Lock' : [ 0x80, ['long']], +} ], + '_XPF_MC_BANK_FLAGS' : [ 0x1, { + 'ClearOnInitializationRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ControlDataRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], + 'AsUCHAR' : [ 0x0, ['unsigned char']], +} ], + '_TOKEN_AUDIT_POLICY' : [ 0x1d, { + 'PerUserPolicy' : [ 0x0, ['array', 29, ['unsigned char']]], +} ], + '_ETW_LAST_ENABLE_INFO' : [ 0x10, { + 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], + 'LoggerId' : [ 0x8, ['unsigned short']], + 'Level' : [ 0xa, ['unsigned char']], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], +} ], + '__unnamed_265d' : [ 0x10, { + 'EndingOffset' : [ 0x0, ['pointer64', ['_LARGE_INTEGER']]], + 'ResourceToRelease' : [ 0x8, ['pointer64', ['pointer64', ['_ERESOURCE']]]], +} ], + '__unnamed_265f' : [ 0x8, { + 'ResourceToRelease' : [ 0x0, ['pointer64', ['_ERESOURCE']]], +} ], + '__unnamed_2663' : [ 0x8, { + 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], + 'PageProtection' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2667' : [ 0x10, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NotifyTypeCreate', 1: 'NotifyTypeRetired'})]], + 'SafeToRecurse' : [ 0x8, ['unsigned char']], +} ], + '__unnamed_2669' : [ 0x28, { + 'Argument1' : [ 0x0, ['pointer64', ['void']]], + 'Argument2' : [ 0x8, ['pointer64', ['void']]], + 'Argument3' : [ 0x10, ['pointer64', ['void']]], + 'Argument4' : [ 0x18, ['pointer64', ['void']]], + 'Argument5' : [ 0x20, ['pointer64', ['void']]], +} ], + '_FS_FILTER_PARAMETERS' : [ 0x28, { + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_265d']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_265f']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_2663']], + 'NotifyStreamFileObject' : [ 0x0, ['__unnamed_2667']], + 'Others' : [ 0x0, ['__unnamed_2669']], +} ], + '_MI_SESSION_DRIVER_UNLOAD' : [ 0x8, { + 'Function' : [ 0x0, ['pointer64', ['void']]], + 'FunctionValue' : [ 0x0, ['unsigned long long']], +} ], + '_PPM_SELECTION_STATISTICS' : [ 0x68, { + 'PlatformOnlyCount' : [ 0x0, ['unsigned long long']], + 'PreVetoCount' : [ 0x8, ['unsigned long long']], + 'VetoCount' : [ 0x10, ['unsigned long long']], + 'IdleDurationCount' : [ 0x18, ['unsigned long long']], + 'LatencyCount' : [ 0x20, ['unsigned long long']], + 'InterruptibleCount' : [ 0x28, ['unsigned long long']], + 'DeviceDependencyCount' : [ 0x30, ['unsigned long long']], + 'ProcessorDependencyCount' : [ 0x38, ['unsigned long long']], + 'WrongProcessorCount' : [ 0x40, ['unsigned long long']], + 'LegacyOverrideCount' : [ 0x48, ['unsigned long long']], + 'CstateCheckCount' : [ 0x50, ['unsigned long long']], + 'NoCStateCount' : [ 0x58, ['unsigned long long']], + 'SelectedCount' : [ 0x60, ['unsigned long long']], +} ], + '_LDR_SERVICE_TAG_RECORD' : [ 0x10, { + 'Next' : [ 0x0, ['pointer64', ['_LDR_SERVICE_TAG_RECORD']]], + 'ServiceTag' : [ 0x8, ['unsigned long']], +} ], + '_COMPRESSED_DATA_INFO' : [ 0xc, { + 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], + 'CompressionUnitShift' : [ 0x2, ['unsigned char']], + 'ChunkShift' : [ 0x3, ['unsigned char']], + 'ClusterShift' : [ 0x4, ['unsigned char']], + 'Reserved' : [ 0x5, ['unsigned char']], + 'NumberOfChunks' : [ 0x6, ['unsigned short']], + 'CompressedChunkSizes' : [ 0x8, ['array', 1, ['unsigned long']]], +} ], + '_HIVE_WAIT_PACKET' : [ 0x28, { + 'WakeEvent' : [ 0x0, ['_KEVENT']], + 'Status' : [ 0x18, ['long']], + 'Next' : [ 0x20, ['pointer64', ['_HIVE_WAIT_PACKET']]], +} ], + '__unnamed_2678' : [ 0x4, { + 'PollInterval' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_267a' : [ 0x18, { + 'PollInterval' : [ 0x0, ['unsigned long']], + 'Vector' : [ 0x4, ['unsigned long']], + 'SwitchToPollingThreshold' : [ 0x8, ['unsigned long']], + 'SwitchToPollingWindow' : [ 0xc, ['unsigned long']], + 'ErrorThreshold' : [ 0x10, ['unsigned long']], + 'ErrorThresholdWindow' : [ 0x14, ['unsigned long']], +} ], + '__unnamed_267c' : [ 0x18, { + 'Polled' : [ 0x0, ['__unnamed_2678']], + 'Interrupt' : [ 0x0, ['__unnamed_267a']], + 'LocalInterrupt' : [ 0x0, ['__unnamed_267a']], + 'Sci' : [ 0x0, ['__unnamed_267a']], + 'Nmi' : [ 0x0, ['__unnamed_267a']], +} ], + '_WHEA_NOTIFICATION_DESCRIPTOR' : [ 0x1c, { + 'Type' : [ 0x0, ['unsigned char']], + 'Length' : [ 0x1, ['unsigned char']], + 'Flags' : [ 0x2, ['_WHEA_NOTIFICATION_FLAGS']], + 'u' : [ 0x4, ['__unnamed_267c']], +} ], + '_POP_HIBER_CONTEXT' : [ 0x1a0, { + 'Reset' : [ 0x0, ['unsigned char']], + 'HiberFlags' : [ 0x1, ['unsigned char']], + 'WroteHiberFile' : [ 0x2, ['unsigned char']], + 'VerifyKernelPhaseOnResume' : [ 0x3, ['unsigned char']], + 'KernelPhaseVerificationActive' : [ 0x4, ['unsigned char']], + 'InitializationFinished' : [ 0x5, ['unsigned char']], + 'NextTableLockHeld' : [ 0x8, ['long']], + 'BootPhaseFinishedBarrier' : [ 0xc, ['long']], + 'KernelResumeFinishedBarrier' : [ 0x10, ['long']], + 'MapFrozen' : [ 0x14, ['unsigned char']], + 'DiscardMap' : [ 0x18, ['_RTL_BITMAP']], + 'KernelPhaseMap' : [ 0x18, ['_RTL_BITMAP']], + 'BootPhaseMap' : [ 0x28, ['_RTL_BITMAP']], + 'ClonedRanges' : [ 0x38, ['_LIST_ENTRY']], + 'ClonedRangeCount' : [ 0x48, ['unsigned long']], + 'ClonedPageCount' : [ 0x50, ['unsigned long long']], + 'CurrentMap' : [ 0x58, ['pointer64', ['_RTL_BITMAP']]], + 'NextCloneRange' : [ 0x60, ['pointer64', ['_LIST_ENTRY']]], + 'NextPreserve' : [ 0x68, ['unsigned long long']], + 'LoaderMdl' : [ 0x70, ['pointer64', ['_MDL']]], + 'AllocatedMdl' : [ 0x78, ['pointer64', ['_MDL']]], + 'PagesOut' : [ 0x80, ['unsigned long long']], + 'IoPages' : [ 0x88, ['pointer64', ['void']]], + 'IoPagesCount' : [ 0x90, ['unsigned long']], + 'CurrentMcb' : [ 0x98, ['pointer64', ['void']]], + 'DumpStack' : [ 0xa0, ['pointer64', ['_DUMP_STACK_CONTEXT']]], + 'WakeState' : [ 0xa8, ['pointer64', ['_KPROCESSOR_STATE']]], + 'IoProgress' : [ 0xb0, ['unsigned long']], + 'Status' : [ 0xb4, ['long']], + 'GraphicsProc' : [ 0xb8, ['unsigned long']], + 'MemoryImage' : [ 0xc0, ['pointer64', ['PO_MEMORY_IMAGE']]], + 'PerformanceStats' : [ 0xc8, ['pointer64', ['unsigned long']]], + 'BootLoaderLogMdl' : [ 0xd0, ['pointer64', ['_MDL']]], + 'SiLogOffset' : [ 0xd8, ['unsigned long']], + 'FirmwareRuntimeInformationMdl' : [ 0xe0, ['pointer64', ['_MDL']]], + 'FirmwareRuntimeInformationVa' : [ 0xe8, ['pointer64', ['void']]], + 'ResumeContext' : [ 0xf0, ['pointer64', ['void']]], + 'ResumeContextPages' : [ 0xf8, ['unsigned long']], + 'ProcessorCount' : [ 0xfc, ['unsigned long']], + 'ProcessorContext' : [ 0x100, ['pointer64', ['_POP_PER_PROCESSOR_CONTEXT']]], + 'ProdConsBuffer' : [ 0x108, ['pointer64', ['unsigned char']]], + 'ProdConsSize' : [ 0x110, ['unsigned long']], + 'MaxDataPages' : [ 0x114, ['unsigned long']], + 'ExtraBuffer' : [ 0x118, ['pointer64', ['void']]], + 'ExtraBufferSize' : [ 0x120, ['unsigned long long']], + 'ExtraMapVa' : [ 0x128, ['pointer64', ['void']]], + 'BitlockerKeyPFN' : [ 0x130, ['unsigned long long']], + 'IoInfo' : [ 0x138, ['_POP_IO_INFO']], + 'HardwareConfigurationSignature' : [ 0x198, ['unsigned long']], +} ], + '_OBJECT_REF_TRACE' : [ 0x80, { + 'StackTrace' : [ 0x0, ['array', 16, ['pointer64', ['void']]]], +} ], + '_CVDD' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'NB10' : [ 0x0, ['_NB10']], + 'RsDs' : [ 0x0, ['_RSDS']], +} ], + '_OBJECT_NAME_INFORMATION' : [ 0x10, { + 'Name' : [ 0x0, ['_UNICODE_STRING']], +} ], + '_WHEA_AER_BRIDGE_DESCRIPTOR' : [ 0x2c, { + 'Type' : [ 0x0, ['unsigned short']], + 'Enabled' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['unsigned char']], + 'BusNumber' : [ 0x4, ['unsigned long']], + 'Slot' : [ 0x8, ['_WHEA_PCI_SLOT_NUMBER']], + 'DeviceControl' : [ 0xc, ['unsigned short']], + 'Flags' : [ 0xe, ['_AER_BRIDGE_DESCRIPTOR_FLAGS']], + 'UncorrectableErrorMask' : [ 0x10, ['unsigned long']], + 'UncorrectableErrorSeverity' : [ 0x14, ['unsigned long']], + 'CorrectableErrorMask' : [ 0x18, ['unsigned long']], + 'AdvancedCapsAndControl' : [ 0x1c, ['unsigned long']], + 'SecondaryUncorrectableErrorMask' : [ 0x20, ['unsigned long']], + 'SecondaryUncorrectableErrorSev' : [ 0x24, ['unsigned long']], + 'SecondaryCapsAndControl' : [ 0x28, ['unsigned long']], +} ], + '_KDESCRIPTOR' : [ 0x10, { + 'Pad' : [ 0x0, ['array', 3, ['unsigned short']]], + 'Limit' : [ 0x6, ['unsigned short']], + 'Base' : [ 0x8, ['pointer64', ['void']]], +} ], + '_PCW_COUNTER_INFORMATION' : [ 0x10, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], +} ], + '_DUMP_STACK_CONTEXT' : [ 0x178, { + 'Init' : [ 0x0, ['_DUMP_INITIALIZATION_CONTEXT']], + 'PartitionOffset' : [ 0x108, ['_LARGE_INTEGER']], + 'DumpPointers' : [ 0x110, ['pointer64', ['void']]], + 'PointersLength' : [ 0x118, ['unsigned long']], + 'ModulePrefix' : [ 0x120, ['pointer64', ['unsigned short']]], + 'DriverList' : [ 0x128, ['_LIST_ENTRY']], + 'InitMsg' : [ 0x138, ['_STRING']], + 'ProgMsg' : [ 0x148, ['_STRING']], + 'DoneMsg' : [ 0x158, ['_STRING']], + 'FileObject' : [ 0x168, ['pointer64', ['void']]], + 'UsageType' : [ 0x170, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile', 4: 'DeviceUsageTypeBoot', 5: 'DeviceUsageTypePostDisplay'})]], +} ], + '_FILE_STANDARD_INFORMATION' : [ 0x18, { + 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], + 'EndOfFile' : [ 0x8, ['_LARGE_INTEGER']], + 'NumberOfLinks' : [ 0x10, ['unsigned long']], + 'DeletePending' : [ 0x14, ['unsigned char']], + 'Directory' : [ 0x15, ['unsigned char']], +} ], + '_PPM_VETO_ACCOUNTING' : [ 0x18, { + 'VetoPresent' : [ 0x0, ['long']], + 'VetoListHead' : [ 0x8, ['_LIST_ENTRY']], +} ], + '_POP_SHUTDOWN_BUG_CHECK' : [ 0x48, { + 'InitiatingThread' : [ 0x0, ['pointer64', ['_ETHREAD']]], + 'InitiatingProcess' : [ 0x8, ['pointer64', ['_EPROCESS']]], + 'ThreadId' : [ 0x10, ['pointer64', ['void']]], + 'ProcessId' : [ 0x18, ['pointer64', ['void']]], + 'Code' : [ 0x20, ['unsigned long']], + 'Parameter1' : [ 0x28, ['unsigned long long']], + 'Parameter2' : [ 0x30, ['unsigned long long']], + 'Parameter3' : [ 0x38, ['unsigned long long']], + 'Parameter4' : [ 0x40, ['unsigned long long']], +} ], + '_NB10' : [ 0x14, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Offset' : [ 0x4, ['unsigned long']], + 'TimeStamp' : [ 0x8, ['unsigned long']], + 'Age' : [ 0xc, ['unsigned long']], + 'PdbName' : [ 0x10, ['array', 1, ['unsigned char']]], +} ], + '_MI_EXTRA_IMAGE_INFORMATION' : [ 0x8, { + 'SizeOfHeaders' : [ 0x0, ['unsigned long']], + 'SizeOfImage' : [ 0x4, ['unsigned long']], +} ], + '_PCW_MASK_INFORMATION' : [ 0x28, { + 'CounterMask' : [ 0x0, ['unsigned long long']], + 'InstanceMask' : [ 0x8, ['pointer64', ['_UNICODE_STRING']]], + 'InstanceId' : [ 0x10, ['unsigned long']], + 'CollectMultiple' : [ 0x14, ['unsigned char']], + 'Buffer' : [ 0x18, ['pointer64', ['_PCW_BUFFER']]], + 'CancelEvent' : [ 0x20, ['pointer64', ['_KEVENT']]], +} ], + '_MMVAD_FLAGS' : [ 0x4, { + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 14, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'PrivateFixup' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 31, native_type='unsigned long')]], + 'DeleteInProgress' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '_SECURITY_DESCRIPTOR_RELATIVE' : [ 0x14, { + 'Revision' : [ 0x0, ['unsigned char']], + 'Sbz1' : [ 0x1, ['unsigned char']], + 'Control' : [ 0x2, ['unsigned short']], + 'Owner' : [ 0x4, ['unsigned long']], + 'Group' : [ 0x8, ['unsigned long']], + 'Sacl' : [ 0xc, ['unsigned long']], + 'Dacl' : [ 0x10, ['unsigned long']], +} ], + '_MI_VAD_EVENT_BLOCK' : [ 0x28, { + 'Next' : [ 0x0, ['pointer64', ['_MI_VAD_EVENT_BLOCK']]], + 'WaitReason' : [ 0x8, ['unsigned long']], + 'Gate' : [ 0x10, ['_KGATE']], + 'SecureInfo' : [ 0x10, ['_MMADDRESS_LIST']], + 'BitMap' : [ 0x10, ['_RTL_BITMAP_EX']], + 'InPageSupport' : [ 0x10, ['pointer64', ['_MMINPAGE_SUPPORT']]], + 'PhysicalMemory' : [ 0x10, ['_MI_PHYSMEM_BLOCK']], + 'LargePage' : [ 0x10, ['pointer64', ['_MI_LARGEPAGE_MEMORY_INFO']]], +} ], + '__unnamed_26b9' : [ 0x20, { + 'TestAllocation' : [ 0x0, ['_ARBITER_TEST_ALLOCATION_PARAMETERS']], + 'RetestAllocation' : [ 0x0, ['_ARBITER_RETEST_ALLOCATION_PARAMETERS']], + 'BootAllocation' : [ 0x0, ['_ARBITER_BOOT_ALLOCATION_PARAMETERS']], + 'QueryAllocatedResources' : [ 0x0, ['_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS']], + 'QueryConflict' : [ 0x0, ['_ARBITER_QUERY_CONFLICT_PARAMETERS']], + 'QueryArbitrate' : [ 0x0, ['_ARBITER_QUERY_ARBITRATE_PARAMETERS']], + 'AddReserved' : [ 0x0, ['_ARBITER_ADD_RESERVED_PARAMETERS']], +} ], + '_ARBITER_PARAMETERS' : [ 0x20, { + 'Parameters' : [ 0x0, ['__unnamed_26b9']], +} ], + '__unnamed_26bd' : [ 0x8, { + 'idxRecord' : [ 0x0, ['unsigned long']], + 'cidContainer' : [ 0x4, ['unsigned long']], +} ], + '_CLS_LSN' : [ 0x8, { + 'offset' : [ 0x0, ['__unnamed_26bd']], + 'ullOffset' : [ 0x0, ['unsigned long long']], +} ], + '_NT_TIB32' : [ 0x1c, { + 'ExceptionList' : [ 0x0, ['unsigned long']], + 'StackBase' : [ 0x4, ['unsigned long']], + 'StackLimit' : [ 0x8, ['unsigned long']], + 'SubSystemTib' : [ 0xc, ['unsigned long']], + 'FiberData' : [ 0x10, ['unsigned long']], + 'Version' : [ 0x10, ['unsigned long']], + 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], + 'Self' : [ 0x18, ['unsigned long']], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + '_RSDS' : [ 0x1c, { + 'Signature' : [ 0x0, ['unsigned long']], + 'Guid' : [ 0x4, ['_GUID']], + 'Age' : [ 0x14, ['unsigned long']], + 'PdbName' : [ 0x18, ['array', 1, ['unsigned char']]], +} ], + 'PO_MEMORY_IMAGE' : [ 0x360, { + 'Signature' : [ 0x0, ['unsigned long']], + 'ImageType' : [ 0x4, ['unsigned long']], + 'CheckSum' : [ 0x8, ['unsigned long']], + 'LengthSelf' : [ 0xc, ['unsigned long']], + 'PageSelf' : [ 0x10, ['unsigned long long']], + 'PageSize' : [ 0x18, ['unsigned long']], + 'SystemTime' : [ 0x20, ['_LARGE_INTEGER']], + 'InterruptTime' : [ 0x28, ['unsigned long long']], + 'FeatureFlags' : [ 0x30, ['unsigned long long']], + 'HiberFlags' : [ 0x38, ['unsigned char']], + 'spare' : [ 0x39, ['array', 3, ['unsigned char']]], + 'NoHiberPtes' : [ 0x3c, ['unsigned long']], + 'HiberVa' : [ 0x40, ['unsigned long long']], + 'NoFreePages' : [ 0x48, ['unsigned long']], + 'FreeMapCheck' : [ 0x4c, ['unsigned long']], + 'WakeCheck' : [ 0x50, ['unsigned long']], + 'NumPagesForLoader' : [ 0x58, ['unsigned long long']], + 'FirstBootRestorePage' : [ 0x60, ['unsigned long long']], + 'FirstKernelRestorePage' : [ 0x68, ['unsigned long long']], + 'PerfInfo' : [ 0x70, ['_PO_HIBER_PERF']], + 'FirmwareRuntimeInformationPages' : [ 0x218, ['unsigned long']], + 'FirmwareRuntimeInformation' : [ 0x220, ['array', 1, ['unsigned long long']]], + 'SiLogOffset' : [ 0x228, ['unsigned long']], + 'NoBootLoaderLogPages' : [ 0x22c, ['unsigned long']], + 'BootLoaderLogPages' : [ 0x230, ['array', 24, ['unsigned long long']]], + 'NotUsed' : [ 0x2f0, ['unsigned long']], + 'ResumeContextCheck' : [ 0x2f4, ['unsigned long']], + 'ResumeContextPages' : [ 0x2f8, ['unsigned long']], + 'Hiberboot' : [ 0x2fc, ['unsigned char']], + 'HvCr3' : [ 0x300, ['unsigned long long']], + 'HvEntryPoint' : [ 0x308, ['unsigned long long']], + 'HvReservedTransitionAddress' : [ 0x310, ['unsigned long long']], + 'HvReservedTransitionAddressSize' : [ 0x318, ['unsigned long long']], + 'BootFlags' : [ 0x320, ['unsigned long long']], + 'HalEntryPointPhysical' : [ 0x328, ['unsigned long long']], + 'HighestPhysicalPage' : [ 0x330, ['unsigned long long']], + 'BitlockerKeyPfns' : [ 0x338, ['array', 4, ['unsigned long long']]], + 'HardwareSignature' : [ 0x358, ['unsigned long']], +} ], + 'BATTERY_REPORTING_SCALE' : [ 0x8, { + 'Granularity' : [ 0x0, ['unsigned long']], + 'Capacity' : [ 0x4, ['unsigned long']], +} ], + '_RTL_ATOM_TABLE_REFERENCE' : [ 0x18, { + 'LowBoxList' : [ 0x0, ['_LIST_ENTRY']], + 'LowBoxID' : [ 0x10, ['unsigned long']], + 'ReferenceCount' : [ 0x14, ['unsigned short']], + 'Flags' : [ 0x16, ['unsigned short']], +} ], + '_CURDIR' : [ 0x18, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x10, ['pointer64', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x1a8, { + 'HiberIoTicks' : [ 0x0, ['unsigned long long']], + 'HiberIoCpuTicks' : [ 0x8, ['unsigned long long']], + 'HiberInitTicks' : [ 0x10, ['unsigned long long']], + 'HiberHiberFileTicks' : [ 0x18, ['unsigned long long']], + 'HiberCompressTicks' : [ 0x20, ['unsigned long long']], + 'HiberSharedBufferTicks' : [ 0x28, ['unsigned long long']], + 'TotalHibernateTime' : [ 0x30, ['_LARGE_INTEGER']], + 'POSTTime' : [ 0x38, ['unsigned long']], + 'ResumeBootMgrTime' : [ 0x3c, ['unsigned long']], + 'BootmgrUserInputTime' : [ 0x40, ['unsigned long']], + 'ResumeAppTicks' : [ 0x48, ['unsigned long long']], + 'ResumeAppStartTimestamp' : [ 0x50, ['unsigned long long']], + 'ResumeLibraryInitTicks' : [ 0x58, ['unsigned long long']], + 'ResumeInitTicks' : [ 0x60, ['unsigned long long']], + 'ResumeRestoreImageStartTimestamp' : [ 0x68, ['unsigned long long']], + 'ResumeHiberFileTicks' : [ 0x70, ['unsigned long long']], + 'ResumeIoTicks' : [ 0x78, ['unsigned long long']], + 'ResumeDecompressTicks' : [ 0x80, ['unsigned long long']], + 'ResumeAllocateTicks' : [ 0x88, ['unsigned long long']], + 'ResumeUserInOutTicks' : [ 0x90, ['unsigned long long']], + 'ResumeMapTicks' : [ 0x98, ['unsigned long long']], + 'ResumeUnmapTicks' : [ 0xa0, ['unsigned long long']], + 'ResumeKernelSwitchTimestamp' : [ 0xa8, ['unsigned long long']], + 'WriteLogDataTimestamp' : [ 0xb0, ['unsigned long long']], + 'KernelReturnFromHandler' : [ 0xb8, ['unsigned long long']], + 'TimeStampCounterAtSwitchTime' : [ 0xc0, ['unsigned long long']], + 'HalTscOffset' : [ 0xc8, ['unsigned long long']], + 'HvlTscOffset' : [ 0xd0, ['unsigned long long']], + 'SleeperThreadEnd' : [ 0xd8, ['unsigned long long']], + 'KernelReturnSystemPowerStateTimestamp' : [ 0xe0, ['unsigned long long']], + 'IoBoundedness' : [ 0xe8, ['unsigned long long']], + 'KernelDecompressTicks' : [ 0xf0, ['unsigned long long']], + 'KernelIoTicks' : [ 0xf8, ['unsigned long long']], + 'KernelCopyTicks' : [ 0x100, ['unsigned long long']], + 'ReadCheckCount' : [ 0x108, ['unsigned long long']], + 'KernelInitTicks' : [ 0x110, ['unsigned long long']], + 'KernelResumeHiberFileTicks' : [ 0x118, ['unsigned long long']], + 'KernelIoCpuTicks' : [ 0x120, ['unsigned long long']], + 'KernelSharedBufferTicks' : [ 0x128, ['unsigned long long']], + 'KernelAnimationTicks' : [ 0x130, ['unsigned long long']], + 'AnimationStart' : [ 0x138, ['_LARGE_INTEGER']], + 'AnimationStop' : [ 0x140, ['_LARGE_INTEGER']], + 'DeviceResumeTime' : [ 0x148, ['unsigned long']], + 'BootPagesProcessed' : [ 0x150, ['unsigned long long']], + 'KernelPagesProcessed' : [ 0x158, ['unsigned long long']], + 'BootBytesWritten' : [ 0x160, ['unsigned long long']], + 'KernelBytesWritten' : [ 0x168, ['unsigned long long']], + 'BootPagesWritten' : [ 0x170, ['unsigned long long']], + 'KernelPagesWritten' : [ 0x178, ['unsigned long long']], + 'BytesWritten' : [ 0x180, ['unsigned long long']], + 'PagesWritten' : [ 0x188, ['unsigned long']], + 'FileRuns' : [ 0x18c, ['unsigned long']], + 'NoMultiStageResumeReason' : [ 0x190, ['unsigned long']], + 'MaxHuffRatio' : [ 0x194, ['unsigned long']], + 'AdjustedTotalResumeTime' : [ 0x198, ['unsigned long long']], + 'ResumeCompleteTimestamp' : [ 0x1a0, ['unsigned long long']], +} ], + '_POP_FX_PROVIDER' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'Activating' : [ 0x4, ['unsigned char']], +} ], + '_RTL_BALANCED_LINKS' : [ 0x20, { + 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'LeftChild' : [ 0x8, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'RightChild' : [ 0x10, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'Balance' : [ 0x18, ['unsigned char']], + 'Reserved' : [ 0x19, ['array', 3, ['unsigned char']]], +} ], + '_FREE_DISPLAY' : [ 0x18, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Hint' : [ 0x4, ['unsigned long']], + 'Display' : [ 0x8, ['_RTL_BITMAP']], +} ], + '__unnamed_26dc' : [ 0x8, { + 'Flags' : [ 0x0, ['_MMSECURE_FLAGS']], + 'FlagsLong' : [ 0x0, ['unsigned long']], + 'StartVa' : [ 0x0, ['pointer64', ['void']]], +} ], + '_MMADDRESS_LIST' : [ 0x10, { + 'u1' : [ 0x0, ['__unnamed_26dc']], + 'EndVa' : [ 0x8, ['pointer64', ['void']]], +} ], + '_MI_PHYSMEM_BLOCK' : [ 0x8, { + 'IoTracker' : [ 0x0, ['pointer64', ['_MMIO_TRACKER']]], +} ], + '_POP_PER_PROCESSOR_CONTEXT' : [ 0x80, { + 'UncompressedData' : [ 0x0, ['pointer64', ['unsigned char']]], + 'MappingVa' : [ 0x8, ['pointer64', ['void']]], + 'XpressEncodeWorkspace' : [ 0x10, ['pointer64', ['void']]], + 'CompressedDataBuffer' : [ 0x18, ['pointer64', ['unsigned char']]], + 'CopyTicks' : [ 0x20, ['unsigned long long']], + 'CompressTicks' : [ 0x28, ['unsigned long long']], + 'BytesCopied' : [ 0x30, ['unsigned long long']], + 'PagesProcessed' : [ 0x38, ['unsigned long long']], + 'DecompressTicks' : [ 0x40, ['unsigned long long']], + 'ResumeCopyTicks' : [ 0x48, ['unsigned long long']], + 'SharedBufferTicks' : [ 0x50, ['unsigned long long']], + 'DecompressTicksByMethod' : [ 0x58, ['array', 2, ['unsigned long long']]], + 'DecompressSizeByMethod' : [ 0x68, ['array', 2, ['unsigned long long']]], + 'CompressCount' : [ 0x78, ['unsigned long']], + 'HuffCompressCount' : [ 0x7c, ['unsigned long']], +} ], + '_DEVICE_OBJECT_LIST_ENTRY' : [ 0x10, { + 'DeviceObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'RelationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceRelation', 1: 'Dependent', 2: 'DirectDescendant'})]], + 'Flags' : [ 0xc, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK' : [ 0x20, { + 'Common' : [ 0x0, ['_IO_REMOVE_LOCK_COMMON_BLOCK']], +} ], + '_POP_IO_INFO' : [ 0x60, { + 'DumpMdl' : [ 0x0, ['pointer64', ['_MDL']]], + 'IoStatus' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'IoReady', 1: 'IoPending', 2: 'IoDone'})]], + 'IoStartCount' : [ 0x10, ['unsigned long long']], + 'IoBytesCompleted' : [ 0x18, ['unsigned long long']], + 'IoBytesInProgress' : [ 0x20, ['unsigned long long']], + 'RequestSize' : [ 0x28, ['unsigned long long']], + 'IoLocation' : [ 0x30, ['_LARGE_INTEGER']], + 'FileOffset' : [ 0x38, ['unsigned long long']], + 'Buffer' : [ 0x40, ['pointer64', ['void']]], + 'AsyncCapable' : [ 0x48, ['unsigned char']], + 'BytesToRead' : [ 0x50, ['unsigned long long']], + 'Pages' : [ 0x58, ['unsigned long']], +} ], + '_LDRP_CSLIST' : [ 0x8, { + 'Tail' : [ 0x0, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_MMVIEW' : [ 0x38, { + 'PteOffset' : [ 0x0, ['unsigned long long']], + 'Entry' : [ 0x8, ['unsigned long long']], + 'u1' : [ 0x10, ['_MMVIEW_CONTROL_AREA']], + 'ViewLinks' : [ 0x18, ['_LIST_ENTRY']], + 'SessionViewVa' : [ 0x28, ['pointer64', ['void']]], + 'SessionId' : [ 0x30, ['unsigned long']], + 'SessionIdForGlobalSubsections' : [ 0x34, ['unsigned long']], +} ], + '_AER_BRIDGE_DESCRIPTOR_FLAGS' : [ 0x2, { + 'UncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'UncorrectableErrorSeverityRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'CorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'AdvancedCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorMaskRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'SecondaryUncorrectableErrorSevRW' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'SecondaryCapsAndControlRW' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ETW_FILTER_HEADER' : [ 0x48, { + 'FilterFlags' : [ 0x0, ['long']], + 'PidFilter' : [ 0x8, ['pointer64', ['_ETW_FILTER_PID']]], + 'ExeFilter' : [ 0x10, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgIdFilter' : [ 0x18, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'PkgAppIdFilter' : [ 0x20, ['pointer64', ['_ETW_FILTER_STRING_TOKEN']]], + 'StackWalkFilter' : [ 0x28, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'EventIdFilter' : [ 0x30, ['pointer64', ['_ETW_PERFECT_HASH_FUNCTION']]], + 'PayloadFilter' : [ 0x38, ['pointer64', ['_ETW_PAYLOAD_FILTER']]], + 'ProviderSideFilter' : [ 0x40, ['pointer64', ['_EVENT_FILTER_HEADER']]], +} ], + '_ETW_PAYLOAD_FILTER' : [ 0x58, { + 'RefCount' : [ 0x0, ['long']], + 'PayloadFilter' : [ 0x8, ['_AGGREGATED_PAYLOAD_FILTER']], +} ], + '_MMVIEW_CONTROL_AREA' : [ 0x8, { + 'ControlArea' : [ 0x0, ['pointer64', ['_CONTROL_AREA']]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ExceptionForInPageErrors' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'UsedForControlArea' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], +} ], + '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LeakedPoolDeliberately' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], +} ], + '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { + 'Type' : [ 0x0, ['unsigned short']], + 'CreatorBackTraceIndex' : [ 0x2, ['unsigned short']], + 'CriticalSection' : [ 0x8, ['pointer64', ['_RTL_CRITICAL_SECTION']]], + 'ProcessLocksList' : [ 0x10, ['_LIST_ENTRY']], + 'EntryCount' : [ 0x20, ['unsigned long']], + 'ContentionCount' : [ 0x24, ['unsigned long']], + 'Flags' : [ 0x28, ['unsigned long']], + 'CreatorBackTraceIndexHigh' : [ 0x2c, ['unsigned short']], + 'SpareUSHORT' : [ 0x2e, ['unsigned short']], +} ], + '_TRACE_ENABLE_INFO' : [ 0x20, { + 'IsEnabled' : [ 0x0, ['unsigned long']], + 'Level' : [ 0x4, ['unsigned char']], + 'Reserved1' : [ 0x5, ['unsigned char']], + 'LoggerId' : [ 0x6, ['unsigned short']], + 'EnableProperty' : [ 0x8, ['unsigned long']], + 'Reserved2' : [ 0xc, ['unsigned long']], + 'MatchAnyKeyword' : [ 0x10, ['unsigned long long']], + 'MatchAllKeyword' : [ 0x18, ['unsigned long long']], +} ], + '__unnamed_2712' : [ 0x8, { + 'Gsiv' : [ 0x0, ['unsigned long']], + 'WakeInterrupt' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2714' : [ 0x10, { + 'Address' : [ 0x0, ['_LARGE_INTEGER']], + 'DataPayload' : [ 0x8, ['unsigned long']], +} ], + '__unnamed_2717' : [ 0x8, { + 'IntrInfo' : [ 0x0, ['_INTERRUPT_HT_INTR_INFO']], +} ], + '__unnamed_271b' : [ 0x4, { + 'DestinationMode' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'ApicDestinationModePhysical', 2: 'ApicDestinationModeLogicalFlat', 3: 'ApicDestinationModeLogicalClustered', 4: 'ApicDestinationModeUnknown'})]], +} ], + '_INTERRUPT_VECTOR_DATA' : [ 0x48, { + 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptTypeControllerInput', 1: 'InterruptTypeXapicMessage', 2: 'InterruptTypeHypertransport', 3: 'InterruptTypeMessageRequest'})]], + 'Vector' : [ 0x4, ['unsigned long']], + 'Irql' : [ 0x8, ['unsigned char']], + 'Polarity' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'InterruptPolarityUnknown', 1: 'InterruptRisingEdge', 2: 'InterruptFallingEdge', 3: 'InterruptActiveBothTriggerLow', 4: 'InterruptActiveBothTriggerHigh'})]], + 'Mode' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], + 'TargetProcessors' : [ 0x18, ['_GROUP_AFFINITY']], + 'IntRemapInfo' : [ 0x28, ['_INTERRUPT_REMAPPING_INFO']], + 'ControllerInput' : [ 0x38, ['__unnamed_2712']], + 'XapicMessage' : [ 0x38, ['__unnamed_2714']], + 'Hypertransport' : [ 0x38, ['__unnamed_2717']], + 'GenericMessage' : [ 0x38, ['__unnamed_2714']], + 'MessageRequest' : [ 0x38, ['__unnamed_271b']], +} ], + '_POP_FX_DEPENDENT' : [ 0x8, { + 'Index' : [ 0x0, ['unsigned long']], + 'ProviderIndex' : [ 0x4, ['unsigned long']], +} ], + '_XPF_MCE_FLAGS' : [ 0x4, { + 'MCG_CapabilityRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MCG_GlobalControlRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_272e' : [ 0x8, { + 'Signature' : [ 0x0, ['unsigned long']], + 'CheckSum' : [ 0x4, ['unsigned long']], +} ], + '__unnamed_2730' : [ 0x10, { + 'DiskId' : [ 0x0, ['_GUID']], +} ], + '__unnamed_2732' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_272e']], + 'Gpt' : [ 0x0, ['__unnamed_2730']], +} ], + '_DUMP_INITIALIZATION_CONTEXT' : [ 0x108, { + 'Length' : [ 0x0, ['unsigned long']], + 'Reserved' : [ 0x4, ['unsigned long']], + 'MemoryBlock' : [ 0x8, ['pointer64', ['void']]], + 'CommonBuffer' : [ 0x10, ['array', 2, ['pointer64', ['void']]]], + 'PhysicalAddress' : [ 0x20, ['array', 2, ['_LARGE_INTEGER']]], + 'StallRoutine' : [ 0x30, ['pointer64', ['void']]], + 'OpenRoutine' : [ 0x38, ['pointer64', ['void']]], + 'WriteRoutine' : [ 0x40, ['pointer64', ['void']]], + 'FinishRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AdapterObject' : [ 0x50, ['pointer64', ['_ADAPTER_OBJECT']]], + 'MappedRegisterBase' : [ 0x58, ['pointer64', ['void']]], + 'PortConfiguration' : [ 0x60, ['pointer64', ['void']]], + 'CrashDump' : [ 0x68, ['unsigned char']], + 'MarkMemoryOnly' : [ 0x69, ['unsigned char']], + 'HiberResume' : [ 0x6a, ['unsigned char']], + 'Reserved1' : [ 0x6b, ['unsigned char']], + 'MaximumTransferSize' : [ 0x6c, ['unsigned long']], + 'CommonBufferSize' : [ 0x70, ['unsigned long']], + 'TargetAddress' : [ 0x78, ['pointer64', ['void']]], + 'WritePendingRoutine' : [ 0x80, ['pointer64', ['void']]], + 'PartitionStyle' : [ 0x88, ['unsigned long']], + 'DiskInfo' : [ 0x8c, ['__unnamed_2732']], + 'ReadRoutine' : [ 0xa0, ['pointer64', ['void']]], + 'GetDriveTelemetryRoutine' : [ 0xa8, ['pointer64', ['void']]], + 'LogSectionTruncateSize' : [ 0xb0, ['unsigned long']], + 'Parameters' : [ 0xb4, ['array', 16, ['unsigned long']]], + 'GetTransferSizesRoutine' : [ 0xf8, ['pointer64', ['void']]], + 'DumpNotifyRoutine' : [ 0x100, ['pointer64', ['void']]], +} ], + '_PROCESSOR_PLATFORM_STATE_RESIDENCY' : [ 0x10, { + 'Residency' : [ 0x0, ['unsigned long long']], + 'TransitionCount' : [ 0x8, ['unsigned long long']], +} ], + '_ETW_QUEUE_ENTRY' : [ 0x38, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'DataBlock' : [ 0x10, ['pointer64', ['_ETWP_NOTIFICATION_HEADER']]], + 'RegEntry' : [ 0x18, ['pointer64', ['_ETW_REG_ENTRY']]], + 'ReplyObject' : [ 0x20, ['pointer64', ['_ETW_REG_ENTRY']]], + 'WakeReference' : [ 0x28, ['pointer64', ['void']]], + 'RegIndex' : [ 0x30, ['unsigned short']], + 'ReplyIndex' : [ 0x32, ['unsigned short']], + 'Flags' : [ 0x34, ['unsigned long']], +} ], + '_ETW_FILTER_PID' : [ 0x24, { + 'Count' : [ 0x0, ['unsigned long']], + 'Pids' : [ 0x4, ['array', 8, ['unsigned long']]], +} ], + '_KDPC_LIST' : [ 0x10, { + 'ListHead' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'LastEntry' : [ 0x8, ['pointer64', ['_SINGLE_LIST_ENTRY']]], +} ], + '_CM_KEY_SECURITY' : [ 0x28, { + 'Signature' : [ 0x0, ['unsigned short']], + 'Reserved' : [ 0x2, ['unsigned short']], + 'Flink' : [ 0x4, ['unsigned long']], + 'Blink' : [ 0x8, ['unsigned long']], + 'ReferenceCount' : [ 0xc, ['unsigned long']], + 'DescriptorLength' : [ 0x10, ['unsigned long']], + 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], +} ], + '_PO_DEVICE_NOTIFY_ORDER' : [ 0x178, { + 'Locked' : [ 0x0, ['unsigned char']], + 'WarmEjectPdoPointer' : [ 0x8, ['pointer64', ['pointer64', ['_DEVICE_OBJECT']]]], + 'OrderLevel' : [ 0x10, ['array', 5, ['_PO_NOTIFY_ORDER_LEVEL']]], +} ], + '_EVENT_FILTER_HEADER' : [ 0x18, { + 'Id' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned char']], + 'Reserved' : [ 0x3, ['array', 5, ['unsigned char']]], + 'InstanceId' : [ 0x8, ['unsigned long long']], + 'Size' : [ 0x10, ['unsigned long']], + 'NextOffset' : [ 0x14, ['unsigned long']], +} ], + '_IO_REMOVE_LOCK_COMMON_BLOCK' : [ 0x20, { + 'Removed' : [ 0x0, ['unsigned char']], + 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], + 'IoCount' : [ 0x4, ['long']], + 'RemoveEvent' : [ 0x8, ['_KEVENT']], +} ], + '_POP_FX_IDLE_STATE' : [ 0x18, { + 'TransitionLatency' : [ 0x0, ['unsigned long long']], + 'ResidencyRequirement' : [ 0x8, ['unsigned long long']], + 'NominalPower' : [ 0x10, ['unsigned long']], +} ], + '_WHEA_NOTIFICATION_FLAGS' : [ 0x2, { + 'PollIntervalRW' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'SwitchToPollingThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'SwitchToPollingWindowRW' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'ErrorThresholdRW' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'ErrorThresholdWindowRW' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AsUSHORT' : [ 0x0, ['unsigned short']], +} ], + '_ARBITER_CONFLICT_INFO' : [ 0x18, { + 'OwningObject' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], + 'Start' : [ 0x8, ['unsigned long long']], + 'End' : [ 0x10, ['unsigned long long']], +} ], + '_PO_NOTIFY_ORDER_LEVEL' : [ 0x48, { + 'DeviceCount' : [ 0x0, ['unsigned long']], + 'ActiveCount' : [ 0x4, ['unsigned long']], + 'WaitSleep' : [ 0x8, ['_LIST_ENTRY']], + 'ReadySleep' : [ 0x18, ['_LIST_ENTRY']], + 'ReadyS0' : [ 0x28, ['_LIST_ENTRY']], + 'WaitS0' : [ 0x38, ['_LIST_ENTRY']], +} ], + '_ETWP_NOTIFICATION_HEADER' : [ 0x48, { + 'NotificationType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'EtwNotificationTypeNoReply', 2: 'EtwNotificationTypeLegacyEnable', 3: 'EtwNotificationTypeEnable', 4: 'EtwNotificationTypePrivateLogger', 5: 'EtwNotificationTypePerflib', 6: 'EtwNotificationTypeAudio', 7: 'EtwNotificationTypeSession', 8: 'EtwNotificationTypeReserved', 9: 'EtwNotificationTypeCredentialUI', 10: 'EtwNotificationTypeInProcSession', 11: 'EtwNotificationTypeMax'})]], + 'NotificationSize' : [ 0x4, ['unsigned long']], + 'RefCount' : [ 0x8, ['long']], + 'ReplyRequested' : [ 0xc, ['unsigned char']], + 'ReplyIndex' : [ 0x10, ['unsigned long']], + 'Timeout' : [ 0x10, ['unsigned long']], + 'ReplyCount' : [ 0x14, ['unsigned long']], + 'NotifyeeCount' : [ 0x14, ['unsigned long']], + 'ReplyHandle' : [ 0x18, ['unsigned long long']], + 'ReplyObject' : [ 0x18, ['pointer64', ['void']]], + 'RegIndex' : [ 0x18, ['unsigned long']], + 'TargetPID' : [ 0x20, ['unsigned long']], + 'SourcePID' : [ 0x24, ['unsigned long']], + 'DestinationGuid' : [ 0x28, ['_GUID']], + 'SourceGuid' : [ 0x38, ['_GUID']], +} ], + '__unnamed_2766' : [ 0x4, { + 'Mask' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Polarity' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MessageType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long')]], + 'RequestEOI' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DestinationMode' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'MessageType3' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Destination' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Vector' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'ExtendedAddress' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_2768' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_2766']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_276b' : [ 0x4, { + 'ExtendedDestination' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 30, native_type='unsigned long')]], + 'PassPW' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'WaitingForEOI' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_276d' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_276b']], + 'AsULONG' : [ 0x0, ['unsigned long']], +} ], + '_INTERRUPT_HT_INTR_INFO' : [ 0x8, { + 'LowPart' : [ 0x0, ['__unnamed_2768']], + 'HighPart' : [ 0x4, ['__unnamed_276d']], +} ], + '_THREAD_PERFORMANCE_DATA' : [ 0x1c0, { + 'Size' : [ 0x0, ['unsigned short']], + 'Version' : [ 0x2, ['unsigned short']], + 'ProcessorNumber' : [ 0x4, ['_PROCESSOR_NUMBER']], + 'ContextSwitches' : [ 0x8, ['unsigned long']], + 'HwCountersCount' : [ 0xc, ['unsigned long']], + 'UpdateCount' : [ 0x10, ['unsigned long long']], + 'WaitReasonBitMap' : [ 0x18, ['unsigned long long']], + 'HardwareCounters' : [ 0x20, ['unsigned long long']], + 'CycleTime' : [ 0x28, ['_COUNTER_READING']], + 'HwCounters' : [ 0x40, ['array', 16, ['_COUNTER_READING']]], +} ], + '_GDI_TEB_BATCH32' : [ 0x4e0, { + 'Offset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 31, native_type='unsigned long')]], + 'HasRenderingCommand' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'HDC' : [ 0x4, ['unsigned long']], + 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], +} ], + '_ETW_REPLY_QUEUE' : [ 0x48, { + 'Queue' : [ 0x0, ['_KQUEUE']], + 'EventsLost' : [ 0x40, ['long']], +} ], + '_ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS' : [ 0x8, { + 'AllocatedResources' : [ 0x0, ['pointer64', ['pointer64', ['_CM_PARTIAL_RESOURCE_LIST']]]], +} ], + '_MI_LARGEPAGE_MEMORY_INFO' : [ 0x28, { + 'ListHead' : [ 0x0, ['_LIST_ENTRY']], + 'ColoredPageInfoBase' : [ 0x10, ['pointer64', ['_COLORED_PAGE_INFO']]], + 'PagesNeedZeroing' : [ 0x18, ['unsigned long']], + 'ActualImageViewSize' : [ 0x20, ['unsigned long long']], +} ], + '__unnamed_277f' : [ 0x8, { + 'MessageAddressLow' : [ 0x0, ['unsigned long']], + 'MessageData' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], +} ], + '__unnamed_2781' : [ 0x8, { + 'RemappedFormat' : [ 0x0, ['_ULARGE_INTEGER']], + 'Msi' : [ 0x0, ['__unnamed_277f']], +} ], + '_INTERRUPT_REMAPPING_INFO' : [ 0x10, { + 'IrtIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'FlagHalInternal' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'FlagTranslated' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], + 'u' : [ 0x8, ['__unnamed_2781']], +} ], + '_RTL_ACTIVATION_CONTEXT_STACK_FRAME' : [ 0x18, { + 'Previous' : [ 0x0, ['pointer64', ['_RTL_ACTIVATION_CONTEXT_STACK_FRAME']]], + 'ActivationContext' : [ 0x8, ['pointer64', ['_ACTIVATION_CONTEXT']]], + 'Flags' : [ 0x10, ['unsigned long']], +} ], + '_MMIO_TRACKER' : [ 0x70, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'PageFrameIndex' : [ 0x10, ['unsigned long long']], + 'NumberOfPages' : [ 0x18, ['unsigned long long']], + 'BaseVa' : [ 0x20, ['pointer64', ['void']]], + 'CacheFlushTimeStamp' : [ 0x20, ['unsigned long']], + 'Mdl' : [ 0x28, ['pointer64', ['_MDL']]], + 'MdlPages' : [ 0x30, ['unsigned long long']], + 'StackTrace' : [ 0x38, ['array', 6, ['pointer64', ['void']]]], + 'CacheInfo' : [ 0x68, ['array', 1, ['_IO_CACHE_INFO']]], +} ], + '_ARBITER_ORDERING' : [ 0x10, { + 'Start' : [ 0x0, ['unsigned long long']], + 'End' : [ 0x8, ['unsigned long long']], +} ], + '__unnamed_278d' : [ 0x4, { + 'ImagePteOffset' : [ 0x0, ['unsigned long']], + 'TossPage' : [ 0x0, ['unsigned long']], +} ], + '__unnamed_2790' : [ 0x4, { + 'e1' : [ 0x0, ['_MMINPAGE_FLAGS']], + 'LongFlags' : [ 0x0, ['unsigned long']], +} ], + '_MMINPAGE_SUPPORT' : [ 0x180, { + 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], + 'ListHead' : [ 0x10, ['_LIST_ENTRY']], + 'Event' : [ 0x20, ['_KEVENT']], + 'CollidedEvent' : [ 0x38, ['_KEVENT']], + 'IoStatus' : [ 0x50, ['_IO_STATUS_BLOCK']], + 'ReadOffset' : [ 0x60, ['_LARGE_INTEGER']], + 'PteContents' : [ 0x68, ['_MMPTE']], + 'Thread' : [ 0x70, ['pointer64', ['_ETHREAD']]], + 'LockedProtoPfn' : [ 0x78, ['pointer64', ['_MMPFN']]], + 'WaitCount' : [ 0x80, ['long']], + 'ByteCount' : [ 0x84, ['unsigned long']], + 'u3' : [ 0x88, ['__unnamed_278d']], + 'u1' : [ 0x8c, ['__unnamed_2790']], + 'FilePointer' : [ 0x90, ['pointer64', ['_FILE_OBJECT']]], + 'ControlArea' : [ 0x98, ['pointer64', ['_CONTROL_AREA']]], + 'Autoboost' : [ 0xa0, ['pointer64', ['void']]], + 'FaultingAddress' : [ 0xa8, ['pointer64', ['void']]], + 'PointerPte' : [ 0xb0, ['pointer64', ['_MMPTE']]], + 'BasePte' : [ 0xb8, ['pointer64', ['_MMPTE']]], + 'Pfn' : [ 0xc0, ['pointer64', ['_MMPFN']]], + 'PrefetchMdl' : [ 0xc8, ['pointer64', ['_MDL']]], + 'Mdl' : [ 0xd0, ['_MDL']], + 'Page' : [ 0x100, ['array', 16, ['unsigned long long']]], +} ], + '_RTL_AVL_TABLE' : [ 0x68, { + 'BalancedRoot' : [ 0x0, ['_RTL_BALANCED_LINKS']], + 'OrderedPointer' : [ 0x20, ['pointer64', ['void']]], + 'WhichOrderedElement' : [ 0x28, ['unsigned long']], + 'NumberGenericTableElements' : [ 0x2c, ['unsigned long']], + 'DepthOfTree' : [ 0x30, ['unsigned long']], + 'RestartKey' : [ 0x38, ['pointer64', ['_RTL_BALANCED_LINKS']]], + 'DeleteCount' : [ 0x40, ['unsigned long']], + 'CompareRoutine' : [ 0x48, ['pointer64', ['void']]], + 'AllocateRoutine' : [ 0x50, ['pointer64', ['void']]], + 'FreeRoutine' : [ 0x58, ['pointer64', ['void']]], + 'TableContext' : [ 0x60, ['pointer64', ['void']]], +} ], + '_MMINPAGE_FLAGS' : [ 0x4, { + 'InjectRetry' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CrossThreadPadding' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'PrefetchSystemVmType' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'VaPrefetchReadBlock' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'CollidedFlowThrough' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceCollisions' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'InPageExpanded' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'IssuedAtLowPriority' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'FaultFromStore' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PagePriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PerformRelocations' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ClusteredPagePriority' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned char')]], + 'MakeClusterValid' : [ 0x2, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'ZeroLastPage' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UserFault' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'BoostedPriority' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'StandbyProtectionNeeded' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PteChanged' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PageFileFault' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PageFilePageHashActive' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'CoalescedIo' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], +} ], + '_AGGREGATED_PAYLOAD_FILTER' : [ 0x50, { + 'MagicValue' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 12, native_type='unsigned short')]], + 'DescriptorVersion' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned short')]], + 'Size' : [ 0x2, ['unsigned short']], + 'PredicateCount' : [ 0x4, ['unsigned short']], + 'Reserved' : [ 0x6, ['unsigned short']], + 'HashedEventIdBitmap' : [ 0x8, ['unsigned long long']], + 'ProviderGuid' : [ 0x10, ['_GUID']], + 'EachEventTableOffset' : [ 0x20, ['unsigned short']], + 'EachEventTableLength' : [ 0x22, ['unsigned short']], + 'PayloadDecoderTableOffset' : [ 0x24, ['unsigned short']], + 'PayloadDecoderTableLength' : [ 0x26, ['unsigned short']], + 'EventFilterTableOffset' : [ 0x28, ['unsigned short']], + 'EventFilterTableLength' : [ 0x2a, ['unsigned short']], + 'UNICODEStringTableOffset' : [ 0x2c, ['unsigned short']], + 'UNICODEStringTableLength' : [ 0x2e, ['unsigned short']], + 'ANSIStringTableOffset' : [ 0x30, ['unsigned short']], + 'ANSIStringTableLength' : [ 0x32, ['unsigned short']], + 'PredicateTable' : [ 0x38, ['array', 1, ['_EVENT_PAYLOAD_PREDICATE']]], +} ], + '_KTRANSACTION_HISTORY' : [ 0x8, { + 'RecordType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {1: 'KTMOH_CommitTransaction_Result', 2: 'KTMOH_RollbackTransaction_Result'})]], + 'Payload' : [ 0x4, ['unsigned long']], +} ], + '_MMSECURE_FLAGS' : [ 0x4, { + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoDelete' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequiresPteReversal' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ExclusiveSecure' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 12, native_type='unsigned long')]], +} ], + '_EVENT_PAYLOAD_PREDICATE' : [ 0x18, { + 'FieldIndex' : [ 0x0, ['unsigned short']], + 'CompareOp' : [ 0x2, ['unsigned short']], + 'Value' : [ 0x8, ['array', 2, ['unsigned long long']]], +} ], + '_COLORED_PAGE_INFO' : [ 0x18, { + 'BeingZeroed' : [ 0x0, ['long']], + 'Processor' : [ 0x4, ['unsigned long']], + 'PagesQueued' : [ 0x8, ['unsigned long long']], + 'PfnAllocation' : [ 0x10, ['pointer64', ['_MMPFN']]], +} ], + '_ETW_FILTER_STRING_TOKEN' : [ 0x18, { + 'Count' : [ 0x0, ['unsigned short']], + 'Tokens' : [ 0x8, ['array', 1, ['_ETW_FILTER_STRING_TOKEN_ELEMENT']]], +} ], + '_IO_CACHE_INFO' : [ 0x1, { + 'CacheAttribute' : [ 0x0, ['unsigned char']], +} ], + '_ETW_FILTER_STRING_TOKEN_ELEMENT' : [ 0x10, { + 'Length' : [ 0x0, ['unsigned short']], + 'String' : [ 0x8, ['pointer64', ['unsigned short']]], +} ], +} From 6631c0c93848e7e90dc0e76035fc38066c7c9946 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Thu, 22 Sep 2016 18:18:37 -0500 Subject: [PATCH 035/304] expand VolatilityKDBG for recent 64-bit Windows 10 generate and check a list of KDBG sizes rather than statically checking at a single size per profile. this allows kdbgscan to find & decrypt the KDBG even if a user manually specifies an incorrect profile when running the plugin --- .../plugins/overlays/windows/win8_kdbg.py | 57 +++++++++++++++---- 1 file changed, 47 insertions(+), 10 deletions(-) diff --git a/volatility/plugins/overlays/windows/win8_kdbg.py b/volatility/plugins/overlays/windows/win8_kdbg.py index 302d8d481..daa1e2b1a 100644 --- a/volatility/plugins/overlays/windows/win8_kdbg.py +++ b/volatility/plugins/overlays/windows/win8_kdbg.py @@ -18,13 +18,14 @@ # along with Volatility. If not, see . # -import struct +import struct, copy import volatility.obj as obj import volatility.addrspace as addrspace import volatility.constants as constants import volatility.utils as utils import volatility.plugins.overlays.windows.win8 as win8 import volatility.plugins.patchguard as patchguard +import volatility.registry as registry try: import distorm3 @@ -64,8 +65,9 @@ def decode_kdbg(self, vals): the Windows kernel file.""" block_encoded, kdbg_block, wait_never, wait_always = vals - header = obj.VolMagic(self.obj_vm).KDBGHeader.v() - kdbg_size = struct.unpack(" Date: Wed, 28 Sep 2016 11:54:46 -0500 Subject: [PATCH 036/304] refs #319 fixing vad plugins on 32-bit win8 and win10 - only 64-bit versions have *VpnHigh members --- .../plugins/overlays/windows/vad_vtypes.py | 42 ++++++++++++++++--- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/volatility/plugins/overlays/windows/vad_vtypes.py b/volatility/plugins/overlays/windows/vad_vtypes.py index 56484c640..626c3f946 100644 --- a/volatility/plugins/overlays/windows/vad_vtypes.py +++ b/volatility/plugins/overlays/windows/vad_vtypes.py @@ -347,6 +347,16 @@ def LeftChild(self): def RightChild(self): return self.VadNode.RightChild +class _MMVAD_SHORT_WIN8_64(_MMVAD_SHORT_WIN8): + + @property + def Start(self): + return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44) + + @property + def End(self): + return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1 + class _MMVAD_WIN8(_MM_AVL_NODE): @property @@ -397,9 +407,15 @@ class Win8Vad(obj.ProfileModification): "minor": lambda x: x == 2} def modification(self, profile): + + if profile.metadata.get("memory_model") == "32bit": + short_vad = _MMVAD_SHORT_WIN8 + else: + short_vad = _MMVAD_SHORT_WIN8_64 + profile.object_classes.update({ '_MMVAD': _MMVAD_WIN8, - '_MMVAD_SHORT': _MMVAD_SHORT_WIN8, + '_MMVAD_SHORT': short_vad, '_MM_AVL_TABLE': _MM_AVL_TABLE_WIN8, '_MM_AVL_NODE': _MM_AVL_NODE, }) @@ -442,12 +458,12 @@ def Parent(self): @property def Start(self): - return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44) + return self.StartingVpn << 12 @property def End(self): - return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1 - + return ((self.EndingVpn + 1) << 12) - 1 + @property def VadFlags(self): return self.u.VadFlags @@ -468,6 +484,16 @@ def LeftChild(self): def RightChild(self): return self.VadNode.Right +class _MMVAD_SHORT_WIN81_64(_MMVAD_SHORT_WIN81): + + @property + def Start(self): + return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44) + + @property + def End(self): + return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1 + class _MMVAD_WIN81(_MMVAD_SHORT_WIN81): @property @@ -518,9 +544,15 @@ class Win81Vad(obj.ProfileModification): "minor": lambda x: x >= 3} def modification(self, profile): + + if profile.metadata.get("memory_model") == "32bit": + short_vad = _MMVAD_SHORT_WIN81 + else: + short_vad = _MMVAD_SHORT_WIN81_64 + profile.object_classes.update({ '_MMVAD': _MMVAD_WIN81, - '_MMVAD_SHORT': _MMVAD_SHORT_WIN81, + '_MMVAD_SHORT': short_vad, '_RTL_AVL_TREE': _RTL_AVL_TREE, '_RTL_BALANCED_NODE': _RTL_BALANCED_NODE, }) From 04771d3b92a6505c95ef23a07dee8c6acb529de1 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 28 Sep 2016 12:10:56 -0500 Subject: [PATCH 037/304] Update README.txt with new profiles --- README.txt | 83 +++++++++++++++++++++++++++++------------------------- 1 file changed, 44 insertions(+), 39 deletions(-) diff --git a/README.txt b/README.txt index 80ea6add7..0ca8af519 100644 --- a/README.txt +++ b/README.txt @@ -160,45 +160,50 @@ WindowsHiberFileSpace32 - This is a hibernate address space for windows hi Profiles -------- -VistaSP0x64 - A Profile for Windows Vista SP0 x64 -VistaSP0x86 - A Profile for Windows Vista SP0 x86 -VistaSP1x64 - A Profile for Windows Vista SP1 x64 -VistaSP1x86 - A Profile for Windows Vista SP1 x86 -VistaSP2x64 - A Profile for Windows Vista SP2 x64 -VistaSP2x86 - A Profile for Windows Vista SP2 x86 -Win10x64 - A Profile for Windows 10 x64 -Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB -Win10x64_DD08DD42 - A Profile for Windows 10 x64 from PDB DD08DD42 -Win10x86 - A Profile for Windows 10 x86 -Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA -Win10x86_9619274A - A Profile for Windows 10 x86 from PDB 9619274A -Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 -Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 -Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 -Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 -Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 -Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 -Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 -Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 -Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 -Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 -Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 -Win2012R2x64 - A Profile for Windows Server 2012 R2 x64 -Win2012x64 - A Profile for Windows Server 2012 x64 -Win7SP0x64 - A Profile for Windows 7 SP0 x64 -Win7SP0x86 - A Profile for Windows 7 SP0 x86 -Win7SP1x64 - A Profile for Windows 7 SP1 x64 -Win7SP1x86 - A Profile for Windows 7 SP1 x86 -Win81U1x64 - A Profile for Windows 8.1 Update 1 x64 -Win81U1x86 - A Profile for Windows 8.1 Update 1 x86 -Win8SP0x64 - A Profile for Windows 8 x64 -Win8SP0x86 - A Profile for Windows 8 x86 -Win8SP1x64 - A Profile for Windows 8.1 x64 -Win8SP1x86 - A Profile for Windows 8.1 x86 -WinXPSP1x64 - A Profile for Windows XP SP1 x64 -WinXPSP2x64 - A Profile for Windows XP SP2 x64 -WinXPSP2x86 - A Profile for Windows XP SP2 x86 -WinXPSP3x86 - A Profile for Windows XP SP3 x86 +VistaSP0x64 - A Profile for Windows Vista SP0 x64 +VistaSP0x86 - A Profile for Windows Vista SP0 x86 +VistaSP1x64 - A Profile for Windows Vista SP1 x64 +VistaSP1x86 - A Profile for Windows Vista SP1 x86 +VistaSP2x64 - A Profile for Windows Vista SP2 x64 +VistaSP2x86 - A Profile for Windows Vista SP2 x86 +Win10x64 - A Profile for Windows 10 x64 +Win10x64_1AC738FB - A Profile for Windows 10 x64 from PDB 1AC738FB +Win10x64_DD08DD42 - A Profile for Windows 10 x64 from PDB DD08DD42 +Win10x86 - A Profile for Windows 10 x86 +Win10x86_44B89EEA - A Profile for Windows 10 x86 from PDB 44B89EEA +Win10x86_9619274A - A Profile for Windows 10 x86 from PDB 9619274A +Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 +Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 +Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 +Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 +Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 +Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 +Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 +Win2008R2SP1x64_632B36E0 - A Profile for Windows 2008 R2 SP1 x64 from PDB 632B36E0 +Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 +Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 +Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 +Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 +Win2012R2x64 - A Profile for Windows Server 2012 R2 x64 +Win2012R2x64_54B5A1C6 - A Profile for Windows Server 2012 R2 x64 from PDB 54B5A1C6 +Win2012x64 - A Profile for Windows Server 2012 x64 +Win7SP0x64 - A Profile for Windows 7 SP0 x64 +Win7SP0x86 - A Profile for Windows 7 SP0 x86 +Win7SP1x64 - A Profile for Windows 7 SP1 x64 +Win7SP1x64_632B36E0 - A Profile for Windows 7 SP1 x64 from PDB 632B36E0 +Win7SP1x86 - A Profile for Windows 7 SP1 x86 +Win7SP1x86_BBA98F40 - A Profile for Windows 7 SP1 x86 from PDB BBA98F40 +Win81U1x64 - A Profile for Windows 8.1 Update 1 x64 +Win81U1x86 - A Profile for Windows 8.1 Update 1 x86 +Win8SP0x64 - A Profile for Windows 8 x64 +Win8SP0x86 - A Profile for Windows 8 x86 +Win8SP1x64 - A Profile for Windows 8.1 x64 +Win8SP1x64_54B5A1C6 - A Profile for Windows 8.1 x64 from PDB 54B5A1C6 +Win8SP1x86 - A Profile for Windows 8.1 x86 +WinXPSP1x64 - A Profile for Windows XP SP1 x64 +WinXPSP2x64 - A Profile for Windows XP SP2 x64 +WinXPSP2x86 - A Profile for Windows XP SP2 x86 +WinXPSP3x86 - A Profile for Windows XP SP3 x86 Plugins ------- From 534374da57679dc353c974de45d27a42b81931ec Mon Sep 17 00:00:00 2001 From: atcuno Date: Fri, 7 Oct 2016 09:36:31 -0500 Subject: [PATCH 038/304] Linux - fix two bugs --- volatility/plugins/linux/psxview.py | 2 +- volatility/plugins/overlays/linux/linux.py | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/psxview.py b/volatility/plugins/linux/psxview.py index 5504ec638..82400aaf5 100644 --- a/volatility/plugins/linux/psxview.py +++ b/volatility/plugins/linux/psxview.py @@ -89,7 +89,7 @@ def calculate(self): for offset in tasks: - if offset not in seen_offsets: + if offset and offset not in seen_offsets: seen_offsets.append(offset) yield offset, obj.Object("task_struct", offset = offset, vm = phys_addr_space), ps_sources diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index 009390210..80f02eb74 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -2049,8 +2049,11 @@ def get_time_vars(self): tv64 = (oreal.tv64 & 0xffffffff) - (oboot.tv64 & 0xffffffff) - tv64 = (tv64 / 100000000) * -1 - timeo = linux_common.vol_timespec(tv64, 0) + if tv64: + tv64 = (tv64 / 100000000) * -1 + timeo = linux_common.vol_timespec(tv64, 0) + else: + timeo = None return (wall, timeo) From 5afe6537e7576d895914a89a9bcc03589cdc55b0 Mon Sep 17 00:00:00 2001 From: Raphael Catolino Date: Sat, 8 Oct 2016 14:18:27 +0200 Subject: [PATCH 039/304] Check for DW_AT_declaration flag in DW_TAG_union_type --- volatility/dwarf.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/dwarf.py b/volatility/dwarf.py index 237622ba5..211cdb42b 100644 --- a/volatility/dwarf.py +++ b/volatility/dwarf.py @@ -201,7 +201,8 @@ def process_statement(self, kind, level, data, statement_id): name = data.get('DW_AT_name', "__unnamed_%s" % statement_id).strip('"') self.name_stack[-1][1] = name self.id_to_name[statement_id] = [name] - self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ] + if 'DW_AT_declaration' not in data: + self.vtypes[name] = [ int(data['DW_AT_byte_size'], self.base), {} ] elif kind == 'DW_TAG_array_type': self.name_stack[-1][1] = statement_id From 7d96c4ded7474de99b01c1a9b480b7ef53f7779a Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Tue, 11 Oct 2016 14:27:27 -0500 Subject: [PATCH 040/304] start using StartingVpnHigh and EndingVpnHigh for VADs on windows 8.1 (not windows 8) --- .../plugins/overlays/windows/vad_vtypes.py | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/volatility/plugins/overlays/windows/vad_vtypes.py b/volatility/plugins/overlays/windows/vad_vtypes.py index 626c3f946..08752493f 100644 --- a/volatility/plugins/overlays/windows/vad_vtypes.py +++ b/volatility/plugins/overlays/windows/vad_vtypes.py @@ -347,16 +347,6 @@ def LeftChild(self): def RightChild(self): return self.VadNode.RightChild -class _MMVAD_SHORT_WIN8_64(_MMVAD_SHORT_WIN8): - - @property - def Start(self): - return (self.StartingVpn << 12) | (self.StartingVpnHigh << 44) - - @property - def End(self): - return (((self.EndingVpn + 1) << 12) | (self.EndingVpnHigh << 44)) - 1 - class _MMVAD_WIN8(_MM_AVL_NODE): @property @@ -408,14 +398,9 @@ class Win8Vad(obj.ProfileModification): def modification(self, profile): - if profile.metadata.get("memory_model") == "32bit": - short_vad = _MMVAD_SHORT_WIN8 - else: - short_vad = _MMVAD_SHORT_WIN8_64 - profile.object_classes.update({ '_MMVAD': _MMVAD_WIN8, - '_MMVAD_SHORT': short_vad, + '_MMVAD_SHORT': _MMVAD_SHORT_WIN8, '_MM_AVL_TABLE': _MM_AVL_TABLE_WIN8, '_MM_AVL_NODE': _MM_AVL_NODE, }) From 692b65da959c1b8351842b0727aa830c4f6cf197 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Tue, 11 Oct 2016 14:32:46 -0500 Subject: [PATCH 041/304] add an md_product metadata field to windows profiles to help distinguish between server and client versions of the OS (when all else is the same, such as kernel version and build number, etc) --- volatility/plugins/overlays/windows/vista.py | 10 ++++++++++ volatility/plugins/overlays/windows/win10.py | 6 ++++++ volatility/plugins/overlays/windows/win2003.py | 7 +++++++ volatility/plugins/overlays/windows/win7.py | 9 +++++++++ volatility/plugins/overlays/windows/win8.py | 10 ++++++++++ volatility/plugins/overlays/windows/xp.py | 2 ++ 6 files changed, 44 insertions(+) diff --git a/volatility/plugins/overlays/windows/vista.py b/volatility/plugins/overlays/windows/vista.py index cf7847e15..49ea2196c 100644 --- a/volatility/plugins/overlays/windows/vista.py +++ b/volatility/plugins/overlays/windows/vista.py @@ -236,6 +236,7 @@ class VistaSP0x86(obj.Profile): _md_memory_model = '32bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp0_x86_vtypes' + _md_product = ["NtProductWinNt"] class VistaSP0x64(obj.Profile): """ A Profile for Windows Vista SP0 x64 """ @@ -245,6 +246,7 @@ class VistaSP0x64(obj.Profile): _md_memory_model = '64bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp0_x64_vtypes' + _md_product = ["NtProductWinNt"] class VistaSP1x86(obj.Profile): """ A Profile for Windows Vista SP1 x86 """ @@ -254,6 +256,7 @@ class VistaSP1x86(obj.Profile): _md_memory_model = '32bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp1_x86_vtypes' + _md_product = ["NtProductWinNt"] class VistaSP1x64(obj.Profile): """ A Profile for Windows Vista SP1 x64 """ @@ -263,6 +266,7 @@ class VistaSP1x64(obj.Profile): _md_memory_model = '64bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp1_x64_vtypes' + _md_product = ["NtProductWinNt"] class VistaSP2x86(obj.Profile): """ A Profile for Windows Vista SP2 x86 """ @@ -272,6 +276,7 @@ class VistaSP2x86(obj.Profile): _md_memory_model = '32bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp2_x86_vtypes' + _md_product = ["NtProductWinNt"] class VistaSP2x64(obj.Profile): """ A Profile for Windows Vista SP2 x64 """ @@ -281,15 +286,20 @@ class VistaSP2x64(obj.Profile): _md_memory_model = '64bit' _md_os = 'windows' _md_vtype_module = 'volatility.plugins.overlays.windows.vista_sp2_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win2008SP1x64(VistaSP1x64): """ A Profile for Windows 2008 SP1 x64 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2008SP2x64(VistaSP2x64): """ A Profile for Windows 2008 SP2 x64 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2008SP1x86(VistaSP1x86): """ A Profile for Windows 2008 SP1 x86 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2008SP2x86(VistaSP2x86): """ A Profile for Windows 2008 SP2 x86 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index 168e83537..c4191c8a5 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -527,6 +527,7 @@ class Win10x64(obj.Profile): _md_minor = 4 _md_build = 9841 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win10x64_1AC738FB(obj.Profile): """ A Profile for Windows 10 x64 from PDB 1AC738FB""" @@ -536,6 +537,7 @@ class Win10x64_1AC738FB(obj.Profile): _md_minor = 4 _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_1AC738FB_vtypes' + _md_product = ["NtProductWinNt"] class Win10x64_DD08DD42(obj.Profile): """ A Profile for Windows 10 x64 from PDB DD08DD42""" @@ -545,6 +547,7 @@ class Win10x64_DD08DD42(obj.Profile): _md_minor = 4 _md_build = 14393 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x64_DD08DD42_vtypes' + _md_product = ["NtProductWinNt"] class Win10x86(obj.Profile): """ A Profile for Windows 10 x86 """ @@ -554,6 +557,7 @@ class Win10x86(obj.Profile): _md_minor = 4 _md_build = 9841 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_vtypes' + _md_product = ["NtProductWinNt"] class Win10x86_44B89EEA(obj.Profile): """ A Profile for Windows 10 x86 from PDB 44B89EEA""" @@ -563,6 +567,7 @@ class Win10x86_44B89EEA(obj.Profile): _md_minor = 4 _md_build = 10240 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_44B89EEA_vtypes' + _md_product = ["NtProductWinNt"] class Win10x86_9619274A(obj.Profile): """ A Profile for Windows 10 x86 from PDB 9619274A""" @@ -572,3 +577,4 @@ class Win10x86_9619274A(obj.Profile): _md_minor = 4 _md_build = 14393 _md_vtype_module = 'volatility.plugins.overlays.windows.win10_x86_9619274A_vtypes' + _md_product = ["NtProductWinNt"] diff --git a/volatility/plugins/overlays/windows/win2003.py b/volatility/plugins/overlays/windows/win2003.py index 8cac99767..c44774c3f 100644 --- a/volatility/plugins/overlays/windows/win2003.py +++ b/volatility/plugins/overlays/windows/win2003.py @@ -133,6 +133,7 @@ class Win2003SP0x86(obj.Profile): _md_build = 3789 _md_memory_model = '32bit' _md_vtype_module = 'volatility.plugins.overlays.windows.win2003_sp0_x86_vtypes' + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2003SP1x86(obj.Profile): """ A Profile for Windows 2003 SP1 x86 """ @@ -142,6 +143,7 @@ class Win2003SP1x86(obj.Profile): _md_build = 3790 _md_memory_model = '32bit' _md_vtype_module = 'volatility.plugins.overlays.windows.win2003_sp1_x86_vtypes' + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2003SP2x86(obj.Profile): """ A Profile for Windows 2003 SP2 x86 """ @@ -152,6 +154,7 @@ class Win2003SP2x86(obj.Profile): _md_build = 3791 _md_memory_model = '32bit' _md_vtype_module = 'volatility.plugins.overlays.windows.win2003_sp2_x86_vtypes' + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2003SP1x64(obj.Profile): """ A Profile for Windows 2003 SP1 x64 """ @@ -161,6 +164,7 @@ class Win2003SP1x64(obj.Profile): _md_minor = 2 _md_build = 3790 _md_vtype_module = 'volatility.plugins.overlays.windows.win2003_sp1_x64_vtypes' + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2003SP2x64(obj.Profile): """ A Profile for Windows 2003 SP2 x64 """ @@ -171,10 +175,13 @@ class Win2003SP2x64(obj.Profile): # This is a fake build number. See the comment in Win2003SP0x86 _md_build = 3791 _md_vtype_module = 'volatility.plugins.overlays.windows.win2003_sp2_x64_vtypes' + _md_product = ["NtProductLanManNt", "NtProductServer"] class WinXPSP1x64(Win2003SP1x64): """ A Profile for Windows XP SP1 x64 """ + _md_product = ["NtProductWinNt"] class WinXPSP2x64(Win2003SP2x64): """ A Profile for Windows XP SP2 x64 """ + _md_product = ["NtProductWinNt"] diff --git a/volatility/plugins/overlays/windows/win7.py b/volatility/plugins/overlays/windows/win7.py index f6828f1e9..b4502195b 100644 --- a/volatility/plugins/overlays/windows/win7.py +++ b/volatility/plugins/overlays/windows/win7.py @@ -197,6 +197,7 @@ class Win7SP0x86(obj.Profile): _md_minor = 1 _md_build = 7600 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp0_x86_vtypes' + _md_product = ["NtProductWinNt"] class Win7SP1x86(obj.Profile): """ A Profile for Windows 7 SP1 x86 """ @@ -206,6 +207,7 @@ class Win7SP1x86(obj.Profile): _md_minor = 1 _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x86_vtypes' + _md_product = ["NtProductWinNt"] class Win7SP1x86_BBA98F40(obj.Profile): """ A Profile for Windows 7 SP1 x86 from PDB BBA98F40""" @@ -215,6 +217,7 @@ class Win7SP1x86_BBA98F40(obj.Profile): _md_minor = 1 _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x86_BBA98F40_vtypes' + _md_product = ["NtProductWinNt"] class Win7SP0x64(obj.Profile): """ A Profile for Windows 7 SP0 x64 """ @@ -224,6 +227,7 @@ class Win7SP0x64(obj.Profile): _md_minor = 1 _md_build = 7600 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp0_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win7SP1x64(obj.Profile): """ A Profile for Windows 7 SP1 x64 """ @@ -233,6 +237,7 @@ class Win7SP1x64(obj.Profile): _md_minor = 1 _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win7SP1x64_632B36E0(obj.Profile): """ A Profile for Windows 7 SP1 x64 from PDB 632B36E0""" @@ -242,12 +247,16 @@ class Win7SP1x64_632B36E0(obj.Profile): _md_minor = 1 _md_build = 7601 _md_vtype_module = 'volatility.plugins.overlays.windows.win7_sp1_x64_632B36E0_vtypes' + _md_product = ["NtProductWinNt"] class Win2008R2SP0x64(Win7SP0x64): """ A Profile for Windows 2008 R2 SP0 x64 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2008R2SP1x64(Win7SP1x64): """ A Profile for Windows 2008 R2 SP1 x64 """ + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2008R2SP1x64_632B36E0(Win7SP1x64_632B36E0): """ A Profile for Windows 2008 R2 SP1 x64 from PDB 632B36E0""" + _md_product = ["NtProductLanManNt", "NtProductServer"] diff --git a/volatility/plugins/overlays/windows/win8.py b/volatility/plugins/overlays/windows/win8.py index a2171a544..648dde62c 100644 --- a/volatility/plugins/overlays/windows/win8.py +++ b/volatility/plugins/overlays/windows/win8.py @@ -412,6 +412,7 @@ class Win8SP0x64(obj.Profile): _md_minor = 2 _md_build = 9200 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp0_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win8SP1x64(obj.Profile): """ A Profile for Windows 8.1 x64 """ @@ -421,6 +422,7 @@ class Win8SP1x64(obj.Profile): _md_minor = 3 _md_build = 9600 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp1_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win8SP1x64_54B5A1C6(obj.Profile): """ A Profile for Windows 8.1 x64 from PDB 54B5A1C6""" @@ -430,18 +432,22 @@ class Win8SP1x64_54B5A1C6(obj.Profile): _md_minor = 3 _md_build = 9600 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp1_x64_54B5A1C6_vtypes' + _md_product = ["NtProductWinNt"] class Win2012x64(Win8SP0x64): """ A Profile for Windows Server 2012 x64 """ _md_build = 9201 ##FIXME: fake build number to indicate server 2012 vs windows 8 + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2012R2x64(Win8SP1x64): """ A Profile for Windows Server 2012 R2 x64 """ _md_build = 9601 ##FIXME: fake build number to indicate server 2012 R2 vs windows 8.1 + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win2012R2x64_54B5A1C6(Win8SP1x64_54B5A1C6): """ A Profile for Windows Server 2012 R2 x64 from PDB 54B5A1C6""" _md_build = 9601 ##FIXME: fake build number to indicate server 2012 R2 vs windows 8.1 + _md_product = ["NtProductLanManNt", "NtProductServer"] class Win8SP0x86(obj.Profile): """ A Profile for Windows 8 x86 """ @@ -451,6 +457,7 @@ class Win8SP0x86(obj.Profile): _md_minor = 2 _md_build = 9200 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp0_x86_vtypes' + _md_product = ["NtProductWinNt"] class Win8SP1x86(obj.Profile): """ A Profile for Windows 8.1 x86 """ @@ -460,6 +467,7 @@ class Win8SP1x86(obj.Profile): _md_minor = 3 _md_build = 9600 _md_vtype_module = 'volatility.plugins.overlays.windows.win8_sp1_x86_vtypes' + _md_product = ["NtProductWinNt"] class Win81U1x64(obj.Profile): """ A Profile for Windows 8.1 Update 1 x64 """ @@ -469,6 +477,7 @@ class Win81U1x64(obj.Profile): _md_minor = 3 _md_build = 17031 _md_vtype_module = 'volatility.plugins.overlays.windows.win81_u1_x64_vtypes' + _md_product = ["NtProductWinNt"] class Win81U1x86(obj.Profile): """ A Profile for Windows 8.1 Update 1 x86 """ @@ -478,3 +487,4 @@ class Win81U1x86(obj.Profile): _md_minor = 3 _md_build = 17031 _md_vtype_module = 'volatility.plugins.overlays.windows.win81_u1_x86_vtypes' + _md_product = ["NtProductWinNt"] diff --git a/volatility/plugins/overlays/windows/xp.py b/volatility/plugins/overlays/windows/xp.py index 557c96fb3..05389a23f 100644 --- a/volatility/plugins/overlays/windows/xp.py +++ b/volatility/plugins/overlays/windows/xp.py @@ -54,6 +54,7 @@ class WinXPSP2x86(obj.Profile): _md_os = 'windows' _md_memory_model = '32bit' _md_vtype_module = 'volatility.plugins.overlays.windows.xp_sp2_x86_vtypes' + _md_product = ["NtProductWinNt"] class WinXPSP3x86(obj.Profile): """ A Profile for Windows XP SP3 x86 """ @@ -62,5 +63,6 @@ class WinXPSP3x86(obj.Profile): _md_os = 'windows' _md_memory_model = '32bit' _md_vtype_module = 'volatility.plugins.overlays.windows.xp_sp3_x86_vtypes' + _md_product = ["NtProductWinNt"] From 6f71a2764c21e405f9f76351ab053dc91f9d4ff3 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Tue, 11 Oct 2016 14:51:16 -0500 Subject: [PATCH 042/304] the iehistory plugin needs a Url property --- volatility/plugins/iehistory.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/plugins/iehistory.py b/volatility/plugins/iehistory.py index a4042a588..c7f106383 100644 --- a/volatility/plugins/iehistory.py +++ b/volatility/plugins/iehistory.py @@ -87,6 +87,10 @@ def url_and_title(self): title = title + t return url, title + + @property + def Url(self): + return self.url_and_title()[0] class IEHistoryVTypes(obj.ProfileModification): """Apply structures for IE history parsing""" From 8d10c1d81e4fbc4cdddcd6fcbb0e0ffcb52a61fb Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 12 Oct 2016 08:13:56 -0500 Subject: [PATCH 043/304] refs #333 add a 1gb default maximum memory range size to vaddump and yarascan --- volatility/plugins/malware/malfind.py | 8 ++++++-- volatility/plugins/vadinfo.py | 7 ++++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index d68ccd042..94f634a98 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -130,7 +130,8 @@ def __init__(self, task = None, **kwargs): BaseYaraScanner.__init__(self, address_space = task.get_process_address_space(), **kwargs) def scan(self, offset = 0, maxlen = None): - for vad, self.address_space in self.task.get_vads(skip_max_commit = True): + filter = lambda x : x.Length < maxlen + for vad, self.address_space in self.task.get_vads(vad_filter = filter, skip_max_commit = True): for match in BaseYaraScanner.scan(self, vad.Start, vad.Length): yield match @@ -196,6 +197,9 @@ def __init__(self, config, *args, **kwargs): config.add_option('REVERSE', short_option = 'R', default = 0, help = 'Reverse this number of bytes', action = 'store', type = 'int') + config.add_option('MAX-SIZE', short_option = 'M', default = 0x40000000, + action = 'store', type = 'long', + help = 'Set the maximum size (default is 1GB)') def _compile_rules(self): """Compile the YARA rules from command-line parameters. @@ -232,7 +236,7 @@ def _compile_rules(self): def _scan_process_memory(self, addr_space, rules): for task in self.filter_tasks(tasks.pslist(addr_space)): scanner = VadYaraScanner(task = task, rules = rules) - for hit, address in scanner.scan(): + for hit, address in scanner.scan(maxlen = self._config.MAX_SIZE): yield (task, address, hit, scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE)) def _scan_kernel_memory(self, addr_space, rules): diff --git a/volatility/plugins/vadinfo.py b/volatility/plugins/vadinfo.py index aac2c5730..13bd8b403 100644 --- a/volatility/plugins/vadinfo.py +++ b/volatility/plugins/vadinfo.py @@ -382,6 +382,9 @@ def __init__(self, config, *args, **kwargs): config.add_option('BASE', short_option = 'b', default = None, help = 'Dump VAD with BASE address (in hex)', action = 'store', type = 'int') + config.add_option('MAX-SIZE', short_option = 'M', default = 0x40000000, + action = 'store', type = 'long', + help = 'Set the maximum size (default is 1GB)') def dump_vad(self, path, vad, address_space): """ @@ -451,7 +454,9 @@ def render_text(self, outfd, data): if offset == None: offset = 0 - for vad, _addrspace in task.get_vads(skip_max_commit = True): + filter = lambda x : x.Length < self._config.MAX_SIZE + + for vad, _addrspace in task.get_vads(vad_filter = filter, skip_max_commit = True): if self._config.BASE and vad.Start != self._config.BASE: continue From 66a46cbb77642042a79075776d8ce76582c64ee6 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 12 Oct 2016 10:02:28 -0500 Subject: [PATCH 044/304] update to the previous commit which only applies a VAD size filter for VadYaraScanner when a maxlen is specified --- volatility/plugins/malware/malfind.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py index 94f634a98..5d5ff3994 100644 --- a/volatility/plugins/malware/malfind.py +++ b/volatility/plugins/malware/malfind.py @@ -130,8 +130,15 @@ def __init__(self, task = None, **kwargs): BaseYaraScanner.__init__(self, address_space = task.get_process_address_space(), **kwargs) def scan(self, offset = 0, maxlen = None): - filter = lambda x : x.Length < maxlen - for vad, self.address_space in self.task.get_vads(vad_filter = filter, skip_max_commit = True): + + if maxlen == None: + vads = self.task.get_vads(skip_max_commit = True) + else: + filter = lambda x : x.Length < maxlen + vads = self.task.get_vads(vad_filter = filter, + skip_max_commit = True) + + for vad, self.address_space in vads: for match in BaseYaraScanner.scan(self, vad.Start, vad.Length): yield match From 107cd7360ff20b184ee769feecddd033b3fe4d7a Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Thu, 13 Oct 2016 08:21:00 -0500 Subject: [PATCH 045/304] handle more recent versions of virtual box ELF core dumps --- volatility/plugins/addrspaces/elfcoredump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/addrspaces/elfcoredump.py b/volatility/plugins/addrspaces/elfcoredump.py index 5bb22b09e..f6f43f6dd 100644 --- a/volatility/plugins/addrspaces/elfcoredump.py +++ b/volatility/plugins/addrspaces/elfcoredump.py @@ -126,7 +126,7 @@ def check_note(self, note): def validate(self): self.as_assert(self.header, 'ELF error: did not find any PT_NOTE segment with VBCORE') self.as_assert(self.header.u32Magic == DBGFCORE_MAGIC, 'Could not find VBox core magic signature') - self.as_assert(self.header.u32FmtVersion == DBGFCORE_FMT_VERSION, 'Unknown VBox core format version') + self.as_assert(self.header.u32FmtVersion & 0xFFFFFFF0 == DBGFCORE_FMT_VERSION, 'Unknown VBox core format version') self.as_assert(self.runs, 'ELF error: did not find any LOAD segment with main RAM') class QemuCoreDumpElf(VirtualBoxCoreDumpElf64): From f6df486e4a5b90dfea1992b9f02b8853975785f1 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Thu, 13 Oct 2016 11:31:29 -0500 Subject: [PATCH 046/304] update the handle pointer decoding algorithm for windows 10 64-bit builds >= 14393 (fixes the handles plugin) --- volatility/plugins/overlays/windows/win10.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/volatility/plugins/overlays/windows/win10.py b/volatility/plugins/overlays/windows/win10.py index c4191c8a5..d6954e811 100644 --- a/volatility/plugins/overlays/windows/win10.py +++ b/volatility/plugins/overlays/windows/win10.py @@ -460,6 +460,17 @@ class _OBJECT_HEADER_10_DD08DD42(_OBJECT_HEADER_10): 58: 'VRegConfigurationContext', 59: 'VirtualKey', } + +class _HANDLE_TABLE_10_DD08DD42(win8._HANDLE_TABLE_81R264): + + def decode_pointer(self, value): + + value = value & 0xFFFFFFFFFFFFFFF8 + value = value >> self.DECODE_MAGIC + if (value & (1 << 47)): + value = value | 0xFFFF000000000000 + + return value class Win10ObjectHeader(obj.ProfileModification): before = ["Win8ObjectClasses"] @@ -474,6 +485,12 @@ def modification(self, profile): if build >= 14393: header = _OBJECT_HEADER_10_DD08DD42 + + ## update the handle table here as well + if metadata.get("memory_model") == "64bit": + profile.object_classes.update({ + "_HANDLE_TABLE": _HANDLE_TABLE_10_DD08DD42}) + elif build >= 10240: header = _OBJECT_HEADER_10_1AC738FB else: From 403fb10afd73266ce40d5a543ad9a41aabc552e8 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 14 Oct 2016 17:02:54 -0500 Subject: [PATCH 047/304] tweak the patch from 6631c0c93848e7e90dc0e76035fc38066c7c9946 to include KDBG sizes for all 64-bit platforms and not just >= 6.2. we need to be able to find the patch guard entropy values for all 64-bit versions of windows for the timer DPC decoding --- volatility/plugins/overlays/windows/win8_kdbg.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/overlays/windows/win8_kdbg.py b/volatility/plugins/overlays/windows/win8_kdbg.py index daa1e2b1a..c6006a6ec 100644 --- a/volatility/plugins/overlays/windows/win8_kdbg.py +++ b/volatility/plugins/overlays/windows/win8_kdbg.py @@ -93,8 +93,8 @@ def unique_sizes(self): if (cls._md_os != "windows" or cls._md_memory_model != "64bit"): continue - if (cls._md_major, cls._md_minor) < (6, 2): - continue + #if (cls._md_major, cls._md_minor) < (6, 2): + # continue conf = copy.deepcopy(self.obj_vm.get_config()) conf.PROFILE = name From 527bf4d6f280dba5a9a18a017703c382656b403a Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 10:20:43 -0500 Subject: [PATCH 048/304] Linux - add support for kaslr kernels --- volatility/plugins/linux/aslr_shift.py | 43 +++++++++++ volatility/plugins/overlays/linux/linux.py | 88 +++++++++++++++++----- 2 files changed, 113 insertions(+), 18 deletions(-) create mode 100644 volatility/plugins/linux/aslr_shift.py diff --git a/volatility/plugins/linux/aslr_shift.py b/volatility/plugins/linux/aslr_shift.py new file mode 100644 index 000000000..6d1ece3bc --- /dev/null +++ b/volatility/plugins/linux/aslr_shift.py @@ -0,0 +1,43 @@ +# Volatility +# +# This file is part of Volatility. +# +# Volatility is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Volatility is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Volatility. If not, see . +# + +""" +@author: Andrew Case +@license: GNU General Public License 2.0 +@contact: atcuno@gmail.com +@organization: +""" + +import volatility.utils as utils +import volatility.plugins.linux.common as common + +class linux_aslr_shift(common.AbstractLinuxCommand): + """Automatically detect the Linux ASLR shift""" + + def calculate(self): + aspace = utils.load_as(self._config) + + yield aspace.profile.shift_address + + def render_text(self, outfd, data): + self.table_header(outfd, [("Shift Address", "[addrpad]")]) + + for shift_address in data: + self.table_row(outfd, shift_address) + + diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index 80f02eb74..ae6c719ef 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -37,6 +37,7 @@ import volatility.obj as obj import volatility.debug as debug import volatility.dwarf as dwarf +import volatility.scan as scan import volatility.plugins.linux.common as linux_common import volatility.plugins.linux.flags as linux_flags import volatility.addrspace as addrspace @@ -211,11 +212,13 @@ def __init__(self, *args, **kwargs): # change the name to catch any code referencing the old hash table self.sys_map = {} self.sym_addr_cache = {} + self.shift_address = 0 obj.Profile.__init__(self, *args, **kwargs) def clear(self): """Clear out the system map, and everything else""" self.sys_map = {} + self.shift_address = 0 obj.Profile.clear(self) def reset(self): @@ -281,7 +284,11 @@ def get_all_symbols(self, module = "kernel"): mod = symtable[module] for (name, addrs) in mod.items(): - ret.append(addrs) + addr = addrs[0][0] + if self.shift_address and addr: + addr = addr + self.shift_address + + ret.append((name, addr)) else: debug.info("All symbols requested for non-existent module %s" % module) @@ -292,14 +299,12 @@ def get_all_addresses(self, module = "kernel"): # returns a hash table for quick looks # the main use of this function is to see if an address is known - ret = {} - symbols = self.get_all_symbols(module) + + ret = {} - for sym in symbols: - - for (addr, addrtype) in sym: - ret[addr] = 1 + for _name, addr in symbols: + ret[addr] = 1 return ret @@ -312,7 +317,7 @@ def _get_symbol_by_address(self, module, sym_address): for (name, addrs) in mod.items(): for (addr, addr_type) in addrs: - if sym_address == addr: + if sym_address == addr + self.shift_address: ret = name break @@ -413,6 +418,9 @@ def get_symbol(self, sym_name, nm_type = "", module = "kernel"): else: debug.info("Requested module {0:s} not found in symbol table\n".format(module)) + if ret: + ret = ret + self.shift_address + return ret def get_symbol_type(self, sym_name, nm_type = "", module = "kernel"): @@ -940,7 +948,6 @@ def get_param_val(self, param, _over = 0): val = 'Y' else: - print "Unknown get_fn: {0:#x}".format(getfn) return None return val @@ -1808,7 +1815,6 @@ def get_libdl_maps(self): ehdr = obj.Object("elf_hdr", offset = vma.vm_start, vm = proc_as) if not ehdr or not ehdr.is_valid(): - #print "could not get header for %d | %s" % (self.pid, self.comm) continue for phdr in ehdr.program_headers(): @@ -2260,6 +2266,19 @@ def d_count(self): ret = self.m("d_count") return ret +class swapperScan(scan.BaseScanner): + """ Scanner for swapper string for Mountain Lion """ + checks = [] + + def __init__(self, needles = None): + self.needles = needles + self.checks = [ ("MultiStringFinderCheck", {'needles':needles}) ] + scan.BaseScanner.__init__(self) + + def scan(self, address_space, offset = 0, maxlen = None): + for offset in scan.BaseScanner.scan(self, address_space, offset, maxlen): + yield offset + class VolatilityDTB(obj.VolatilityMagic): """A scanner for DTB values.""" @@ -2273,18 +2292,28 @@ def generate_suggestions(self): else: sym = "init_level4_pgt" shifts = [0xffffffff80000000, 0xffffffff80000000 - 0x1000000, 0xffffffff7fe00000] + + config = self.obj_vm.get_config() + tbl = self.obj_vm.profile.sys_map["kernel"] + + if config.SHIFT: + shift_address = config.SHIFT + else: + shift_address = self.obj_vm.profile.shift_address good_dtb = -1 - + + init_task_addr = tbl["init_task"][0][0] + shift_address + dtb_sym_addr = tbl[sym][0][0] + shift_address + + comm_offset = profile.get_obj_offset("task_struct", "comm") + pid_offset = self.obj_vm.profile.get_obj_offset("task_struct", "pid") + pas = self.obj_vm + for shift in shifts: - sym_addr = profile.get_symbol(sym) - shift - - pas = self.obj_vm - - init_task_addr = profile.get_symbol("init_task") - offset = profile.get_obj_offset("task_struct", "comm") + sym_addr = dtb_sym_addr - shift - read_addr = init_task_addr - shift + offset + read_addr = init_task_addr - shift + comm_offset buf = pas.read(read_addr, 12) @@ -2294,6 +2323,28 @@ def generate_suggestions(self): good_dtb = sym_addr break + # check for relocated kernel + if good_dtb == -1 and shift_address == 0: + scanner = swapperScan(needles = ["swapper/0"]) + for swapper_offset in scanner.scan(self.obj_vm): + swapper_address = swapper_offset - comm_offset + + if pas.read(swapper_address + pid_offset, 4) != "\x00\x00\x00\x00": + continue + + tmp_shift_address = swapper_address - (init_task_addr - shifts[0]) + + if tmp_shift_address & 0xfff != 0x000: + continue + + shift_address = tmp_shift_address + good_dtb = dtb_sym_addr - shifts[0] + shift_address + + break + + if shift_address != 0: + self.obj_vm.profile.shift_address = shift_address + yield good_dtb # the intel check, simply checks for the static paging of init_task @@ -2314,6 +2365,7 @@ def generate_suggestions(self): for shift in shifts: phys = self.obj_vm.vtop(init_task_addr) check = init_task_addr - shift + if phys == check: ret = True break From f8c7c38b70852f2d0b8728bd5c27f6e026a9a355 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 11:09:29 -0500 Subject: [PATCH 049/304] Linux - update linux_lsmod and moddump to work with latest kernels --- volatility/plugins/overlays/linux/linux.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index ae6c719ef..16a554bd5 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -1010,6 +1010,24 @@ def get_symbol(self, wanted_sym_name): break return ret + + @property + def symtab(self): + if hasattr(self, "kallsyms"): + ret = self.kallsyms.symtab + else: + ret = self.m("symtab") + + return ret + + @property + def num_symtab(self): + if hasattr(self, "kallsyms"): + ret = self.kallsyms.num_symtab.v() + else: + ret = self.m("num_symtab").v() + + return ret def is_valid(self): valid = False From cc880fa73ae5744a074f4dafe27302bc15c146a8 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 11:13:49 -0500 Subject: [PATCH 050/304] Linux - fix issue 280 related to network byte order --- volatility/plugins/overlays/linux/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index 16a554bd5..f45bee7a8 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -744,7 +744,7 @@ def dst_port(self): elif hasattr(self, "inet_dport"): return socket.htons(self.inet_dport) elif hasattr(self, "sk") and hasattr(self.sk, "__sk_common") and hasattr(self.sk.__sk_common, "skc_dport"): - return self.sk.__sk_common.skc_num #pylint: disable-msg=W0212 + return socket.htons(self.sk.__sk_common.skc_dport) #pylint: disable-msg=W0212 else: return None From f85cb934d9b92f6302e0f6e695f431459708097c Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 11:21:43 -0500 Subject: [PATCH 051/304] Linux - ensure address checks are done on int and not CType --- volatility/plugins/linux/common.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/linux/common.py b/volatility/plugins/linux/common.py index 3928d2905..50a80d21a 100644 --- a/volatility/plugins/linux/common.py +++ b/volatility/plugins/linux/common.py @@ -67,6 +67,7 @@ def is_valid_profile(profile): return profile.metadata.get('os', 'Unknown').lower() == 'linux' def is_known_address(self, addr, modules): + addr = int(addr) text = self.profile.get_symbol("_text") etext = self.profile.get_symbol("_etext") @@ -84,7 +85,7 @@ def address_in_module(self, addr, modules): def verify_ops(self, ops, op_members, modules): for check in op_members: - addr = ops.m(check) + addr = int(ops.m(check)) if addr and addr != 0: From 33d461c31212db5fddeee12b019eefa4727f8c28 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 11:25:29 -0500 Subject: [PATCH 052/304] Linux - check for corruption on hash table size in arp table enumeration --- volatility/plugins/linux/arp.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility/plugins/linux/arp.py b/volatility/plugins/linux/arp.py index 443964c07..84b9c9bdc 100644 --- a/volatility/plugins/linux/arp.py +++ b/volatility/plugins/linux/arp.py @@ -82,6 +82,9 @@ def handle_table(self, ntable): buckets = obj.Object(theType = 'Array', offset = hash_table, vm = self.addr_space, targetType = 'Pointer', count = hash_size) + if not buckets or hash_size > 50000: + return [] + for i in range(hash_size): if buckets[i]: neighbor = obj.Object("neighbour", offset = buckets[i], vm = self.addr_space) From 2ff525da7de115cc9e4f04156ef1acfcc6fa62cf Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 17 Oct 2016 11:41:02 -0500 Subject: [PATCH 053/304] Linux - fix hidden modules related to issue 273 --- volatility/plugins/linux/hidden_modules.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility/plugins/linux/hidden_modules.py b/volatility/plugins/linux/hidden_modules.py index f7f22a8c8..346b055eb 100644 --- a/volatility/plugins/linux/hidden_modules.py +++ b/volatility/plugins/linux/hidden_modules.py @@ -63,9 +63,7 @@ def walk_modules_address_space(self, addr_space): check_bufs = [] replace_bufs = [] - check_nums = [3000, 2800, 2700, 2500, 2300, 2100, 2000, 1500, 1300, 1200, 1024, 512, 256, 128, 96, 64, 48, 32, 24, 16, 12, 9] - if minus_size == 4: - check_nums = check_nums + [8, 6, 5] + check_nums = [3000, 2800, 2700, 2500, 2300, 2100, 2000, 1500, 1300, 1200, 1024, 512, 256, 128, 96, 64, 48, 32, 24] for num in check_nums: check_bufs.append("\x00" * num) From 5f113ee60dd70ad528625a0ed6553c7baa404cf6 Mon Sep 17 00:00:00 2001 From: atcuno Date: Fri, 21 Oct 2016 11:56:23 -0500 Subject: [PATCH 054/304] Linux - add further checks in ASLR scanning --- volatility/plugins/overlays/linux/linux.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index f45bee7a8..99120dfa4 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -2343,10 +2343,13 @@ def generate_suggestions(self): # check for relocated kernel if good_dtb == -1 and shift_address == 0: - scanner = swapperScan(needles = ["swapper/0"]) + scanner = swapperScan(needles = ["swapper/0\x00\x00\x00\x00\x00\x00"]) for swapper_offset in scanner.scan(self.obj_vm): swapper_address = swapper_offset - comm_offset + if pas.read(swapper_address, 4) != "\x00\x00\x00\x00": + continue + if pas.read(swapper_address + pid_offset, 4) != "\x00\x00\x00\x00": continue @@ -2357,9 +2360,8 @@ def generate_suggestions(self): shift_address = tmp_shift_address good_dtb = dtb_sym_addr - shifts[0] + shift_address - break - + if shift_address != 0: self.obj_vm.profile.shift_address = shift_address From 19d12116fe2f1f3d98873799c8fe80ddbf046f32 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 21 Oct 2016 15:22:38 -0500 Subject: [PATCH 055/304] fix a backtrace in hashdump when the CurrentControlSetXXX cannot be determined --- volatility/win32/hashdump.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility/win32/hashdump.py b/volatility/win32/hashdump.py index ddca5a6f5..7f22ee6be 100644 --- a/volatility/win32/hashdump.py +++ b/volatility/win32/hashdump.py @@ -117,6 +117,8 @@ def find_control_set(sysaddr): for v in rawreg.values(csselect): if v.Name == "Current": return v.Data + + return 1 def get_bootkey(sysaddr): cs = find_control_set(sysaddr) From 1d65795714821c90336a13765c67abcac0641eba Mon Sep 17 00:00:00 2001 From: atcuno Date: Tue, 25 Oct 2016 13:50:29 -0500 Subject: [PATCH 056/304] Linux - fix overflow error in ARP table size calculation --- volatility/plugins/linux/arp.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/linux/arp.py b/volatility/plugins/linux/arp.py index 84b9c9bdc..341ff193d 100644 --- a/volatility/plugins/linux/arp.py +++ b/volatility/plugins/linux/arp.py @@ -74,7 +74,11 @@ def handle_table(self, ntable): hash_size = ntable.nht.hash_mask hash_table = ntable.nht.hash_buckets else: - hash_size = (1 << ntable.nht.hash_shift) + try: + hash_size = (1 << ntable.nht.hash_shift) + except OverflowError: + return [] + hash_table = ntable.nht.hash_buckets if not self.addr_space.is_valid_address(hash_table): From 4d5fbcb61ab1b7526dd83d123fa00b9c66fc68b9 Mon Sep 17 00:00:00 2001 From: atcuno Date: Tue, 25 Oct 2016 15:49:24 -0500 Subject: [PATCH 057/304] Linux - re-enable strict validation of linux_bash_hash --- volatility/plugins/linux/bash_hash.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/bash_hash.py b/volatility/plugins/linux/bash_hash.py index 48dad9c53..1aaf36b62 100644 --- a/volatility/plugins/linux/bash_hash.py +++ b/volatility/plugins/linux/bash_hash.py @@ -102,10 +102,10 @@ def __iter__(self): for bucket_ptr in bucket_array: bucket = bucket_ptr.dereference_as("bucket_contents") while bucket.times_found > 0 and bucket.data.is_valid() and bucket.key.is_valid(): - #pdata = bucket.data + pdata = bucket.data - #if pdata.path.is_valid() and (0 <= pdata.flags <= 2): - yield bucket + if pdata.path.is_valid() and (0 <= pdata.flags <= 2): + yield bucket bucket = bucket.next @@ -143,6 +143,8 @@ def calculate(self): if not (self._config.SCAN_ALL or str(task.comm) == "bash"): continue + print "Scanning %d" % task.pid + for ent in task.bash_hash_entries(): yield task, ent From b223e1088954db0788c7f67f749f4fc3f8fe94bb Mon Sep 17 00:00:00 2001 From: atcuno Date: Tue, 25 Oct 2016 16:03:35 -0500 Subject: [PATCH 058/304] Linux - remove print and add infinite loop protection to bash_hash --- volatility/plugins/linux/bash_hash.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/bash_hash.py b/volatility/plugins/linux/bash_hash.py index 1aaf36b62..b93ddf3d1 100644 --- a/volatility/plugins/linux/bash_hash.py +++ b/volatility/plugins/linux/bash_hash.py @@ -97,18 +97,25 @@ def is_valid(self): def __iter__(self): if self.is_valid(): + seen = {} + bucket_array = obj.Object(theType="Array", targetType="Pointer", offset = self.bucket_array, vm = self.nbuckets.obj_vm, count = 64) for bucket_ptr in bucket_array: bucket = bucket_ptr.dereference_as("bucket_contents") while bucket.times_found > 0 and bucket.data.is_valid() and bucket.key.is_valid(): + if bucket.v() in seen: + break + + seen[bucket.v()] = 1 + pdata = bucket.data if pdata.path.is_valid() and (0 <= pdata.flags <= 2): yield bucket bucket = bucket.next - + class BashHashTypes(obj.ProfileModification): conditions = {"os" : lambda x : x in ["linux"]} @@ -143,8 +150,6 @@ def calculate(self): if not (self._config.SCAN_ALL or str(task.comm) == "bash"): continue - print "Scanning %d" % task.pid - for ent in task.bash_hash_entries(): yield task, ent From 75fb0346b5147532584b7da6efc44816e098c739 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Wed, 26 Oct 2016 08:54:53 -0500 Subject: [PATCH 059/304] refs #342 Add an interpreter path in convert.py --- tools/mac/convert.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/mac/convert.py b/tools/mac/convert.py index 963a6e18c..270bf9169 100755 --- a/tools/mac/convert.py +++ b/tools/mac/convert.py @@ -1,3 +1,5 @@ +#!/usr/bin/env python + import os, sys, re class DWARFParser(object): From bc824fd3e2c5e51638ebf30257a9babd3fa289e7 Mon Sep 17 00:00:00 2001 From: atcuno Date: Fri, 18 Nov 2016 10:18:08 -0600 Subject: [PATCH 060/304] Linux - fix smearing issue check_fops and substantially improve performance --- volatility/plugins/linux/check_fops.py | 14 +++++++------- volatility/plugins/linux/common.py | 15 +++++++++++++-- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/volatility/plugins/linux/check_fops.py b/volatility/plugins/linux/check_fops.py index 8581d2131..d9ef2013b 100644 --- a/volatility/plugins/linux/check_fops.py +++ b/volatility/plugins/linux/check_fops.py @@ -57,9 +57,8 @@ def check_open_files_fop(self, f_op_members, modules): for (hooked_member, hook_address) in self.verify_ops(filp.f_op, f_op_members, modules): name = "{0:s} {1:d} {2:s}".format(task.comm, i, linux_common.get_path(task, filp)) yield (name, hooked_member, hook_address) - + def check_proc_fop(self, f_op_members, modules): - proc_mnt_addr = self.addr_space.profile.get_symbol("proc_mnt") if not proc_mnt_addr: return @@ -74,22 +73,23 @@ def check_proc_fop(self, f_op_members, modules): # only check the root directory for dentry in root.d_subdirs.list_of_type("dentry", "d_u"): - name = dentry.d_name.name.dereference_as("String", length = 255) for (hooked_member, hook_address) in self.verify_ops(dentry.d_inode.i_fop, f_op_members, modules): yield("proc_mnt: {0}".format(name), hooked_member, hook_address) def walk_proc(self, cur, f_op_members, modules, parent = ""): - + last_cur = None while cur: - if cur.obj_offset in self.seen_proc: + if cur.obj_offset == last_cur: + break + cur = cur.next continue self.seen_proc[cur.obj_offset] = 1 - + name = cur.name.dereference_as("String", length = 255) fops = cur.proc_fops @@ -104,6 +104,7 @@ def walk_proc(self, cur, f_op_members, modules, parent = ""): yield (name, hooked_member, hook_address) subdir = subdir.next + last_cur = cur.obj_offset cur = cur.next def check_proc_root_fops(self, f_op_members, modules): @@ -138,7 +139,6 @@ def calculate(self): funcs = [self.check_open_files_fop, self.check_proc_fop, self.check_proc_root_fops, self.check_file_cache] for func in funcs: - for (name, member, address) in func(f_op_members, modules): yield (name, member, address) diff --git a/volatility/plugins/linux/common.py b/volatility/plugins/linux/common.py index 50a80d21a..0c1f7d997 100644 --- a/volatility/plugins/linux/common.py +++ b/volatility/plugins/linux/common.py @@ -51,6 +51,7 @@ class AbstractLinuxCommand(commands.Command): def __init__(self, *args, **kwargs): self.addr_space = None self.known_addrs = {} + self.known_fops = {} commands.Command.__init__(self, *args, **kwargs) @property @@ -83,12 +84,19 @@ def address_in_module(self, addr, modules): return False def verify_ops(self, ops, op_members, modules): + ops_addr = ops.v() + ops_list = [] + + if ops_addr in self.known_fops: + for check, addr in self.known_fops[ops_addr]: + yield check, addr + + return for check in op_members: addr = int(ops.m(check)) - if addr and addr != 0: - + if addr and addr != 0 and addr != -1: if addr in self.known_addrs: known = self.known_addrs[addr] else: @@ -97,6 +105,9 @@ def verify_ops(self, ops, op_members, modules): if known == 0: yield (check, addr) + ops_list.append((check, addr)) + + self.known_fops[ops_addr] = ops_list class AbstractLinuxIntelCommand(AbstractLinuxCommand): @staticmethod From 266005c070b8e88744472b92ed37021c3750b12b Mon Sep 17 00:00:00 2001 From: atcuno Date: Fri, 18 Nov 2016 10:28:09 -0600 Subject: [PATCH 061/304] Linux - add support through Linux 4.9 for cpuinfo --- volatility/plugins/linux/cpuinfo.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/cpuinfo.py b/volatility/plugins/linux/cpuinfo.py index 716656955..81a9fea1e 100644 --- a/volatility/plugins/linux/cpuinfo.py +++ b/volatility/plugins/linux/cpuinfo.py @@ -78,8 +78,9 @@ def get_per_cpu_symbol(self, sym_name, module = "kernel"): def online_cpus(self): """ returns a list of online cpus (the processor numbers) """ - cpu_online_bits_addr = self.addr_space.profile.get_symbol("cpu_online_bits") - cpu_present_map_addr = self.addr_space.profile.get_symbol("cpu_present_map") + cpu_online_bits_addr = self.addr_space.profile.get_symbol("cpu_online_bits") + cpu_present_map_addr = self.addr_space.profile.get_symbol("cpu_present_map") + cpu_present_mask_addr = self.addr_space.profile.get_symbol("__cpu_present_mask") #later kernels.. if cpu_online_bits_addr: @@ -88,11 +89,14 @@ def online_cpus(self): elif cpu_present_map_addr: bmap = obj.Object("unsigned long", offset = cpu_present_map_addr, vm = self.addr_space) + elif cpu_present_mask_addr: + bmap = obj.Object("unsigned long", offset = cpu_present_mask_addr, vm = self.addr_space) + else: raise AttributeError, "Unable to determine number of online CPUs for memory capture" cpus = [] - for i in range(8): + for i in range(32): if bmap & (1 << i): cpus.append(i) From ecd8a54eb8d4394cd5e292dc8b51982e088a42fb Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Mon, 21 Nov 2016 10:04:51 -0600 Subject: [PATCH 062/304] update to support registry plugins on win10 14393.447 --- volatility/plugins/bigpagepools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/bigpagepools.py b/volatility/plugins/bigpagepools.py index 3536db992..b4e85942a 100644 --- a/volatility/plugins/bigpagepools.py +++ b/volatility/plugins/bigpagepools.py @@ -68,7 +68,7 @@ def modification(self, profile): (6, 2, '32bit') : [[92, 88]], (6, 2, '64bit') : [[-5200, -5224]], (6, 3, '32bit') : [[116, 120]], - (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40], [32, 24]], + (6, 4, '64bit') : [[208, 184], [168, 192], [176, 168], [48, 40], [32, 24], [24, 48]], (6, 4, '32bit') : [[-168, -164]], } From 4c5b1f699ba99dfab32d505b59e0b14b92a150f1 Mon Sep 17 00:00:00 2001 From: Ladi Prosek Date: Wed, 14 Dec 2016 16:10:46 +0100 Subject: [PATCH 063/304] Increase the _DBGKD_GET_VERSION64 search area In recent Win10 builds _DBGKD_GET_VERSION64 does not immediately precede the KDBG structure. It is still within a few pages from it though. --- volatility/plugins/overlays/windows/kdbg_vtypes.py | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/volatility/plugins/overlays/windows/kdbg_vtypes.py b/volatility/plugins/overlays/windows/kdbg_vtypes.py index 3a883227e..8c9825512 100644 --- a/volatility/plugins/overlays/windows/kdbg_vtypes.py +++ b/volatility/plugins/overlays/windows/kdbg_vtypes.py @@ -56,6 +56,16 @@ def modules(self): yield l def dbgkd_version64(self): + """Finds _DBGKD_GET_VERSION64 corresponding to this KDBG""" + verinfo = self.dbgkd_find_version64(pages_to_scan = 1) + if verinfo: + return verinfo + + # _DBGKD_GET_VERSION64 does not immediately precede KDBG on newer Windows. + # Try again with more pages to scan. + return self.dbgkd_find_version64(pages_to_scan = 16) + + def dbgkd_find_version64(self, pages_to_scan): """Scan backwards from the base of KDBG to find the _DBGKD_GET_VERSION64. We have a winner when kernel base addresses and process list head match.""" @@ -64,7 +74,8 @@ def dbgkd_version64(self): memory_model = self.obj_native_vm.profile.metadata.get('memory_model', '32bit') dbgkd_off = self.obj_offset & 0xFFFFFFFFFFFFF000 - dbgkd_end = dbgkd_off + 0x1000 + dbgkd_off -= (pages_to_scan / 2) * 0x1000 + dbgkd_end = dbgkd_off + pages_to_scan * 0x1000 # The _DBGKD_GET_VERSION64 structure is autogenerated, so # this value should be correct for each profile dbgkd_size = self.obj_native_vm.profile.get_obj_size("_DBGKD_GET_VERSION64") From 5a41f277104ffcffc3ac43ebbbb608f66dcc0789 Mon Sep 17 00:00:00 2001 From: Ladi Prosek Date: Thu, 15 Dec 2016 09:56:58 +0100 Subject: [PATCH 064/304] Beef up nt!KdCopyDataBlock detection In recent Win10 builds the nt!KdCopyDataBlock detection algorithm incorrectly finds a code region in NDIS.sys instead of the real thing. NDIS!ndisFIsLoopbackNetBuffer+0x36: fffff800`ecf185fa 803dc90f030004 cmp byte ptr [NDIS!ndisWppEnabledLevelPerFlag+0x2 (fffff800`ecf495ca)],4 fffff800`ecf18601 721b jb NDIS!ndisFIsLoopbackNetBuffer+0x5a (fffff800`ecf1861e) fffff800`ecf18603 4d8943c8 mov qword ptr [r11-38h],r8 fffff800`ecf18607 4c8bca mov r9,rdx fffff800`ecf1860a 4c8bc0 mov r8,rax fffff800`ecf1860d 488d15b4f20100 lea rdx,[NDIS!WPP_64f4c5b0cce0308c37da1ab1727cd205_Traceguids (fffff800`ecf378c8)] ... This commit makes the detection more selective by also looking for a bswap instruction, present in all variants of nt!KdCopyDataBlock seen in the wild so far - Win8, Win8.1, Win10, Win10 RS1. --- volatility/plugins/overlays/windows/win8_kdbg.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/overlays/windows/win8_kdbg.py b/volatility/plugins/overlays/windows/win8_kdbg.py index c6006a6ec..a5e793c75 100644 --- a/volatility/plugins/overlays/windows/win8_kdbg.py +++ b/volatility/plugins/overlays/windows/win8_kdbg.py @@ -161,6 +161,8 @@ def copy_data_block(self, full_addr): wait_always = None # nt!KdpDataBlockEncoded block_encoded = None + # only for KdCopyDataBlock detection + bswap = None for op in ops: # cmp cs:KdpDataBlockEncoded, 0 @@ -202,14 +204,18 @@ def copy_data_block(self, full_addr): offset = offset, vm = addr_space) break + # bswap reg + elif (not bswap and op.mnemonic == 'BSWAP'): + bswap = True elif op.mnemonic == "RET": break # check if we've found all the required offsets if (block_encoded != None and kdbg_block != None - and wait_never != None - and wait_always != None): + and wait_never != None + and wait_always != None + and bswap != None): # some acquisition tools decode the KDBG block but leave # nt!KdpDataBlockEncoded set, so we handle it here. From 15d9dcfb6ff3f3bf90c9eb46553b98438cfb8ed6 Mon Sep 17 00:00:00 2001 From: Ladi Prosek Date: Thu, 15 Dec 2016 10:19:24 +0100 Subject: [PATCH 065/304] Add basic error handling to raw2dmp Failing the conversion with cryptic errors like "integer out of range for 'I' format code" is suboptimal. This commit adds checks for the two most common error conditions. --- volatility/plugins/raw2dmp.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/plugins/raw2dmp.py b/volatility/plugins/raw2dmp.py index 9fbd62589..e6a6b2ce3 100644 --- a/volatility/plugins/raw2dmp.py +++ b/volatility/plugins/raw2dmp.py @@ -57,10 +57,14 @@ def convert_to_crash(config, output): offset = obj.VolMagic(vspace).KUSER_SHARED_DATA.v(), vm = vspace) kdbg = obj.VolMagic(vspace).KDBG.v() + if not kdbg: + raise RuntimeError("Couldn't find KDBG block. Wrong profile?") # Scanning the memory region near KDDEBUGGER_DATA64 for # DBGKD_GET_VERSION64 dbgkd = kdbg.dbgkd_version64() + if not dbgkd: + raise RuntimeError("Couldn't find _DBGKD_GET_VERSION64.") # Set the correct file magic for i in range(len("PAGE")): From b2b19f843bf123d4ddcfd6e14fa2ce0ba898ed93 Mon Sep 17 00:00:00 2001 From: Michael Ligh Date: Fri, 16 Dec 2016 10:54:58 -0600 Subject: [PATCH 066/304] version bump to 2.6 --- volatility/constants.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/constants.py b/volatility/constants.py index 0e6e09a72..6d1044fe1 100644 --- a/volatility/constants.py +++ b/volatility/constants.py @@ -23,7 +23,7 @@ import os, sys -VERSION = "2.5" +VERSION = "2.6" SCAN_BLOCKSIZE = 1024 * 1024 * 10 From bf16230c9c239fd7b41358ed77a015eea5b93a45 Mon Sep 17 00:00:00 2001 From: gleeda Date: Thu, 22 Dec 2016 09:13:07 -0500 Subject: [PATCH 067/304] making tree.html use a remote ds.js script --- tools/doxygen/d3/tree.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/doxygen/d3/tree.html b/tools/doxygen/d3/tree.html index 72cd462a9..18b6db585 100644 --- a/tools/doxygen/d3/tree.html +++ b/tools/doxygen/d3/tree.html @@ -25,7 +25,7 @@ - +