/* Header autogenerated by Brandon Falk's PDB Dumper * * Invocation: C:\projects\pdbdump_2\pdbdump.exe L:\symbolarchive\win8_spB_x64\wudfhost.pdb\509D5A5AEFF042ECA252BB6D4359268C1\wudfhost.pdb */ struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 1a 10 00 00 */ }; enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 2a 10 00 00 */ unsigned char SystemTime[12]; /* +0x0014 2a 10 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 2a 10 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 2b 10 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 2c 10 00 00 */ unsigned char NtProductType[4]; /* +0x0264 2e 10 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 2f 10 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 30 10 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc 31 10 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 33 10 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 34 10 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 35 10 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 38 10 00 00 */ unsigned char Reserved[1]; /* +0x02d5 39 10 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 3a 10 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 31 10 00 00 */ unsigned char DismountCount[4]; /* +0x02dc 31 10 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 3b 10 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 43 10 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 34 10 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 44 10 00 00 */ /* unsigned char TickCount[0]; +0x0320 2a 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 45 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x032c 34 10 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 34 10 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 45 10 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 47 10 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 48 10 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 45 10 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 45 10 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 31 10 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 49 10 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 49 10 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 4a 10 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[8]; /* +0x0008 5a 10 00 00 */ unsigned char CleanupGroup[8]; /* +0x0010 5c 10 00 00 */ unsigned char CleanupGroupCancelCallback[8]; /* +0x0018 5f 10 00 00 */ void *RaceDll; /* +0x0020 */ unsigned char ActivationContext[8]; /* +0x0028 61 10 00 00 */ unsigned char FinalizationCallback[24]; /* +0x0030 66 10 00 00 */ }; struct _TP_CALLBACK_ENVIRON_V3:: { unsigned long Flags; /* +0x0000 */ }; struct _TP_CALLBACK_ENVIRON_V3:::: { /* unsigned char LongFunction[0]; +0x0000 3c 10 00 00 */ /* unsigned char Persistent[0]; +0x0000 3d 10 00 00 */ unsigned char Private[4]; /* +0x0000 7a 10 00 00 */ }; struct _TP_TASK { unsigned char Callbacks[8]; /* +0x0000 81 10 00 00 */ unsigned long NumaNode; /* +0x0008 */ unsigned char IdealProcessor; /* +0x000c */ unsigned char ListEntry[16]; /* +0x0010 82 10 00 00 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[8]; /* +0x0000 88 10 00 00 */ unsigned char Unposted[8]; /* +0x0008 8b 10 00 00 */ }; struct _TEB { unsigned char NtTib[56]; /* +0x0000 94 10 00 00 */ void *EnvironmentPointer; /* +0x0038 */ unsigned char ClientId[16]; /* +0x0040 95 10 00 00 */ void *ActiveRpcHandle; /* +0x0050 */ void *ThreadLocalStoragePointer; /* +0x0058 */ unsigned char ProcessEnvironmentBlock[8]; /* +0x0060 97 10 00 00 */ unsigned long LastErrorValue; /* +0x0068 */ unsigned long CountOfOwnedCriticalSections; /* +0x006c */ void *CsrClientThread; /* +0x0070 */ void *Win32ThreadInfo; /* +0x0078 */ unsigned char User32Reserved[104]; /* +0x0080 98 10 00 00 */ unsigned char UserReserved[24]; /* +0x00e8 99 10 00 00 */ void *WOW32Reserved; /* +0x0100 */ unsigned long CurrentLocale; /* +0x0108 */ unsigned long FpSoftwareStatusRegister; /* +0x010c */ unsigned char SystemReserved1[432]; /* +0x0110 9a 10 00 00 */ long ExceptionCode; /* +0x02c0 */ unsigned char ActivationContextStackPointer[8]; /* +0x02c8 9c 10 00 00 */ unsigned char SpareBytes[24]; /* +0x02d0 9d 10 00 00 */ unsigned long TxFsContext; /* +0x02e8 */ unsigned char GdiTebBatch[1256]; /* +0x02f0 9e 10 00 00 */ unsigned char RealClientId[16]; /* +0x07d8 95 10 00 00 */ void *GdiCachedProcessHandle; /* +0x07e8 */ unsigned long GdiClientPID; /* +0x07f0 */ unsigned long GdiClientTID; /* +0x07f4 */ void *GdiThreadLocalInfo; /* +0x07f8 */ unsigned char Win32ClientInfo[496]; /* +0x0800 9f 10 00 00 */ unsigned char glDispatchTable[1864]; /* +0x09f0 a0 10 00 00 */ unsigned char glReserved1[232]; /* +0x1138 a1 10 00 00 */ void *glReserved2; /* +0x1220 */ void *glSectionInfo; /* +0x1228 */ void *glSection; /* +0x1230 */ void *glTable; /* +0x1238 */ void *glCurrentRC; /* +0x1240 */ void *glContext; /* +0x1248 */ unsigned long LastStatusValue; /* +0x1250 */ unsigned char StaticUnicodeString[16]; /* +0x1258 a2 10 00 00 */ unsigned char StaticUnicodeBuffer[528]; /* +0x1268 a3 10 00 00 */ void *DeallocationStack; /* +0x1478 */ unsigned char TlsSlots[512]; /* +0x1480 a4 10 00 00 */ unsigned char TlsLinks[16]; /* +0x1680 82 10 00 00 */ void *Vdm; /* +0x1690 */ void *ReservedForNtRpc; /* +0x1698 */ unsigned char DbgSsReserved[16]; /* +0x16a0 a5 10 00 00 */ unsigned long HardErrorMode; /* +0x16b0 */ unsigned char Instrumentation[88]; /* +0x16b8 a6 10 00 00 */ unsigned char ActivityId[16]; /* +0x1710 17 10 00 00 */ void *SubProcessTag; /* +0x1720 */ void *EtwLocalData; /* +0x1728 */ void *EtwTraceData; /* +0x1730 */ void *WinSockData; /* +0x1738 */ unsigned long GdiBatchCount; /* +0x1740 */ /* unsigned char CurrentIdealProcessor[0]; +0x1744 a7 10 00 00 */ unsigned long IdealProcessorValue; /* +0x1744 */ unsigned char ReservedPad0; /* +0x1744 */ unsigned char ReservedPad1; /* +0x1745 */ unsigned char ReservedPad2; /* +0x1746 */ unsigned char IdealProcessor; /* +0x1747 */ unsigned long GuaranteedStackBytes; /* +0x1748 */ void *ReservedForPerf; /* +0x1750 */ void *ReservedForOle; /* +0x1758 */ unsigned long WaitingOnLoaderLock; /* +0x1760 */ void *SavedPriorityState; /* +0x1768 */ unsigned long long ReservedForCodeCoverage; /* +0x1770 */ void *ThreadPoolData; /* +0x1778 */ unsigned char TlsExpansionSlots[8]; /* +0x1780 6f 10 00 00 */ void *DeallocationBStore; /* +0x1788 */ void *BStoreLimit; /* +0x1790 */ unsigned long MuiGeneration; /* +0x1798 */ unsigned long IsImpersonating; /* +0x179c */ void *NlsCache; /* +0x17a0 */ void *pShimData; /* +0x17a8 */ unsigned short HeapVirtualAffinity; /* +0x17b0 */ unsigned short LowFragHeapDataSlot; /* +0x17b2 */ void *CurrentTransactionHandle; /* +0x17b8 */ unsigned char ActiveFrame[8]; /* +0x17c0 a9 10 00 00 */ void *FlsData; /* +0x17c8 */ void *PreferredLanguages; /* +0x17d0 */ void *UserPrefLanguages; /* +0x17d8 */ void *MergedPrefLanguages; /* +0x17e0 */ unsigned long MuiImpersonation; /* +0x17e8 */ /* unsigned char CrossTebFlags[0]; +0x17ec aa 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x17ec ab 10 00 00 */ unsigned short SameTebFlags; /* +0x17ee */ /* unsigned char SafeThunkCall[0]; +0x17ee ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x17ee ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x17ee ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x17ee af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x17ee b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x17ee b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x17ee b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x17ee b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x17ee b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x17ee b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x17ee b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x17ee b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x17ee b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x17ee b9 10 00 00 */ void *TxnScopeEnterCallback; /* +0x17f0 */ void *TxnScopeExitCallback; /* +0x17f8 */ void *TxnScopeContext; /* +0x1800 */ unsigned long LockCount; /* +0x1808 */ unsigned long SpareUlong0; /* +0x180c */ void *ResourceRetValue; /* +0x1810 */ void *ReservedForWdf; /* +0x1818 */ }; struct _LIST_ENTRY { unsigned char Flink[8]; /* +0x0000 bd 10 00 00 */ unsigned char Blink[8]; /* +0x0008 bd 10 00 00 */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[8]; /* +0x0000 cc 10 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[8]; /* +0x0000 d1 10 00 00 */ unsigned char LeftChild[8]; /* +0x0008 d1 10 00 00 */ unsigned char RightChild[8]; /* +0x0010 d1 10 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[8]; /* +0x0000 bd 10 00 00 */ unsigned char PrevLinkage[8]; /* +0x0008 bd 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[24]; /* +0x0000 db 10 00 00 */ unsigned char ChainHead[8]; /* +0x0018 bd 10 00 00 */ unsigned long BucketIndex; /* +0x0020 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[16]; /* +0x0000 82 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[8]; /* +0x0008 71 06 00 00 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0008 */ }; struct _RTL_BITMAP { unsigned long SizeOfBitMap; /* +0x0000 */ unsigned long *Buffer; /* +0x0008 */ }; struct _LARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct _IMAGE_NT_HEADERS64 { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 00 11 00 00 */ unsigned char OptionalHeader[240]; /* +0x0018 01 11 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c 06 11 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 07 11 00 00 */ long e_lfanew; /* +0x003c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 0f 11 00 00 */ unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ /* unsigned char Red[0]; +0x0010 10 11 00 00 */ /* unsigned char Balance[0]; +0x0010 36 10 00 00 */ unsigned long long ParentValue; /* +0x0010 */ }; struct _RTL_RB_TREE { unsigned char Root[8]; /* +0x0000 0e 11 00 00 */ unsigned char Min[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[8]; /* +0x0000 0e 11 00 00 */ }; enum tagAR_STATE { AR_ENABLED = 0, AR_DISABLED = 1, AR_SUPPRESSED = 2, AR_REMOTESESSION = 4, AR_MULTIMON = 8, AR_NOSENSOR = 16, AR_NOT_SUPPORTED = 32 }; struct _iobuf { char *_ptr; /* +0x0000 */ unsigned char _cnt[8]; /* +0x0008 74 00 00 00 */ char *_base; /* +0x0010 */ unsigned char _flag[4]; /* +0x0018 74 00 00 00 */ unsigned char _file[4]; /* +0x001c 74 00 00 00 */ unsigned char _charbuf[4]; /* +0x0020 74 00 00 00 */ unsigned char _bufsiz[4]; /* +0x0024 74 00 00 00 */ char *_tmpfname; /* +0x0028 */ }; struct localeinfo_struct { unsigned char locinfo[8]; /* +0x0000 6c 11 00 00 */ unsigned char mbcinfo[8]; /* +0x0008 6e 11 00 00 */ }; struct _IMAGE_THUNK_DATA64:: { unsigned long long ForwarderString; /* +0x0000 */ unsigned long long Function; /* +0x0000 */ unsigned long long Ordinal; /* +0x0000 */ unsigned long long AddressOfData; /* +0x0000 */ }; struct _EVENT_DATA_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _EVENT_DESCRIPTOR { unsigned short Id; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char Channel; /* +0x0003 */ unsigned char Level; /* +0x0004 */ unsigned char Opcode; /* +0x0005 */ unsigned short Task; /* +0x0006 */ unsigned long long Keyword; /* +0x0008 */ }; struct _MCGEN_TRACE_CONTEXT { unsigned long long RegistrationHandle; /* +0x0000 */ unsigned long long Logger; /* +0x0008 */ unsigned long long MatchAnyKeyword; /* +0x0010 */ unsigned long long MatchAllKeyword; /* +0x0018 */ unsigned long Flags; /* +0x0020 */ unsigned long IsEnabled; /* +0x0024 */ unsigned char Level; /* +0x0028 */ unsigned char Reserve; /* +0x0029 */ unsigned short EnableBitsCount; /* +0x002a */ unsigned long *EnableBitMask; /* +0x0030 */ unsigned char EnableKeyWords[8]; /* +0x0038 8c 11 00 00 */ unsigned char EnableLevel[8]; /* +0x0040 9b 11 00 00 */ }; enum WMIDPREQUESTCODE { WMI_GET_ALL_DATA = 0, WMI_GET_SINGLE_INSTANCE = 1, WMI_SET_SINGLE_INSTANCE = 2, WMI_SET_SINGLE_ITEM = 3, WMI_ENABLE_EVENTS = 4, WMI_DISABLE_EVENTS = 5, WMI_ENABLE_COLLECTION = 6, WMI_DISABLE_COLLECTION = 7, WMI_REGINFO = 8, WMI_EXECUTE_METHOD = 9, WMI_CAPTURE_STATE = 10 }; struct _EVENT_FILTER_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; struct _TRACE_GUID_REGISTRATION { unsigned char Guid[8]; /* +0x0000 19 10 00 00 */ void *RegHandle; /* +0x0008 */ }; struct HINSTANCE__ { unsigned char unused[4]; /* +0x0000 74 00 00 00 */ }; struct _OSVERSIONINFOW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 ca 11 00 00 */ }; struct _EVENT_TRACE_HEADER { unsigned short Size; /* +0x0000 */ unsigned short FieldTypeFlags; /* +0x0002 */ unsigned char HeaderType; /* +0x0002 */ unsigned char MarkerFlags; /* +0x0003 */ unsigned long Version; /* +0x0004 */ unsigned char Class[4]; /* +0x0004 e3 11 00 00 */ unsigned long ThreadId; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned char TimeStamp[8]; /* +0x0010 35 10 00 00 */ /* unsigned char Guid[0]; +0x0018 17 10 00 00 */ unsigned long long GuidPtr; /* +0x0018 */ unsigned long KernelTime; /* +0x0028 */ unsigned long UserTime; /* +0x002c */ unsigned long long ProcessorTime; /* +0x0028 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char Type; /* +0x0000 */ unsigned char Level; /* +0x0001 */ unsigned short Version; /* +0x0002 */ }; struct MofTemplate_jzccppppq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[144]; /* +0x0030 d9 11 00 00 */ }; struct MofTemplate_z::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[16]; /* +0x0030 ef 11 00 00 */ }; struct MofTemplate_zq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[32]; /* +0x0030 f4 11 00 00 */ }; struct MofTemplate_jzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[48]; /* +0x0030 f9 11 00 00 */ }; struct MofTemplate_jcccqqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[112]; /* +0x0030 02 12 00 00 */ }; struct MofTemplate_jzqzj::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[80]; /* +0x0030 0b 12 00 00 */ }; struct MofTemplate_jzzzzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[96]; /* +0x0030 10 12 00 00 */ }; struct MofTemplate_jzqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 e0 11 00 00 */ unsigned char EventData[64]; /* +0x0030 15 12 00 00 */ }; struct _ldiv_t { long quot; /* +0x0000 */ long rem; /* +0x0004 */ }; struct tagPROPVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 52 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 53 12 00 00 */ /* unsigned char puuid[0]; +0x0008 54 12 00 00 */ /* unsigned char pclipdata[0]; +0x0008 56 12 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 57 12 00 00 */ /* unsigned char blob[0]; +0x0008 58 12 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 5c 12 00 00 */ /* unsigned char pStream[0]; +0x0008 5e 12 00 00 */ /* unsigned char pStorage[0]; +0x0008 60 12 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 62 12 00 00 */ /* unsigned char parray[0]; +0x0008 64 12 00 00 */ /* unsigned char cac[0]; +0x0008 65 12 00 00 */ /* unsigned char caub[0]; +0x0008 66 12 00 00 */ /* unsigned char cai[0]; +0x0008 67 12 00 00 */ /* unsigned char caui[0]; +0x0008 68 12 00 00 */ /* unsigned char cal[0]; +0x0008 69 12 00 00 */ /* unsigned char caul[0]; +0x0008 6a 12 00 00 */ /* unsigned char cah[0]; +0x0008 6b 12 00 00 */ /* unsigned char cauh[0]; +0x0008 6c 12 00 00 */ /* unsigned char caflt[0]; +0x0008 6d 12 00 00 */ /* unsigned char cadbl[0]; +0x0008 6e 12 00 00 */ /* unsigned char cabool[0]; +0x0008 6f 12 00 00 */ /* unsigned char cascode[0]; +0x0008 70 12 00 00 */ /* unsigned char cacy[0]; +0x0008 71 12 00 00 */ /* unsigned char cadate[0]; +0x0008 72 12 00 00 */ /* unsigned char cafiletime[0]; +0x0008 73 12 00 00 */ /* unsigned char cauuid[0]; +0x0008 74 12 00 00 */ /* unsigned char caclipdata[0]; +0x0008 75 12 00 00 */ /* unsigned char cabstr[0]; +0x0008 76 12 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 77 12 00 00 */ /* unsigned char calpstr[0]; +0x0008 78 12 00 00 */ /* unsigned char calpwstr[0]; +0x0008 79 12 00 00 */ /* unsigned char capropvar[0]; +0x0008 7a 12 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 7c 12 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0008 80 12 00 00 */ /* unsigned char pvarVal[-8]; +0x0008 51 12 00 00 */ unsigned char decVal[24]; /* +0x0000 7b 12 00 00 */ }; struct tagVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 52 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 5c 12 00 00 */ /* unsigned char parray[0]; +0x0008 64 12 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0008 80 12 00 00 */ /* unsigned char pvarVal[0]; +0x0008 84 12 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 7c 12 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ void *pvRecord; /* +0x0008 */ /* unsigned char pRecInfo[-16]; +0x0010 88 12 00 00 */ unsigned char decVal[24]; /* +0x0000 7b 12 00 00 */ }; struct _devicemodeA { unsigned char dmDeviceName[32]; /* +0x0000 bb 12 00 00 */ unsigned short dmSpecVersion; /* +0x0020 */ unsigned short dmDriverVersion; /* +0x0022 */ unsigned short dmSize; /* +0x0024 */ unsigned short dmDriverExtra; /* +0x0026 */ unsigned long dmFields; /* +0x0028 */ short dmOrientation; /* +0x002c */ short dmPaperSize; /* +0x002e */ short dmPaperLength; /* +0x0030 */ short dmPaperWidth; /* +0x0032 */ short dmScale; /* +0x0034 */ short dmCopies; /* +0x0036 */ short dmDefaultSource; /* +0x0038 */ short dmPrintQuality; /* +0x003a */ unsigned char dmPosition[8]; /* +0x002c bc 12 00 00 */ unsigned long dmDisplayOrientation; /* +0x0034 */ unsigned long dmDisplayFixedOutput; /* +0x0038 */ short dmColor; /* +0x003c */ short dmDuplex; /* +0x003e */ short dmYResolution; /* +0x0040 */ short dmTTOption; /* +0x0042 */ short dmCollate; /* +0x0044 */ unsigned char dmFormName[32]; /* +0x0046 bb 12 00 00 */ unsigned short dmLogPixels; /* +0x0066 */ unsigned long dmBitsPerPel; /* +0x0068 */ unsigned long dmPelsWidth; /* +0x006c */ unsigned long dmPelsHeight; /* +0x0070 */ unsigned long dmDisplayFlags; /* +0x0074 */ unsigned long dmNup; /* +0x0074 */ unsigned long dmDisplayFrequency; /* +0x0078 */ unsigned long dmICMMethod; /* +0x007c */ unsigned long dmICMIntent; /* +0x0080 */ unsigned long dmMediaType; /* +0x0084 */ unsigned long dmDitherType; /* +0x0088 */ unsigned long dmReserved1; /* +0x008c */ unsigned long dmReserved2; /* +0x0090 */ unsigned long dmPanningWidth; /* +0x0094 */ unsigned long dmPanningHeight; /* +0x0098 */ }; struct _devicemodeW { unsigned char dmDeviceName[64]; /* +0x0000 c1 12 00 00 */ unsigned short dmSpecVersion; /* +0x0040 */ unsigned short dmDriverVersion; /* +0x0042 */ unsigned short dmSize; /* +0x0044 */ unsigned short dmDriverExtra; /* +0x0046 */ unsigned long dmFields; /* +0x0048 */ short dmOrientation; /* +0x004c */ short dmPaperSize; /* +0x004e */ short dmPaperLength; /* +0x0050 */ short dmPaperWidth; /* +0x0052 */ short dmScale; /* +0x0054 */ short dmCopies; /* +0x0056 */ short dmDefaultSource; /* +0x0058 */ short dmPrintQuality; /* +0x005a */ unsigned char dmPosition[8]; /* +0x004c bc 12 00 00 */ unsigned long dmDisplayOrientation; /* +0x0054 */ unsigned long dmDisplayFixedOutput; /* +0x0058 */ short dmColor; /* +0x005c */ short dmDuplex; /* +0x005e */ short dmYResolution; /* +0x0060 */ short dmTTOption; /* +0x0062 */ short dmCollate; /* +0x0064 */ unsigned char dmFormName[64]; /* +0x0066 c1 12 00 00 */ unsigned short dmLogPixels; /* +0x00a6 */ unsigned long dmBitsPerPel; /* +0x00a8 */ unsigned long dmPelsWidth; /* +0x00ac */ unsigned long dmPelsHeight; /* +0x00b0 */ unsigned long dmDisplayFlags; /* +0x00b4 */ unsigned long dmNup; /* +0x00b4 */ unsigned long dmDisplayFrequency; /* +0x00b8 */ unsigned long dmICMMethod; /* +0x00bc */ unsigned long dmICMIntent; /* +0x00c0 */ unsigned long dmMediaType; /* +0x00c4 */ unsigned long dmDitherType; /* +0x00c8 */ unsigned long dmReserved1; /* +0x00cc */ unsigned long dmReserved2; /* +0x00d0 */ unsigned long dmPanningWidth; /* +0x00d4 */ unsigned long dmPanningHeight; /* +0x00d8 */ }; struct tagTEXTMETRICA { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar; /* +0x002c */ unsigned char tmLastChar; /* +0x002d */ unsigned char tmDefaultChar; /* +0x002e */ unsigned char tmBreakChar; /* +0x002f */ unsigned char tmItalic; /* +0x0030 */ unsigned char tmUnderlined; /* +0x0031 */ unsigned char tmStruckOut; /* +0x0032 */ unsigned char tmPitchAndFamily; /* +0x0033 */ unsigned char tmCharSet; /* +0x0034 */ }; struct tagTEXTMETRICW { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar[2]; /* +0x002c 71 00 00 00 */ unsigned char tmLastChar[2]; /* +0x002e 71 00 00 00 */ unsigned char tmDefaultChar[2]; /* +0x0030 71 00 00 00 */ unsigned char tmBreakChar[2]; /* +0x0032 71 00 00 00 */ unsigned char tmItalic; /* +0x0034 */ unsigned char tmUnderlined; /* +0x0035 */ unsigned char tmStruckOut; /* +0x0036 */ unsigned char tmPitchAndFamily; /* +0x0037 */ unsigned char tmCharSet; /* +0x0038 */ }; struct _RTL_CRITICAL_SECTION { unsigned char DebugInfo[8]; /* +0x0000 2a 13 00 00 */ long LockCount; /* +0x0008 */ long RecursionCount; /* +0x000c */ void *OwningThread; /* +0x0010 */ void *LockSemaphore; /* +0x0018 */ unsigned long long SpinCount; /* +0x0020 */ }; struct ATL::_ATL_BASE_MODULE70 { unsigned char cbSize[8]; /* +0x0000 75 00 00 00 */ unsigned char m_hInst[8]; /* +0x0008 c3 11 00 00 */ unsigned char m_hInstResource[8]; /* +0x0010 c3 11 00 00 */ unsigned char m_bNT5orWin98[4]; /* +0x0018 30 00 00 00 */ unsigned long dwAtlBuildVer; /* +0x001c */ unsigned char pguidVer[8]; /* +0x0020 19 10 00 00 */ unsigned char m_csResource[40]; /* +0x0028 1e 13 00 00 */ unsigned char m_rgResourceInstance[16]; /* +0x0050 48 13 00 00 */ }; struct ATL::ATLSTRINGRESOURCEIMAGE { unsigned short nLength; /* +0x0000 */ /* unsigned char achString[0]; +0x0002 73 13 00 00 */ }; struct tagSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ void *pvData; /* +0x0010 */ unsigned char rgsabound[8]; /* +0x0018 88 13 00 00 */ }; struct _SYSTEMTIME { unsigned short wYear; /* +0x0000 */ unsigned short wMonth; /* +0x0002 */ unsigned short wDayOfWeek; /* +0x0004 */ unsigned short wDay; /* +0x0006 */ unsigned short wHour; /* +0x0008 */ unsigned short wMinute; /* +0x000a */ unsigned short wSecond; /* +0x000c */ unsigned short wMilliseconds; /* +0x000e */ }; struct tagEXCEPINFO { unsigned short wCode; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned char bstrSource[8]; /* +0x0008 71 06 00 00 */ unsigned char bstrDescription[8]; /* +0x0010 71 06 00 00 */ unsigned char bstrHelpFile[8]; /* +0x0018 71 06 00 00 */ unsigned long dwHelpContext; /* +0x0020 */ void *pvReserved; /* +0x0028 */ unsigned char pfnDeferredFillIn[8]; /* +0x0030 2c 14 00 00 */ long scode; /* +0x0038 */ }; struct tagDISPPARAMS { unsigned char rgvarg[8]; /* +0x0000 84 12 00 00 */ long *rgdispidNamedArgs; /* +0x0008 */ unsigned char cArgs[4]; /* +0x0010 75 00 00 00 */ unsigned char cNamedArgs[4]; /* +0x0014 75 00 00 00 */ }; struct ATL::CComBSTR { unsigned char m_str[8]; /* +0x0000 71 06 00 00 */ }; struct tagCY { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ long long int64; /* +0x0000 */ }; enum FILEITEM_CREATION_FLAGS { FICF_DEFAULT = 0, FICF_DELETE_NOT_ALLOWED_IF_CONTAINER = 1, FICF_ALLOW_NAMESPACE_JUNCTION = 2, FICF_ADVANCED_SHAPES_ALLOWED = 4, FICF_FILTER_ON_MANIFESTED_TYPES = 8, FICF_FILTER_ON_MANIFESTED_KINDS = 16, FICF_INHERITED_FLAGS_MASK = 28, FICF_DONT_CHECK_PATH_FOR_EXISTENCE = 32 }; struct ATL::_ATL_OBJMAP_ENTRY30 { unsigned char pclsid[8]; /* +0x0000 19 10 00 00 */ unsigned char pfnUpdateRegistry[8]; /* +0x0008 29 16 00 00 */ unsigned char pfnGetClassObject[8]; /* +0x0010 2c 16 00 00 */ unsigned char pfnCreateInstance[8]; /* +0x0018 2c 16 00 00 */ unsigned char pCF[8]; /* +0x0020 5a 12 00 00 */ unsigned long dwRegister; /* +0x0028 */ unsigned char pfnGetObjectDescription[8]; /* +0x0030 2e 16 00 00 */ unsigned char pfnGetCategoryMap[16]; /* +0x0038 33 16 00 00 */ }; struct ATL::_ATL_COM_MODULE70 { unsigned char cbSize[8]; /* +0x0000 75 00 00 00 */ unsigned char m_hInstTypeLib[8]; /* +0x0008 c3 11 00 00 */ unsigned char m_ppAutoObjMapFirst[8]; /* +0x0010 6a 16 00 00 */ unsigned char m_ppAutoObjMapLast[8]; /* +0x0018 6a 16 00 00 */ unsigned char m_csObjMap[40]; /* +0x0020 1e 13 00 00 */ }; struct ATL::_ATL_WIN_MODULE70 { unsigned char cbSize[8]; /* +0x0000 75 00 00 00 */ unsigned char m_csWindowCreate[40]; /* +0x0008 1e 13 00 00 */ unsigned char m_pCreateWndList[8]; /* +0x0030 89 16 00 00 */ unsigned char m_rgWindowClassAtoms[16]; /* +0x0038 8a 16 00 00 */ }; struct ATL::_AtlCreateWndData { void *m_pThis; /* +0x0000 */ unsigned long m_dwThreadID; /* +0x0008 */ unsigned char m_pNext[8]; /* +0x0010 89 16 00 00 */ }; struct ATL::_ATL_MODULE70 { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ long m_nLockCnt; /* +0x0004 */ unsigned char m_pTermFuncs[8]; /* +0x0008 d4 16 00 00 */ unsigned char m_csStaticDataInitAndTypeInfo[40]; /* +0x0010 1e 13 00 00 */ }; struct ATL::_ATL_TERMFUNC_ELEM { unsigned char pFunc[8]; /* +0x0000 e8 16 00 00 */ unsigned long long dw; /* +0x0008 */ unsigned char pNext[8]; /* +0x0010 d4 16 00 00 */ }; struct ATL::_ATL_REGMAP_ENTRY { unsigned char szKey[8]; /* +0x0000 14 10 00 00 */ unsigned char szData[8]; /* +0x0008 14 10 00 00 */ }; struct _SECURITY_ATTRIBUTES { unsigned long nLength; /* +0x0000 */ void *lpSecurityDescriptor; /* +0x0008 */ unsigned char bInheritHandle[8]; /* +0x0010 74 00 00 00 */ }; struct tagMSG { unsigned char hwnd[8]; /* +0x0000 95 17 00 00 */ unsigned char message[8]; /* +0x0008 75 00 00 00 */ unsigned long long wParam; /* +0x0010 */ long long lParam; /* +0x0018 */ unsigned long time; /* +0x0020 */ unsigned char pt[12]; /* +0x0024 99 17 00 00 */ }; struct ATL::_AtlAptCreateObjData { unsigned char pfnCreateInstance[8]; /* +0x0000 2c 16 00 00 */ unsigned char piid[8]; /* +0x0008 19 10 00 00 */ void *hEvent; /* +0x0010 */ unsigned char pStream[8]; /* +0x0018 5e 12 00 00 */ unsigned char hRes[8]; /* +0x0020 08 00 00 00 */ }; struct _FILETIME { unsigned long dwLowDateTime; /* +0x0000 */ unsigned long dwHighDateTime; /* +0x0004 */ }; struct ATL::CSimpleMap { unsigned char m_aKey[8]; /* +0x0000 e9 10 00 00 */ unsigned char m_aVal[8]; /* +0x0008 e9 10 00 00 */ unsigned char m_nSize[8]; /* +0x0010 74 00 00 00 */ }; struct ATL::CRegParser::CParseBuffer { unsigned char nPos[4]; /* +0x0000 74 00 00 00 */ unsigned char nSize[4]; /* +0x0004 74 00 00 00 */ unsigned char p[8]; /* +0x0008 71 06 00 00 */ }; struct _OVERLAPPED { unsigned long long Internal; /* +0x0000 */ unsigned long long InternalHigh; /* +0x0008 */ unsigned long Offset; /* +0x0010 */ unsigned long OffsetHigh; /* +0x0014 */ void *Pointer; /* +0x0010 */ void *hEvent; /* +0x0018 */ }; struct ATL::CRegParser::VTFromRegType::__l2::typemap { unsigned char lpsz[8]; /* +0x0000 14 10 00 00 */ unsigned short vt; /* +0x0008 */ }; struct ATL::CRegParser::HKeyFromString::__l2::keymap { unsigned char lpsz[8]; /* +0x0000 14 10 00 00 */ unsigned char hkey[8]; /* +0x0008 b4 17 00 00 */ }; enum tagTYPEKIND { TKIND_ENUM = 0, TKIND_RECORD = 1, TKIND_MODULE = 2, TKIND_INTERFACE = 3, TKIND_DISPATCH = 4, TKIND_COCLASS = 5, TKIND_ALIAS = 6, TKIND_UNION = 7, TKIND_MAX = 8 }; enum tagSYSKIND { SYS_WIN16 = 0, SYS_WIN32 = 1, SYS_MAC = 2, SYS_WIN64 = 3 }; struct tagTLIBATTR { unsigned char guid[16]; /* +0x0000 17 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char syskind[4]; /* +0x0014 a9 19 00 00 */ unsigned short wMajorVerNum; /* +0x0018 */ unsigned short wMinorVerNum; /* +0x001a */ unsigned short wLibFlags; /* +0x001c */ }; struct ATL::_ATL_CATMAP_ENTRY { unsigned char iType[8]; /* +0x0000 74 00 00 00 */ unsigned char pcatid[8]; /* +0x0008 19 10 00 00 */ }; struct _DLLVERSIONINFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformID; /* +0x0010 */ }; struct ATL::_ATL_INTMAP_ENTRY { unsigned char piid[8]; /* +0x0000 19 10 00 00 */ unsigned long long dw; /* +0x0008 */ unsigned char pFunc[8]; /* +0x0010 06 1b 00 00 */ }; enum WudfProblem { WudfProblem_None = 0, WudfProblem_Cancelled = 1, WudfProblem_SendFailure = 2, WudfProblem_Timeout = 3, WudfProblem_InvalidRequest = 4, WudfProblem_InvalidReply = 5, WudfProblem_FailedCriticalOperation = 6, WudfProblem_FailedToExit = 7, WudfProblem_Disconnect = 8, WudfProblem_LeakingHandle = 9, WudfProblem_InvalidInterruptState = 10, WudfProblem_IsrTimedOut = 11, WudfProblem_Max = 12 }; enum WdfComponentType { WdfComponentInvalid = 0, WdfComponentPlatform = 1, WdfComponentReflector = 2, WdfComponentDriverManager = 3, WdfComponentHost = 4, WdfComponentFramework = 5, WdfComponentTest = 6, WdfComponentMax = 7 }; enum _WDF_HOST_EXIT_CODE { WdfHostExit_StillActive = 259, /* WdfHostExit_CodeUnknown = Unavail */ }; enum WudfOperationType { WudfOperation_Invalid = 0, WudfOperation_Init = 1, WudfOperation_HostShutdown = 2, WudfOperation_Pnp = 3, WudfOperation_Cleanup = 4, WudfOperation_Close = 5, WudfOperation_Cancel = 6, WudfOperation_IO = 7, WudfOperation_Interrupt = 8, WudfOperation_Other = 9, WudfOperation_Max = 10 }; enum WdfDeviceStartStateType { WudfDeviceStartState_Unknown = 0, WudfDeviceStartState_NotStarted = 1, WudfDeviceStartState_Started = 2, WudfDeviceStartState_Removed = 3 }; struct WUDF_PROBLEM { unsigned char ProblemCode[4]; /* +0x0000 2a 1b 00 00 */ unsigned char Detector[4]; /* +0x0004 2c 1b 00 00 */ unsigned char ExitCode[4]; /* +0x0008 2e 1b 00 00 */ unsigned char Operation[4]; /* +0x000c 30 1b 00 00 */ unsigned long Message; /* +0x0010 */ unsigned long Status; /* +0x0014 */ unsigned char DeviceStarted[4]; /* +0x0018 32 1b 00 00 */ }; struct CWdfObjectTracker { unsigned char m_cs[40]; /* +0x0000 23 13 00 00 */ unsigned char m_bInitialized; /* +0x0028 */ unsigned char m_ObjectList[16]; /* +0x0030 82 10 00 00 */ }; struct CObjectTrackingManager { unsigned char m_ObjectTrackingSettings[16]; /* +0x0000 84 1b 00 00 */ unsigned char m_pObjectTracker[8]; /* +0x0010 72 1b 00 00 */ unsigned char m_pStackTracker[8]; /* +0x0018 86 1b 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0003 { unsigned char bTrackObjects[4]; /* +0x0000 74 00 00 00 */ unsigned char bTrackRefCounts[4]; /* +0x0004 74 00 00 00 */ unsigned long nMaxRefCountChangesToTrack; /* +0x0008 */ unsigned long nMaxStackDepthToTrack; /* +0x000c */ }; struct _WDF_REFCOUNT_TRACKING_DATA { long RefCount; /* +0x0000 */ unsigned char RefCountHistory[8]; /* +0x0008 a3 1b 00 00 */ unsigned char nValidFrames[8]; /* +0x0010 75 00 00 00 */ }; enum WdfDriverStopType { WdfInternalError = 0, WdfDriverError = 1, WdfCallerError = 2, WdfExternalError = 3, WdfUnhandledExceptionError = 4, WdfDriverStopTypeMax = 5 }; enum WdfErrorClass { WdfErrorClass_Undefined = 0, WdfErrorClass_BadArgument = 1, WdfErrorClass_BadState = 2, WdfErrorClass_BadResponse = 3, WdfErrorClass_BadAction = 4, WdfErrorClass_LostReference = 5, WdfErrorClass_GlobalMax = 6, WdfErrorClass_PlatformStart = 6, WdfErrorClass_PlatformMax = 7, WdfErrorClass_RdStart = 6, WdfErrorClass_RdMax = 7, WdfErrorClass_DmStart = 6, WdfErrorClass_DmMax = 7, WdfErrorClass_HostStart = 6, WdfErrorClass_HostMax = 7, WdfErrorClass_FxStart = 6, WdfErrorClass_FxMax = 7, WdfErrorClass_TestStart = 6, WdfErrorClass_TestMax = 7 }; enum _EVENT_TYPE { NotificationEvent = 0, SynchronizationEvent = 1 }; enum WdfPoolType { WdfNonPagedPool = 0, WdfPagedPool = 1, WdfPoolChargeQuota = 128 }; enum WDF_REGISTRY_READ_RESULT { ValuePresent = 0, ValueNotPresent = 1, ValueInvalid = 2 }; enum WDF_MODULE_INFO_CHANGE_TYPE { ModuleLoaded = 0, ModuleUnloaded = 1 }; enum WudfBreakPointType { WudfPlatformUserBreakin = 1, WudfPlatformKernelBreakin = 2, WudfPlatformUserOrKernelBreakin = 3 }; enum WudfDebuggerType { WudfPlatformUserDebugger = 0, WudfPlatformUserOrKernelDebugger = 1 }; struct _tagSTACKFRAME64 { unsigned char AddrPC[16]; /* +0x0000 6e 1c 00 00 */ unsigned char AddrReturn[16]; /* +0x0010 6e 1c 00 00 */ unsigned char AddrFrame[16]; /* +0x0020 6e 1c 00 00 */ unsigned char AddrStack[16]; /* +0x0030 6e 1c 00 00 */ unsigned char AddrBStore[16]; /* +0x0040 6e 1c 00 00 */ void *FuncTableEntry; /* +0x0050 */ unsigned char Params[32]; /* +0x0058 6f 1c 00 00 */ unsigned char Far[4]; /* +0x0078 74 00 00 00 */ unsigned char Virtual[4]; /* +0x007c 74 00 00 00 */ unsigned char Reserved[24]; /* +0x0080 44 10 00 00 */ unsigned char KdHelp[112]; /* +0x0098 70 1c 00 00 */ }; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified = 0, PowerDeviceD0 = 1, PowerDeviceD1 = 2, PowerDeviceD2 = 3, PowerDeviceD3 = 4, PowerDeviceMaximum = 5 }; enum _DEVICE_WAKE_DEPTH { DeviceWakeDepthNotWakeable = 0, DeviceWakeDepthD0 = 1, DeviceWakeDepthD1 = 2, DeviceWakeDepthD2 = 3, DeviceWakeDepthD3hot = 4, DeviceWakeDepthD3cold = 5, DeviceWakeDepthMaximum = 6 }; struct _WORK_QUEUE_ITEM { unsigned char List[16]; /* +0x0000 82 10 00 00 */ unsigned char WorkerRoutine[8]; /* +0x0010 1d 16 00 00 */ void *Parameter; /* +0x0018 */ }; enum _POWER_STATE_TYPE { SystemPowerState = 0, DevicePowerState = 1 }; enum _DEVICE_RELATION_TYPE { BusRelations = 0, EjectionRelations = 1, PowerRelations = 2, RemovalRelations = 3, TargetDeviceRelation = 4, SingleBusRelations = 5, TransportRelations = 6 }; struct MxDeviceObject { unsigned char m_DeviceObject[8]; /* +0x0000 bc 1c 00 00 */ }; struct _OBJECT_ATTRIBUTES { unsigned long Length; /* +0x0000 */ void *RootDirectory; /* +0x0008 */ unsigned char ObjectName[8]; /* +0x0010 e6 10 00 00 */ unsigned long Attributes; /* +0x0018 */ void *SecurityDescriptor; /* +0x0020 */ void *SecurityQualityOfService; /* +0x0028 */ }; struct MxLockNoDynam { unsigned char m_Lock[48]; /* +0x0000 e0 1c 00 00 */ }; struct MdLock { unsigned char Lock[40]; /* +0x0000 23 13 00 00 */ unsigned char Initialized[4]; /* +0x0028 30 00 00 00 */ unsigned long OwnerThreadId; /* +0x002c */ }; struct MxPagedLockNoDynam { unsigned char m_Lock[48]; /* +0x0000 fe 1c 00 00 */ }; enum _KWAIT_REASON { Executive = 0, FreePage = 1, PageIn = 2, PoolAllocation = 3, DelayExecution = 4, Suspended = 5, UserRequest = 6, WrExecutive = 7, WrFreePage = 8, WrPageIn = 9, WrPoolAllocation = 10, WrDelayExecution = 11, WrSuspended = 12, WrUserRequest = 13, WrEventPair = 14, WrQueue = 15, WrLpcReceive = 16, WrLpcReply = 17, WrVirtualMemory = 18, WrPageOut = 19, WrRendezvous = 20, Spare2 = 21, Spare3 = 22, Spare4 = 23, Spare5 = 24, WrCalloutStack = 25, WrKernel = 26, WrResource = 27, WrPushLock = 28, WrMutex = 29, WrQuantumEnd = 30, WrDispatchInt = 31, WrPreempted = 32, WrYieldExecution = 33, WrFastMutex = 34, WrGuardedMutex = 35, WrRundown = 36, MaximumWaitReason = 37 }; struct MxEvent { unsigned char m_Event[8]; /* +0x0000 0f 1d 00 00 */ }; struct MdEvent { void *Event; /* +0x0000 */ }; enum _POOL_TYPE { NonPagedPool = 0, PagedPool = 1, NonPagedPoolMustSucceed = 2, DontUseThisType = 3, NonPagedPoolCacheAligned = 4, PagedPoolCacheAligned = 5, NonPagedPoolCacheAlignedMustS = 6, MaxPoolType = 7, NonPagedPoolSession = 32, PagedPoolSession = 33, NonPagedPoolMustSucceedSession = 34, DontUseThisTypeSession = 35, NonPagedPoolCacheAlignedSession = 36, PagedPoolCacheAlignedSession = 37, NonPagedPoolCacheAlignedMustSSession = 38, NonPagedPoolNx = 512, NonPagedPoolNxCacheAligned = 516 }; struct _MdTimerWin5 { unsigned char m_TimerCallback[8]; /* +0x0000 33 1d 00 00 */ void *m_TimerContext; /* +0x0008 */ long m_Period; /* +0x0010 */ unsigned char m_Lock[40]; /* +0x0018 23 13 00 00 */ unsigned char m_LockInitialized[8]; /* +0x0040 74 00 00 00 */ void *m_TimerHandle; /* +0x0048 */ void *m_WaitHandle; /* +0x0050 */ unsigned char m_CallbackStartedRunning[8]; /* +0x0058 74 00 00 00 */ }; struct _MdTimerWin6Plus { unsigned char m_TimerCallback[8]; /* +0x0000 33 1d 00 00 */ void *m_TimerContext; /* +0x0008 */ long m_Period; /* +0x0010 */ unsigned char m_TP[64]; /* +0x0018 53 1d 00 00 */ unsigned char m_TimerHandle[8]; /* +0x0058 55 1d 00 00 */ unsigned char m_WorkObject[8]; /* +0x0060 57 1d 00 00 */ unsigned char m_CallbackStartedRunning[8]; /* +0x0068 74 00 00 00 */ }; struct _MXTIMER_THREADPOOL_FUNC { unsigned char hKernel32[8]; /* +0x0000 c3 11 00 00 */ unsigned char pfnCreateTpTimer[8]; /* +0x0008 6d 1d 00 00 */ unsigned char pfnSetTpTimer[8]; /* +0x0010 70 1d 00 00 */ unsigned char pfnWaitForTpTimerCallbacks[8]; /* +0x0018 73 1d 00 00 */ unsigned char pfnCreateTpWork[8]; /* +0x0020 78 1d 00 00 */ unsigned char pfnSubmitTpWork[8]; /* +0x0028 7b 1d 00 00 */ unsigned char pfnCloseTpTimer[8]; /* +0x0030 7e 1d 00 00 */ unsigned char pfnCloseTpWork[8]; /* +0x0038 7b 1d 00 00 */ }; struct _MdTimer { unsigned char m_RunningOnWin6Plus[8]; /* +0x0000 74 00 00 00 */ unsigned char m_Win5Timer[96]; /* +0x0008 2f 1d 00 00 */ unsigned char m_Win6PlusTimer[112]; /* +0x0068 51 1d 00 00 */ }; struct MxTimer { unsigned char m_Timer[216]; /* +0x0000 8c 1d 00 00 */ }; struct MxWorkItem { unsigned char m_WorkItem[8]; /* +0x0000 a9 1d 00 00 */ }; struct UmWorkItem { unsigned char DeviceObject[8]; /* +0x0000 bc 1c 00 00 */ unsigned char WaitBlock[8]; /* +0x0008 ac 1d 00 00 */ void *WorkItemEvent; /* +0x0010 */ unsigned char Callback[8]; /* +0x0018 b3 1d 00 00 */ void *Context; /* +0x0020 */ }; struct WUDF_EVENT { void *Value; /* +0x0000 */ }; enum _KINTERRUPT_MODE { LevelSensitive = 0, Latched = 1 }; enum _WDF_INTERRUPT_POLARITY { WdfInterruptPolarityUnknown = 0, WdfInterruptActiveHigh = 1, WdfInterruptActiveLow = 2 }; struct _WDF_INTERRUPT_INFO { unsigned long Size; /* +0x0000 */ unsigned long long Reserved1; /* +0x0008 */ unsigned long long TargetProcessorSet; /* +0x0010 */ unsigned long Reserved2; /* +0x0018 */ unsigned long MessageNumber; /* +0x001c */ unsigned long Vector; /* +0x0020 */ unsigned char Irql; /* +0x0024 */ unsigned char Mode[4]; /* +0x0028 ef 1d 00 00 */ unsigned char Polarity[4]; /* +0x002c f1 1d 00 00 */ unsigned char MessageSignaled; /* +0x0030 */ unsigned char ShareDisposition; /* +0x0031 */ unsigned short Group; /* +0x0038 */ }; enum _WDF_INTERRUPT_POLICY { WdfIrqPolicyMachineDefault = 0, WdfIrqPolicyAllCloseProcessors = 1, WdfIrqPolicyOneCloseProcessor = 2, WdfIrqPolicyAllProcessorsInMachine = 3, WdfIrqPolicySpecifiedProcessors = 4, WdfIrqPolicySpreadMessagesAcrossAllProcessors = 5 }; enum _WDF_INTERRUPT_PRIORITY { WdfIrqPriorityUndefined = 0, WdfIrqPriorityLow = 1, WdfIrqPriorityNormal = 2, WdfIrqPriorityHigh = 3 }; struct _WDF_INTERRUPT_EXTENDED_POLICY { unsigned long Size; /* +0x0000 */ unsigned char Policy[4]; /* +0x0004 f7 1d 00 00 */ unsigned char Priority[8]; /* +0x0008 f9 1d 00 00 */ unsigned char TargetProcessorSetAndGroup[16]; /* +0x0010 fa 1d 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE { unsigned char Header[4]; /* +0x0000 01 1e 00 00 */ unsigned long AttachDeviceNameOffset; /* +0x0004 */ unsigned char InternalReferenceStringValid[4]; /* +0x0008 3a 10 00 00 */ unsigned char InternalReferenceStringOffset[8]; /* +0x000c 2c 10 00 00 */ unsigned long PdoNameOffset; /* +0x0014 */ void *DeviceObjectPointer; /* +0x0018 */ }; enum _WUDF_CONTROL_OBJ_REF_STRING { WudfRefStringMin = 0, WudfRefStringElevations = 0, WudfRefStringNullFile = 1, WudfRefStringMax = 2, WudfRefStringUnknown = 2 }; struct _WUDFMESSAGE_CREATE { /* unsigned char Header[0]; +0x0000 01 1e 00 00 */ unsigned char IoHeader[32]; /* +0x0000 0b 1e 00 00 */ unsigned char DevnodeContext[8]; /* +0x0020 04 1e 00 00 */ unsigned long long FileNameByteLength; /* +0x0028 */ unsigned long Options; /* +0x0030 */ unsigned short FileAttributes; /* +0x0034 */ unsigned short ShareAccess; /* +0x0036 */ unsigned long DesiredAccess; /* +0x0038 */ unsigned char RelatedCreateContext[8]; /* +0x0040 0d 1e 00 00 */ unsigned long InitiatorProcessId; /* +0x0048 */ }; struct _WUDFMESSAGE_REPLY_HEADER { long NtStatus; /* +0x0000 */ }; struct _WUDFMESSAGE_IO_REPLY { unsigned char Header[8]; /* +0x0000 11 1e 00 00 */ unsigned long long Information; /* +0x0008 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 11 1e 00 00 */ unsigned long ProcessTimeout; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_OPEN_PROCESS_REPLY { unsigned char Header[8]; /* +0x0000 11 1e 00 00 */ void *ProcessHandle; /* +0x0008 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL { unsigned char Header[4]; /* +0x0000 01 1e 00 00 */ unsigned char InterfaceGuid[20]; /* +0x0004 17 10 00 00 */ unsigned char DevnodeContext[8]; /* +0x0018 04 1e 00 00 */ unsigned char DeviceContext[8]; /* +0x0020 28 1e 00 00 */ }; struct _WUDFMESSAGE_TARGET_DEVICE_NOTIFICATION { unsigned char Header[4]; /* +0x0000 01 1e 00 00 */ unsigned char Event[20]; /* +0x0004 17 10 00 00 */ unsigned char DevnodeContext[8]; /* +0x0018 04 1e 00 00 */ unsigned long long TargetContext; /* +0x0020 */ unsigned long CustomBufferSize; /* +0x0028 */ unsigned long NameBufferOffset; /* +0x002c */ }; struct _WUDFMESSAGE_TRANSPORT_QUERY_ID { unsigned char Header[8]; /* +0x0000 01 1e 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 04 1e 00 00 */ unsigned long Id; /* +0x0010 */ unsigned long BufferSize; /* +0x0014 */ }; struct _ALPC_MESSAGE_ATTRIBUTES { unsigned long AllocatedAttributes; /* +0x0000 */ unsigned long ValidAttributes; /* +0x0004 */ }; struct WdfCtorStatus { long m_ConstructorStatus; /* +0x0000 */ }; enum WELL_KNOWN_SID_TYPE { WinNullSid = 0, WinWorldSid = 1, WinLocalSid = 2, WinCreatorOwnerSid = 3, WinCreatorGroupSid = 4, WinCreatorOwnerServerSid = 5, WinCreatorGroupServerSid = 6, WinNtAuthoritySid = 7, WinDialupSid = 8, WinNetworkSid = 9, WinBatchSid = 10, WinInteractiveSid = 11, WinServiceSid = 12, WinAnonymousSid = 13, WinProxySid = 14, WinEnterpriseControllersSid = 15, WinSelfSid = 16, WinAuthenticatedUserSid = 17, WinRestrictedCodeSid = 18, WinTerminalServerSid = 19, WinRemoteLogonIdSid = 20, WinLogonIdsSid = 21, WinLocalSystemSid = 22, WinLocalServiceSid = 23, WinNetworkServiceSid = 24, WinBuiltinDomainSid = 25, WinBuiltinAdministratorsSid = 26, WinBuiltinUsersSid = 27, WinBuiltinGuestsSid = 28, WinBuiltinPowerUsersSid = 29, WinBuiltinAccountOperatorsSid = 30, WinBuiltinSystemOperatorsSid = 31, WinBuiltinPrintOperatorsSid = 32, WinBuiltinBackupOperatorsSid = 33, WinBuiltinReplicatorSid = 34, WinBuiltinPreWindows2000CompatibleAccessSid = 35, WinBuiltinRemoteDesktopUsersSid = 36, WinBuiltinNetworkConfigurationOperatorsSid = 37, WinAccountAdministratorSid = 38, WinAccountGuestSid = 39, WinAccountKrbtgtSid = 40, WinAccountDomainAdminsSid = 41, WinAccountDomainUsersSid = 42, WinAccountDomainGuestsSid = 43, WinAccountComputersSid = 44, WinAccountControllersSid = 45, WinAccountCertAdminsSid = 46, WinAccountSchemaAdminsSid = 47, WinAccountEnterpriseAdminsSid = 48, WinAccountPolicyAdminsSid = 49, WinAccountRasAndIasServersSid = 50, WinNTLMAuthenticationSid = 51, WinDigestAuthenticationSid = 52, WinSChannelAuthenticationSid = 53, WinThisOrganizationSid = 54, WinOtherOrganizationSid = 55, WinBuiltinIncomingForestTrustBuildersSid = 56, WinBuiltinPerfMonitoringUsersSid = 57, WinBuiltinPerfLoggingUsersSid = 58, WinBuiltinAuthorizationAccessSid = 59, WinBuiltinTerminalServerLicenseServersSid = 60, WinBuiltinDCOMUsersSid = 61, WinBuiltinIUsersSid = 62, WinIUserSid = 63, WinBuiltinCryptoOperatorsSid = 64, WinUntrustedLabelSid = 65, WinLowLabelSid = 66, WinMediumLabelSid = 67, WinHighLabelSid = 68, WinSystemLabelSid = 69, WinWriteRestrictedCodeSid = 70, WinCreatorOwnerRightsSid = 71, WinCacheablePrincipalsGroupSid = 72, WinNonCacheablePrincipalsGroupSid = 73, WinEnterpriseReadonlyControllersSid = 74, WinAccountReadonlyControllersSid = 75, WinBuiltinEventLogReadersGroup = 76, WinNewEnterpriseReadonlyControllersSid = 77, WinBuiltinCertSvcDComAccessGroup = 78, WinMediumPlusLabelSid = 79, WinLocalLogonSid = 80, WinConsoleLogonSid = 81, WinThisOrganizationCertificateSid = 82, WinApplicationPackageAuthoritySid = 83, WinBuiltinAnyPackageSid = 84, WinCapabilityInternetClientSid = 85, WinCapabilityInternetClientServerSid = 86, WinCapabilityPrivateNetworkClientServerSid = 87, WinCapabilityPicturesLibrarySid = 88, WinCapabilityVideosLibrarySid = 89, WinCapabilityMusicLibrarySid = 90, WinCapabilityDocumentsLibrarySid = 91, WinCapabilitySharedUserCertificatesSid = 92, WinCapabilityDefaultWindowsCredentialsSid = 93, WinCapabilityRemovableStorageSid = 94, WinBuiltinRDSRemoteAccessServersSid = 95, WinBuiltinRDSEndpointServersSid = 96, WinBuiltinRDSManagementServersSid = 97, WinUserModeDriversSid = 98, WinBuiltinHyperVAdminsSid = 99 }; struct _WUDF_WORKITEM_CONFIG { unsigned long Size; /* +0x0000 */ unsigned char OnWorkItemFunc[8]; /* +0x0008 f2 1e 00 00 */ unsigned char AutomaticSerialization; /* +0x0010 */ }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 }; enum POWER_ACTION { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7 }; enum DEVICE_TEXT_TYPE { DeviceTextDescription = 0, DeviceTextLocationInformation = 1 }; enum BUS_QUERY_ID_TYPE { BusQueryDeviceID = 0, BusQueryHardwareIDs = 1, BusQueryCompatibleIDs = 2, BusQueryInstanceID = 3, BusQueryDeviceSerialNumber = 4, BusQueryContainerID = 5 }; enum _DEVICE_USAGE_NOTIFICATION_TYPE { DeviceUsageTypeUndefined = 0, DeviceUsageTypePaging = 1, DeviceUsageTypeHibernation = 2, DeviceUsageTypeDumpFile = 3, DeviceUsageTypeBoot = 4 }; struct FxIrp { unsigned char m_Irp[8]; /* +0x0000 f9 1e 00 00 */ }; struct WudfDriverAndFxInfo { unsigned char pFxModInfo[8]; /* +0x0000 60 1f 00 00 */ unsigned char pDriverModInfo[8]; /* +0x0008 60 1f 00 00 */ unsigned char pFxDevice[8]; /* +0x0010 62 1f 00 00 */ unsigned char DriverCreatedFileList[16]; /* +0x0018 82 10 00 00 */ unsigned char pIUMDFx[8]; /* +0x0028 64 1f 00 00 */ void *pContext; /* +0x0030 */ unsigned char isInitialized[8]; /* +0x0038 74 00 00 00 */ }; enum _WDF_DEVICE_IO_BUFFER_RETRIEVAL { WdfDeviceIoBufferRetrievalInvalid = 0, WdfDeviceIoBufferRetrievalCopyImmediately = 1, WdfDeviceIoBufferRetrievalDeferred = 2, WdfDeviceIoBufferRetrievalMaximum = 3 }; enum _WDF_DEVICE_IO_TYPE { WdfDeviceIoUndefined = 0, WdfDeviceIoNeither = 1, WdfDeviceIoBuffered = 2, WdfDeviceIoDirect = 3, WdfDeviceIoBufferedOrDirect = 4, WdfDeviceIoMaximum = 5 }; enum RdWmiPowerAction { ActionInvalid = 0, SetS0IdleEnable = 1, SetS0IdleDisable = 2, SetSxWakeEnable = 3, SetSxWakeDisable = 4, QueryS0Idle = 5, QuerySxWake = 6 }; struct WudfTargetDeviceRegistration { unsigned char Entry[16]; /* +0x0000 82 10 00 00 */ unsigned char pCallback[8]; /* +0x0010 ac 1f 00 00 */ unsigned long long RegistrationID; /* +0x0018 */ }; enum _WDF_EVENT_TYPE { WdfEventReserved = 0, WdfEventBroadcast = 1, WdfEventMaximum = 2 }; enum _WUDF_DISPATCHER_TYPE { WUDF_DISPATCHER_DEFAULT = 0, WUDF_DISPATCHER_FILE_HANDLE = 1, WUDF_DISPATCHER_WINUSB = 2 }; enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS { WdfPropertyStoreNormal = 0, WdfPropertyStoreCreateIfMissing = 1, WdfPropertyStoreCreateVolatile = 2, WdfPropertyStoreRetrieveFlagsMask = 3 }; enum _WDF_PROPERTY_STORE_DISPOSITION { CreatedNewStore = 1, OpenedExistingStore = 2 }; enum WmiIdleWakeInstanceUpdate { IdleWakeInstanceUpdateInvalid = 0, AddS0IdleInstance = 1, RemoveS0IdleInstance = 2, AddSxWakeInstance = 3, RemoveSxWakeInstance = 4, IdleWakeInstanceUpdateMax = 5 }; enum _MEMORY_CACHING_TYPE { MmNonCached = 0, MmCached = 1, MmWriteCombined = 2, MmHardwareCoherentCached = 3, MmNonCachedUnordered = 4, MmUSWCCached = 5, MmMaximumCacheType = 6 }; enum _WDF_DEVICE_HWACCESS_TARGET_TYPE { WdfDeviceHwAccessTargetTypeInvalid = 0, WdfDeviceHwAccessTargetTypeRegister = 1, WdfDeviceHwAccessTargetTypeRegisterBuffer = 2, WdfDeviceHwAccessTargetTypePort = 3, WdfDeviceHwAccessTargetTypePortBuffer = 4, WdfDeviceHwAccessTargetTypeMaximum = 5 }; enum _WDF_DEVICE_HWACCESS_TARGET_SIZE { WdfDeviceHwAccessTargetSizeInvalid = 0, WdfDeviceHwAccessTargetSizeUchar = 1, WdfDeviceHwAccessTargetSizeUshort = 2, WdfDeviceHwAccessTargetSizeUlong = 3, WdfDeviceHwAccessTargetSizeUlong64 = 4, WdfDeviceHwAccessTargetSizeMaximum = 5 }; enum _CM_SHARE_DISPOSITION { CmResourceShareUndetermined = 0, CmResourceShareDeviceExclusive = 1, CmResourceShareDriverExclusive = 2, CmResourceShareShared = 3 }; enum InterruptControlType { InterruptControlTypeUndefined = 0, InterruptControlTypeAssignResources = 1, InterruptControlTypeConnect = 2, InterruptControlTypeDisconnect = 3, InterruptControlTypeResetInterruptInfo = 4, InterruptControlTypeRevokeResources = 5, InterruptControlTypeSetPolicy = 6, InterruptControlTypeFlushQueuedDpcs = 7, InterruptControlTypeAcknowledge = 8, InterruptControlTypeMaximum = 9 }; enum _WUDF_IRP_COPY_DIRECTION { CopyDirectionToHost = 1, CopyDirectionFromHost = 2 }; enum _WUDF_IRP_BUFFER_INDEX { IrpBufferIndexPrimary = 0, IrpBufferIndexSecondary = 1, IrpBufferIndexMax = 2 }; enum WUDF_USB_SS_EVENT { UsbSSCallbackInvoked = 0, UsbSSComplete = 1 }; struct _POWER_IRP_COMPLETION_INFO { unsigned char D0IrpCompletionFunction[8]; /* +0x0000 4e 1f 00 00 */ void *D0IrpCompletionContext; /* +0x0008 */ unsigned char DxIrpCompletionFunction[8]; /* +0x0010 4e 1f 00 00 */ void *DxIrpCompletionContext; /* +0x0018 */ unsigned char WWIrpCompletionFunction[8]; /* +0x0020 4e 1f 00 00 */ void *WWIrpCompletionContext; /* +0x0028 */ unsigned char UsbSSCompletionRoutine[8]; /* +0x0030 03 1f 00 00 */ void *UsbSSCompletionContext; /* +0x0038 */ unsigned char UsbIdleCallback[8]; /* +0x0040 1d 16 00 00 */ void *UsbIdleContext; /* +0x0048 */ unsigned char UsbIdleCallbackReply[8]; /* +0x0050 32 21 00 00 */ unsigned long UsbIdleCallbackReplyId; /* +0x0058 */ }; struct UMDF_VERSION_DATA { unsigned long MajorNumber; /* +0x0000 */ unsigned long MinorNumber; /* +0x0004 */ unsigned long ServiceNumber; /* +0x0008 */ }; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous = 0, SecurityIdentification = 1, SecurityImpersonation = 2, SecurityDelegation = 3 }; enum _WDF_REQUEST_TYPE { WdfRequestUndefined = 0, WdfRequestCreate = 1, WdfRequestCleanup = 2, WdfRequestRead = 3, WdfRequestWrite = 4, WdfRequestDeviceIoControl = 5, WdfRequestClose = 6, WdfRequestUsb = 7, WdfRequestOther = 8, WdfRequestInternalIoctl = 9, WdfRequestTypeNoFormat = 10, WdfRequestFlushBuffers = 11, WdfRequestQueryInformation = 12, WdfRequestSetInformation = 13, WdfRequestMaximum = 14 }; enum _WUDFX_IRP_STACK_FLAGS { WUDFX_IRP_STACK_FLAGS_NONE = 0, /* WUDFX_IRP_STACK_FLAGS_IMPERSONATE_CLIENT = Unavail */ }; enum _WDF_FILE_INFORMATION_CLASS { WdfFileInformationDirectory = 1, WdfFileInformationFullDirectory = 2, WdfFileInformationBothDirectory = 3, WdfFileInformationBasic = 4, WdfFileInformationStandard = 5, WdfFileInformationInternal = 6, WdfFileInformationEa = 7, WdfFileInformationAccess = 8, WdfFileInformationName = 9, WdfFileInformationRename = 10, WdfFileInformationLink = 11, WdfFileInformationNames = 12, WdfFileInformationDisposition = 13, WdfFileInformationPosition = 14, WdfFileInformationFullEa = 15, WdfFileInformationMode = 16, WdfFileInformationAlignment = 17, WdfFileInformationAll = 18, WdfFileInformationAllocation = 19, WdfFileInformationEndOfFile = 20, WdfFileInformationAlternateName = 21, WdfFileInformationStream = 22, WdfFileInformationPipe = 23, WdfFileInformationPipeLocal = 24, WdfFileInformationPipeRemote = 25, WdfFileInformationMailslotQuery = 26, WdfFileInformationMailslotSet = 27, WdfFileInformationCompression = 28, WdfFileInformationObjectId = 29, WdfFileInformationCompletion = 30, WdfFileInformationMoveCluster = 31, WdfFileInformationQuota = 32, WdfFileInformationReparsePoint = 33, WdfFileInformationNetworkOpen = 34, WdfFileInformationAttributeTag = 35, WdfFileInformationTracking = 36, WdfFileInformationIdBothDirectory = 37, WdfFileInformationIdFullDirectory = 38, WdfFileInformationValidDataLength = 39, WdfFileInformationShortName = 40, WdfFileInformationIoCompletionNotification = 41, WdfFileInformationIoStatusBlockRange = 42, WdfFileInformationIoPriorityHint = 43, WdfFileInformationSfioReserve = 44, WdfFileInformationSfioVolume = 45, WdfFileInformationHardLink = 46, WdfFileInformationProcessIdsUsingFile = 47, WdfFileInformationNormalizedName = 48, WdfFileInformationNetworkPhysicalName = 49, WdfFileInformationIdGlobalTxDirectory = 50, WdfFileInformationIsRemoteDevice = 51, WdfFileInformationAttributeCache = 52, WdfFileInformationMaximum = 53 }; struct _OSVERSIONINFOEXW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 ca 11 00 00 */ unsigned short wServicePackMajor; /* +0x0114 */ unsigned short wServicePackMinor; /* +0x0116 */ unsigned short wSuiteMask; /* +0x0118 */ unsigned char wProductType; /* +0x011a */ unsigned char wReserved; /* +0x011b */ }; struct CWudfRefCountedHandle { long m_cRefCount; /* +0x0000 */ void *m_hFile; /* +0x0008 */ long m_bInvalid; /* +0x0010 */ }; enum CWudfIoStackLocationBase::IoStackLocationStatus { UNINITIALIZED = 0, VALID = 1, DISCARDED = 2 }; struct _WUDF_REQUEST_PARAMETERS { unsigned long Size; /* +0x0000 */ unsigned char MajorFunction; /* +0x0004 */ unsigned char MinorFunction; /* +0x0005 */ unsigned char IrpStackFlags[40]; /* +0x0008 83 21 00 00 */ }; struct _WUDF_REQUEST_PARAMETERS:::: { /* unsigned char Alignment[0]; +0x0000 7d 22 00 00 */ unsigned long DesiredAccess; /* +0x0000 */ unsigned long Options; /* +0x0008 */ unsigned short FileAttributes; /* +0x0010 */ unsigned short ShareAccess; /* +0x0012 */ unsigned long EaLength; /* +0x0018 */ }; struct _WUDF_REQUEST_PARAMETERS:::: { unsigned long Length; /* +0x0000 */ unsigned long Key; /* +0x0008 */ unsigned char ByteOffset[8]; /* +0x0010 35 10 00 00 */ }; struct _WUDF_REQUEST_PARAMETERS:::: { unsigned long OutputBufferLength; /* +0x0000 */ unsigned long InputBufferLength; /* +0x0008 */ unsigned long IoControlCode; /* +0x0010 */ void *Type3InputBuffer; /* +0x0018 */ }; struct _WUDF_REQUEST_PARAMETERS:::: { unsigned char FileInformationClass[4]; /* +0x0000 87 21 00 00 */ unsigned long Length; /* +0x0004 */ }; struct _WUDF_REQUEST_PARAMETERS:::: { void *Argument1; /* +0x0000 */ void *Argument2; /* +0x0008 */ void *Argument3; /* +0x0010 */ void *Argument4; /* +0x0018 */ }; struct CWudfIoStack { unsigned long m_cLocations; /* +0x0000 */ unsigned char m_aIoStack[8]; /* +0x0008 60 22 00 00 */ unsigned long m_cLocationsAllocated; /* +0x0010 */ unsigned long m_nCurrentStackLocation; /* +0x0014 */ }; enum _WUDFMESSAGE { WudfMsg_Reserved = 0, WudfMsg_IRP = 1, WudfMsg_IRP_Completion = 2, WudfMsg_CREATE_DEVICE_STACK = 3, WudfMsg_ADD_DEVICE = 4, WudfMsg_CREATE = 5, WudfMsg_CLOSE = 6, WudfMsg_CLEANUP = 7, WudfMsg_READ = 8, WudfMsg_WRITE = 9, WudfMsg_IOCONTROL = 10, WudfMsg_FLUSH = 11, WudfMsg_QUERY_INFORMATION_FILE = 12, WudfMsg_SET_INFORMATION_FILE = 13, WudfMsg_Cancel = 14, WudfMsg_POWER_IRP_COMPLETE = 15, WudfMsg_USB_SS_EVENT = 16, WudfMsg_CLOSE_DEVICE_STACK = 17, WudfMsg_REMOTE_INTERFACE_ARRIVAL = 18, WudfMsg_REMOTE_INTERFACE_REMOVAL = 19, WudfMsg_TARGET_DEVICE_NOTIFICATION = 20, WudfMsg_TRANSPORT_QUERY_ID = 21, WudfMsg_FramworkMax = 22, WudfMsg_ExitProcess = 23, WdfProcMgmt_Message_Reserved = 24, WdfProcMgmt_Message_ControlObjectName = 25, WdfProcMgmt_Message_QueryProcess = 26, WdfProcMgmt_Message_OpenProcess = 27, WdfProcMgmt_Message_CloseProcess = 28, WudfMsg_Connect = 29, WudfMsg_WMI_POWER_DATA = 30, WudfMsg_Max = 31 }; struct CWudfIrp:: { unsigned char hrStatus[8]; /* +0x0000 08 00 00 00 */ unsigned long long Information; /* +0x0008 */ }; struct _WUDFMESSAGE_IO_HEADER { unsigned char Header[8]; /* +0x0000 01 1e 00 00 */ void *Irp; /* +0x0008 */ unsigned long long RequestId; /* +0x0010 */ unsigned long ProcessId; /* +0x0018 */ unsigned char Is32bitProcess; /* +0x001c */ char RequestorMode; /* +0x001d */ unsigned char DirectMappedTransfer; /* +0x001e */ }; struct _WUDFX_IRP_BUFFER_INFO { unsigned char Valid[40]; /* +0x0000 74 00 00 00 */ }; struct _WUDFMESSAGE_HEADER { unsigned char Message[1]; /* +0x0000 bf 22 00 00 */ }; struct _WUDFX_IRP_BUFFER_INFO:: { void *Address; /* +0x0000 */ unsigned long long LengthCb; /* +0x0008 */ }; struct _WUDFMESSAGE_PNP_REPLY_ALL { /* unsigned char IrpReply[0]; +0x0000 2e 24 00 00 */ unsigned char IrpCompletionReply[96]; /* +0x0000 2f 24 00 00 */ }; struct _WUDFMESSAGE_IRP { unsigned char Header[8]; /* +0x0000 01 1e 00 00 */ void *Irp; /* +0x0008 */ /* unsigned char DevnodeContext[0]; +0x0010 04 1e 00 00 */ unsigned char CreateContext[8]; /* +0x0010 0d 1e 00 00 */ unsigned char IoStatus[16]; /* +0x0018 4a 1f 00 00 */ unsigned char MajorCode; /* +0x0028 */ unsigned char MinorCode; /* +0x0029 */ unsigned char Parameters[64]; /* +0x0030 32 24 00 00 */ }; struct _IRP_LOGGING_CONTEXT { unsigned char IrpOwnedByUmDriver[4]; /* +0x0000 74 00 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long long RawSizeInBytes; /* +0x0000 */ unsigned char AllocatedResources[8]; /* +0x0008 2b 1f 00 00 */ unsigned long long TranslatedSizeInBytes; /* +0x0010 */ unsigned char AllocatedResourcesTranslated[8]; /* +0x0018 2b 1f 00 00 */ }; struct _CM_RESOURCE_LIST { unsigned long Count; /* +0x0000 */ unsigned char List[36]; /* +0x0004 4b 24 00 00 */ }; struct WPP_PROJECT_CONTROL_BLOCK { /* unsigned char Control[0]; +0x0000 51 24 00 00 */ unsigned char ReserveSpace[40]; /* +0x0000 52 24 00 00 */ }; struct _WPP_TRACE_CONTROL_BLOCK { unsigned char Next[8]; /* +0x0000 55 24 00 00 */ unsigned long long UmRegistrationHandle; /* +0x0008 */ unsigned long long Logger; /* +0x0010 */ /* unsigned char Win2kCb[0]; +0x0010 58 24 00 00 */ void *Ptr; /* +0x0010 */ unsigned char Cb[8]; /* +0x0010 55 24 00 00 */ unsigned char FlagsLen; /* +0x0018 */ unsigned char Level; /* +0x0019 */ unsigned short Options; /* +0x001a */ unsigned char Flags[4]; /* +0x001c 34 10 00 00 */ unsigned char ControlGuid[8]; /* +0x0020 19 10 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long SystemContext; /* +0x0000 */ unsigned char Type[4]; /* +0x0004 c8 1c 00 00 */ unsigned char State[4]; /* +0x0008 c6 1c 00 00 */ unsigned char ShutdownType[4]; /* +0x000c 22 1f 00 00 */ }; struct _POWER_STATE { /* unsigned char SystemState[0]; +0x0000 1f 1f 00 00 */ unsigned char DeviceState[4]; /* +0x0000 ae 1c 00 00 */ }; struct _DEVICE_CAPABILITIES { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ /* unsigned char DeviceD1[0]; +0x0004 3c 10 00 00 */ /* unsigned char DeviceD2[0]; +0x0004 3d 10 00 00 */ /* unsigned char LockSupported[0]; +0x0004 3e 10 00 00 */ /* unsigned char EjectSupported[0]; +0x0004 3f 10 00 00 */ /* unsigned char Removable[0]; +0x0004 40 10 00 00 */ /* unsigned char DockDevice[0]; +0x0004 41 10 00 00 */ /* unsigned char UniqueID[0]; +0x0004 42 10 00 00 */ /* unsigned char SilentInstall[0]; +0x0004 74 24 00 00 */ /* unsigned char RawDeviceOK[0]; +0x0004 75 24 00 00 */ /* unsigned char SurpriseRemovalOK[0]; +0x0004 76 24 00 00 */ /* unsigned char WakeFromD0[0]; +0x0004 77 24 00 00 */ /* unsigned char WakeFromD1[0]; +0x0004 78 24 00 00 */ /* unsigned char WakeFromD2[0]; +0x0004 79 24 00 00 */ /* unsigned char WakeFromD3[0]; +0x0004 7a 24 00 00 */ /* unsigned char HardwareDisabled[0]; +0x0004 7b 24 00 00 */ /* unsigned char NonDynamic[0]; +0x0004 7c 24 00 00 */ /* unsigned char WarmEjectSupported[0]; +0x0004 7d 24 00 00 */ /* unsigned char NoDisplayInUI[0]; +0x0004 7e 24 00 00 */ /* unsigned char Reserved1[0]; +0x0004 7f 24 00 00 */ unsigned char Reserved[4]; /* +0x0004 80 24 00 00 */ unsigned long Address; /* +0x0008 */ unsigned long UINumber; /* +0x000c */ unsigned char DeviceState[28]; /* +0x0010 81 24 00 00 */ unsigned char SystemWake[4]; /* +0x002c 1f 1f 00 00 */ unsigned char DeviceWake[4]; /* +0x0030 ae 1c 00 00 */ unsigned long D1Latency; /* +0x0034 */ unsigned long D2Latency; /* +0x0038 */ unsigned long D3Latency; /* +0x003c */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char Capabilities[64]; /* +0x0000 25 1f 00 00 */ }; struct _WUDFMESSAGE_IRP_COMPLETION { unsigned char Header[8]; /* +0x0000 01 1e 00 00 */ unsigned char CompletionContext[8]; /* +0x0008 8b 24 00 00 */ unsigned char IoStatus[16]; /* +0x0010 4a 1f 00 00 */ unsigned char Parameters[64]; /* +0x0020 32 24 00 00 */ }; struct _IO_STATUS_BLOCK { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ unsigned long long Information; /* +0x0008 */ }; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation = 2, FileBothDirectoryInformation = 3, FileBasicInformation = 4, FileStandardInformation = 5, FileInternalInformation = 6, FileEaInformation = 7, FileAccessInformation = 8, FileNameInformation = 9, FileRenameInformation = 10, FileLinkInformation = 11, FileNamesInformation = 12, FileDispositionInformation = 13, FilePositionInformation = 14, FileFullEaInformation = 15, FileModeInformation = 16, FileAlignmentInformation = 17, FileAllInformation = 18, FileAllocationInformation = 19, FileEndOfFileInformation = 20, FileAlternateNameInformation = 21, FileStreamInformation = 22, FilePipeInformation = 23, FilePipeLocalInformation = 24, FilePipeRemoteInformation = 25, FileMailslotQueryInformation = 26, FileMailslotSetInformation = 27, FileCompressionInformation = 28, FileObjectIdInformation = 29, FileCompletionInformation = 30, FileMoveClusterInformation = 31, FileQuotaInformation = 32, FileReparsePointInformation = 33, FileNetworkOpenInformation = 34, FileAttributeTagInformation = 35, FileTrackingInformation = 36, FileIdBothDirectoryInformation = 37, FileIdFullDirectoryInformation = 38, FileValidDataLengthInformation = 39, FileShortNameInformation = 40, FileIoCompletionNotificationInformation = 41, FileIoStatusBlockRangeInformation = 42, FileIoPriorityHintInformation = 43, FileSfioReserveInformation = 44, FileSfioVolumeInformation = 45, FileHardLinkInformation = 46, FileProcessIdsUsingFileInformation = 47, FileNormalizedNameInformation = 48, FileNetworkPhysicalNameInformation = 49, FileIdGlobalTxDirectoryInformation = 50, FileIsRemoteDeviceInformation = 51, FileAttributeCacheInformation = 52, FileNumaNodeInformation = 53, FileStandardLinkInformation = 54, FileRemoteProtocolInformation = 55, FileRenameInformationBypassAccessCheck = 56, FileLinkInformationBypassAccessCheck = 57, FileIntegrityStreamInformation = 58, FileVolumeNameInformation = 59, FileMaximumInformation = 60 }; enum _DISPATCHER_FILE_TYPE { DispatcherFileTypeRegular = 0, DispatcherFileTypeNull = 1 }; struct CDispatcherFile { unsigned char m_FileType[24]; /* +0x0000 2f 25 00 00 */ }; struct CDispatcherFile:: { /* unsigned char Regular[0]; +0x0000 3c 25 00 00 */ unsigned char Null[16]; /* +0x0000 3d 25 00 00 */ }; struct _DISPATCHER_FILE_REGULAR_INFO { unsigned char FileObj[8]; /* +0x0000 d2 20 00 00 */ }; struct _DISPATCHER_FILE_NULL_INFO { unsigned char DeviceStack[8]; /* +0x0000 54 20 00 00 */ void *Handle; /* +0x0008 */ }; struct CWudfDriverInfo { unsigned char isExclusive[8]; /* +0x0000 30 00 00 00 */ unsigned char pDriverImagePath[8]; /* +0x0008 14 10 00 00 */ unsigned char DriverCLSID[16]; /* +0x0010 17 10 00 00 */ unsigned char pConfigSubPath[8]; /* +0x0020 14 10 00 00 */ }; enum _MODE { KernelMode = 0, UserMode = 1, MaximumMode = 2 }; enum _WUDF_BOOT_MODE { WUDF_BOOT_MODE_NORMAL = 0, WUDF_BOOT_MODE_SAFE_MODE = 1, WUDF_BOOT_MODE_SAFE_MODE_WITH_NETWORKING = 2 }; struct ATL::_ATL_SAFE_ALLOCA_IMPL::CAtlSafeAllocBufferManager::CAtlSafeAllocBufferNode { unsigned char m_pNext[8]; /* +0x0000 ab 12 00 00 */ unsigned char _pad[8]; /* +0x0008 1a 10 00 00 */ }; struct _DEVPROPKEY { unsigned char fmtid[16]; /* +0x0000 17 10 00 00 */ unsigned long pid; /* +0x0010 */ }; struct tagCABSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 e9 10 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_24 { unsigned char arrayOfBaseClassDescriptors[28]; /* +0x0000 cb 26 00 00 */ }; struct _s__RTTIBaseClassDescriptor2 { unsigned char pTypeDescriptor[8]; /* +0x0000 d2 26 00 00 */ unsigned long numContainedBases; /* +0x0008 */ unsigned char where[12]; /* +0x000c d3 26 00 00 */ unsigned long attributes; /* +0x0018 */ unsigned char pClassDescriptor[8]; /* +0x001c d6 26 00 00 */ }; struct tagCAUL { unsigned long cElems; /* +0x0000 */ unsigned long *pElems; /* +0x0008 */ }; struct tagCASCODE { unsigned long cElems; /* +0x0000 */ long *pElems; /* +0x0008 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_8 { unsigned char arrayOfBaseClassDescriptors[12]; /* +0x0000 de 26 00 00 */ }; struct $_TypeDescriptor$_extraBytes_18 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[18]; /* +0x0010 e2 26 00 00 */ }; struct threadlocaleinfostruct { unsigned char refcount[4]; /* +0x0000 74 00 00 00 */ unsigned char lc_codepage[4]; /* +0x0004 75 00 00 00 */ unsigned char lc_collate_cp[4]; /* +0x0008 75 00 00 00 */ unsigned char lc_handle[24]; /* +0x000c e5 26 00 00 */ unsigned char lc_id[316]; /* +0x0024 e7 26 00 00 */ }; struct _s__RTTIClassHierarchyDescriptor { unsigned long signature; /* +0x0000 */ unsigned long attributes; /* +0x0004 */ unsigned long numBaseClasses; /* +0x0008 */ unsigned char pBaseClassArray[8]; /* +0x000c f2 26 00 00 */ }; struct _RD_DEVICE_INTERFACE_STORE_PARAMETERS { unsigned char InterfaceGUID[16]; /* +0x0000 17 10 00 00 */ unsigned long RefStringCch; /* +0x0010 */ /* unsigned char RefString[0]; +0x0014 73 13 00 00 */ }; enum _tagPARSEACTION { PARSE_CANONICALIZE = 1, PARSE_FRIENDLY = 2, PARSE_SECURITY_URL = 3, PARSE_ROOTDOCUMENT = 4, PARSE_DOCUMENT = 5, PARSE_ANCHOR = 6, PARSE_ENCODE_IS_UNESCAPE = 7, PARSE_DECODE_IS_ESCAPE = 8, PARSE_PATH_FROM_URL = 9, PARSE_URL_FROM_PATH = 10, PARSE_MIME = 11, PARSE_SERVER = 12, PARSE_SCHEMA = 13, PARSE_SITE = 14, PARSE_DOMAIN = 15, PARSE_LOCATION = 16, PARSE_SECURITY_DOMAIN = 17, PARSE_ESCAPE = 18, PARSE_UNESCAPE = 19 }; struct $_TypeDescriptor$_extraBytes_17 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[17]; /* +0x0010 fb 26 00 00 */ }; struct tagCABOOL { unsigned long cElems; /* +0x0000 */ short *pElems; /* +0x0008 */ }; struct _s__RTTICompleteObjectLocator2 { unsigned long signature; /* +0x0000 */ unsigned long offset; /* +0x0004 */ unsigned long cdOffset; /* +0x0008 */ unsigned char pTypeDescriptor[8]; /* +0x000c d2 26 00 00 */ unsigned char pClassDescriptor[8]; /* +0x0014 d6 26 00 00 */ unsigned char pSelf[8]; /* +0x001c 02 27 00 00 */ }; enum _tagINTERNETFEATURELIST { FEATURE_OBJECT_CACHING = 0, FEATURE_ZONE_ELEVATION = 1, FEATURE_MIME_HANDLING = 2, FEATURE_MIME_SNIFFING = 3, FEATURE_WINDOW_RESTRICTIONS = 4, FEATURE_WEBOC_POPUPMANAGEMENT = 5, FEATURE_BEHAVIORS = 6, FEATURE_DISABLE_MK_PROTOCOL = 7, FEATURE_LOCALMACHINE_LOCKDOWN = 8, FEATURE_SECURITYBAND = 9, FEATURE_RESTRICT_ACTIVEXINSTALL = 10, FEATURE_VALIDATE_NAVIGATE_URL = 11, FEATURE_RESTRICT_FILEDOWNLOAD = 12, FEATURE_ADDON_MANAGEMENT = 13, FEATURE_PROTOCOL_LOCKDOWN = 14, FEATURE_HTTP_USERNAME_PASSWORD_DISABLE = 15, FEATURE_SAFE_BINDTOOBJECT = 16, FEATURE_UNC_SAVEDFILECHECK = 17, FEATURE_GET_URL_DOM_FILEPATH_UNENCODED = 18, FEATURE_TABBED_BROWSING = 19, FEATURE_SSLUX = 20, FEATURE_DISABLE_NAVIGATION_SOUNDS = 21, FEATURE_DISABLE_LEGACY_COMPRESSION = 22, FEATURE_FORCE_ADDR_AND_STATUS = 23, FEATURE_XMLHTTP = 24, FEATURE_DISABLE_TELNET_PROTOCOL = 25, FEATURE_FEEDS = 26, FEATURE_BLOCK_INPUT_PROMPTS = 27, FEATURE_ENTRY_COUNT = 28 }; enum tagCALLCONV { CC_FASTCALL = 0, CC_CDECL = 1, CC_MSCPASCAL = 2, CC_PASCAL = 2, CC_MACPASCAL = 3, CC_STDCALL = 4, CC_FPFASTCALL = 5, CC_SYSCALL = 6, CC_MPWCDECL = 7, CC_MPWPASCAL = 8, CC_MAX = 9 }; struct tagPOINT { long x; /* +0x0000 */ long y; /* +0x0004 */ }; enum __MIDL_ICodeInstall_0001 { CIP_DISK_FULL = 0, CIP_ACCESS_DENIED = 1, CIP_NEWER_VERSION_EXISTS = 2, CIP_OLDER_VERSION_EXISTS = 3, CIP_NAME_CONFLICT = 4, CIP_TRUST_VERIFICATION_COMPONENT_MISSING = 5, CIP_EXE_SELF_REGISTERATION_TIMEOUT = 6, CIP_UNSAFE_TO_ABORT = 7, CIP_NEED_REBOOT = 8, CIP_NEED_REBOOT_UI_PERMISSION = 9 }; struct tagCATEGORYINFO { unsigned char catid[16]; /* +0x0000 17 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char szDescription[256]; /* +0x0014 ca 11 00 00 */ }; struct _GROUP_AFFINITY { unsigned long long Mask; /* +0x0000 */ unsigned short Group; /* +0x0008 */ unsigned char Reserved[6]; /* +0x000a 11 27 00 00 */ }; struct $_TypeDescriptor$_extraBytes_24 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[24]; /* +0x0010 15 27 00 00 */ }; enum _IRP_HANDLING_FLAG { IRP_HANDLING__COMPLETE = 0, IRP_HANDLING__FORWARD = 1, IRP_HANDLING__MAX = 2 }; struct _WUDFMESSAGE_IRP_REPLY { unsigned char Header[8]; /* +0x0000 11 1e 00 00 */ unsigned long long Information; /* +0x0008 */ unsigned char Parameters[64]; /* +0x0010 32 24 00 00 */ unsigned char IrpHandling[8]; /* +0x0050 19 27 00 00 */ unsigned char CompletionContext[8]; /* +0x0058 8b 24 00 00 */ }; struct _devicemodeA:: { short dmOrientation; /* +0x0000 */ short dmPaperSize; /* +0x0002 */ short dmPaperLength; /* +0x0004 */ short dmPaperWidth; /* +0x0006 */ short dmScale; /* +0x0008 */ short dmCopies; /* +0x000a */ short dmDefaultSource; /* +0x000c */ short dmPrintQuality; /* +0x000e */ unsigned char dmPosition[8]; /* +0x0000 bc 12 00 00 */ unsigned long dmDisplayOrientation; /* +0x0008 */ unsigned long dmDisplayFixedOutput; /* +0x000c */ }; struct _devicemodeA:::: { short dmOrientation; /* +0x0000 */ short dmPaperSize; /* +0x0002 */ short dmPaperLength; /* +0x0004 */ short dmPaperWidth; /* +0x0006 */ short dmScale; /* +0x0008 */ short dmCopies; /* +0x000a */ short dmDefaultSource; /* +0x000c */ short dmPrintQuality; /* +0x000e */ }; struct _devicemodeA:::: { unsigned char dmPosition[8]; /* +0x0000 bc 12 00 00 */ unsigned long dmDisplayOrientation; /* +0x0008 */ unsigned long dmDisplayFixedOutput; /* +0x000c */ }; struct _devicemodeA:: { unsigned long dmDisplayFlags; /* +0x0000 */ unsigned long dmNup; /* +0x0000 */ }; struct _SP_DEVINFO_DATA { unsigned long cbSize; /* +0x0000 */ unsigned char ClassGuid[16]; /* +0x0004 17 10 00 00 */ unsigned long DevInst; /* +0x0014 */ unsigned long long Reserved; /* +0x0018 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[8]; /* +0x0008 a9 10 00 00 */ unsigned char Context[8]; /* +0x0010 29 27 00 00 */ }; enum DISPLAYCONFIG_SCANLINE_ORDERING { DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED = 0, DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE = 1, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST = 3, DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 = -1 }; struct _BLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pBlobData; /* +0x0008 */ }; enum tagCOWAIT_FLAGS { COWAIT_WAITALL = 1, COWAIT_ALERTABLE = 2, COWAIT_INPUTAVAILABLE = 4, COWAIT_DISPATCH_CALLS = 8, COWAIT_DISPATCH_WINDOW_MESSAGES = 16, REAL_COWAIT_ENABLECALLREENTRANCY = 8, COWAIT_ENABLEWINDOWMESSAGES = 16, COWAIT_ENABLECALLREENTRANCY = 24 }; struct _PMD { unsigned char mdisp[4]; /* +0x0000 74 00 00 00 */ unsigned char pdisp[4]; /* +0x0004 74 00 00 00 */ unsigned char vdisp[4]; /* +0x0008 74 00 00 00 */ }; struct tagCAC { unsigned long cElems; /* +0x0000 */ char *pElems; /* +0x0008 */ }; struct tagSTATSTG { unsigned char pwcsName[8]; /* +0x0000 71 06 00 00 */ unsigned long type; /* +0x0008 */ unsigned char cbSize[8]; /* +0x0010 4e 10 00 00 */ unsigned char mtime[8]; /* +0x0018 53 12 00 00 */ unsigned char ctime[8]; /* +0x0020 53 12 00 00 */ unsigned char atime[8]; /* +0x0028 53 12 00 00 */ unsigned long grfMode; /* +0x0030 */ unsigned long grfLocksSupported; /* +0x0034 */ unsigned char clsid[16]; /* +0x0038 17 10 00 00 */ unsigned long grfStateBits; /* +0x0048 */ unsigned long reserved; /* +0x004c */ }; struct tagCACLSID { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 54 12 00 00 */ }; struct _NT_TIB { unsigned char ExceptionList[8]; /* +0x0000 3e 27 00 00 */ void *StackBase; /* +0x0008 */ void *StackLimit; /* +0x0010 */ void *SubSystemTib; /* +0x0018 */ void *FiberData; /* +0x0020 */ unsigned long Version; /* +0x0020 */ void *ArbitraryUserPointer; /* +0x0028 */ unsigned char Self[8]; /* +0x0030 3f 27 00 00 */ }; struct _NT_TIB:: { void *FiberData; /* +0x0000 */ unsigned long Version; /* +0x0000 */ }; struct _WUDFMESSAGE_SET_DEVICE_INTERFACE_STATE2 { unsigned char Enable; /* +0x0000 */ unsigned char InterfaceInfo[16]; /* +0x0004 45 27 00 00 */ }; enum tagMSHLFLAGS { MSHLFLAGS_NORMAL = 0, MSHLFLAGS_TABLESTRONG = 1, MSHLFLAGS_TABLEWEAK = 2, MSHLFLAGS_NOPING = 4, MSHLFLAGS_RESERVED1 = 8, MSHLFLAGS_RESERVED2 = 16, MSHLFLAGS_RESERVED3 = 32, MSHLFLAGS_RESERVED4 = 64 }; struct $_TypeDescriptor$_extraBytes_22 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[22]; /* +0x0010 4b 27 00 00 */ }; struct tagCAUH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 f7 14 00 00 */ }; enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess = 0, PsAttributeDebugObject = 1, PsAttributeToken = 2, PsAttributeClientId = 3, PsAttributeTebAddress = 4, PsAttributeImageName = 5, PsAttributeImageInfo = 6, PsAttributeMemoryReserve = 7, PsAttributePriorityClass = 8, PsAttributeErrorMode = 9, PsAttributeStdHandleInfo = 10, PsAttributeHandleList = 11, PsAttributeGroupAffinity = 12, PsAttributePreferredNode = 13, PsAttributeIdealProcessor = 14, PsAttributeUmsThread = 15, PsAttributeMitigationOptions = 16, PsAttributeSecurityCapabilities = 17, PsAttributeMax = 18 }; struct _KDHELP64 { unsigned long long Thread; /* +0x0000 */ unsigned long ThCallbackStack; /* +0x0008 */ unsigned long ThCallbackBStore; /* +0x000c */ unsigned long NextCallback; /* +0x0010 */ unsigned long FramePointer; /* +0x0014 */ unsigned long long KiCallUserMode; /* +0x0018 */ unsigned long long KeUserCallbackDispatcher; /* +0x0020 */ unsigned long long SystemRangeStart; /* +0x0028 */ unsigned long long KiUserExceptionDispatcher; /* +0x0030 */ unsigned long long StackBase; /* +0x0038 */ unsigned long long StackLimit; /* +0x0040 */ unsigned char Reserved[40]; /* +0x0048 54 27 00 00 */ }; struct _TEB:: { /* unsigned char CurrentIdealProcessor[0]; +0x0000 a7 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0000 */ unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:::: { unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:: { /* unsigned char CrossTebFlags[0]; +0x0000 aa 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0000 ab 10 00 00 */ }; struct _TEB:::: { unsigned char SpareCrossTebBits[2]; /* +0x0000 ab 10 00 00 */ }; struct _TEB:: { unsigned short SameTebFlags; /* +0x0000 */ /* unsigned char SafeThunkCall[0]; +0x0000 ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b9 10 00 00 */ }; struct _TEB:::: { /* unsigned char SafeThunkCall[0]; +0x0000 ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b9 10 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_16 { unsigned char arrayOfBaseClassDescriptors[20]; /* +0x0000 64 27 00 00 */ }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; struct _ALPC_SECURITY_ATTR { unsigned long Flags; /* +0x0000 */ unsigned char QoS[8]; /* +0x0008 6c 27 00 00 */ void *ContextHandle; /* +0x0010 */ }; struct tagCADBL { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 41 06 00 00 */ }; struct tagCACLIPDATA { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 56 12 00 00 */ }; enum tagCHANGEKIND { CHANGEKIND_ADDMEMBER = 0, CHANGEKIND_DELETEMEMBER = 1, CHANGEKIND_SETNAMES = 2, CHANGEKIND_SETDOCUMENTATION = 3, CHANGEKIND_GENERAL = 4, CHANGEKIND_INVALIDATE = 5, CHANGEKIND_CHANGEFAILED = 6, CHANGEKIND_MAX = 7 }; struct _INTERFACE { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ void *Context; /* +0x0008 */ unsigned char InterfaceReference[8]; /* +0x0010 1d 16 00 00 */ unsigned char InterfaceDereference[8]; /* +0x0018 1d 16 00 00 */ }; struct tagCABSTRBLOB { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 78 27 00 00 */ }; enum tagExtentMode { DVEXTENT_CONTENT = 0, DVEXTENT_INTEGRAL = 1 }; struct _KUSER_SHARED_DATA:: { unsigned char MitigationPolicies; /* +0x0000 */ /* unsigned char NXSupportPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 38 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 39 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char NXSupportPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 38 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 39 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned long SharedDataFlags; /* +0x0000 */ /* unsigned char DbgErrorPortPresent[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 43 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char DbgErrorPortPresent[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 43 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { /* unsigned char TickCount[0]; +0x0000 2a 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0000 45 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0000 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 34 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char ReservedTickCountOverlay[12]; /* +0x0000 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 34 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned short TscQpcData; /* +0x0000 */ unsigned char TscQpcEnabled[1]; /* +0x0000 49 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char TscQpcEnabled[1]; /* +0x0000 49 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_128 { unsigned char arrayOfBaseClassDescriptors[132]; /* +0x0000 8f 27 00 00 */ }; struct _s__RTTIBaseClassArray { unsigned char arrayOfBaseClassDescriptors[4]; /* +0x0000 92 27 00 00 */ }; struct tagCAPROPVARIANT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 51 12 00 00 */ }; struct $_TypeDescriptor$_extraBytes_23 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[23]; /* +0x0010 99 27 00 00 */ }; enum tagShutdownType { IdleShutdown = 0, ForcedShutdown = 1 }; enum tagDOMNodeType { NODE_INVALID = 0, NODE_ELEMENT = 1, NODE_ATTRIBUTE = 2, NODE_TEXT = 3, NODE_CDATA_SECTION = 4, NODE_ENTITY_REFERENCE = 5, NODE_ENTITY = 6, NODE_PROCESSING_INSTRUCTION = 7, NODE_COMMENT = 8, NODE_DOCUMENT = 9, NODE_DOCUMENT_TYPE = 10, NODE_DOCUMENT_FRAGMENT = 11, NODE_NOTATION = 12 }; enum tagBINDSTATUS { BINDSTATUS_FINDINGRESOURCE = 1, BINDSTATUS_CONNECTING = 2, BINDSTATUS_REDIRECTING = 3, BINDSTATUS_BEGINDOWNLOADDATA = 4, BINDSTATUS_DOWNLOADINGDATA = 5, BINDSTATUS_ENDDOWNLOADDATA = 6, BINDSTATUS_BEGINDOWNLOADCOMPONENTS = 7, BINDSTATUS_INSTALLINGCOMPONENTS = 8, BINDSTATUS_ENDDOWNLOADCOMPONENTS = 9, BINDSTATUS_USINGCACHEDCOPY = 10, BINDSTATUS_SENDINGREQUEST = 11, BINDSTATUS_CLASSIDAVAILABLE = 12, BINDSTATUS_MIMETYPEAVAILABLE = 13, BINDSTATUS_CACHEFILENAMEAVAILABLE = 14, BINDSTATUS_BEGINSYNCOPERATION = 15, BINDSTATUS_ENDSYNCOPERATION = 16, BINDSTATUS_BEGINUPLOADDATA = 17, BINDSTATUS_UPLOADINGDATA = 18, BINDSTATUS_ENDUPLOADDATA = 19, BINDSTATUS_PROTOCOLCLASSID = 20, BINDSTATUS_ENCODING = 21, BINDSTATUS_VERIFIEDMIMETYPEAVAILABLE = 22, BINDSTATUS_CLASSINSTALLLOCATION = 23, BINDSTATUS_DECODING = 24, BINDSTATUS_LOADINGMIMEHANDLER = 25, BINDSTATUS_CONTENTDISPOSITIONATTACH = 26, BINDSTATUS_FILTERREPORTMIMETYPE = 27, BINDSTATUS_CLSIDCANINSTANTIATE = 28, BINDSTATUS_IUNKNOWNAVAILABLE = 29, BINDSTATUS_DIRECTBIND = 30, BINDSTATUS_RAWMIMETYPE = 31, BINDSTATUS_PROXYDETECTING = 32, BINDSTATUS_ACCEPTRANGES = 33, BINDSTATUS_COOKIE_SENT = 34, BINDSTATUS_COMPACT_POLICY_RECEIVED = 35, BINDSTATUS_COOKIE_SUPPRESSED = 36, BINDSTATUS_COOKIE_STATE_UNKNOWN = 37, BINDSTATUS_COOKIE_STATE_ACCEPT = 38, BINDSTATUS_COOKIE_STATE_REJECT = 39, BINDSTATUS_COOKIE_STATE_PROMPT = 40, BINDSTATUS_COOKIE_STATE_LEASH = 41, BINDSTATUS_COOKIE_STATE_DOWNGRADE = 42, BINDSTATUS_POLICY_HREF = 43, BINDSTATUS_P3P_HEADER = 44, BINDSTATUS_SESSION_COOKIE_RECEIVED = 45, BINDSTATUS_PERSISTENT_COOKIE_RECEIVED = 46, BINDSTATUS_SESSION_COOKIES_ALLOWED = 47, BINDSTATUS_CACHECONTROL = 48, BINDSTATUS_CONTENTDISPOSITIONFILENAME = 49, BINDSTATUS_MIMETEXTPLAINMISMATCH = 50, BINDSTATUS_PUBLISHERAVAILABLE = 51, BINDSTATUS_DISPLAYNAMEAVAILABLE = 52, BINDSTATUS_SSLUX_NAVBLOCKED = 53, BINDSTATUS_SERVER_MIMETYPEAVAILABLE = 54, BINDSTATUS_SNIFFED_CLASSIDAVAILABLE = 55, BINDSTATUS_64BIT_PROGRESS = 56, BINDSTATUS_LAST = 56, BINDSTATUS_RESERVED_0 = 57, BINDSTATUS_RESERVED_1 = 58, BINDSTATUS_RESERVED_2 = 59, BINDSTATUS_RESERVED_3 = 60, BINDSTATUS_RESERVED_4 = 61, BINDSTATUS_RESERVED_5 = 62, BINDSTATUS_RESERVED_6 = 63, BINDSTATUS_RESERVED_7 = 64, BINDSTATUS_RESERVED_8 = 65, BINDSTATUS_RESERVED_9 = 66, BINDSTATUS_LAST_PRIVATE = 66 }; struct $_TypeDescriptor$_extraBytes_21 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[21]; /* +0x0010 a3 27 00 00 */ }; struct $_TypeDescriptor$_extraBytes_15 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[15]; /* +0x0010 b5 27 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 b8 27 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 b9 27 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 ba 27 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 bb 27 00 00 */ unsigned char SpareBits[5]; /* +0x0003 bc 27 00 00 */ void *Mutant; /* +0x0008 */ void *ImageBaseAddress; /* +0x0010 */ unsigned char Ldr[8]; /* +0x0018 be 27 00 00 */ unsigned char ProcessParameters[8]; /* +0x0020 c0 27 00 00 */ void *SubSystemData; /* +0x0028 */ void *ProcessHeap; /* +0x0030 */ unsigned char FastPebLock[8]; /* +0x0038 27 13 00 00 */ void *AtlThunkSListPtr; /* +0x0040 */ void *IFEOKey; /* +0x0048 */ unsigned long CrossProcessFlags; /* +0x0050 */ /* unsigned char ProcessInJob[0]; +0x0050 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0050 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0050 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0050 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0050 40 10 00 00 */ unsigned char ReservedBits0[8]; /* +0x0050 c1 27 00 00 */ void *KernelCallbackTable; /* +0x0058 */ void *UserSharedInfoPtr; /* +0x0058 */ unsigned char SystemReserved[4]; /* +0x0060 34 10 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0064 */ void *ApiSetMap; /* +0x0068 */ unsigned long TlsExpansionCounter; /* +0x0070 */ void *TlsBitmap; /* +0x0078 */ unsigned char TlsBitmapBits[8]; /* +0x0080 2c 10 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x0088 */ void *HotpatchInformation; /* +0x0090 */ unsigned char ReadOnlyStaticServerData[8]; /* +0x0098 6f 10 00 00 */ void *AnsiCodePageData; /* +0x00a0 */ void *OemCodePageData; /* +0x00a8 */ void *UnicodeCaseTableData; /* +0x00b0 */ unsigned long NumberOfProcessors; /* +0x00b8 */ unsigned long NtGlobalFlag; /* +0x00bc */ unsigned char CriticalSectionTimeout[8]; /* +0x00c0 35 10 00 00 */ unsigned long long HeapSegmentReserve; /* +0x00c8 */ unsigned long long HeapSegmentCommit; /* +0x00d0 */ unsigned long long HeapDeCommitTotalFreeThreshold; /* +0x00d8 */ unsigned long long HeapDeCommitFreeBlockThreshold; /* +0x00e0 */ unsigned long NumberOfHeaps; /* +0x00e8 */ unsigned long MaximumNumberOfHeaps; /* +0x00ec */ unsigned char ProcessHeaps[8]; /* +0x00f0 6f 10 00 00 */ void *GdiSharedHandleTable; /* +0x00f8 */ void *ProcessStarterHelper; /* +0x0100 */ unsigned long GdiDCAttributeList; /* +0x0108 */ unsigned char LoaderLock[8]; /* +0x0110 27 13 00 00 */ unsigned long OSMajorVersion; /* +0x0118 */ unsigned long OSMinorVersion; /* +0x011c */ unsigned short OSBuildNumber; /* +0x0120 */ unsigned short OSCSDVersion; /* +0x0122 */ unsigned long OSPlatformId; /* +0x0124 */ unsigned long ImageSubsystem; /* +0x0128 */ unsigned long ImageSubsystemMajorVersion; /* +0x012c */ unsigned long ImageSubsystemMinorVersion; /* +0x0130 */ unsigned long long ActiveProcessAffinityMask; /* +0x0138 */ unsigned char GdiHandleBuffer[240]; /* +0x0140 c2 27 00 00 */ unsigned char PostProcessInitRoutine[8]; /* +0x0230 8d 27 00 00 */ void *TlsExpansionBitmap; /* +0x0238 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0240 c3 27 00 00 */ unsigned long SessionId; /* +0x02c0 */ unsigned char AppCompatFlags[8]; /* +0x02c8 4e 10 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x02d0 4e 10 00 00 */ void *pShimData; /* +0x02d8 */ void *AppCompatInfo; /* +0x02e0 */ unsigned char CSDVersion[16]; /* +0x02e8 a2 10 00 00 */ unsigned char ActivationContextData[8]; /* +0x02f8 c6 27 00 00 */ unsigned char ProcessAssemblyStorageMap[8]; /* +0x0300 c8 27 00 00 */ unsigned char SystemDefaultActivationContextData[8]; /* +0x0308 c6 27 00 00 */ unsigned char SystemAssemblyStorageMap[8]; /* +0x0310 c8 27 00 00 */ unsigned long long MinimumStackCommit; /* +0x0318 */ unsigned char FlsCallback[8]; /* +0x0320 ca 27 00 00 */ unsigned char FlsListHead[16]; /* +0x0328 82 10 00 00 */ void *FlsBitmap; /* +0x0338 */ unsigned char FlsBitmapBits[16]; /* +0x0340 cb 27 00 00 */ unsigned long FlsHighIndex; /* +0x0350 */ void *WerRegistrationData; /* +0x0358 */ void *WerShipAssertPtr; /* +0x0360 */ void *pUnused; /* +0x0368 */ void *pImageHeaderHash; /* +0x0370 */ unsigned long TracingFlags; /* +0x0378 */ /* unsigned char HeapTracingEnabled[0]; +0x0378 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0378 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0378 3e 10 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0378 cc 27 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0380 */ }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0004 { void *Reserved; /* +0x0000 */ }; struct tagCAFLT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 40 06 00 00 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[8]; /* +0x0008 10 10 00 00 */ }; /* enum { WPP_TRACE_OPTIONS = 43 }; */ enum ADDRESS_MODE { AddrMode1616 = 0, AddrMode1632 = 1, AddrModeReal = 2, AddrModeFlat = 3 }; struct _tagADDRESS64 { unsigned long long Offset; /* +0x0000 */ unsigned short Segment; /* +0x0008 */ unsigned char Mode[4]; /* +0x000c da 27 00 00 */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 3c 10 00 00 */ unsigned char Features[512]; /* +0x0010 de 27 00 00 */ }; enum _WDF_PROPERTY_STORE_ROOT_CLASS { WdfPropertyStoreRootClassHardwareKey = 0, WdfPropertyStoreRootClassSoftwareKey = 1, WdfPropertyStoreRootClassDeviceInterfaceKey = 2, WdfPropertyStoreRootClassLegacyHardwareKey = 3 }; struct _WDF_PROPERTY_STORE_ROOT { unsigned long LengthCb; /* +0x0000 */ unsigned char RootClass[20]; /* +0x0004 e2 27 00 00 */ }; struct _WDF_PROPERTY_STORE_ROOT:::: { unsigned char ServiceName[8]; /* +0x0000 14 10 00 00 */ }; struct _WDF_PROPERTY_STORE_ROOT:::: { unsigned char InterfaceGUID[8]; /* +0x0000 19 10 00 00 */ unsigned char ReferenceString[8]; /* +0x0008 14 10 00 00 */ }; struct _WDF_PROPERTY_STORE_ROOT:::: { unsigned char LegacyMapName[8]; /* +0x0000 14 10 00 00 */ }; struct tagCAH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 f1 10 00 00 */ }; struct tagVersionedStream { unsigned char guidVersion[16]; /* +0x0000 17 10 00 00 */ unsigned char pStream[8]; /* +0x0010 5e 12 00 00 */ }; struct $_TypeDescriptor$_extraBytes_19 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[19]; /* +0x0010 f6 27 00 00 */ }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = -1, Internal = 0, Isa = 1, Eisa = 2, MicroChannel = 3, TurboChannel = 4, PCIBus = 5, VMEBus = 6, NuBus = 7, PCMCIABus = 8, CBus = 9, MPIBus = 10, MPSABus = 11, ProcessorInternal = 12, InternalPowerBus = 13, PNPISABus = 14, PNPBus = 15, Vmcs = 16, ACPIBus = 17, MaximumInterfaceType = 18 }; struct _CM_FULL_RESOURCE_DESCRIPTOR { unsigned char InterfaceType[4]; /* +0x0000 fa 27 00 00 */ unsigned long BusNumber; /* +0x0004 */ unsigned char PartialResourceList[28]; /* +0x0008 fb 27 00 00 */ }; struct tagPROPVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 52 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 53 12 00 00 */ /* unsigned char puuid[0]; +0x0008 54 12 00 00 */ /* unsigned char pclipdata[0]; +0x0008 56 12 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 57 12 00 00 */ /* unsigned char blob[0]; +0x0008 58 12 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 5c 12 00 00 */ /* unsigned char pStream[0]; +0x0008 5e 12 00 00 */ /* unsigned char pStorage[0]; +0x0008 60 12 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 62 12 00 00 */ /* unsigned char parray[0]; +0x0008 64 12 00 00 */ /* unsigned char cac[0]; +0x0008 65 12 00 00 */ /* unsigned char caub[0]; +0x0008 66 12 00 00 */ /* unsigned char cai[0]; +0x0008 67 12 00 00 */ /* unsigned char caui[0]; +0x0008 68 12 00 00 */ /* unsigned char cal[0]; +0x0008 69 12 00 00 */ /* unsigned char caul[0]; +0x0008 6a 12 00 00 */ /* unsigned char cah[0]; +0x0008 6b 12 00 00 */ /* unsigned char cauh[0]; +0x0008 6c 12 00 00 */ /* unsigned char caflt[0]; +0x0008 6d 12 00 00 */ /* unsigned char cadbl[0]; +0x0008 6e 12 00 00 */ /* unsigned char cabool[0]; +0x0008 6f 12 00 00 */ /* unsigned char cascode[0]; +0x0008 70 12 00 00 */ /* unsigned char cacy[0]; +0x0008 71 12 00 00 */ /* unsigned char cadate[0]; +0x0008 72 12 00 00 */ /* unsigned char cafiletime[0]; +0x0008 73 12 00 00 */ /* unsigned char cauuid[0]; +0x0008 74 12 00 00 */ /* unsigned char caclipdata[0]; +0x0008 75 12 00 00 */ /* unsigned char cabstr[0]; +0x0008 76 12 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 77 12 00 00 */ /* unsigned char calpstr[0]; +0x0008 78 12 00 00 */ /* unsigned char calpwstr[0]; +0x0008 79 12 00 00 */ /* unsigned char capropvar[0]; +0x0008 7a 12 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 7c 12 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0008 80 12 00 00 */ unsigned char pvarVal[16]; /* +0x0008 51 12 00 00 */ }; struct tagPROPVARIANT:::::: { char cVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char hVal[0]; +0x0000 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0000 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 52 12 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char filetime[0]; +0x0000 53 12 00 00 */ /* unsigned char puuid[0]; +0x0000 54 12 00 00 */ /* unsigned char pclipdata[0]; +0x0000 56 12 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0000 57 12 00 00 */ /* unsigned char blob[0]; +0x0000 58 12 00 00 */ char *pszVal; /* +0x0000 */ /* unsigned char pwszVal[0]; +0x0000 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0000 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0000 5c 12 00 00 */ /* unsigned char pStream[0]; +0x0000 5e 12 00 00 */ /* unsigned char pStorage[0]; +0x0000 60 12 00 00 */ /* unsigned char pVersionedStream[0]; +0x0000 62 12 00 00 */ /* unsigned char parray[0]; +0x0000 64 12 00 00 */ /* unsigned char cac[0]; +0x0000 65 12 00 00 */ /* unsigned char caub[0]; +0x0000 66 12 00 00 */ /* unsigned char cai[0]; +0x0000 67 12 00 00 */ /* unsigned char caui[0]; +0x0000 68 12 00 00 */ /* unsigned char cal[0]; +0x0000 69 12 00 00 */ /* unsigned char caul[0]; +0x0000 6a 12 00 00 */ /* unsigned char cah[0]; +0x0000 6b 12 00 00 */ /* unsigned char cauh[0]; +0x0000 6c 12 00 00 */ /* unsigned char caflt[0]; +0x0000 6d 12 00 00 */ /* unsigned char cadbl[0]; +0x0000 6e 12 00 00 */ /* unsigned char cabool[0]; +0x0000 6f 12 00 00 */ /* unsigned char cascode[0]; +0x0000 70 12 00 00 */ /* unsigned char cacy[0]; +0x0000 71 12 00 00 */ /* unsigned char cadate[0]; +0x0000 72 12 00 00 */ /* unsigned char cafiletime[0]; +0x0000 73 12 00 00 */ /* unsigned char cauuid[0]; +0x0000 74 12 00 00 */ /* unsigned char caclipdata[0]; +0x0000 75 12 00 00 */ /* unsigned char cabstr[0]; +0x0000 76 12 00 00 */ /* unsigned char cabstrblob[0]; +0x0000 77 12 00 00 */ /* unsigned char calpstr[0]; +0x0000 78 12 00 00 */ /* unsigned char calpwstr[0]; +0x0000 79 12 00 00 */ /* unsigned char capropvar[0]; +0x0000 7a 12 00 00 */ char *pcVal; /* +0x0000 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ long *plVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0000 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 06 00 00 */ short *pboolVal; /* +0x0000 */ /* unsigned char pdecVal[0]; +0x0000 7c 12 00 00 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0000 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0000 80 12 00 00 */ unsigned char pvarVal[16]; /* +0x0000 51 12 00 00 */ }; struct $_TypeDescriptor$_extraBytes_29 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[29]; /* +0x0010 05 28 00 00 */ }; struct tagLC_ID { unsigned short wLanguage; /* +0x0000 */ unsigned short wCountry; /* +0x0002 */ unsigned short wCodePage; /* +0x0004 */ }; struct tagSAFEARRAYBOUND { unsigned long cElements; /* +0x0000 */ long lLbound; /* +0x0004 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long long HDC; /* +0x0008 */ unsigned char Buffer[1240]; /* +0x0010 0e 28 00 00 */ }; enum tagINVOKEKIND { INVOKE_FUNC = 1, INVOKE_PROPERTYGET = 2, INVOKE_PROPERTYPUT = 4, INVOKE_PROPERTYPUTREF = 8 }; struct tagCALPSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 ee 10 00 00 */ }; struct _TypeDescriptor { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ /* unsigned char name[0]; +0x0010 50 28 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagCACY { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 7d 12 00 00 */ }; struct _OVERLAPPED:: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ void *Pointer; /* +0x0000 */ }; struct _OVERLAPPED:::: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ }; struct _SECURITY_QUALITY_OF_SERVICE { unsigned long Length; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 4c 21 00 00 */ unsigned char ContextTrackingMode; /* +0x0008 */ unsigned char EffectiveOnly; /* +0x0009 */ }; struct $_TypeDescriptor$_extraBytes_45 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[45]; /* +0x0010 61 28 00 00 */ }; struct _IO_STATUS_BLOCK:: { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ }; struct _WUDFMESSAGE_CANCEL { /* unsigned char Header[0]; +0x0000 01 1e 00 00 */ unsigned char IoHeader[32]; /* +0x0000 0b 1e 00 00 */ unsigned long long RequestIdToCancel; /* +0x0020 */ }; struct tagVS_FIXEDFILEINFO { unsigned long dwSignature; /* +0x0000 */ unsigned long dwStrucVersion; /* +0x0004 */ unsigned long dwFileVersionMS; /* +0x0008 */ unsigned long dwFileVersionLS; /* +0x000c */ unsigned long dwProductVersionMS; /* +0x0010 */ unsigned long dwProductVersionLS; /* +0x0014 */ unsigned long dwFileFlagsMask; /* +0x0018 */ unsigned long dwFileFlags; /* +0x001c */ unsigned long dwFileOS; /* +0x0020 */ unsigned long dwFileType; /* +0x0024 */ unsigned long dwFileSubtype; /* +0x0028 */ unsigned long dwFileDateMS; /* +0x002c */ unsigned long dwFileDateLS; /* +0x0030 */ }; struct $_TypeDescriptor$_extraBytes_102 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[102]; /* +0x0010 6f 28 00 00 */ }; enum PS_CREATE_STATE { PsCreateInitialState = 0, PsCreateFailOnFileOpen = 1, PsCreateFailOnSectionCreate = 2, PsCreateFailExeFormat = 3, PsCreateFailMachineMismatch = 4, PsCreateFailExeName = 5, PsCreateSuccess = 6, PsCreateMaximumStates = 7 }; struct tagCAUI { unsigned long cElems; /* +0x0000 */ unsigned short *pElems; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char PartialDescriptors[20]; /* +0x0008 9e 28 00 00 */ }; struct _RTL_CRITICAL_SECTION_DEBUG { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char CriticalSection[8]; /* +0x0008 27 13 00 00 */ unsigned char ProcessLocksList[16]; /* +0x0010 82 10 00 00 */ unsigned long EntryCount; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned long Flags; /* +0x0028 */ unsigned short CreatorBackTraceIndexHigh; /* +0x002c */ unsigned short SpareUSHORT; /* +0x002e */ }; struct _WUDF_REQUEST_PARAMETERS:::::: { /* unsigned char Alignment[0]; +0x0000 7d 22 00 00 */ unsigned long DesiredAccess; /* +0x0000 */ }; struct _SYSTEM_POWER_STATE_CONTEXT { /* unsigned char Reserved1[0]; +0x0000 a6 28 00 00 */ /* unsigned char TargetSystemState[0]; +0x0000 a7 28 00 00 */ /* unsigned char EffectiveSystemState[0]; +0x0000 a8 28 00 00 */ /* unsigned char CurrentSystemState[0]; +0x0000 a9 28 00 00 */ /* unsigned char IgnoreHibernationPath[0]; +0x0000 aa 28 00 00 */ /* unsigned char PseudoTransition[0]; +0x0000 ab 28 00 00 */ /* unsigned char Reserved2[0]; +0x0000 ac 28 00 00 */ unsigned long ContextAsUlong; /* +0x0000 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_40 { unsigned char arrayOfBaseClassDescriptors[44]; /* +0x0000 b0 28 00 00 */ }; enum CWMO_FLAGS { CWMO_DISPATCH_CALLS = 1, CWMO_DISPATCH_WINDOW_MESSAGES = 2, REAL_CWMO_ENABLE_CALL_REENTRANCY = 1, CWMO_ENABLE_WINDOW_MESSAGES = 2, CWMO_ENABLE_CALL_REENTRANCY = 3 }; enum _tagPSUACTION { PSU_DEFAULT = 1, PSU_SECURITY_URL_ONLY = 2 }; struct $_s__RTTIBaseClassArray$_extraBytes_32 { unsigned char arrayOfBaseClassDescriptors[36]; /* +0x0000 c3 28 00 00 */ }; struct $_TypeDescriptor$_extraBytes_31 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[31]; /* +0x0010 c7 28 00 00 */ }; enum tagGLOBALOPT_EH_VALUES { COMGLB_EXCEPTION_HANDLE = 0, COMGLB_EXCEPTION_DONOT_HANDLE_FATAL = 1, COMGLB_EXCEPTION_DONOT_HANDLE = 1, COMGLB_EXCEPTION_DONOT_HANDLE_ANY = 2 }; enum __MIDL_IUri_0002 { Uri_HOST_UNKNOWN = 0, Uri_HOST_DNS = 1, Uri_HOST_IPV4 = 2, Uri_HOST_IPV6 = 3, Uri_HOST_IDN = 4 }; struct _PORT_MESSAGE:::: { short DataLength; /* +0x0000 */ short TotalLength; /* +0x0002 */ }; struct _PORT_MESSAGE:::: { short Type; /* +0x0000 */ short DataInfoOffset; /* +0x0002 */ }; struct _PORT_MESSAGE:: { /* unsigned char ClientId[0]; +0x0000 95 10 00 00 */ unsigned char DoNotUseThisField[16]; /* +0x0000 41 00 00 00 */ }; struct _PORT_MESSAGE:: { unsigned long long ClientViewSize; /* +0x0000 */ unsigned long CallbackId; /* +0x0000 */ }; enum WPP_CTL_NAMES { WPP_CTL_DriverManagerTraceGuid = 0, WPP_CTL_TestTraceGuid = 1, WPP_CTL_ReflectorTraceGuid = 2, WPP_CTL_LpcDriverTraceGuid = 3, WPP_CTL_HostProcessTraceGuid = 4, WPP_CTL_FrameworkTraceGuid = 5, WPP_CTL_PlatformLibraryTraceGuid = 6, WPP_CTL_LpcTraceGuid = 7, WPP_LAST_CTL = 8 }; enum _MEMORY_CACHING_TYPE_ORIG { MmFrameBufferCached = 2 }; struct $_s__RTTIBaseClassArray$_extraBytes_104 { unsigned char arrayOfBaseClassDescriptors[108]; /* +0x0000 e2 28 00 00 */ }; struct _WUDFMESSAGE_REGISTER_DEVICE_INTERFACE2 { unsigned char InterfaceGuid[16]; /* +0x0000 17 10 00 00 */ /* unsigned char InterfaceReferenceString[0]; +0x0010 73 13 00 00 */ }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[8]; /* +0x0000 3e 27 00 00 */ unsigned char Handler[8]; /* +0x0008 ed 28 00 00 */ }; enum tagMSHCTX { MSHCTX_LOCAL = 0, MSHCTX_NOSHAREDMEM = 1, MSHCTX_DIFFERENTMACHINE = 2, MSHCTX_INPROC = 3, MSHCTX_CROSSCTX = 4 }; struct _WPP_WIN2K_CONTROL_BLOCK { unsigned long long Logger; /* +0x0000 */ unsigned long Flags; /* +0x0008 */ unsigned long Level; /* +0x000c */ unsigned char ControlGuid[8]; /* +0x0010 19 10 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_56 { unsigned char arrayOfBaseClassDescriptors[60]; /* +0x0000 fb 28 00 00 */ }; struct _CONTEXT { unsigned long long P1Home; /* +0x0000 */ unsigned long long P2Home; /* +0x0008 */ unsigned long long P3Home; /* +0x0010 */ unsigned long long P4Home; /* +0x0018 */ unsigned long long P5Home; /* +0x0020 */ unsigned long long P6Home; /* +0x0028 */ unsigned long ContextFlags; /* +0x0030 */ unsigned long MxCsr; /* +0x0034 */ unsigned short SegCs; /* +0x0038 */ unsigned short SegDs; /* +0x003a */ unsigned short SegEs; /* +0x003c */ unsigned short SegFs; /* +0x003e */ unsigned short SegGs; /* +0x0040 */ unsigned short SegSs; /* +0x0042 */ unsigned long EFlags; /* +0x0044 */ unsigned long long Dr0; /* +0x0048 */ unsigned long long Dr1; /* +0x0050 */ unsigned long long Dr2; /* +0x0058 */ unsigned long long Dr3; /* +0x0060 */ unsigned long long Dr6; /* +0x0068 */ unsigned long long Dr7; /* +0x0070 */ unsigned long long Rax; /* +0x0078 */ unsigned long long Rcx; /* +0x0080 */ unsigned long long Rdx; /* +0x0088 */ unsigned long long Rbx; /* +0x0090 */ unsigned long long Rsp; /* +0x0098 */ unsigned long long Rbp; /* +0x00a0 */ unsigned long long Rsi; /* +0x00a8 */ unsigned long long Rdi; /* +0x00b0 */ unsigned long long R8; /* +0x00b8 */ unsigned long long R9; /* +0x00c0 */ unsigned long long R10; /* +0x00c8 */ unsigned long long R11; /* +0x00d0 */ unsigned long long R12; /* +0x00d8 */ unsigned long long R13; /* +0x00e0 */ unsigned long long R14; /* +0x00e8 */ unsigned long long R15; /* +0x00f0 */ unsigned long long Rip; /* +0x00f8 */ /* unsigned char FltSave[0]; +0x0100 fe 28 00 00 */ unsigned char Header[32]; /* +0x0100 00 29 00 00 */ unsigned char Legacy[128]; /* +0x0120 01 29 00 00 */ unsigned char Xmm0[16]; /* +0x01a0 ff 28 00 00 */ unsigned char Xmm1[16]; /* +0x01b0 ff 28 00 00 */ unsigned char Xmm2[16]; /* +0x01c0 ff 28 00 00 */ unsigned char Xmm3[16]; /* +0x01d0 ff 28 00 00 */ unsigned char Xmm4[16]; /* +0x01e0 ff 28 00 00 */ unsigned char Xmm5[16]; /* +0x01f0 ff 28 00 00 */ unsigned char Xmm6[16]; /* +0x0200 ff 28 00 00 */ unsigned char Xmm7[16]; /* +0x0210 ff 28 00 00 */ unsigned char Xmm8[16]; /* +0x0220 ff 28 00 00 */ unsigned char Xmm9[16]; /* +0x0230 ff 28 00 00 */ unsigned char Xmm10[16]; /* +0x0240 ff 28 00 00 */ unsigned char Xmm11[16]; /* +0x0250 ff 28 00 00 */ unsigned char Xmm12[16]; /* +0x0260 ff 28 00 00 */ unsigned char Xmm13[16]; /* +0x0270 ff 28 00 00 */ unsigned char Xmm14[16]; /* +0x0280 ff 28 00 00 */ unsigned char Xmm15[112]; /* +0x0290 ff 28 00 00 */ unsigned char VectorRegister[416]; /* +0x0300 02 29 00 00 */ unsigned long long VectorControl; /* +0x04a0 */ unsigned long long DebugControl; /* +0x04a8 */ unsigned long long LastBranchToRip; /* +0x04b0 */ unsigned long long LastBranchFromRip; /* +0x04b8 */ unsigned long long LastExceptionToRip; /* +0x04c0 */ unsigned long long LastExceptionFromRip; /* +0x04c8 */ }; struct _CONTEXT:: { /* unsigned char FltSave[0]; +0x0000 fe 28 00 00 */ unsigned char Header[32]; /* +0x0000 00 29 00 00 */ unsigned char Legacy[128]; /* +0x0020 01 29 00 00 */ unsigned char Xmm0[16]; /* +0x00a0 ff 28 00 00 */ unsigned char Xmm1[16]; /* +0x00b0 ff 28 00 00 */ unsigned char Xmm2[16]; /* +0x00c0 ff 28 00 00 */ unsigned char Xmm3[16]; /* +0x00d0 ff 28 00 00 */ unsigned char Xmm4[16]; /* +0x00e0 ff 28 00 00 */ unsigned char Xmm5[16]; /* +0x00f0 ff 28 00 00 */ unsigned char Xmm6[16]; /* +0x0100 ff 28 00 00 */ unsigned char Xmm7[16]; /* +0x0110 ff 28 00 00 */ unsigned char Xmm8[16]; /* +0x0120 ff 28 00 00 */ unsigned char Xmm9[16]; /* +0x0130 ff 28 00 00 */ unsigned char Xmm10[16]; /* +0x0140 ff 28 00 00 */ unsigned char Xmm11[16]; /* +0x0150 ff 28 00 00 */ unsigned char Xmm12[16]; /* +0x0160 ff 28 00 00 */ unsigned char Xmm13[16]; /* +0x0170 ff 28 00 00 */ unsigned char Xmm14[16]; /* +0x0180 ff 28 00 00 */ unsigned char Xmm15[112]; /* +0x0190 ff 28 00 00 */ }; struct _CONTEXT:::: { unsigned char Header[32]; /* +0x0000 00 29 00 00 */ unsigned char Legacy[128]; /* +0x0020 01 29 00 00 */ unsigned char Xmm0[16]; /* +0x00a0 ff 28 00 00 */ unsigned char Xmm1[16]; /* +0x00b0 ff 28 00 00 */ unsigned char Xmm2[16]; /* +0x00c0 ff 28 00 00 */ unsigned char Xmm3[16]; /* +0x00d0 ff 28 00 00 */ unsigned char Xmm4[16]; /* +0x00e0 ff 28 00 00 */ unsigned char Xmm5[16]; /* +0x00f0 ff 28 00 00 */ unsigned char Xmm6[16]; /* +0x0100 ff 28 00 00 */ unsigned char Xmm7[16]; /* +0x0110 ff 28 00 00 */ unsigned char Xmm8[16]; /* +0x0120 ff 28 00 00 */ unsigned char Xmm9[16]; /* +0x0130 ff 28 00 00 */ unsigned char Xmm10[16]; /* +0x0140 ff 28 00 00 */ unsigned char Xmm11[16]; /* +0x0150 ff 28 00 00 */ unsigned char Xmm12[16]; /* +0x0160 ff 28 00 00 */ unsigned char Xmm13[16]; /* +0x0170 ff 28 00 00 */ unsigned char Xmm14[16]; /* +0x0180 ff 28 00 00 */ unsigned char Xmm15[16]; /* +0x0190 ff 28 00 00 */ }; struct tagCAFILETIME { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 f9 17 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ }; struct _PEB:: { unsigned char BitField; /* +0x0000 */ /* unsigned char ImageUsesLargePages[0]; +0x0000 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 b8 27 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 b9 27 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 ba 27 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 bb 27 00 00 */ unsigned char SpareBits[1]; /* +0x0000 bc 27 00 00 */ }; struct _PEB:::: { /* unsigned char ImageUsesLargePages[0]; +0x0000 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 b8 27 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 b9 27 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 ba 27 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 bb 27 00 00 */ unsigned char SpareBits[1]; /* +0x0000 bc 27 00 00 */ }; struct _PEB:: { unsigned long CrossProcessFlags; /* +0x0000 */ /* unsigned char ProcessInJob[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 40 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 c1 27 00 00 */ }; struct _PEB:::: { /* unsigned char ProcessInJob[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 40 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 c1 27 00 00 */ }; struct _PEB:: { void *KernelCallbackTable; /* +0x0000 */ void *UserSharedInfoPtr; /* +0x0000 */ }; struct _PEB:: { unsigned long TracingFlags; /* +0x0000 */ /* unsigned char HeapTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3e 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 cc 27 00 00 */ }; struct _PEB:::: { /* unsigned char HeapTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3e 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 cc 27 00 00 */ }; struct $_TypeDescriptor$_extraBytes_42 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[42]; /* +0x0010 1d 29 00 00 */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; struct $_TypeDescriptor$_extraBytes_16 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[16]; /* +0x0010 23 29 00 00 */ }; enum _WUDF_BREAK_POINT_TYPE { WudfUserBreakin = 1, WudfKernelBreakin = 2, WudfUserOrKernelBreakin = 3 }; struct $_TypeDescriptor$_extraBytes_28 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[28]; /* +0x0010 36 29 00 00 */ }; struct _EVENT_TRACE_HEADER:: { unsigned short FieldTypeFlags; /* +0x0000 */ unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long Version; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { /* unsigned char Guid[0]; +0x0000 17 10 00 00 */ unsigned long long GuidPtr; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ unsigned long long ProcessorTime; /* +0x0000 */ unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0001 { void *DllBase; /* +0x0000 */ void *EntryPoint; /* +0x0008 */ unsigned long SizeOfImage; /* +0x0010 */ unsigned char ModuleHandle[8]; /* +0x0018 c3 11 00 00 */ unsigned char IsWudfComponent[8]; /* +0x0020 74 00 00 00 */ unsigned char FullModuleName[8]; /* +0x0028 71 06 00 00 */ unsigned char BaseModuleName[8]; /* +0x0030 71 06 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Level; /* +0x0000 */ unsigned long Vector; /* +0x0004 */ unsigned long long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { /* unsigned char Raw[0]; +0x0000 7e 29 00 00 */ unsigned char Translated[16]; /* +0x0000 7f 29 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::::::: { unsigned short Reserved; /* +0x0000 */ unsigned short MessageCount; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long Port; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long RequestLine; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Data[12]; /* +0x0000 46 10 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Reserved; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long DataSize; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length40; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length48; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length64; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Class; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char Reserved1; /* +0x0002 */ unsigned char Reserved2; /* +0x0003 */ unsigned long IdLowPart; /* +0x0004 */ unsigned long IdHighPart; /* +0x0008 */ }; struct $_TypeDescriptor$_extraBytes_20 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[20]; /* +0x0010 9b 29 00 00 */ }; struct _WDF_ACTIVATION_FRAME { unsigned char ListHead[8]; /* +0x0000 13 1c 00 00 */ unsigned char NextFrame[8]; /* +0x0008 12 1c 00 00 */ void *Caller; /* +0x0010 */ }; struct _M128A { unsigned long long Low; /* +0x0000 */ long long High; /* +0x0008 */ }; enum _WDF_REQUEST_SEND_OPTIONS_FLAGS { WDF_REQUEST_SEND_OPTION_TIMEOUT = 1, WDF_REQUEST_SEND_OPTION_SYNCHRONOUS = 2, WDF_REQUEST_SEND_OPTION_IGNORE_TARGET_STATE = 4, WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET = 8, /* WDF_REQUEST_SEND_OPTION_IMPERSONATE_CLIENT = Unavail */ }; enum _WUDF_IO_MESSAGE_CONTEXT_TYPE { WudfIoMessageContextFile = 0, WudfIoMessageContextDeviceStack = 1 }; struct _WUDFMESSAGE_IO { /* unsigned char Header[0]; +0x0000 01 1e 00 00 */ unsigned char IoHeader[72]; /* +0x0000 0b 1e 00 00 */ }; struct $_TypeDescriptor$_extraBytes_26 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[26]; /* +0x0010 d9 29 00 00 */ }; struct tagVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 52 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 5c 12 00 00 */ /* unsigned char parray[0]; +0x0008 64 12 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0008 80 12 00 00 */ /* unsigned char pvarVal[0]; +0x0008 84 12 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 7c 12 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ void *pvRecord; /* +0x0008 */ unsigned char pRecInfo[8]; /* +0x0010 88 12 00 00 */ }; struct tagVARIANT:::::: { long long llVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 52 12 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0000 5a 12 00 00 */ /* unsigned char pdispVal[0]; +0x0000 5c 12 00 00 */ /* unsigned char parray[0]; +0x0000 64 12 00 00 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ long *plVal; /* +0x0000 */ long long *pllVal; /* +0x0000 */ /* unsigned char pfltVal[0]; +0x0000 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 06 00 00 */ short *pboolVal; /* +0x0000 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 7d 12 00 00 */ /* unsigned char pdate[0]; +0x0000 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 7e 12 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 7f 12 00 00 */ /* unsigned char pparray[0]; +0x0000 80 12 00 00 */ /* unsigned char pvarVal[0]; +0x0000 84 12 00 00 */ void *byref; /* +0x0000 */ char cVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ unsigned long long ullVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0000 7c 12 00 00 */ char *pcVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ unsigned long long *pullVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 06 00 00 */ void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[8]; /* +0x0008 88 12 00 00 */ }; struct tagVARIANT:::::::: { void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[8]; /* +0x0008 88 12 00 00 */ }; struct tagTYPEATTR { unsigned char guid[16]; /* +0x0000 17 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned long dwReserved; /* +0x0014 */ long memidConstructor; /* +0x0018 */ long memidDestructor; /* +0x001c */ unsigned char lpstrSchema[8]; /* +0x0020 71 06 00 00 */ unsigned long cbSizeInstance; /* +0x0028 */ unsigned char typekind[4]; /* +0x002c 40 19 00 00 */ unsigned short cFuncs; /* +0x0030 */ unsigned short cVars; /* +0x0032 */ unsigned short cImplTypes; /* +0x0034 */ unsigned short cbSizeVft; /* +0x0036 */ unsigned short cbAlignment; /* +0x0038 */ unsigned short wTypeFlags; /* +0x003a */ unsigned short wMajorVerNum; /* +0x003c */ unsigned short wMinorVerNum; /* +0x003e */ unsigned char tdescAlias[16]; /* +0x0040 e3 29 00 00 */ unsigned char idldescType[16]; /* +0x0050 e4 29 00 00 */ }; struct tagCLIPDATA { unsigned long cbSize; /* +0x0000 */ long ulClipFmt; /* +0x0004 */ unsigned char *pClipData; /* +0x0008 */ }; struct threadlocaleinfostruct:: { char *locale; /* +0x0000 */ unsigned char wlocale[8]; /* +0x0008 71 06 00 00 */ unsigned char refcount[8]; /* +0x0010 74 06 00 00 */ unsigned char wrefcount[8]; /* +0x0018 74 06 00 00 */ }; enum WPP_DEFINE_BIT_NAMES { WPP_BLOCK_START_DriverManagerTraceGuid = 0, WPP_BIT_MGR_TRACE_MGR = 1, WPP_BIT_MGR_TRACE_SERVICE_KEY = 2, WPP_BIT_MGR_TRACE_DEVNODE = 3, WPP_BIT_MGR_TRACE_PROCESS = 4, WPP_BIT_MGR_TRACE_LPC = 5, WPP_BIT_MGR_TRACE_RESERVED_05 = 6, WPP_BIT_MGR_TRACE_RESERVED_06 = 7, WPP_BIT_MGR_TRACE_RESERVED_07 = 8, WPP_BIT_MGR_TRACE_RESERVED_08 = 9, WPP_BIT_MGR_TRACE_RESERVED_09 = 10, WPP_BIT_MGR_TRACE_RESERVED_0a = 11, WPP_BIT_MGR_TRACE_RESERVED_0b = 12, WPP_BIT_MGR_TRACE_RESERVED_0c = 13, WPP_BIT_MGR_TRACE_RESERVED_0d = 14, WPP_BIT_MGR_TRACE_RESERVED_0e = 15, WPP_BIT_MGR_TRACE_RESERVED_0f = 16, WPP_BIT_MGR_TRACE_RESERVED_10 = 17, WPP_BIT_MGR_TRACE_RESERVED_11 = 18, WPP_BIT_MGR_TRACE_RESERVED_12 = 19, WPP_BIT_MGR_TRACE_RESERVED_13 = 20, WPP_BIT_MGR_TRACE_RESERVED_14 = 21, WPP_BIT_MGR_TRACE_RESERVED_15 = 22, WPP_BIT_MGR_TRACE_RESERVED_16 = 23, WPP_BIT_MGR_TRACE_RESERVED_17 = 24, WPP_BIT_MGR_TRACE_RESERVED_18 = 25, WPP_BIT_MGR_TRACE_RESERVED_19 = 26, WPP_BIT_MGR_TRACE_RESERVED_1a = 27, WPP_BIT_MGR_TRACE_RESERVED_1b = 28, WPP_BIT_MGR_TRACE_RESERVED_1c = 29, WPP_BIT_MGR_TRACE_RESERVED_1d = 30, WPP_BIT_MGR_TRACE_RESERVED_1e = 31, WPP_BIT_MGR_TRACE_FUNCTION = 32, WPP_BLOCK_END_DriverManagerTraceGuid = 33, /* WPP_BLOCK_START_TestTraceGuid = Unavail */ }; struct _WUDFMESSAGE_IRP_COMPLETION_REPLY { unsigned char Header[8]; /* +0x0000 11 1e 00 00 */ unsigned long long Information; /* +0x0008 */ unsigned char Parameters[64]; /* +0x0010 32 24 00 00 */ }; enum _WPP_FLAG_LEN_ENUM { WPP_FLAG_LEN = 1 }; struct tagDEC { unsigned short wReserved; /* +0x0000 */ unsigned char scale; /* +0x0002 */ unsigned char sign; /* +0x0003 */ unsigned short signscale; /* +0x0002 */ unsigned long Hi32; /* +0x0004 */ unsigned long Lo32; /* +0x0008 */ unsigned long Mid32; /* +0x000c */ unsigned long long Lo64; /* +0x0008 */ }; struct tagDEC:: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ unsigned short signscale; /* +0x0000 */ }; struct tagDEC:::: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ }; struct tagDEC:: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ unsigned long long Lo64; /* +0x0000 */ }; struct tagDEC:::: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ }; struct _IMAGE_OPTIONAL_HEADER64 { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long long ImageBase; /* +0x0018 */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long long SizeOfStackReserve; /* +0x0048 */ unsigned long long SizeOfStackCommit; /* +0x0050 */ unsigned long long SizeOfHeapReserve; /* +0x0058 */ unsigned long long SizeOfHeapCommit; /* +0x0060 */ unsigned long LoaderFlags; /* +0x0068 */ unsigned long NumberOfRvaAndSizes; /* +0x006c */ unsigned char DataDirectory[128]; /* +0x0070 0a 2a 00 00 */ }; struct tagBSTRBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pData; /* +0x0008 */ }; enum _PS_STD_HANDLE_STATE { PsNeverDuplicate = 0, PsRequestDuplicate = 1, PsAlwaysDuplicate = 2, PsMaxStdHandleStates = 3 }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0018 */ void *StandardInput; /* +0x0020 */ void *StandardOutput; /* +0x0028 */ void *StandardError; /* +0x0030 */ unsigned char CurrentDirectory[24]; /* +0x0038 22 2a 00 00 */ unsigned char DllPath[16]; /* +0x0050 a2 10 00 00 */ unsigned char ImagePathName[16]; /* +0x0060 a2 10 00 00 */ unsigned char CommandLine[16]; /* +0x0070 a2 10 00 00 */ void *Environment; /* +0x0080 */ unsigned long StartingX; /* +0x0088 */ unsigned long StartingY; /* +0x008c */ unsigned long CountX; /* +0x0090 */ unsigned long CountY; /* +0x0094 */ unsigned long CountCharsX; /* +0x0098 */ unsigned long CountCharsY; /* +0x009c */ unsigned long FillAttribute; /* +0x00a0 */ unsigned long WindowFlags; /* +0x00a4 */ unsigned long ShowWindowFlags; /* +0x00a8 */ unsigned char WindowTitle[16]; /* +0x00b0 a2 10 00 00 */ unsigned char DesktopInfo[16]; /* +0x00c0 a2 10 00 00 */ unsigned char ShellInfo[16]; /* +0x00d0 a2 10 00 00 */ unsigned char RuntimeData[16]; /* +0x00e0 a2 10 00 00 */ unsigned char CurrentDirectores[768]; /* +0x00f0 24 2a 00 00 */ unsigned char EnvironmentSize[8]; /* +0x03f0 45 10 00 00 */ unsigned char EnvironmentVersion[8]; /* +0x03f8 45 10 00 00 */ unsigned char PackageMoniker[16]; /* +0x0400 a2 10 00 00 */ void *PackageDependencyData; /* +0x0410 */ unsigned long ProcessGroupId; /* +0x0418 */ }; enum _URLZONEREG { URLZONEREG_DEFAULT = 0, URLZONEREG_HKLM = 1, URLZONEREG_HKCU = 2 }; struct $_TypeDescriptor$_extraBytes_27 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[27]; /* +0x0010 38 2a 00 00 */ }; enum tagFUNCKIND { FUNC_VIRTUAL = 0, FUNC_PUREVIRTUAL = 1, FUNC_NONVIRTUAL = 2, FUNC_STATIC = 3, FUNC_DISPATCH = 4 }; struct tagCAUB { unsigned long cElems; /* +0x0000 */ unsigned char *pElems; /* +0x0008 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0008 */ }; enum VARENUM { VT_EMPTY = 0, VT_NULL = 1, VT_I2 = 2, VT_I4 = 3, VT_R4 = 4, VT_R8 = 5, VT_CY = 6, VT_DATE = 7, VT_BSTR = 8, VT_DISPATCH = 9, VT_ERROR = 10, VT_BOOL = 11, VT_VARIANT = 12, VT_UNKNOWN = 13, VT_DECIMAL = 14, VT_I1 = 16, VT_UI1 = 17, VT_UI2 = 18, VT_UI4 = 19, VT_I8 = 20, VT_UI8 = 21, VT_INT = 22, VT_UINT = 23, VT_VOID = 24, VT_HRESULT = 25, VT_PTR = 26, VT_SAFEARRAY = 27, VT_CARRAY = 28, VT_USERDEFINED = 29, VT_LPSTR = 30, VT_LPWSTR = 31, VT_RECORD = 36, VT_INT_PTR = 37, VT_UINT_PTR = 38, VT_FILETIME = 64, VT_BLOB = 65, VT_STREAM = 66, VT_STORAGE = 67, VT_STREAMED_OBJECT = 68, VT_STORED_OBJECT = 69, VT_BLOB_OBJECT = 70, VT_CF = 71, VT_CLSID = 72, VT_VERSIONED_STREAM = 73, VT_BSTR_BLOB = 4095, VT_VECTOR = 4096, VT_ARRAY = 8192, VT_BYREF = 16384, = 32770 }; struct _WUDFMESSAGE_CANCEL:: { /* unsigned char Header[0]; +0x0000 01 1e 00 00 */ unsigned char IoHeader[32]; /* +0x0000 0b 1e 00 00 */ }; struct _USB_IDLE_CALLBACK_INFO { unsigned char IdleCallback[8]; /* +0x0000 1d 16 00 00 */ void *IdleContext; /* +0x0008 */ }; struct _IO_SECURITY_CONTEXT { unsigned char SecurityQos[8]; /* +0x0000 6c 27 00 00 */ unsigned char AccessState[8]; /* +0x0008 7d 2a 00 00 */ unsigned long DesiredAccess; /* +0x0010 */ unsigned long FullCreateOptions; /* +0x0014 */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[16]; /* +0x0010 82 10 00 00 */ unsigned char InMemoryOrderModuleList[16]; /* +0x0020 82 10 00 00 */ unsigned char InInitializationOrderModuleList[16]; /* +0x0030 82 10 00 00 */ void *EntryInProgress; /* +0x0040 */ unsigned char ShutdownInProgress; /* +0x0048 */ void *ShutdownThreadId; /* +0x0050 */ }; struct _ULARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Children[0]; +0x0000 0f 11 00 00 */ unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_BALANCED_NODE:::: { unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Red[0]; +0x0000 10 11 00 00 */ /* unsigned char Balance[0]; +0x0000 36 10 00 00 */ unsigned long long ParentValue; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_30 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[30]; /* +0x0010 8f 2a 00 00 */ }; enum tagURLZONE { URLZONE_INVALID = -1, URLZONE_PREDEFINED_MIN = 0, URLZONE_LOCAL_MACHINE = 0, URLZONE_INTRANET = 1, URLZONE_TRUSTED = 2, URLZONE_INTERNET = 3, URLZONE_UNTRUSTED = 4, URLZONE_PREDEFINED_MAX = 999, URLZONE_USER_MIN = 1000, URLZONE_USER_MAX = 10000 }; struct _STACK_DEVICE_CAPABILITIES { unsigned char DeviceCaps[64]; /* +0x0000 25 1f 00 00 */ unsigned char DeepestWakeableDstate[24]; /* +0x0040 94 2a 00 00 */ }; struct tagIDLDESC { unsigned long long dwReserved; /* +0x0000 */ unsigned short wIDLFlags; /* +0x0008 */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[8]; /* +0x0000 ba 2a 00 00 */ unsigned char FrameListCache[16]; /* +0x0008 82 10 00 00 */ unsigned long Flags; /* +0x0018 */ unsigned long NextCookieSequenceNumber; /* +0x001c */ unsigned long StackId; /* +0x0020 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[16]; /* +0x0008 ea 10 00 00 */ }; struct tagTYPEDESC { /* unsigned char lptdesc[0]; +0x0000 bf 2a 00 00 */ /* unsigned char lpadesc[0]; +0x0000 c1 2a 00 00 */ unsigned long hreftype; /* +0x0000 */ unsigned short vt; /* +0x0008 */ }; struct tagTYPEDESC:: { /* unsigned char lptdesc[0]; +0x0000 bf 2a 00 00 */ /* unsigned char lpadesc[0]; +0x0000 c1 2a 00 00 */ unsigned long hreftype; /* +0x0000 */ }; enum tagTYSPEC { TYSPEC_CLSID = 0, TYSPEC_FILEEXT = 1, TYSPEC_MIMETYPE = 2, TYSPEC_FILENAME = 3, TYSPEC_PROGID = 4, TYSPEC_PACKAGENAME = 5, TYSPEC_OBJECTID = 6 }; struct $_TypeDescriptor$_extraBytes_40 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[40]; /* +0x0010 de 2a 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_48 { unsigned char arrayOfBaseClassDescriptors[52]; /* +0x0000 e2 2a 00 00 */ }; struct { /* unsigned char typeInfo_CWudfFileObj[0]; +0x0000 d2 20 00 00 */ /* unsigned char typeInfo_CWudfIrp[0]; +0x0000 93 20 00 00 */ /* unsigned char typeInfo_CWudfIoIrp[0]; +0x0000 cf 20 00 00 */ /* unsigned char typeInfo_IWudfFile[0]; +0x0000 cb 1f 00 00 */ /* unsigned char typeInfo_IWudfIoIrp[0]; +0x0000 6f 1f 00 00 */ /* unsigned char typeInfo_CWudfDevStackTable[0]; +0x0000 e7 2a 00 00 */ /* unsigned char typeInfo_CWudfDeviceStack[0]; +0x0000 54 20 00 00 */ /* unsigned char typeInfo_CWudfDriverInfo[0]; +0x0000 89 20 00 00 */ /* unsigned char typeInfo_CWudfDevice[0]; +0x0000 90 20 00 00 */ /* unsigned char typeInfo_CWudfIoStack[0]; +0x0000 e7 22 00 00 */ /* unsigned char typeInfo_CWudfIoStackLocation[0]; +0x0000 60 22 00 00 */ /* unsigned char typeInfo_CWudfIrpTable[0]; +0x0000 e8 2a 00 00 */ /* unsigned char typeInfo_CWudfDriverCreatedFile[0]; +0x0000 03 22 00 00 */ /* unsigned char typeInfo_CWudfRefCountedHandle[0]; +0x0000 f0 21 00 00 */ /* unsigned char typeInfo_WUDFMESSAGE_IRP[0]; +0x0000 db 23 00 00 */ /* unsigned char typeInfo_WudfDriverAndFxInfo[0]; +0x0000 aa 20 00 00 */ /* unsigned char typeInfo__UMURB_HEADER[0]; +0x0000 ea 2a 00 00 */ /* unsigned char typeInfo__WUDF_REQUEST_PARAMETERS[0]; +0x0000 6b 22 00 00 */ /* unsigned char typeInfo__WDF_REQUEST_TYPE[0]; +0x0000 9b 23 00 00 */ unsigned char typeInfo__WUDFMESSAGE[8]; /* +0x0000 fe 22 00 00 */ }; enum tagSTREAM_SEEK { STREAM_SEEK_SET = 0, STREAM_SEEK_CUR = 1, STREAM_SEEK_END = 2 }; enum tagCOINITBASE { COINITBASE_MULTITHREADED = 0 }; enum tagDESCKIND { DESCKIND_NONE = 0, DESCKIND_FUNCDESC = 1, DESCKIND_VARDESC = 2, DESCKIND_TYPECOMP = 3, DESCKIND_IMPLICITAPPOBJ = 4, DESCKIND_MAX = 5 }; struct tagCY:: { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _tagQUERYOPTION { QUERY_EXPIRATION_DATE = 1, QUERY_TIME_OF_LAST_CHANGE = 2, QUERY_CONTENT_ENCODING = 3, QUERY_CONTENT_TYPE = 4, QUERY_REFRESH = 5, QUERY_RECOMBINE = 6, QUERY_CAN_NAVIGATE = 7, QUERY_USES_NETWORK = 8, QUERY_IS_CACHED = 9, QUERY_IS_INSTALLEDENTRY = 10, QUERY_IS_CACHED_OR_MAPPED = 11, QUERY_USES_CACHE = 12, QUERY_IS_SECURE = 13, QUERY_IS_SAFE = 14, QUERY_USES_HISTORYFOLDER = 15, QUERY_IS_CACHED_AND_USABLE_OFFLINE = 16 }; enum __MIDL_IUri_0001 { Uri_PROPERTY_ABSOLUTE_URI = 0, Uri_PROPERTY_STRING_START = 0, Uri_PROPERTY_AUTHORITY = 1, Uri_PROPERTY_DISPLAY_URI = 2, Uri_PROPERTY_DOMAIN = 3, Uri_PROPERTY_EXTENSION = 4, Uri_PROPERTY_FRAGMENT = 5, Uri_PROPERTY_HOST = 6, Uri_PROPERTY_PASSWORD = 7, Uri_PROPERTY_PATH = 8, Uri_PROPERTY_PATH_AND_QUERY = 9, Uri_PROPERTY_QUERY = 10, Uri_PROPERTY_RAW_URI = 11, Uri_PROPERTY_SCHEME_NAME = 12, Uri_PROPERTY_USER_INFO = 13, Uri_PROPERTY_USER_NAME = 14, Uri_PROPERTY_STRING_LAST = 14, Uri_PROPERTY_HOST_TYPE = 15, Uri_PROPERTY_DWORD_START = 15, Uri_PROPERTY_PORT = 16, Uri_PROPERTY_SCHEME = 17, Uri_PROPERTY_ZONE = 18, Uri_PROPERTY_DWORD_LAST = 18 }; struct _WUDFMESSAGE_IO:: { /* unsigned char CreateContext[0]; +0x0000 0d 1e 00 00 */ unsigned char DevnodeContext[8]; /* +0x0000 04 1e 00 00 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long IoControlCode; /* +0x0000 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long Key; /* +0x0000 */ unsigned char ByteOffset[8]; /* +0x0008 35 10 00 00 */ }; struct _WUDFMESSAGE_IO:::: { unsigned char FileInformationClass[4]; /* +0x0000 1b 25 00 00 */ }; enum tagBINDSTRING { BINDSTRING_HEADERS = 1, BINDSTRING_ACCEPT_MIMES = 2, BINDSTRING_EXTRA_URL = 3, BINDSTRING_LANGUAGE = 4, BINDSTRING_USERNAME = 5, BINDSTRING_PASSWORD = 6, BINDSTRING_UA_PIXELS = 7, BINDSTRING_UA_COLOR = 8, BINDSTRING_OS = 9, BINDSTRING_USER_AGENT = 10, BINDSTRING_ACCEPT_ENCODINGS = 11, BINDSTRING_POST_COOKIE = 12, BINDSTRING_POST_DATA_MIME = 13, BINDSTRING_URL = 14, BINDSTRING_IID = 15, BINDSTRING_FLAG_BIND_TO_OBJECT = 16, BINDSTRING_PTR_BIND_CONTEXT = 17, BINDSTRING_XDR_ORIGIN = 18, BINDSTRING_DOWNLOADPATH = 19, BINDSTRING_ROOTDOC_URL = 20, BINDSTRING_INITIAL_FILENAME = 21 }; enum tagVARKIND { VAR_PERINSTANCE = 0, VAR_STATIC = 1, VAR_CONST = 2, VAR_DISPATCH = 3 }; struct tagVARDESC { long memid; /* +0x0000 */ unsigned char lpstrSchema[8]; /* +0x0008 71 06 00 00 */ unsigned long oInst; /* +0x0010 */ unsigned char lpvarValue[8]; /* +0x0010 84 12 00 00 */ unsigned char elemdescVar[32]; /* +0x0018 3a 2b 00 00 */ unsigned short wVarFlags; /* +0x0038 */ unsigned char varkind[4]; /* +0x003c 3c 2b 00 00 */ }; struct tagVARDESC:: { unsigned long oInst; /* +0x0000 */ unsigned char lpvarValue[8]; /* +0x0000 84 12 00 00 */ }; struct _UMURB_HEADER { unsigned short Length; /* +0x0000 */ unsigned short Function; /* +0x0002 */ void *InterfaceHandle; /* +0x0008 */ unsigned long Status; /* +0x0010 */ }; struct $_TypeDescriptor$_extraBytes_101 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[101]; /* +0x0010 52 2b 00 00 */ }; struct tagARRAYDESC { unsigned char tdescElem[16]; /* +0x0000 e3 29 00 00 */ unsigned short cDims; /* +0x0010 */ unsigned char rgbounds[12]; /* +0x0014 88 13 00 00 */ }; enum _WDF_IO_QUEUE_DISPATCH_TYPE { WdfIoQueueDispatchSequential = 1, WdfIoQueueDispatchParallel = 2, WdfIoQueueDispatchManual = 3, WdfIoQueueDispatchMaximum = 4 }; enum _WDF_PNP_STATE { WdfPnpStateInvalid = 0, WdfPnpStateDisabled = 1, WdfPnpStateFailed = 2, WdfPnpStateRemoved = 3, WdfPnpStateResourcesChanged = 4, WdfPnpStateDontDisplayInUI = 5, WdfPnpStateNotDisableable = 6, WdfPnpStateMaximum = 7 }; enum _WUDF_TRI_STATE { WudfUseDefault = 0, WudfFalse = 1, WudfTrue = 2 }; struct _ACCESS_STATE { unsigned char OperationID[8]; /* +0x0000 fc 10 00 00 */ unsigned char SecurityEvaluated; /* +0x0008 */ unsigned char GenerateAudit; /* +0x0009 */ unsigned char GenerateOnClose; /* +0x000a */ unsigned char PrivilegesAllocated; /* +0x000b */ unsigned long Flags; /* +0x000c */ unsigned long RemainingDesiredAccess; /* +0x0010 */ unsigned long PreviouslyGrantedAccess; /* +0x0014 */ unsigned long OriginalDesiredAccess; /* +0x0018 */ unsigned char SubjectSecurityContext[32]; /* +0x0020 93 2b 00 00 */ void *SecurityDescriptor; /* +0x0040 */ void *AuxData; /* +0x0048 */ }; struct _ACCESS_STATE:: { /* unsigned char InitialPrivilegeSet[0]; +0x0000 97 2b 00 00 */ unsigned char PrivilegeSet[44]; /* +0x0000 98 2b 00 00 */ }; struct _WUDFMESSAGE_IRP:: { /* unsigned char DevnodeContext[0]; +0x0000 04 1e 00 00 */ unsigned char CreateContext[8]; /* +0x0000 0d 1e 00 00 */ }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; enum tagXMLEMEM_TYPE { XMLELEMTYPE_ELEMENT = 0, XMLELEMTYPE_TEXT = 1, XMLELEMTYPE_COMMENT = 2, XMLELEMTYPE_DOCUMENT = 3, XMLELEMTYPE_DTD = 4, XMLELEMTYPE_PI = 5, XMLELEMTYPE_OTHER = 6 }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerState[4]; /* +0x0000 1f 1f 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerSequence[12]; /* +0x0000 fc 2b 00 00 */ }; struct _XSAVE_FORMAT { unsigned short ControlWord; /* +0x0000 */ unsigned short StatusWord; /* +0x0002 */ unsigned char TagWord; /* +0x0004 */ unsigned char Reserved1; /* +0x0005 */ unsigned short ErrorOpcode; /* +0x0006 */ unsigned long ErrorOffset; /* +0x0008 */ unsigned short ErrorSelector; /* +0x000c */ unsigned short Reserved2; /* +0x000e */ unsigned long DataOffset; /* +0x0010 */ unsigned short DataSelector; /* +0x0014 */ unsigned short Reserved3; /* +0x0016 */ unsigned long MxCsr; /* +0x0018 */ unsigned long MxCsr_Mask; /* +0x001c */ unsigned char FloatRegisters[128]; /* +0x0020 01 29 00 00 */ unsigned char XmmRegisters[256]; /* +0x00a0 19 2c 00 00 */ unsigned char Reserved4[96]; /* +0x01a0 1a 2c 00 00 */ }; enum tagCLSCTX { CLSCTX_INPROC_SERVER = 1, CLSCTX_INPROC_HANDLER = 2, CLSCTX_LOCAL_SERVER = 4, CLSCTX_INPROC_SERVER16 = 8, CLSCTX_REMOTE_SERVER = 16, CLSCTX_INPROC_HANDLER16 = 32, CLSCTX_RESERVED1 = 64, CLSCTX_RESERVED2 = 128, CLSCTX_RESERVED3 = 256, CLSCTX_RESERVED4 = 512, CLSCTX_NO_CODE_DOWNLOAD = 1024, CLSCTX_RESERVED5 = 2048, CLSCTX_NO_CUSTOM_MARSHAL = 4096, CLSCTX_ENABLE_CODE_DOWNLOAD = 8192, CLSCTX_NO_FAILURE_LOG = 16384, = 32770 }; struct _SECURITY_SUBJECT_CONTEXT { void *ClientToken; /* +0x0000 */ unsigned char ImpersonationLevel[8]; /* +0x0008 4c 21 00 00 */ void *PrimaryToken; /* +0x0010 */ void *ProcessAuditId; /* +0x0018 */ }; struct _WPP_TRACE_CONTROL_BLOCK:: { unsigned long long Logger; /* +0x0000 */ /* unsigned char Win2kCb[0]; +0x0000 58 24 00 00 */ void *Ptr; /* +0x0000 */ unsigned char Cb[8]; /* +0x0000 55 24 00 00 */ }; struct $_TypeDescriptor$_extraBytes_14 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[14]; /* +0x0010 25 2c 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0006_0001 { unsigned char StartNewTraceSession[4]; /* +0x0000 74 00 00 00 */ unsigned char PrivateTrace[4]; /* +0x0004 74 00 00 00 */ unsigned char TruncateExistingLog[4]; /* +0x0008 74 00 00 00 */ unsigned long MaximumLogFileMb; /* +0x000c */ }; struct tagFUNCDESC { long memid; /* +0x0000 */ long *lprgscode; /* +0x0008 */ unsigned char lprgelemdescParam[8]; /* +0x0010 2a 2c 00 00 */ unsigned char funckind[4]; /* +0x0018 3c 2a 00 00 */ unsigned char invkind[4]; /* +0x001c 2f 28 00 00 */ unsigned char callconv[4]; /* +0x0020 08 27 00 00 */ short cParams; /* +0x0024 */ short cParamsOpt; /* +0x0026 */ short oVft; /* +0x0028 */ short cScodes; /* +0x002a */ unsigned char elemdescFunc[32]; /* +0x0030 3a 2b 00 00 */ unsigned short wFuncFlags; /* +0x0050 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_88 { unsigned char arrayOfBaseClassDescriptors[92]; /* +0x0000 3c 2c 00 00 */ }; enum PIDMSI_STATUS_VALUE { PIDMSI_STATUS_NORMAL = 0, PIDMSI_STATUS_NEW = 1, PIDMSI_STATUS_PRELIM = 2, PIDMSI_STATUS_DRAFT = 3, PIDMSI_STATUS_INPROGRESS = 4, PIDMSI_STATUS_EDIT = 5, PIDMSI_STATUS_REVIEW = 6, PIDMSI_STATUS_PROOF = 7, PIDMSI_STATUS_FINAL = 8, PIDMSI_STATUS_OTHER = 32767 }; enum tagApplicationType { ServerApplication = 0, LibraryApplication = 1 }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[8]; /* +0x0008 ea 28 00 00 */ void *ExceptionAddress; /* +0x0010 */ unsigned long NumberParameters; /* +0x0018 */ unsigned char ExceptionInformation[120]; /* +0x0020 43 2c 00 00 */ }; struct _SYSTEM_POWER_STATE_CONTEXT:::: { /* unsigned char Reserved1[0]; +0x0000 a6 28 00 00 */ /* unsigned char TargetSystemState[0]; +0x0000 a7 28 00 00 */ /* unsigned char EffectiveSystemState[0]; +0x0000 a8 28 00 00 */ /* unsigned char CurrentSystemState[0]; +0x0000 a9 28 00 00 */ /* unsigned char IgnoreHibernationPath[0]; +0x0000 aa 28 00 00 */ /* unsigned char PseudoTransition[0]; +0x0000 ab 28 00 00 */ unsigned char Reserved2[4]; /* +0x0000 ac 28 00 00 */ }; struct $_TypeDescriptor$_extraBytes_104 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[104]; /* +0x0010 4a 2c 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0002 { unsigned char TraceGuid[16]; /* +0x0000 17 10 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long Level; /* +0x0014 */ }; struct _INITIAL_PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[36]; /* +0x0008 50 2c 00 00 */ }; struct tagCONNECTDATA { unsigned char pUnk[8]; /* +0x0000 5a 12 00 00 */ unsigned long dwCookie; /* +0x0008 */ }; struct tagELEMDESC { unsigned char tdesc[16]; /* +0x0000 e3 29 00 00 */ /* unsigned char idldesc[0]; +0x0010 e4 29 00 00 */ unsigned char paramdesc[16]; /* +0x0010 55 2c 00 00 */ }; struct tagELEMDESC:: { /* unsigned char idldesc[0]; +0x0000 e4 29 00 00 */ unsigned char paramdesc[16]; /* +0x0000 55 2c 00 00 */ }; struct _POWER_SEQUENCE { unsigned long SequenceD1; /* +0x0000 */ unsigned long SequenceD2; /* +0x0004 */ unsigned long SequenceD3; /* +0x0008 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[16]; /* +0x0000 a2 10 00 00 */ void *Handle; /* +0x0010 */ }; struct _LUID_AND_ATTRIBUTES { unsigned char Luid[8]; /* +0x0000 fc 10 00 00 */ unsigned long Attributes; /* +0x0008 */ }; enum _WDF_CALLBACK_CONSTRAINT { None = 0, WdfDeviceLevel = 1, WdfLevelReserved = 2, WdfLevelMaximum = 3 }; enum _WDF_PNP_CAPABILITY { WdfPnpCapInvalid = 0, WdfPnpCapLockSupported = 1, WdfPnpCapEjectSupported = 2, WdfPnpCapRemovable = 3, WdfPnpCapDockDevice = 4, WdfPnpCapSurpriseRemovalOk = 5, WdfPnpCapNoDisplayInUI = 6, WdfPnpCapMaximum = 7 }; struct tagPARAMDESC { unsigned char pparamdescex[8]; /* +0x0000 bc 2c 00 00 */ unsigned short wParamFlags; /* +0x0008 */ }; enum _WDF_IO_QUEUE_STATE { WdfIoQueueAcceptRequests = 1, WdfIoQueueDispatchRequests = 2, WdfIoQueueNoRequests = 4, WdfIoQueueDriverNoRequests = 8, WdfIoQueuePnpHeld = 16 }; struct tagBINDPTR { /* unsigned char lpfuncdesc[0]; +0x0000 19 28 00 00 */ /* unsigned char lpvardesc[0]; +0x0000 1e 28 00 00 */ unsigned char lptcomp[8]; /* +0x0000 4c 19 00 00 */ }; struct _WUDFMEMORY_OFFSET { unsigned long long BufferOffset; /* +0x0000 */ unsigned long long BufferLength; /* +0x0008 */ }; struct _PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[12]; /* +0x0008 45 2d 00 00 */ }; struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { unsigned char Previous[8]; /* +0x0000 ba 2a 00 00 */ unsigned char ActivationContext[8]; /* +0x0008 61 10 00 00 */ unsigned long Flags; /* +0x0010 */ }; struct tagPARAMDESCEX { unsigned long cBytes; /* +0x0000 */ unsigned char varDefaultValue[24]; /* +0x0008 83 12 00 00 */ };