/* Header autogenerated by Brandon Falk's PDB Dumper * * Invocation: C:\projects\pdbdump_2\pdbdump.exe L:\symbolarchive\win8_spB_x64\wudfplatform.pdb\B74E78F345734A328C34FF82906A04951\wudfplatform.pdb */ struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 1a 10 00 00 */ }; enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 2a 10 00 00 */ unsigned char SystemTime[12]; /* +0x0014 2a 10 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 2a 10 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 2b 10 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 2c 10 00 00 */ unsigned char NtProductType[4]; /* +0x0264 2e 10 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 2f 10 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 30 10 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc 31 10 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 33 10 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 34 10 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 35 10 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 38 10 00 00 */ unsigned char Reserved[1]; /* +0x02d5 39 10 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 3a 10 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 31 10 00 00 */ unsigned char DismountCount[4]; /* +0x02dc 31 10 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 3b 10 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 43 10 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 34 10 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 44 10 00 00 */ /* unsigned char TickCount[0]; +0x0320 2a 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 45 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x032c 34 10 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 34 10 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 45 10 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 47 10 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 48 10 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 45 10 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 45 10 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 31 10 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 49 10 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 49 10 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 4a 10 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[8]; /* +0x0008 5a 10 00 00 */ unsigned char CleanupGroup[8]; /* +0x0010 5c 10 00 00 */ unsigned char CleanupGroupCancelCallback[8]; /* +0x0018 5f 10 00 00 */ void *RaceDll; /* +0x0020 */ unsigned char ActivationContext[8]; /* +0x0028 61 10 00 00 */ unsigned char FinalizationCallback[24]; /* +0x0030 66 10 00 00 */ }; struct _TP_CALLBACK_ENVIRON_V3:: { unsigned long Flags; /* +0x0000 */ }; struct _TP_CALLBACK_ENVIRON_V3:::: { /* unsigned char LongFunction[0]; +0x0000 3c 10 00 00 */ /* unsigned char Persistent[0]; +0x0000 3d 10 00 00 */ unsigned char Private[4]; /* +0x0000 7a 10 00 00 */ }; struct _TP_TASK { unsigned char Callbacks[8]; /* +0x0000 81 10 00 00 */ unsigned long NumaNode; /* +0x0008 */ unsigned char IdealProcessor; /* +0x000c */ unsigned char ListEntry[16]; /* +0x0010 82 10 00 00 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[8]; /* +0x0000 88 10 00 00 */ unsigned char Unposted[8]; /* +0x0008 8b 10 00 00 */ }; struct _TEB { unsigned char NtTib[56]; /* +0x0000 94 10 00 00 */ void *EnvironmentPointer; /* +0x0038 */ unsigned char ClientId[16]; /* +0x0040 95 10 00 00 */ void *ActiveRpcHandle; /* +0x0050 */ void *ThreadLocalStoragePointer; /* +0x0058 */ unsigned char ProcessEnvironmentBlock[8]; /* +0x0060 97 10 00 00 */ unsigned long LastErrorValue; /* +0x0068 */ unsigned long CountOfOwnedCriticalSections; /* +0x006c */ void *CsrClientThread; /* +0x0070 */ void *Win32ThreadInfo; /* +0x0078 */ unsigned char User32Reserved[104]; /* +0x0080 98 10 00 00 */ unsigned char UserReserved[24]; /* +0x00e8 99 10 00 00 */ void *WOW32Reserved; /* +0x0100 */ unsigned long CurrentLocale; /* +0x0108 */ unsigned long FpSoftwareStatusRegister; /* +0x010c */ unsigned char SystemReserved1[432]; /* +0x0110 9a 10 00 00 */ long ExceptionCode; /* +0x02c0 */ unsigned char ActivationContextStackPointer[8]; /* +0x02c8 9c 10 00 00 */ unsigned char SpareBytes[24]; /* +0x02d0 9d 10 00 00 */ unsigned long TxFsContext; /* +0x02e8 */ unsigned char GdiTebBatch[1256]; /* +0x02f0 9e 10 00 00 */ unsigned char RealClientId[16]; /* +0x07d8 95 10 00 00 */ void *GdiCachedProcessHandle; /* +0x07e8 */ unsigned long GdiClientPID; /* +0x07f0 */ unsigned long GdiClientTID; /* +0x07f4 */ void *GdiThreadLocalInfo; /* +0x07f8 */ unsigned char Win32ClientInfo[496]; /* +0x0800 9f 10 00 00 */ unsigned char glDispatchTable[1864]; /* +0x09f0 a0 10 00 00 */ unsigned char glReserved1[232]; /* +0x1138 a1 10 00 00 */ void *glReserved2; /* +0x1220 */ void *glSectionInfo; /* +0x1228 */ void *glSection; /* +0x1230 */ void *glTable; /* +0x1238 */ void *glCurrentRC; /* +0x1240 */ void *glContext; /* +0x1248 */ unsigned long LastStatusValue; /* +0x1250 */ unsigned char StaticUnicodeString[16]; /* +0x1258 a2 10 00 00 */ unsigned char StaticUnicodeBuffer[528]; /* +0x1268 a3 10 00 00 */ void *DeallocationStack; /* +0x1478 */ unsigned char TlsSlots[512]; /* +0x1480 a4 10 00 00 */ unsigned char TlsLinks[16]; /* +0x1680 82 10 00 00 */ void *Vdm; /* +0x1690 */ void *ReservedForNtRpc; /* +0x1698 */ unsigned char DbgSsReserved[16]; /* +0x16a0 a5 10 00 00 */ unsigned long HardErrorMode; /* +0x16b0 */ unsigned char Instrumentation[88]; /* +0x16b8 a6 10 00 00 */ unsigned char ActivityId[16]; /* +0x1710 17 10 00 00 */ void *SubProcessTag; /* +0x1720 */ void *EtwLocalData; /* +0x1728 */ void *EtwTraceData; /* +0x1730 */ void *WinSockData; /* +0x1738 */ unsigned long GdiBatchCount; /* +0x1740 */ /* unsigned char CurrentIdealProcessor[0]; +0x1744 a7 10 00 00 */ unsigned long IdealProcessorValue; /* +0x1744 */ unsigned char ReservedPad0; /* +0x1744 */ unsigned char ReservedPad1; /* +0x1745 */ unsigned char ReservedPad2; /* +0x1746 */ unsigned char IdealProcessor; /* +0x1747 */ unsigned long GuaranteedStackBytes; /* +0x1748 */ void *ReservedForPerf; /* +0x1750 */ void *ReservedForOle; /* +0x1758 */ unsigned long WaitingOnLoaderLock; /* +0x1760 */ void *SavedPriorityState; /* +0x1768 */ unsigned long long ReservedForCodeCoverage; /* +0x1770 */ void *ThreadPoolData; /* +0x1778 */ unsigned char TlsExpansionSlots[8]; /* +0x1780 6f 10 00 00 */ void *DeallocationBStore; /* +0x1788 */ void *BStoreLimit; /* +0x1790 */ unsigned long MuiGeneration; /* +0x1798 */ unsigned long IsImpersonating; /* +0x179c */ void *NlsCache; /* +0x17a0 */ void *pShimData; /* +0x17a8 */ unsigned short HeapVirtualAffinity; /* +0x17b0 */ unsigned short LowFragHeapDataSlot; /* +0x17b2 */ void *CurrentTransactionHandle; /* +0x17b8 */ unsigned char ActiveFrame[8]; /* +0x17c0 a9 10 00 00 */ void *FlsData; /* +0x17c8 */ void *PreferredLanguages; /* +0x17d0 */ void *UserPrefLanguages; /* +0x17d8 */ void *MergedPrefLanguages; /* +0x17e0 */ unsigned long MuiImpersonation; /* +0x17e8 */ /* unsigned char CrossTebFlags[0]; +0x17ec aa 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x17ec ab 10 00 00 */ unsigned short SameTebFlags; /* +0x17ee */ /* unsigned char SafeThunkCall[0]; +0x17ee ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x17ee ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x17ee ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x17ee af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x17ee b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x17ee b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x17ee b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x17ee b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x17ee b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x17ee b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x17ee b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x17ee b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x17ee b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x17ee b9 10 00 00 */ void *TxnScopeEnterCallback; /* +0x17f0 */ void *TxnScopeExitCallback; /* +0x17f8 */ void *TxnScopeContext; /* +0x1800 */ unsigned long LockCount; /* +0x1808 */ unsigned long SpareUlong0; /* +0x180c */ void *ResourceRetValue; /* +0x1810 */ void *ReservedForWdf; /* +0x1818 */ }; struct _LIST_ENTRY { unsigned char Flink[8]; /* +0x0000 bd 10 00 00 */ unsigned char Blink[8]; /* +0x0008 bd 10 00 00 */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[8]; /* +0x0000 cc 10 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[8]; /* +0x0000 d1 10 00 00 */ unsigned char LeftChild[8]; /* +0x0008 d1 10 00 00 */ unsigned char RightChild[8]; /* +0x0010 d1 10 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[8]; /* +0x0000 bd 10 00 00 */ unsigned char PrevLinkage[8]; /* +0x0008 bd 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[24]; /* +0x0000 db 10 00 00 */ unsigned char ChainHead[8]; /* +0x0018 bd 10 00 00 */ unsigned long BucketIndex; /* +0x0020 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[16]; /* +0x0000 82 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[8]; /* +0x0008 71 06 00 00 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0008 */ }; struct _RTL_BITMAP { unsigned long SizeOfBitMap; /* +0x0000 */ unsigned long *Buffer; /* +0x0008 */ }; struct _LARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct _IMAGE_NT_HEADERS64 { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 00 11 00 00 */ unsigned char OptionalHeader[240]; /* +0x0018 01 11 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c 06 11 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 07 11 00 00 */ long e_lfanew; /* +0x003c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 0f 11 00 00 */ unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ /* unsigned char Red[0]; +0x0010 10 11 00 00 */ /* unsigned char Balance[0]; +0x0010 36 10 00 00 */ unsigned long long ParentValue; /* +0x0010 */ }; struct _RTL_RB_TREE { unsigned char Root[8]; /* +0x0000 0e 11 00 00 */ unsigned char Min[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[8]; /* +0x0000 0e 11 00 00 */ }; struct _ldiv_t { long quot; /* +0x0000 */ long rem; /* +0x0004 */ }; struct _iobuf { char *_ptr; /* +0x0000 */ unsigned char _cnt[8]; /* +0x0008 74 00 00 00 */ char *_base; /* +0x0010 */ unsigned char _flag[4]; /* +0x0018 74 00 00 00 */ unsigned char _file[4]; /* +0x001c 74 00 00 00 */ unsigned char _charbuf[4]; /* +0x0020 74 00 00 00 */ unsigned char _bufsiz[4]; /* +0x0024 74 00 00 00 */ char *_tmpfname; /* +0x0028 */ }; struct localeinfo_struct { unsigned char locinfo[8]; /* +0x0000 44 11 00 00 */ unsigned char mbcinfo[8]; /* +0x0008 46 11 00 00 */ }; enum tagAR_STATE { AR_ENABLED = 0, AR_DISABLED = 1, AR_SUPPRESSED = 2, AR_REMOTESESSION = 4, AR_MULTIMON = 8, AR_NOSENSOR = 16, AR_NOT_SUPPORTED = 32 }; struct _EVENT_DATA_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _EVENT_DESCRIPTOR { unsigned short Id; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char Channel; /* +0x0003 */ unsigned char Level; /* +0x0004 */ unsigned char Opcode; /* +0x0005 */ unsigned short Task; /* +0x0006 */ unsigned long long Keyword; /* +0x0008 */ }; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified = 0, PowerDeviceD0 = 1, PowerDeviceD1 = 2, PowerDeviceD2 = 3, PowerDeviceD3 = 4, PowerDeviceMaximum = 5 }; enum _DEVICE_WAKE_DEPTH { DeviceWakeDepthNotWakeable = 0, DeviceWakeDepthD0 = 1, DeviceWakeDepthD1 = 2, DeviceWakeDepthD2 = 3, DeviceWakeDepthD3hot = 4, DeviceWakeDepthD3cold = 5, DeviceWakeDepthMaximum = 6 }; struct _WORK_QUEUE_ITEM { unsigned char List[16]; /* +0x0000 82 10 00 00 */ unsigned char WorkerRoutine[8]; /* +0x0010 16 12 00 00 */ void *Parameter; /* +0x0018 */ }; enum _POWER_STATE_TYPE { SystemPowerState = 0, DevicePowerState = 1 }; enum _DEVICE_RELATION_TYPE { BusRelations = 0, EjectionRelations = 1, PowerRelations = 2, RemovalRelations = 3, TargetDeviceRelation = 4, SingleBusRelations = 5, TransportRelations = 6 }; struct MxDeviceObject { unsigned char m_DeviceObject[8]; /* +0x0000 1d 12 00 00 */ }; struct HINSTANCE__ { unsigned char unused[4]; /* +0x0000 74 00 00 00 */ }; struct _OBJECT_ATTRIBUTES { unsigned long Length; /* +0x0000 */ void *RootDirectory; /* +0x0008 */ unsigned char ObjectName[8]; /* +0x0010 e6 10 00 00 */ unsigned long Attributes; /* +0x0018 */ void *SecurityDescriptor; /* +0x0020 */ void *SecurityQualityOfService; /* +0x0028 */ }; struct MxLockNoDynam { unsigned char m_Lock[48]; /* +0x0000 4e 12 00 00 */ }; struct MdLock { unsigned char Lock[40]; /* +0x0000 5a 12 00 00 */ unsigned char Initialized[4]; /* +0x0028 30 00 00 00 */ unsigned long OwnerThreadId; /* +0x002c */ }; struct _RTL_CRITICAL_SECTION { unsigned char DebugInfo[8]; /* +0x0000 6c 12 00 00 */ long LockCount; /* +0x0008 */ long RecursionCount; /* +0x000c */ void *OwningThread; /* +0x0010 */ void *LockSemaphore; /* +0x0018 */ unsigned long long SpinCount; /* +0x0020 */ }; struct MxPagedLockNoDynam { unsigned char m_Lock[48]; /* +0x0000 7a 12 00 00 */ }; enum _EVENT_TYPE { NotificationEvent = 0, SynchronizationEvent = 1 }; enum _KWAIT_REASON { Executive = 0, FreePage = 1, PageIn = 2, PoolAllocation = 3, DelayExecution = 4, Suspended = 5, UserRequest = 6, WrExecutive = 7, WrFreePage = 8, WrPageIn = 9, WrPoolAllocation = 10, WrDelayExecution = 11, WrSuspended = 12, WrUserRequest = 13, WrEventPair = 14, WrQueue = 15, WrLpcReceive = 16, WrLpcReply = 17, WrVirtualMemory = 18, WrPageOut = 19, WrRendezvous = 20, Spare2 = 21, Spare3 = 22, Spare4 = 23, Spare5 = 24, WrCalloutStack = 25, WrKernel = 26, WrResource = 27, WrPushLock = 28, WrMutex = 29, WrQuantumEnd = 30, WrDispatchInt = 31, WrPreempted = 32, WrYieldExecution = 33, WrFastMutex = 34, WrGuardedMutex = 35, WrRundown = 36, MaximumWaitReason = 37 }; struct MxEvent { unsigned char m_Event[8]; /* +0x0000 8b 12 00 00 */ }; struct MdEvent { void *Event; /* +0x0000 */ }; struct _SECURITY_ATTRIBUTES { unsigned long nLength; /* +0x0000 */ void *lpSecurityDescriptor; /* +0x0008 */ unsigned char bInheritHandle[8]; /* +0x0010 74 00 00 00 */ }; enum _POOL_TYPE { NonPagedPool = 0, PagedPool = 1, NonPagedPoolMustSucceed = 2, DontUseThisType = 3, NonPagedPoolCacheAligned = 4, PagedPoolCacheAligned = 5, NonPagedPoolCacheAlignedMustS = 6, MaxPoolType = 7, NonPagedPoolSession = 32, PagedPoolSession = 33, NonPagedPoolMustSucceedSession = 34, DontUseThisTypeSession = 35, NonPagedPoolCacheAlignedSession = 36, PagedPoolCacheAlignedSession = 37, NonPagedPoolCacheAlignedMustSSession = 38, NonPagedPoolNx = 512, NonPagedPoolNxCacheAligned = 516 }; struct _MdTimerWin5 { unsigned char m_TimerCallback[8]; /* +0x0000 b7 12 00 00 */ void *m_TimerContext; /* +0x0008 */ long m_Period; /* +0x0010 */ unsigned char m_Lock[40]; /* +0x0018 5a 12 00 00 */ unsigned char m_LockInitialized[8]; /* +0x0040 74 00 00 00 */ void *m_TimerHandle; /* +0x0048 */ void *m_WaitHandle; /* +0x0050 */ unsigned char m_CallbackStartedRunning[8]; /* +0x0058 74 00 00 00 */ }; struct _MdTimerWin6Plus { unsigned char m_TimerCallback[8]; /* +0x0000 b7 12 00 00 */ void *m_TimerContext; /* +0x0008 */ long m_Period; /* +0x0010 */ unsigned char m_TP[64]; /* +0x0018 d9 12 00 00 */ unsigned char m_TimerHandle[8]; /* +0x0058 db 12 00 00 */ unsigned char m_WorkObject[8]; /* +0x0060 dd 12 00 00 */ unsigned char m_CallbackStartedRunning[8]; /* +0x0068 74 00 00 00 */ }; struct _MXTIMER_THREADPOOL_FUNC { unsigned char hKernel32[8]; /* +0x0000 3b 12 00 00 */ unsigned char pfnCreateTpTimer[8]; /* +0x0008 f3 12 00 00 */ unsigned char pfnSetTpTimer[8]; /* +0x0010 f8 12 00 00 */ unsigned char pfnWaitForTpTimerCallbacks[8]; /* +0x0018 fb 12 00 00 */ unsigned char pfnCreateTpWork[8]; /* +0x0020 00 13 00 00 */ unsigned char pfnSubmitTpWork[8]; /* +0x0028 03 13 00 00 */ unsigned char pfnCloseTpTimer[8]; /* +0x0030 06 13 00 00 */ unsigned char pfnCloseTpWork[8]; /* +0x0038 03 13 00 00 */ }; struct _FILETIME { unsigned long dwLowDateTime; /* +0x0000 */ unsigned long dwHighDateTime; /* +0x0004 */ }; struct _MdTimer { unsigned char m_RunningOnWin6Plus[8]; /* +0x0000 74 00 00 00 */ unsigned char m_Win5Timer[96]; /* +0x0008 b3 12 00 00 */ unsigned char m_Win6PlusTimer[112]; /* +0x0068 d7 12 00 00 */ }; struct _OSVERSIONINFOW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 2c 13 00 00 */ }; struct MxTimer { unsigned char m_Timer[216]; /* +0x0000 1b 13 00 00 */ }; struct MxWorkItem { unsigned char m_WorkItem[8]; /* +0x0000 3f 13 00 00 */ }; struct UmWorkItem { unsigned char DeviceObject[8]; /* +0x0000 1d 12 00 00 */ unsigned char WaitBlock[8]; /* +0x0008 42 13 00 00 */ void *WorkItemEvent; /* +0x0010 */ unsigned char Callback[8]; /* +0x0018 49 13 00 00 */ void *Context; /* +0x0020 */ }; enum WudfProblem { WudfProblem_None = 0, WudfProblem_Cancelled = 1, WudfProblem_SendFailure = 2, WudfProblem_Timeout = 3, WudfProblem_InvalidRequest = 4, WudfProblem_InvalidReply = 5, WudfProblem_FailedCriticalOperation = 6, WudfProblem_FailedToExit = 7, WudfProblem_Disconnect = 8, WudfProblem_LeakingHandle = 9, WudfProblem_InvalidInterruptState = 10, WudfProblem_IsrTimedOut = 11, WudfProblem_Max = 12 }; enum WdfComponentType { WdfComponentInvalid = 0, WdfComponentPlatform = 1, WdfComponentReflector = 2, WdfComponentDriverManager = 3, WdfComponentHost = 4, WdfComponentFramework = 5, WdfComponentTest = 6, WdfComponentMax = 7 }; enum _WDF_HOST_EXIT_CODE { WdfHostExit_StillActive = 259, /* WdfHostExit_CodeUnknown = Unavail */ }; enum WudfOperationType { WudfOperation_Invalid = 0, WudfOperation_Init = 1, WudfOperation_HostShutdown = 2, WudfOperation_Pnp = 3, WudfOperation_Cleanup = 4, WudfOperation_Close = 5, WudfOperation_Cancel = 6, WudfOperation_IO = 7, WudfOperation_Interrupt = 8, WudfOperation_Other = 9, WudfOperation_Max = 10 }; enum WdfDeviceStartStateType { WudfDeviceStartState_Unknown = 0, WudfDeviceStartState_NotStarted = 1, WudfDeviceStartState_Started = 2, WudfDeviceStartState_Removed = 3 }; struct WUDF_PROBLEM { unsigned char ProblemCode[4]; /* +0x0000 6c 13 00 00 */ unsigned char Detector[4]; /* +0x0004 6e 13 00 00 */ unsigned char ExitCode[4]; /* +0x0008 70 13 00 00 */ unsigned char Operation[4]; /* +0x000c 72 13 00 00 */ unsigned long Message; /* +0x0010 */ unsigned long Status; /* +0x0014 */ unsigned char DeviceStarted[4]; /* +0x0018 74 13 00 00 */ }; struct tagPROPVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 8d 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 f4 12 00 00 */ /* unsigned char puuid[0]; +0x0008 8e 13 00 00 */ /* unsigned char pclipdata[0]; +0x0008 90 13 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 91 13 00 00 */ /* unsigned char blob[0]; +0x0008 92 13 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 96 13 00 00 */ /* unsigned char pStream[0]; +0x0008 98 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 9a 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 9c 13 00 00 */ /* unsigned char parray[0]; +0x0008 9e 13 00 00 */ /* unsigned char cac[0]; +0x0008 9f 13 00 00 */ /* unsigned char caub[0]; +0x0008 a0 13 00 00 */ /* unsigned char cai[0]; +0x0008 a1 13 00 00 */ /* unsigned char caui[0]; +0x0008 a2 13 00 00 */ /* unsigned char cal[0]; +0x0008 a3 13 00 00 */ /* unsigned char caul[0]; +0x0008 a4 13 00 00 */ /* unsigned char cah[0]; +0x0008 a5 13 00 00 */ /* unsigned char cauh[0]; +0x0008 a6 13 00 00 */ /* unsigned char caflt[0]; +0x0008 a7 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 a8 13 00 00 */ /* unsigned char cabool[0]; +0x0008 a9 13 00 00 */ /* unsigned char cascode[0]; +0x0008 aa 13 00 00 */ /* unsigned char cacy[0]; +0x0008 ab 13 00 00 */ /* unsigned char cadate[0]; +0x0008 ac 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 ad 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 ae 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 af 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 b0 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 b1 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 b2 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 b3 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 b4 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 b6 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0008 ba 13 00 00 */ /* unsigned char pvarVal[-8]; +0x0008 8c 13 00 00 */ unsigned char decVal[24]; /* +0x0000 b5 13 00 00 */ }; struct tagVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 8d 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 96 13 00 00 */ /* unsigned char parray[0]; +0x0008 9e 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0008 ba 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 be 13 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 b6 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ void *pvRecord; /* +0x0008 */ /* unsigned char pRecInfo[-16]; +0x0010 c2 13 00 00 */ unsigned char decVal[24]; /* +0x0000 b5 13 00 00 */ }; enum _KINTERRUPT_MODE { LevelSensitive = 0, Latched = 1 }; enum _WDF_INTERRUPT_POLARITY { WdfInterruptPolarityUnknown = 0, WdfInterruptActiveHigh = 1, WdfInterruptActiveLow = 2 }; struct _WDF_INTERRUPT_INFO { unsigned long Size; /* +0x0000 */ unsigned long long Reserved1; /* +0x0008 */ unsigned long long TargetProcessorSet; /* +0x0010 */ unsigned long Reserved2; /* +0x0018 */ unsigned long MessageNumber; /* +0x001c */ unsigned long Vector; /* +0x0020 */ unsigned char Irql; /* +0x0024 */ unsigned char Mode[4]; /* +0x0028 c8 13 00 00 */ unsigned char Polarity[4]; /* +0x002c ca 13 00 00 */ unsigned char MessageSignaled; /* +0x0030 */ unsigned char ShareDisposition; /* +0x0031 */ unsigned short Group; /* +0x0038 */ }; enum _WDF_INTERRUPT_POLICY { WdfIrqPolicyMachineDefault = 0, WdfIrqPolicyAllCloseProcessors = 1, WdfIrqPolicyOneCloseProcessor = 2, WdfIrqPolicyAllProcessorsInMachine = 3, WdfIrqPolicySpecifiedProcessors = 4, WdfIrqPolicySpreadMessagesAcrossAllProcessors = 5 }; enum _WDF_INTERRUPT_PRIORITY { WdfIrqPriorityUndefined = 0, WdfIrqPriorityLow = 1, WdfIrqPriorityNormal = 2, WdfIrqPriorityHigh = 3 }; struct _WDF_INTERRUPT_EXTENDED_POLICY { unsigned long Size; /* +0x0000 */ unsigned char Policy[4]; /* +0x0004 d0 13 00 00 */ unsigned char Priority[8]; /* +0x0008 d2 13 00 00 */ unsigned char TargetProcessorSetAndGroup[16]; /* +0x0010 d3 13 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned long AttachDeviceNameOffset; /* +0x0004 */ unsigned char InternalReferenceStringValid[4]; /* +0x0008 3a 10 00 00 */ unsigned char InternalReferenceStringOffset[8]; /* +0x000c 2c 10 00 00 */ unsigned long PdoNameOffset; /* +0x0014 */ void *DeviceObjectPointer; /* +0x0018 */ }; enum _WUDF_CONTROL_OBJ_REF_STRING { WudfRefStringMin = 0, WudfRefStringElevations = 0, WudfRefStringNullFile = 1, WudfRefStringMax = 2, WudfRefStringUnknown = 2 }; struct _WUDFMESSAGE_CREATE { /* unsigned char Header[0]; +0x0000 da 13 00 00 */ unsigned char IoHeader[32]; /* +0x0000 e4 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0020 dd 13 00 00 */ unsigned long long FileNameByteLength; /* +0x0028 */ unsigned long Options; /* +0x0030 */ unsigned short FileAttributes; /* +0x0034 */ unsigned short ShareAccess; /* +0x0036 */ unsigned long DesiredAccess; /* +0x0038 */ unsigned char RelatedCreateContext[8]; /* +0x0040 e6 13 00 00 */ unsigned long InitiatorProcessId; /* +0x0048 */ }; struct _WUDFMESSAGE_REPLY_HEADER { long NtStatus; /* +0x0000 */ }; struct _WUDFMESSAGE_IO_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned long long Information; /* +0x0008 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 ea 13 00 00 */ unsigned long ProcessTimeout; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_OPEN_PROCESS_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ void *ProcessHandle; /* +0x0008 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned char InterfaceGuid[20]; /* +0x0004 17 10 00 00 */ unsigned char DevnodeContext[8]; /* +0x0018 dd 13 00 00 */ unsigned char DeviceContext[8]; /* +0x0020 01 14 00 00 */ }; struct _WUDFMESSAGE_TARGET_DEVICE_NOTIFICATION { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned char Event[20]; /* +0x0004 17 10 00 00 */ unsigned char DevnodeContext[8]; /* +0x0018 dd 13 00 00 */ unsigned long long TargetContext; /* +0x0020 */ unsigned long CustomBufferSize; /* +0x0028 */ unsigned long NameBufferOffset; /* +0x002c */ }; struct _WUDFMESSAGE_TRANSPORT_QUERY_ID { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ unsigned long Id; /* +0x0010 */ unsigned long BufferSize; /* +0x0014 */ }; struct WUDF_EVENT { void *Value; /* +0x0000 */ }; struct _ALPC_MESSAGE_ATTRIBUTES { unsigned long AllocatedAttributes; /* +0x0000 */ unsigned long ValidAttributes; /* +0x0004 */ }; struct WdfCtorStatus { long m_ConstructorStatus; /* +0x0000 */ }; enum WdfDriverStopType { WdfInternalError = 0, WdfDriverError = 1, WdfCallerError = 2, WdfExternalError = 3, WdfUnhandledExceptionError = 4, WdfDriverStopTypeMax = 5 }; enum WdfErrorClass { WdfErrorClass_Undefined = 0, WdfErrorClass_BadArgument = 1, WdfErrorClass_BadState = 2, WdfErrorClass_BadResponse = 3, WdfErrorClass_BadAction = 4, WdfErrorClass_LostReference = 5, WdfErrorClass_GlobalMax = 6, WdfErrorClass_PlatformStart = 6, WdfErrorClass_PlatformMax = 7, WdfErrorClass_RdStart = 6, WdfErrorClass_RdMax = 7, WdfErrorClass_DmStart = 6, WdfErrorClass_DmMax = 7, WdfErrorClass_HostStart = 6, WdfErrorClass_HostMax = 7, WdfErrorClass_FxStart = 6, WdfErrorClass_FxMax = 7, WdfErrorClass_TestStart = 6, WdfErrorClass_TestMax = 7 }; enum WELL_KNOWN_SID_TYPE { WinNullSid = 0, WinWorldSid = 1, WinLocalSid = 2, WinCreatorOwnerSid = 3, WinCreatorGroupSid = 4, WinCreatorOwnerServerSid = 5, WinCreatorGroupServerSid = 6, WinNtAuthoritySid = 7, WinDialupSid = 8, WinNetworkSid = 9, WinBatchSid = 10, WinInteractiveSid = 11, WinServiceSid = 12, WinAnonymousSid = 13, WinProxySid = 14, WinEnterpriseControllersSid = 15, WinSelfSid = 16, WinAuthenticatedUserSid = 17, WinRestrictedCodeSid = 18, WinTerminalServerSid = 19, WinRemoteLogonIdSid = 20, WinLogonIdsSid = 21, WinLocalSystemSid = 22, WinLocalServiceSid = 23, WinNetworkServiceSid = 24, WinBuiltinDomainSid = 25, WinBuiltinAdministratorsSid = 26, WinBuiltinUsersSid = 27, WinBuiltinGuestsSid = 28, WinBuiltinPowerUsersSid = 29, WinBuiltinAccountOperatorsSid = 30, WinBuiltinSystemOperatorsSid = 31, WinBuiltinPrintOperatorsSid = 32, WinBuiltinBackupOperatorsSid = 33, WinBuiltinReplicatorSid = 34, WinBuiltinPreWindows2000CompatibleAccessSid = 35, WinBuiltinRemoteDesktopUsersSid = 36, WinBuiltinNetworkConfigurationOperatorsSid = 37, WinAccountAdministratorSid = 38, WinAccountGuestSid = 39, WinAccountKrbtgtSid = 40, WinAccountDomainAdminsSid = 41, WinAccountDomainUsersSid = 42, WinAccountDomainGuestsSid = 43, WinAccountComputersSid = 44, WinAccountControllersSid = 45, WinAccountCertAdminsSid = 46, WinAccountSchemaAdminsSid = 47, WinAccountEnterpriseAdminsSid = 48, WinAccountPolicyAdminsSid = 49, WinAccountRasAndIasServersSid = 50, WinNTLMAuthenticationSid = 51, WinDigestAuthenticationSid = 52, WinSChannelAuthenticationSid = 53, WinThisOrganizationSid = 54, WinOtherOrganizationSid = 55, WinBuiltinIncomingForestTrustBuildersSid = 56, WinBuiltinPerfMonitoringUsersSid = 57, WinBuiltinPerfLoggingUsersSid = 58, WinBuiltinAuthorizationAccessSid = 59, WinBuiltinTerminalServerLicenseServersSid = 60, WinBuiltinDCOMUsersSid = 61, WinBuiltinIUsersSid = 62, WinIUserSid = 63, WinBuiltinCryptoOperatorsSid = 64, WinUntrustedLabelSid = 65, WinLowLabelSid = 66, WinMediumLabelSid = 67, WinHighLabelSid = 68, WinSystemLabelSid = 69, WinWriteRestrictedCodeSid = 70, WinCreatorOwnerRightsSid = 71, WinCacheablePrincipalsGroupSid = 72, WinNonCacheablePrincipalsGroupSid = 73, WinEnterpriseReadonlyControllersSid = 74, WinAccountReadonlyControllersSid = 75, WinBuiltinEventLogReadersGroup = 76, WinNewEnterpriseReadonlyControllersSid = 77, WinBuiltinCertSvcDComAccessGroup = 78, WinMediumPlusLabelSid = 79, WinLocalLogonSid = 80, WinConsoleLogonSid = 81, WinThisOrganizationCertificateSid = 82, WinApplicationPackageAuthoritySid = 83, WinBuiltinAnyPackageSid = 84, WinCapabilityInternetClientSid = 85, WinCapabilityInternetClientServerSid = 86, WinCapabilityPrivateNetworkClientServerSid = 87, WinCapabilityPicturesLibrarySid = 88, WinCapabilityVideosLibrarySid = 89, WinCapabilityMusicLibrarySid = 90, WinCapabilityDocumentsLibrarySid = 91, WinCapabilitySharedUserCertificatesSid = 92, WinCapabilityDefaultWindowsCredentialsSid = 93, WinCapabilityRemovableStorageSid = 94, WinBuiltinRDSRemoteAccessServersSid = 95, WinBuiltinRDSEndpointServersSid = 96, WinBuiltinRDSManagementServersSid = 97, WinUserModeDriversSid = 98, WinBuiltinHyperVAdminsSid = 99 }; enum WdfPoolType { WdfNonPagedPool = 0, WdfPagedPool = 1, WdfPoolChargeQuota = 128 }; struct _IMAGE_THUNK_DATA64:: { unsigned long long ForwarderString; /* +0x0000 */ unsigned long long Function; /* +0x0000 */ unsigned long long Ordinal; /* +0x0000 */ unsigned long long AddressOfData; /* +0x0000 */ }; struct _OSVERSIONINFOEXW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 2c 13 00 00 */ unsigned short wServicePackMajor; /* +0x0114 */ unsigned short wServicePackMinor; /* +0x0116 */ unsigned short wSuiteMask; /* +0x0118 */ unsigned char wProductType; /* +0x011a */ unsigned char wReserved; /* +0x011b */ }; struct WudfMessageTracker { unsigned long m_TimeToLiveInSeconds; /* +0x0000 */ unsigned char m_TimedOut; /* +0x0004 */ }; struct WudfLpcMessageParameters { unsigned char m_LpcMessage[8]; /* +0x0000 3c 15 00 00 */ unsigned long m_MessageId; /* +0x0008 */ }; struct _PORT_MESSAGE:::: { short DataLength; /* +0x0000 */ short TotalLength; /* +0x0002 */ }; struct WdfLpcPortParameters { unsigned char m_ServerPortName[8]; /* +0x0000 14 10 00 00 */ unsigned char m_Notification[8]; /* +0x0008 ac 15 00 00 */ unsigned char m_Lpc[8]; /* +0x0010 ae 15 00 00 */ void *m_PortHandle; /* +0x0018 */ unsigned char m_Owner[8]; /* +0x0020 6e 13 00 00 */ }; enum _MODE { KernelMode = 0, UserMode = 1, MaximumMode = 2 }; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous = 0, SecurityIdentification = 1, SecurityImpersonation = 2, SecurityDelegation = 3 }; enum _ALPC_PORT_INFORMATION_CLASS { AlpcBasicInformation = 0, AlpcPortInformation = 1, AlpcAssociateCompletionPortInformation = 2, AlpcConnectedSIDInformation = 3, AlpcServerInformation = 4, AlpcMessageZoneInformation = 5, AlpcRegisterCompletionListInformation = 6, AlpcUnregisterCompletionListInformation = 7, AlpcAdjustCompletionListConcurrencyCountInformation = 8, AlpcRegisterCallbackInformation = 9, AlpcCompletionListRundownInformation = 10 }; enum _WUDFMESSAGE { WudfMsg_Reserved = 0, WudfMsg_IRP = 1, WudfMsg_IRP_Completion = 2, WudfMsg_CREATE_DEVICE_STACK = 3, WudfMsg_ADD_DEVICE = 4, WudfMsg_CREATE = 5, WudfMsg_CLOSE = 6, WudfMsg_CLEANUP = 7, WudfMsg_READ = 8, WudfMsg_WRITE = 9, WudfMsg_IOCONTROL = 10, WudfMsg_FLUSH = 11, WudfMsg_QUERY_INFORMATION_FILE = 12, WudfMsg_SET_INFORMATION_FILE = 13, WudfMsg_Cancel = 14, WudfMsg_POWER_IRP_COMPLETE = 15, WudfMsg_USB_SS_EVENT = 16, WudfMsg_CLOSE_DEVICE_STACK = 17, WudfMsg_REMOTE_INTERFACE_ARRIVAL = 18, WudfMsg_REMOTE_INTERFACE_REMOVAL = 19, WudfMsg_TARGET_DEVICE_NOTIFICATION = 20, WudfMsg_TRANSPORT_QUERY_ID = 21, WudfMsg_FramworkMax = 22, WudfMsg_ExitProcess = 23, WdfProcMgmt_Message_Reserved = 24, WdfProcMgmt_Message_ControlObjectName = 25, WdfProcMgmt_Message_QueryProcess = 26, WdfProcMgmt_Message_OpenProcess = 27, WdfProcMgmt_Message_CloseProcess = 28, WudfMsg_Connect = 29, WudfMsg_WMI_POWER_DATA = 30, WudfMsg_Max = 31 }; struct _WDF_ACTIVATION_FRAME { unsigned char ListHead[8]; /* +0x0000 3f 17 00 00 */ unsigned char NextFrame[8]; /* +0x0008 3e 17 00 00 */ void *Caller; /* +0x0010 */ }; struct _MCGEN_TRACE_CONTEXT { unsigned long long RegistrationHandle; /* +0x0000 */ unsigned long long Logger; /* +0x0008 */ unsigned long long MatchAnyKeyword; /* +0x0010 */ unsigned long long MatchAllKeyword; /* +0x0018 */ unsigned long Flags; /* +0x0020 */ unsigned long IsEnabled; /* +0x0024 */ unsigned char Level; /* +0x0028 */ unsigned char Reserve; /* +0x0029 */ unsigned short EnableBitsCount; /* +0x002a */ unsigned long *EnableBitMask; /* +0x0030 */ unsigned char EnableKeyWords[8]; /* +0x0038 07 12 00 00 */ unsigned char EnableLevel[8]; /* +0x0040 06 12 00 00 */ }; enum WMIDPREQUESTCODE { WMI_GET_ALL_DATA = 0, WMI_GET_SINGLE_INSTANCE = 1, WMI_SET_SINGLE_INSTANCE = 2, WMI_SET_SINGLE_ITEM = 3, WMI_ENABLE_EVENTS = 4, WMI_DISABLE_EVENTS = 5, WMI_ENABLE_COLLECTION = 6, WMI_DISABLE_COLLECTION = 7, WMI_REGINFO = 8, WMI_EXECUTE_METHOD = 9, WMI_CAPTURE_STATE = 10 }; struct _EVENT_FILTER_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; struct _TRACE_GUID_REGISTRATION { unsigned char Guid[8]; /* +0x0000 19 10 00 00 */ void *RegHandle; /* +0x0008 */ }; struct _EVENT_TRACE_HEADER { unsigned short Size; /* +0x0000 */ unsigned short FieldTypeFlags; /* +0x0002 */ unsigned char HeaderType; /* +0x0002 */ unsigned char MarkerFlags; /* +0x0003 */ unsigned long Version; /* +0x0004 */ unsigned char Class[4]; /* +0x0004 87 17 00 00 */ unsigned long ThreadId; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned char TimeStamp[8]; /* +0x0010 35 10 00 00 */ /* unsigned char Guid[0]; +0x0018 17 10 00 00 */ unsigned long long GuidPtr; /* +0x0018 */ unsigned long KernelTime; /* +0x0028 */ unsigned long UserTime; /* +0x002c */ unsigned long long ProcessorTime; /* +0x0028 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char Type; /* +0x0000 */ unsigned char Level; /* +0x0001 */ unsigned short Version; /* +0x0002 */ }; struct MofTemplate_jzccppppq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[144]; /* +0x0030 7d 17 00 00 */ }; struct MofTemplate_z::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[16]; /* +0x0030 93 17 00 00 */ }; struct MofTemplate_zq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[32]; /* +0x0030 98 17 00 00 */ }; struct MofTemplate_jzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[48]; /* +0x0030 9d 17 00 00 */ }; struct MofTemplate_jcccqqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[112]; /* +0x0030 a6 17 00 00 */ }; struct MofTemplate_jzqzj::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[80]; /* +0x0030 af 17 00 00 */ }; struct MofTemplate_jzzzzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[96]; /* +0x0030 b4 17 00 00 */ }; struct MofTemplate_jzqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 84 17 00 00 */ unsigned char EventData[64]; /* +0x0030 b9 17 00 00 */ }; enum WDF_REGISTRY_READ_RESULT { ValuePresent = 0, ValueNotPresent = 1, ValueInvalid = 2 }; enum WDF_MODULE_INFO_CHANGE_TYPE { ModuleLoaded = 0, ModuleUnloaded = 1 }; enum WudfBreakPointType { WudfPlatformUserBreakin = 1, WudfPlatformKernelBreakin = 2, WudfPlatformUserOrKernelBreakin = 3 }; enum WudfDebuggerType { WudfPlatformUserDebugger = 0, WudfPlatformUserOrKernelDebugger = 1 }; struct WDF_PROCESS_INFORMATION { unsigned char Component[8]; /* +0x0000 6e 13 00 00 */ unsigned char GlobalTraceSessionName[8]; /* +0x0008 14 10 00 00 */ unsigned char RootDirectoryPath[8]; /* +0x0010 14 10 00 00 */ unsigned char TraceFilePath[8]; /* +0x0018 14 10 00 00 */ unsigned char FullDumpFileName[8]; /* +0x0020 14 10 00 00 */ unsigned char FullConfigLogName[8]; /* +0x0028 14 10 00 00 */ unsigned char IsWUDFTraceEnabled[8]; /* +0x0030 30 00 00 00 */ }; struct WUDF_PLATFORM_THREAD_DATA { unsigned char Thread[8]; /* +0x0000 02 18 00 00 */ unsigned char TrackerList[8]; /* +0x0008 3e 17 00 00 */ void *OverlappedEvent; /* +0x0010 */ }; struct _EVENT_TRACE_PROPERTIES { unsigned char Wnode[48]; /* +0x0000 1b 1a 00 00 */ unsigned long BufferSize; /* +0x0030 */ unsigned long MinimumBuffers; /* +0x0034 */ unsigned long MaximumBuffers; /* +0x0038 */ unsigned long MaximumFileSize; /* +0x003c */ unsigned long LogFileMode; /* +0x0040 */ unsigned long FlushTimer; /* +0x0044 */ unsigned long EnableFlags; /* +0x0048 */ long AgeLimit; /* +0x004c */ unsigned long NumberOfBuffers; /* +0x0050 */ unsigned long FreeBuffers; /* +0x0054 */ unsigned long EventsLost; /* +0x0058 */ unsigned long BuffersWritten; /* +0x005c */ unsigned long LogBuffersLost; /* +0x0060 */ unsigned long RealTimeBuffersLost; /* +0x0064 */ void *LoggerThreadId; /* +0x0068 */ unsigned long LogFileNameOffset; /* +0x0070 */ unsigned long LoggerNameOffset; /* +0x0074 */ }; enum CTraceSession:: { NotRunning = 0, Disabled = 1, Running = 2, PreviouslyRunning = 3 }; struct _WER_REPORT_INFORMATION { unsigned long dwSize; /* +0x0000 */ void *hProcess; /* +0x0008 */ unsigned char wzConsentKey[128]; /* +0x0010 8c 1a 00 00 */ unsigned char wzFriendlyEventName[256]; /* +0x0090 2c 13 00 00 */ unsigned char wzApplicationName[256]; /* +0x0190 2c 13 00 00 */ unsigned char wzApplicationPath[520]; /* +0x0290 2b 10 00 00 */ unsigned char wzDescription[1024]; /* +0x0498 8d 1a 00 00 */ unsigned char hwndParent[8]; /* +0x0898 8f 1a 00 00 */ }; struct tagCABSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 e9 10 00 00 */ }; struct _s__RTTIBaseClassDescriptor2 { unsigned char pTypeDescriptor[8]; /* +0x0000 c0 1a 00 00 */ unsigned long numContainedBases; /* +0x0008 */ unsigned char where[12]; /* +0x000c c1 1a 00 00 */ unsigned long attributes; /* +0x0018 */ unsigned char pClassDescriptor[8]; /* +0x001c c4 1a 00 00 */ }; struct tagCAUL { unsigned long cElems; /* +0x0000 */ unsigned long *pElems; /* +0x0008 */ }; struct tagCASCODE { unsigned long cElems; /* +0x0000 */ long *pElems; /* +0x0008 */ }; struct _SYSTEMTIME { unsigned short wYear; /* +0x0000 */ unsigned short wMonth; /* +0x0002 */ unsigned short wDayOfWeek; /* +0x0004 */ unsigned short wDay; /* +0x0006 */ unsigned short wHour; /* +0x0008 */ unsigned short wMinute; /* +0x000a */ unsigned short wSecond; /* +0x000c */ unsigned short wMilliseconds; /* +0x000e */ }; struct threadlocaleinfostruct { unsigned char refcount[4]; /* +0x0000 74 00 00 00 */ unsigned char lc_codepage[4]; /* +0x0004 75 00 00 00 */ unsigned char lc_collate_cp[4]; /* +0x0008 75 00 00 00 */ unsigned char lc_handle[24]; /* +0x000c cd 1a 00 00 */ unsigned char lc_id[316]; /* +0x0024 cf 1a 00 00 */ }; struct _ALPC_PORT_ATTRIBUTES { unsigned long Flags; /* +0x0000 */ unsigned char SecurityQos[12]; /* +0x0004 1a 16 00 00 */ unsigned long long MaxMessageLength; /* +0x0010 */ unsigned long long MemoryBandwidth; /* +0x0018 */ unsigned long long MaxPoolUsage; /* +0x0020 */ unsigned long long MaxSectionSize; /* +0x0028 */ unsigned long long MaxViewSize; /* +0x0030 */ unsigned long long MaxTotalSectionSize; /* +0x0038 */ unsigned long DupObjectTypes; /* +0x0040 */ unsigned long Reserved; /* +0x0044 */ }; enum _tagPARSEACTION { PARSE_CANONICALIZE = 1, PARSE_FRIENDLY = 2, PARSE_SECURITY_URL = 3, PARSE_ROOTDOCUMENT = 4, PARSE_DOCUMENT = 5, PARSE_ANCHOR = 6, PARSE_ENCODE_IS_UNESCAPE = 7, PARSE_DECODE_IS_ESCAPE = 8, PARSE_PATH_FROM_URL = 9, PARSE_URL_FROM_PATH = 10, PARSE_MIME = 11, PARSE_SERVER = 12, PARSE_SCHEMA = 13, PARSE_SITE = 14, PARSE_DOMAIN = 15, PARSE_LOCATION = 16, PARSE_SECURITY_DOMAIN = 17, PARSE_ESCAPE = 18, PARSE_UNESCAPE = 19 }; struct tagCABOOL { unsigned long cElems; /* +0x0000 */ short *pElems; /* +0x0008 */ }; enum _tagINTERNETFEATURELIST { FEATURE_OBJECT_CACHING = 0, FEATURE_ZONE_ELEVATION = 1, FEATURE_MIME_HANDLING = 2, FEATURE_MIME_SNIFFING = 3, FEATURE_WINDOW_RESTRICTIONS = 4, FEATURE_WEBOC_POPUPMANAGEMENT = 5, FEATURE_BEHAVIORS = 6, FEATURE_DISABLE_MK_PROTOCOL = 7, FEATURE_LOCALMACHINE_LOCKDOWN = 8, FEATURE_SECURITYBAND = 9, FEATURE_RESTRICT_ACTIVEXINSTALL = 10, FEATURE_VALIDATE_NAVIGATE_URL = 11, FEATURE_RESTRICT_FILEDOWNLOAD = 12, FEATURE_ADDON_MANAGEMENT = 13, FEATURE_PROTOCOL_LOCKDOWN = 14, FEATURE_HTTP_USERNAME_PASSWORD_DISABLE = 15, FEATURE_SAFE_BINDTOOBJECT = 16, FEATURE_UNC_SAVEDFILECHECK = 17, FEATURE_GET_URL_DOM_FILEPATH_UNENCODED = 18, FEATURE_TABBED_BROWSING = 19, FEATURE_SSLUX = 20, FEATURE_DISABLE_NAVIGATION_SOUNDS = 21, FEATURE_DISABLE_LEGACY_COMPRESSION = 22, FEATURE_FORCE_ADDR_AND_STATUS = 23, FEATURE_XMLHTTP = 24, FEATURE_DISABLE_TELNET_PROTOCOL = 25, FEATURE_FEEDS = 26, FEATURE_BLOCK_INPUT_PROMPTS = 27, FEATURE_ENTRY_COUNT = 28 }; struct _WUDFMESSAGE_HEADER { unsigned char Message[1]; /* +0x0000 bc 16 00 00 */ }; enum tagCALLCONV { CC_FASTCALL = 0, CC_CDECL = 1, CC_MSCPASCAL = 2, CC_PASCAL = 2, CC_MACPASCAL = 3, CC_STDCALL = 4, CC_FPFASTCALL = 5, CC_SYSCALL = 6, CC_MPWCDECL = 7, CC_MPWPASCAL = 8, CC_MAX = 9 }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0002 { unsigned char TraceGuid[16]; /* +0x0000 17 10 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long Level; /* +0x0014 */ }; struct _s__RTTIClassHierarchyDescriptor { unsigned long signature; /* +0x0000 */ unsigned long attributes; /* +0x0004 */ unsigned long numBaseClasses; /* +0x0008 */ unsigned char pBaseClassArray[8]; /* +0x000c e8 1a 00 00 */ }; enum __MIDL_ICodeInstall_0001 { CIP_DISK_FULL = 0, CIP_ACCESS_DENIED = 1, CIP_NEWER_VERSION_EXISTS = 2, CIP_OLDER_VERSION_EXISTS = 3, CIP_NAME_CONFLICT = 4, CIP_TRUST_VERIFICATION_COMPONENT_MISSING = 5, CIP_EXE_SELF_REGISTERATION_TIMEOUT = 6, CIP_UNSAFE_TO_ABORT = 7, CIP_NEED_REBOOT = 8, CIP_NEED_REBOOT_UI_PERMISSION = 9 }; struct _GROUP_AFFINITY { unsigned long long Mask; /* +0x0000 */ unsigned short Group; /* +0x0008 */ unsigned char Reserved[6]; /* +0x000a ed 1a 00 00 */ }; struct $_TypeDescriptor$_extraBytes_24 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[24]; /* +0x0010 f1 1a 00 00 */ }; struct _s__RTTICompleteObjectLocator2 { unsigned long signature; /* +0x0000 */ unsigned long offset; /* +0x0004 */ unsigned long cdOffset; /* +0x0008 */ unsigned char pTypeDescriptor[8]; /* +0x000c c0 1a 00 00 */ unsigned char pClassDescriptor[8]; /* +0x0014 c4 1a 00 00 */ unsigned char pSelf[8]; /* +0x001c f6 1a 00 00 */ }; struct _SP_DEVINFO_DATA { unsigned long cbSize; /* +0x0000 */ unsigned char ClassGuid[16]; /* +0x0004 17 10 00 00 */ unsigned long DevInst; /* +0x0014 */ unsigned long long Reserved; /* +0x0018 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[8]; /* +0x0008 a9 10 00 00 */ unsigned char Context[8]; /* +0x0010 fe 1a 00 00 */ }; enum DISPLAYCONFIG_SCANLINE_ORDERING { DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED = 0, DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE = 1, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST = 3, DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 = -1 }; struct tagBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pBlobData; /* +0x0008 */ }; enum tagCOWAIT_FLAGS { COWAIT_WAITALL = 1, COWAIT_ALERTABLE = 2, COWAIT_INPUTAVAILABLE = 4, COWAIT_DISPATCH_CALLS = 8, COWAIT_DISPATCH_WINDOW_MESSAGES = 16, REAL_COWAIT_ENABLECALLREENTRANCY = 8, COWAIT_ENABLEWINDOWMESSAGES = 16, COWAIT_ENABLECALLREENTRANCY = 24 }; struct _PMD { unsigned char mdisp[4]; /* +0x0000 74 00 00 00 */ unsigned char pdisp[4]; /* +0x0004 74 00 00 00 */ unsigned char vdisp[4]; /* +0x0008 74 00 00 00 */ }; struct tagCAC { unsigned long cElems; /* +0x0000 */ char *pElems; /* +0x0008 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_8 { unsigned char arrayOfBaseClassDescriptors[12]; /* +0x0000 0d 1b 00 00 */ }; struct _SECURITY_QUALITY_OF_SERVICE { unsigned long Length; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 cb 15 00 00 */ unsigned char ContextTrackingMode; /* +0x0008 */ unsigned char EffectiveOnly; /* +0x0009 */ }; struct tagCACLSID { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 8e 13 00 00 */ }; struct _NT_TIB { unsigned char ExceptionList[8]; /* +0x0000 16 1b 00 00 */ void *StackBase; /* +0x0008 */ void *StackLimit; /* +0x0010 */ void *SubSystemTib; /* +0x0018 */ void *FiberData; /* +0x0020 */ unsigned long Version; /* +0x0020 */ void *ArbitraryUserPointer; /* +0x0028 */ unsigned char Self[8]; /* +0x0030 17 1b 00 00 */ }; struct _NT_TIB:: { void *FiberData; /* +0x0000 */ unsigned long Version; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_22 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[22]; /* +0x0010 1d 1b 00 00 */ }; struct tagCAUH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 21 1b 00 00 */ }; enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess = 0, PsAttributeDebugObject = 1, PsAttributeToken = 2, PsAttributeClientId = 3, PsAttributeTebAddress = 4, PsAttributeImageName = 5, PsAttributeImageInfo = 6, PsAttributeMemoryReserve = 7, PsAttributePriorityClass = 8, PsAttributeErrorMode = 9, PsAttributeStdHandleInfo = 10, PsAttributeHandleList = 11, PsAttributeGroupAffinity = 12, PsAttributePreferredNode = 13, PsAttributeIdealProcessor = 14, PsAttributeUmsThread = 15, PsAttributeMitigationOptions = 16, PsAttributeSecurityCapabilities = 17, PsAttributeMax = 18 }; struct _TEB:: { /* unsigned char CurrentIdealProcessor[0]; +0x0000 a7 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0000 */ unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:::: { unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:: { /* unsigned char CrossTebFlags[0]; +0x0000 aa 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0000 ab 10 00 00 */ }; struct _TEB:::: { unsigned char SpareCrossTebBits[2]; /* +0x0000 ab 10 00 00 */ }; struct _TEB:: { unsigned short SameTebFlags; /* +0x0000 */ /* unsigned char SafeThunkCall[0]; +0x0000 ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b9 10 00 00 */ }; struct _TEB:::: { /* unsigned char SafeThunkCall[0]; +0x0000 ac 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ad 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ae 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 af 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 b0 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 b1 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b2 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b3 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b4 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b5 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b6 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b7 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b8 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b9 10 00 00 */ }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS { WdfPropertyStoreNormal = 0, WdfPropertyStoreCreateIfMissing = 1, WdfPropertyStoreCreateVolatile = 2, WdfPropertyStoreRetrieveFlagsMask = 3 }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; struct _ALPC_SECURITY_ATTR { unsigned long Flags; /* +0x0000 */ unsigned char QoS[8]; /* +0x0008 1b 16 00 00 */ void *ContextHandle; /* +0x0010 */ }; struct tagCADBL { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 41 06 00 00 */ }; struct tagCACLIPDATA { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 90 13 00 00 */ }; enum tagCHANGEKIND { CHANGEKIND_ADDMEMBER = 0, CHANGEKIND_DELETEMEMBER = 1, CHANGEKIND_SETNAMES = 2, CHANGEKIND_SETDOCUMENTATION = 3, CHANGEKIND_GENERAL = 4, CHANGEKIND_INVALIDATE = 5, CHANGEKIND_CHANGEFAILED = 6, CHANGEKIND_MAX = 7 }; struct tagCABSTRBLOB { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 41 1b 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_40 { unsigned char arrayOfBaseClassDescriptors[44]; /* +0x0000 45 1b 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned char MitigationPolicies; /* +0x0000 */ /* unsigned char NXSupportPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 38 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 39 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char NXSupportPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 37 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 38 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 39 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned long SharedDataFlags; /* +0x0000 */ /* unsigned char DbgErrorPortPresent[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 43 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char DbgErrorPortPresent[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 41 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 42 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 43 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { /* unsigned char TickCount[0]; +0x0000 2a 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0000 45 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0000 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 34 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char ReservedTickCountOverlay[12]; /* +0x0000 46 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 34 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned short TscQpcData; /* +0x0000 */ unsigned char TscQpcEnabled[1]; /* +0x0000 49 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char TscQpcEnabled[1]; /* +0x0000 49 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_128 { unsigned char arrayOfBaseClassDescriptors[132]; /* +0x0000 59 1b 00 00 */ }; struct _WUDFMESSAGE_REPLY_ALL { /* unsigned char WudfMsg_CREATE_DEVICE_STACK_Reply[0]; +0x0000 5c 1b 00 00 */ /* unsigned char WudfMsg_ADD_DEVICE_Reply[0]; +0x0000 5d 1b 00 00 */ /* unsigned char WudfMsg_CREATE_Reply[0]; +0x0000 5e 1b 00 00 */ /* unsigned char WudfMsg_CLOSE_Reply[0]; +0x0000 5f 1b 00 00 */ /* unsigned char WudfMsg_CLEANUP_Reply[0]; +0x0000 60 1b 00 00 */ /* unsigned char WudfMsg_IO_Reply[0]; +0x0000 ee 13 00 00 */ /* unsigned char WudfMsg_CANCEL_Reply[0]; +0x0000 61 1b 00 00 */ /* unsigned char WudfMsg_POWER_IRP_COMPLETE_Reply[0]; +0x0000 62 1b 00 00 */ /* unsigned char WudfMsg_USB_SS_EVENT_Reply[0]; +0x0000 63 1b 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_ARRIVAL_Reply[0]; +0x0000 64 1b 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_REMOVAL_Reply[0]; +0x0000 65 1b 00 00 */ /* unsigned char WudfMsg_TARGET_DEVICE_NOTIFICATION_Reply[0]; +0x0000 66 1b 00 00 */ /* unsigned char WudfMsg_TRANSPORT_QUERY_ID_Reply[0]; +0x0000 67 1b 00 00 */ /* unsigned char WudfMsg_EXIT_PROCESS_Reply[0]; +0x0000 68 1b 00 00 */ /* unsigned char WudfMsg_MESSAGE_CONTROL_OBJECT_NAME_Reply[0]; +0x0000 69 1b 00 00 */ /* unsigned char WudfMsg_IRP_Reply[0]; +0x0000 6a 1b 00 00 */ /* unsigned char WudfMsg_IRP_COMPLETION_Reply[0]; +0x0000 6b 1b 00 00 */ /* unsigned char WudfMsg_CLOSE_DEVICE_STACK_Reply[0]; +0x0000 6c 1b 00 00 */ /* unsigned char WudfMsg_MESSAGE_QUERY_PROCESS_Reply[0]; +0x0000 f4 13 00 00 */ /* unsigned char WudfMsg_MESSAGE_OPEN_PROCESS_Reply[0]; +0x0000 f9 13 00 00 */ /* unsigned char WudfMsg_MESSAGE_CLOSE_PROCESS_Reply[0]; +0x0000 6d 1b 00 00 */ /* unsigned char WudfMsg_CONNECT_Reply[0]; +0x0000 6e 1b 00 00 */ unsigned char WudfMsg_WMI_POWER_DATA_Reply[96]; /* +0x0000 6f 1b 00 00 */ }; struct _s__RTTIBaseClassArray { unsigned char arrayOfBaseClassDescriptors[4]; /* +0x0000 72 1b 00 00 */ }; struct tagCAPROPVARIANT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 8c 13 00 00 */ }; enum tagShutdownType { IdleShutdown = 0, ForcedShutdown = 1 }; enum tagDOMNodeType { NODE_INVALID = 0, NODE_ELEMENT = 1, NODE_ATTRIBUTE = 2, NODE_TEXT = 3, NODE_CDATA_SECTION = 4, NODE_ENTITY_REFERENCE = 5, NODE_ENTITY = 6, NODE_PROCESSING_INSTRUCTION = 7, NODE_COMMENT = 8, NODE_DOCUMENT = 9, NODE_DOCUMENT_TYPE = 10, NODE_DOCUMENT_FRAGMENT = 11, NODE_NOTATION = 12 }; enum tagBINDSTATUS { BINDSTATUS_FINDINGRESOURCE = 1, BINDSTATUS_CONNECTING = 2, BINDSTATUS_REDIRECTING = 3, BINDSTATUS_BEGINDOWNLOADDATA = 4, BINDSTATUS_DOWNLOADINGDATA = 5, BINDSTATUS_ENDDOWNLOADDATA = 6, BINDSTATUS_BEGINDOWNLOADCOMPONENTS = 7, BINDSTATUS_INSTALLINGCOMPONENTS = 8, BINDSTATUS_ENDDOWNLOADCOMPONENTS = 9, BINDSTATUS_USINGCACHEDCOPY = 10, BINDSTATUS_SENDINGREQUEST = 11, BINDSTATUS_CLASSIDAVAILABLE = 12, BINDSTATUS_MIMETYPEAVAILABLE = 13, BINDSTATUS_CACHEFILENAMEAVAILABLE = 14, BINDSTATUS_BEGINSYNCOPERATION = 15, BINDSTATUS_ENDSYNCOPERATION = 16, BINDSTATUS_BEGINUPLOADDATA = 17, BINDSTATUS_UPLOADINGDATA = 18, BINDSTATUS_ENDUPLOADDATA = 19, BINDSTATUS_PROTOCOLCLASSID = 20, BINDSTATUS_ENCODING = 21, BINDSTATUS_VERIFIEDMIMETYPEAVAILABLE = 22, BINDSTATUS_CLASSINSTALLLOCATION = 23, BINDSTATUS_DECODING = 24, BINDSTATUS_LOADINGMIMEHANDLER = 25, BINDSTATUS_CONTENTDISPOSITIONATTACH = 26, BINDSTATUS_FILTERREPORTMIMETYPE = 27, BINDSTATUS_CLSIDCANINSTANTIATE = 28, BINDSTATUS_IUNKNOWNAVAILABLE = 29, BINDSTATUS_DIRECTBIND = 30, BINDSTATUS_RAWMIMETYPE = 31, BINDSTATUS_PROXYDETECTING = 32, BINDSTATUS_ACCEPTRANGES = 33, BINDSTATUS_COOKIE_SENT = 34, BINDSTATUS_COMPACT_POLICY_RECEIVED = 35, BINDSTATUS_COOKIE_SUPPRESSED = 36, BINDSTATUS_COOKIE_STATE_UNKNOWN = 37, BINDSTATUS_COOKIE_STATE_ACCEPT = 38, BINDSTATUS_COOKIE_STATE_REJECT = 39, BINDSTATUS_COOKIE_STATE_PROMPT = 40, BINDSTATUS_COOKIE_STATE_LEASH = 41, BINDSTATUS_COOKIE_STATE_DOWNGRADE = 42, BINDSTATUS_POLICY_HREF = 43, BINDSTATUS_P3P_HEADER = 44, BINDSTATUS_SESSION_COOKIE_RECEIVED = 45, BINDSTATUS_PERSISTENT_COOKIE_RECEIVED = 46, BINDSTATUS_SESSION_COOKIES_ALLOWED = 47, BINDSTATUS_CACHECONTROL = 48, BINDSTATUS_CONTENTDISPOSITIONFILENAME = 49, BINDSTATUS_MIMETEXTPLAINMISMATCH = 50, BINDSTATUS_PUBLISHERAVAILABLE = 51, BINDSTATUS_DISPLAYNAMEAVAILABLE = 52, BINDSTATUS_SSLUX_NAVBLOCKED = 53, BINDSTATUS_SERVER_MIMETYPEAVAILABLE = 54, BINDSTATUS_SNIFFED_CLASSIDAVAILABLE = 55, BINDSTATUS_64BIT_PROGRESS = 56, BINDSTATUS_LAST = 56, BINDSTATUS_RESERVED_0 = 57, BINDSTATUS_RESERVED_1 = 58, BINDSTATUS_RESERVED_2 = 59, BINDSTATUS_RESERVED_3 = 60, BINDSTATUS_RESERVED_4 = 61, BINDSTATUS_RESERVED_5 = 62, BINDSTATUS_RESERVED_6 = 63, BINDSTATUS_RESERVED_7 = 64, BINDSTATUS_RESERVED_8 = 65, BINDSTATUS_RESERVED_9 = 66, BINDSTATUS_LAST_PRIVATE = 66 }; struct _WDFPROCMGMT_MESSAGE_CONTROL_OBJECT_NAME_REPLY { unsigned char Header[4]; /* +0x0000 ea 13 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 9a 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 9b 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 9c 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 9d 1b 00 00 */ unsigned char SpareBits[5]; /* +0x0003 9e 1b 00 00 */ void *Mutant; /* +0x0008 */ void *ImageBaseAddress; /* +0x0010 */ unsigned char Ldr[8]; /* +0x0018 a0 1b 00 00 */ unsigned char ProcessParameters[8]; /* +0x0020 a2 1b 00 00 */ void *SubSystemData; /* +0x0028 */ void *ProcessHeap; /* +0x0030 */ unsigned char FastPebLock[8]; /* +0x0038 67 12 00 00 */ void *AtlThunkSListPtr; /* +0x0040 */ void *IFEOKey; /* +0x0048 */ unsigned long CrossProcessFlags; /* +0x0050 */ /* unsigned char ProcessInJob[0]; +0x0050 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0050 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0050 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0050 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0050 40 10 00 00 */ unsigned char ReservedBits0[8]; /* +0x0050 a3 1b 00 00 */ void *KernelCallbackTable; /* +0x0058 */ void *UserSharedInfoPtr; /* +0x0058 */ unsigned char SystemReserved[4]; /* +0x0060 34 10 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0064 */ void *ApiSetMap; /* +0x0068 */ unsigned long TlsExpansionCounter; /* +0x0070 */ void *TlsBitmap; /* +0x0078 */ unsigned char TlsBitmapBits[8]; /* +0x0080 2c 10 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x0088 */ void *HotpatchInformation; /* +0x0090 */ unsigned char ReadOnlyStaticServerData[8]; /* +0x0098 6f 10 00 00 */ void *AnsiCodePageData; /* +0x00a0 */ void *OemCodePageData; /* +0x00a8 */ void *UnicodeCaseTableData; /* +0x00b0 */ unsigned long NumberOfProcessors; /* +0x00b8 */ unsigned long NtGlobalFlag; /* +0x00bc */ unsigned char CriticalSectionTimeout[8]; /* +0x00c0 35 10 00 00 */ unsigned long long HeapSegmentReserve; /* +0x00c8 */ unsigned long long HeapSegmentCommit; /* +0x00d0 */ unsigned long long HeapDeCommitTotalFreeThreshold; /* +0x00d8 */ unsigned long long HeapDeCommitFreeBlockThreshold; /* +0x00e0 */ unsigned long NumberOfHeaps; /* +0x00e8 */ unsigned long MaximumNumberOfHeaps; /* +0x00ec */ unsigned char ProcessHeaps[8]; /* +0x00f0 6f 10 00 00 */ void *GdiSharedHandleTable; /* +0x00f8 */ void *ProcessStarterHelper; /* +0x0100 */ unsigned long GdiDCAttributeList; /* +0x0108 */ unsigned char LoaderLock[8]; /* +0x0110 67 12 00 00 */ unsigned long OSMajorVersion; /* +0x0118 */ unsigned long OSMinorVersion; /* +0x011c */ unsigned short OSBuildNumber; /* +0x0120 */ unsigned short OSCSDVersion; /* +0x0122 */ unsigned long OSPlatformId; /* +0x0124 */ unsigned long ImageSubsystem; /* +0x0128 */ unsigned long ImageSubsystemMajorVersion; /* +0x012c */ unsigned long ImageSubsystemMinorVersion; /* +0x0130 */ unsigned long long ActiveProcessAffinityMask; /* +0x0138 */ unsigned char GdiHandleBuffer[240]; /* +0x0140 a4 1b 00 00 */ unsigned char PostProcessInitRoutine[8]; /* +0x0230 a5 1b 00 00 */ void *TlsExpansionBitmap; /* +0x0238 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0240 a6 1b 00 00 */ unsigned long SessionId; /* +0x02c0 */ unsigned char AppCompatFlags[8]; /* +0x02c8 4e 10 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x02d0 4e 10 00 00 */ void *pShimData; /* +0x02d8 */ void *AppCompatInfo; /* +0x02e0 */ unsigned char CSDVersion[16]; /* +0x02e8 a2 10 00 00 */ unsigned char ActivationContextData[8]; /* +0x02f8 a9 1b 00 00 */ unsigned char ProcessAssemblyStorageMap[8]; /* +0x0300 ab 1b 00 00 */ unsigned char SystemDefaultActivationContextData[8]; /* +0x0308 a9 1b 00 00 */ unsigned char SystemAssemblyStorageMap[8]; /* +0x0310 ab 1b 00 00 */ unsigned long long MinimumStackCommit; /* +0x0318 */ unsigned char FlsCallback[8]; /* +0x0320 ad 1b 00 00 */ unsigned char FlsListHead[16]; /* +0x0328 82 10 00 00 */ void *FlsBitmap; /* +0x0338 */ unsigned char FlsBitmapBits[16]; /* +0x0340 ae 1b 00 00 */ unsigned long FlsHighIndex; /* +0x0350 */ void *WerRegistrationData; /* +0x0358 */ void *WerShipAssertPtr; /* +0x0360 */ void *pUnused; /* +0x0368 */ void *pImageHeaderHash; /* +0x0370 */ unsigned long TracingFlags; /* +0x0378 */ /* unsigned char HeapTracingEnabled[0]; +0x0378 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0378 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0378 3e 10 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0378 af 1b 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0380 */ }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0004 { void *Reserved; /* +0x0000 */ }; struct tagCAFLT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 40 06 00 00 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[8]; /* +0x0008 10 10 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0006_0001 { unsigned char StartNewTraceSession[4]; /* +0x0000 74 00 00 00 */ unsigned char PrivateTrace[4]; /* +0x0004 74 00 00 00 */ unsigned char TruncateExistingLog[4]; /* +0x0008 74 00 00 00 */ unsigned long MaximumLogFileMb; /* +0x000c */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 3c 10 00 00 */ unsigned char Features[512]; /* +0x0010 bd 1b 00 00 */ }; struct tagCAH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 f1 10 00 00 */ }; struct tagVersionedStream { unsigned char guidVersion[16]; /* +0x0000 17 10 00 00 */ unsigned char pStream[8]; /* +0x0010 98 13 00 00 */ }; struct $_TypeDescriptor$_extraBytes_19 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[19]; /* +0x0010 c5 1b 00 00 */ }; struct _WUDFMESSAGE_IO_HEADER { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ void *Irp; /* +0x0008 */ unsigned long long RequestId; /* +0x0010 */ unsigned long ProcessId; /* +0x0018 */ unsigned char Is32bitProcess; /* +0x001c */ char RequestorMode; /* +0x001d */ unsigned char DirectMappedTransfer; /* +0x001e */ }; struct tagPROPVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 8d 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 f4 12 00 00 */ /* unsigned char puuid[0]; +0x0008 8e 13 00 00 */ /* unsigned char pclipdata[0]; +0x0008 90 13 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 91 13 00 00 */ /* unsigned char blob[0]; +0x0008 92 13 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 96 13 00 00 */ /* unsigned char pStream[0]; +0x0008 98 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 9a 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 9c 13 00 00 */ /* unsigned char parray[0]; +0x0008 9e 13 00 00 */ /* unsigned char cac[0]; +0x0008 9f 13 00 00 */ /* unsigned char caub[0]; +0x0008 a0 13 00 00 */ /* unsigned char cai[0]; +0x0008 a1 13 00 00 */ /* unsigned char caui[0]; +0x0008 a2 13 00 00 */ /* unsigned char cal[0]; +0x0008 a3 13 00 00 */ /* unsigned char caul[0]; +0x0008 a4 13 00 00 */ /* unsigned char cah[0]; +0x0008 a5 13 00 00 */ /* unsigned char cauh[0]; +0x0008 a6 13 00 00 */ /* unsigned char caflt[0]; +0x0008 a7 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 a8 13 00 00 */ /* unsigned char cabool[0]; +0x0008 a9 13 00 00 */ /* unsigned char cascode[0]; +0x0008 aa 13 00 00 */ /* unsigned char cacy[0]; +0x0008 ab 13 00 00 */ /* unsigned char cadate[0]; +0x0008 ac 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 ad 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 ae 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 af 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 b0 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 b1 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 b2 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 b3 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 b4 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 b6 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0008 ba 13 00 00 */ unsigned char pvarVal[16]; /* +0x0008 8c 13 00 00 */ }; struct tagPROPVARIANT:::::: { char cVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char hVal[0]; +0x0000 35 10 00 00 */ /* unsigned char uhVal[0]; +0x0000 4e 10 00 00 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 8d 13 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char filetime[0]; +0x0000 f4 12 00 00 */ /* unsigned char puuid[0]; +0x0000 8e 13 00 00 */ /* unsigned char pclipdata[0]; +0x0000 90 13 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 06 00 00 */ /* unsigned char bstrblobVal[0]; +0x0000 91 13 00 00 */ /* unsigned char blob[0]; +0x0000 92 13 00 00 */ char *pszVal; /* +0x0000 */ /* unsigned char pwszVal[0]; +0x0000 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0000 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0000 96 13 00 00 */ /* unsigned char pStream[0]; +0x0000 98 13 00 00 */ /* unsigned char pStorage[0]; +0x0000 9a 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0000 9c 13 00 00 */ /* unsigned char parray[0]; +0x0000 9e 13 00 00 */ /* unsigned char cac[0]; +0x0000 9f 13 00 00 */ /* unsigned char caub[0]; +0x0000 a0 13 00 00 */ /* unsigned char cai[0]; +0x0000 a1 13 00 00 */ /* unsigned char caui[0]; +0x0000 a2 13 00 00 */ /* unsigned char cal[0]; +0x0000 a3 13 00 00 */ /* unsigned char caul[0]; +0x0000 a4 13 00 00 */ /* unsigned char cah[0]; +0x0000 a5 13 00 00 */ /* unsigned char cauh[0]; +0x0000 a6 13 00 00 */ /* unsigned char caflt[0]; +0x0000 a7 13 00 00 */ /* unsigned char cadbl[0]; +0x0000 a8 13 00 00 */ /* unsigned char cabool[0]; +0x0000 a9 13 00 00 */ /* unsigned char cascode[0]; +0x0000 aa 13 00 00 */ /* unsigned char cacy[0]; +0x0000 ab 13 00 00 */ /* unsigned char cadate[0]; +0x0000 ac 13 00 00 */ /* unsigned char cafiletime[0]; +0x0000 ad 13 00 00 */ /* unsigned char cauuid[0]; +0x0000 ae 13 00 00 */ /* unsigned char caclipdata[0]; +0x0000 af 13 00 00 */ /* unsigned char cabstr[0]; +0x0000 b0 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0000 b1 13 00 00 */ /* unsigned char calpstr[0]; +0x0000 b2 13 00 00 */ /* unsigned char calpwstr[0]; +0x0000 b3 13 00 00 */ /* unsigned char capropvar[0]; +0x0000 b4 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ long *plVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 06 00 00 */ /* unsigned char pfltVal[0]; +0x0000 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 06 00 00 */ short *pboolVal; /* +0x0000 */ /* unsigned char pdecVal[0]; +0x0000 b6 13 00 00 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0000 ba 13 00 00 */ unsigned char pvarVal[16]; /* +0x0000 8c 13 00 00 */ }; struct _OVERLAPPED { unsigned long long Internal; /* +0x0000 */ unsigned long long InternalHigh; /* +0x0008 */ unsigned long Offset; /* +0x0010 */ unsigned long OffsetHigh; /* +0x0014 */ void *Pointer; /* +0x0010 */ void *hEvent; /* +0x0018 */ }; struct tagLC_ID { unsigned short wLanguage; /* +0x0000 */ unsigned short wCountry; /* +0x0002 */ unsigned short wCodePage; /* +0x0004 */ }; struct _WUDFMESSAGE_CONNECT_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ void *ProcessId; /* +0x0008 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long long HDC; /* +0x0008 */ unsigned char Buffer[1240]; /* +0x0010 06 1c 00 00 */ }; enum tagINVOKEKIND { INVOKE_FUNC = 1, INVOKE_PROPERTYGET = 2, INVOKE_PROPERTYPUT = 4, INVOKE_PROPERTYPUTREF = 8 }; struct tagCALPSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 ee 10 00 00 */ }; struct _TypeDescriptor { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ /* unsigned char name[0]; +0x0010 4f 1c 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; struct $_TypeDescriptor$_extraBytes_21 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[21]; /* +0x0010 55 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_39 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[39]; /* +0x0010 59 1c 00 00 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagCACY { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 b7 13 00 00 */ }; struct _OVERLAPPED:: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ void *Pointer; /* +0x0000 */ }; struct _OVERLAPPED:::: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ }; struct tagVS_FIXEDFILEINFO { unsigned long dwSignature; /* +0x0000 */ unsigned long dwStrucVersion; /* +0x0004 */ unsigned long dwFileVersionMS; /* +0x0008 */ unsigned long dwFileVersionLS; /* +0x000c */ unsigned long dwProductVersionMS; /* +0x0010 */ unsigned long dwProductVersionLS; /* +0x0014 */ unsigned long dwFileFlagsMask; /* +0x0018 */ unsigned long dwFileFlags; /* +0x001c */ unsigned long dwFileOS; /* +0x0020 */ unsigned long dwFileType; /* +0x0024 */ unsigned long dwFileSubtype; /* +0x0028 */ unsigned long dwFileDateMS; /* +0x002c */ unsigned long dwFileDateLS; /* +0x0030 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_16 { unsigned char arrayOfBaseClassDescriptors[20]; /* +0x0000 6b 1c 00 00 */ }; struct WER_REPORT_DESCRIPTOR { unsigned char Problem[8]; /* +0x0000 14 10 00 00 */ unsigned char Summary[8]; /* +0x0008 14 10 00 00 */ unsigned char Description[8]; /* +0x0010 14 10 00 00 */ unsigned char DumpHeap[8]; /* +0x0018 30 00 00 00 */ }; enum PS_CREATE_STATE { PsCreateInitialState = 0, PsCreateFailOnFileOpen = 1, PsCreateFailOnSectionCreate = 2, PsCreateFailExeFormat = 3, PsCreateFailMachineMismatch = 4, PsCreateFailExeName = 5, PsCreateSuccess = 6, PsCreateMaximumStates = 7 }; struct tagCAUI { unsigned long cElems; /* +0x0000 */ unsigned short *pElems; /* +0x0008 */ }; struct _EXCEPTION_POINTERS { unsigned char ExceptionRecord[8]; /* +0x0000 a2 1c 00 00 */ unsigned char ContextRecord[8]; /* +0x0008 61 18 00 00 */ }; struct _RTL_CRITICAL_SECTION_DEBUG { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char CriticalSection[8]; /* +0x0008 67 12 00 00 */ unsigned char ProcessLocksList[16]; /* +0x0010 82 10 00 00 */ unsigned long EntryCount; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned long Flags; /* +0x0028 */ unsigned short CreatorBackTraceIndexHigh; /* +0x002c */ unsigned short SpareUSHORT; /* +0x002e */ }; struct tagSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ void *pvData; /* +0x0010 */ unsigned char rgsabound[8]; /* +0x0018 a8 1c 00 00 */ }; enum _IRP_HANDLING_FLAG { IRP_HANDLING__COMPLETE = 0, IRP_HANDLING__FORWARD = 1, IRP_HANDLING__MAX = 2 }; struct _WUDFMESSAGE_IRP_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned long long Information; /* +0x0008 */ unsigned char Parameters[64]; /* +0x0010 ac 1c 00 00 */ unsigned char IrpHandling[8]; /* +0x0050 ae 1c 00 00 */ unsigned char CompletionContext[8]; /* +0x0058 b0 1c 00 00 */ }; enum CWMO_FLAGS { CWMO_DISPATCH_CALLS = 1, CWMO_DISPATCH_WINDOW_MESSAGES = 2, REAL_CWMO_ENABLE_CALL_REENTRANCY = 1, CWMO_ENABLE_WINDOW_MESSAGES = 2, CWMO_ENABLE_CALL_REENTRANCY = 3 }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[8]; /* +0x0008 a2 1c 00 00 */ void *ExceptionAddress; /* +0x0010 */ unsigned long NumberParameters; /* +0x0018 */ unsigned char ExceptionInformation[120]; /* +0x0020 b6 1c 00 00 */ }; enum _tagPSUACTION { PSU_DEFAULT = 1, PSU_SECURITY_URL_ONLY = 2 }; enum _WUDF_IRP_BUFFER_INDEX { IrpBufferIndexPrimary = 0, IrpBufferIndexSecondary = 1, IrpBufferIndexMax = 2 }; struct _ALPC_CONTEXT_ATTR { void *PortContext; /* +0x0000 */ void *MessageContext; /* +0x0008 */ unsigned long Sequence; /* +0x0010 */ unsigned long MessageId; /* +0x0014 */ unsigned long CallbackId; /* +0x0018 */ }; struct CPlatform:: { unsigned char Initialized[4]; /* +0x0000 30 00 00 00 */ unsigned char Settings[20]; /* +0x0004 74 18 00 00 */ unsigned char StackTracker[8]; /* +0x0018 05 1a 00 00 */ }; struct _WUDFMESSAGE_CREATE_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned char CreateContext[8]; /* +0x0008 e6 13 00 00 */ }; enum tagGLOBALOPT_EH_VALUES { COMGLB_EXCEPTION_HANDLE = 0, COMGLB_EXCEPTION_DONOT_HANDLE_FATAL = 1, COMGLB_EXCEPTION_DONOT_HANDLE = 1, COMGLB_EXCEPTION_DONOT_HANDLE_ANY = 2 }; enum __MIDL_IUri_0002 { Uri_HOST_UNKNOWN = 0, Uri_HOST_DNS = 1, Uri_HOST_IPV4 = 2, Uri_HOST_IPV6 = 3, Uri_HOST_IDN = 4 }; struct _PORT_MESSAGE:::: { short Type; /* +0x0000 */ short DataInfoOffset; /* +0x0002 */ }; struct _PORT_MESSAGE:: { /* unsigned char ClientId[0]; +0x0000 95 10 00 00 */ unsigned char DoNotUseThisField[16]; /* +0x0000 41 00 00 00 */ }; struct _PORT_MESSAGE:: { unsigned long long ClientViewSize; /* +0x0000 */ unsigned long CallbackId; /* +0x0000 */ }; struct tagSTATSTG { unsigned char pwcsName[8]; /* +0x0000 71 06 00 00 */ unsigned long type; /* +0x0008 */ unsigned char cbSize[8]; /* +0x0010 4e 10 00 00 */ unsigned char mtime[8]; /* +0x0018 f4 12 00 00 */ unsigned char ctime[8]; /* +0x0020 f4 12 00 00 */ unsigned char atime[8]; /* +0x0028 f4 12 00 00 */ unsigned long grfMode; /* +0x0030 */ unsigned long grfLocksSupported; /* +0x0034 */ unsigned char clsid[16]; /* +0x0038 17 10 00 00 */ unsigned long grfStateBits; /* +0x0048 */ unsigned long reserved; /* +0x004c */ }; enum _MEMORY_CACHING_TYPE_ORIG { MmFrameBufferCached = 2 }; struct $_s__RTTIBaseClassArray$_extraBytes_104 { unsigned char arrayOfBaseClassDescriptors[108]; /* +0x0000 d8 1c 00 00 */ }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[8]; /* +0x0000 16 1b 00 00 */ unsigned char Handler[8]; /* +0x0008 df 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_23 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[23]; /* +0x0010 e3 1c 00 00 */ }; struct tagDISPPARAMS { unsigned char rgvarg[8]; /* +0x0000 be 13 00 00 */ long *rgdispidNamedArgs; /* +0x0008 */ unsigned char cArgs[4]; /* +0x0010 75 00 00 00 */ unsigned char cNamedArgs[4]; /* +0x0014 75 00 00 00 */ }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 }; struct _POWER_STATE { /* unsigned char SystemState[0]; +0x0000 ea 1c 00 00 */ unsigned char DeviceState[4]; /* +0x0000 0c 12 00 00 */ }; struct _CONTEXT { unsigned long long P1Home; /* +0x0000 */ unsigned long long P2Home; /* +0x0008 */ unsigned long long P3Home; /* +0x0010 */ unsigned long long P4Home; /* +0x0018 */ unsigned long long P5Home; /* +0x0020 */ unsigned long long P6Home; /* +0x0028 */ unsigned long ContextFlags; /* +0x0030 */ unsigned long MxCsr; /* +0x0034 */ unsigned short SegCs; /* +0x0038 */ unsigned short SegDs; /* +0x003a */ unsigned short SegEs; /* +0x003c */ unsigned short SegFs; /* +0x003e */ unsigned short SegGs; /* +0x0040 */ unsigned short SegSs; /* +0x0042 */ unsigned long EFlags; /* +0x0044 */ unsigned long long Dr0; /* +0x0048 */ unsigned long long Dr1; /* +0x0050 */ unsigned long long Dr2; /* +0x0058 */ unsigned long long Dr3; /* +0x0060 */ unsigned long long Dr6; /* +0x0068 */ unsigned long long Dr7; /* +0x0070 */ unsigned long long Rax; /* +0x0078 */ unsigned long long Rcx; /* +0x0080 */ unsigned long long Rdx; /* +0x0088 */ unsigned long long Rbx; /* +0x0090 */ unsigned long long Rsp; /* +0x0098 */ unsigned long long Rbp; /* +0x00a0 */ unsigned long long Rsi; /* +0x00a8 */ unsigned long long Rdi; /* +0x00b0 */ unsigned long long R8; /* +0x00b8 */ unsigned long long R9; /* +0x00c0 */ unsigned long long R10; /* +0x00c8 */ unsigned long long R11; /* +0x00d0 */ unsigned long long R12; /* +0x00d8 */ unsigned long long R13; /* +0x00e0 */ unsigned long long R14; /* +0x00e8 */ unsigned long long R15; /* +0x00f0 */ unsigned long long Rip; /* +0x00f8 */ /* unsigned char FltSave[0]; +0x0100 ed 1c 00 00 */ unsigned char Header[32]; /* +0x0100 ef 1c 00 00 */ unsigned char Legacy[128]; /* +0x0120 f0 1c 00 00 */ unsigned char Xmm0[16]; /* +0x01a0 ee 1c 00 00 */ unsigned char Xmm1[16]; /* +0x01b0 ee 1c 00 00 */ unsigned char Xmm2[16]; /* +0x01c0 ee 1c 00 00 */ unsigned char Xmm3[16]; /* +0x01d0 ee 1c 00 00 */ unsigned char Xmm4[16]; /* +0x01e0 ee 1c 00 00 */ unsigned char Xmm5[16]; /* +0x01f0 ee 1c 00 00 */ unsigned char Xmm6[16]; /* +0x0200 ee 1c 00 00 */ unsigned char Xmm7[16]; /* +0x0210 ee 1c 00 00 */ unsigned char Xmm8[16]; /* +0x0220 ee 1c 00 00 */ unsigned char Xmm9[16]; /* +0x0230 ee 1c 00 00 */ unsigned char Xmm10[16]; /* +0x0240 ee 1c 00 00 */ unsigned char Xmm11[16]; /* +0x0250 ee 1c 00 00 */ unsigned char Xmm12[16]; /* +0x0260 ee 1c 00 00 */ unsigned char Xmm13[16]; /* +0x0270 ee 1c 00 00 */ unsigned char Xmm14[16]; /* +0x0280 ee 1c 00 00 */ unsigned char Xmm15[112]; /* +0x0290 ee 1c 00 00 */ unsigned char VectorRegister[416]; /* +0x0300 f1 1c 00 00 */ unsigned long long VectorControl; /* +0x04a0 */ unsigned long long DebugControl; /* +0x04a8 */ unsigned long long LastBranchToRip; /* +0x04b0 */ unsigned long long LastBranchFromRip; /* +0x04b8 */ unsigned long long LastExceptionToRip; /* +0x04c0 */ unsigned long long LastExceptionFromRip; /* +0x04c8 */ }; struct _CONTEXT:: { /* unsigned char FltSave[0]; +0x0000 ed 1c 00 00 */ unsigned char Header[32]; /* +0x0000 ef 1c 00 00 */ unsigned char Legacy[128]; /* +0x0020 f0 1c 00 00 */ unsigned char Xmm0[16]; /* +0x00a0 ee 1c 00 00 */ unsigned char Xmm1[16]; /* +0x00b0 ee 1c 00 00 */ unsigned char Xmm2[16]; /* +0x00c0 ee 1c 00 00 */ unsigned char Xmm3[16]; /* +0x00d0 ee 1c 00 00 */ unsigned char Xmm4[16]; /* +0x00e0 ee 1c 00 00 */ unsigned char Xmm5[16]; /* +0x00f0 ee 1c 00 00 */ unsigned char Xmm6[16]; /* +0x0100 ee 1c 00 00 */ unsigned char Xmm7[16]; /* +0x0110 ee 1c 00 00 */ unsigned char Xmm8[16]; /* +0x0120 ee 1c 00 00 */ unsigned char Xmm9[16]; /* +0x0130 ee 1c 00 00 */ unsigned char Xmm10[16]; /* +0x0140 ee 1c 00 00 */ unsigned char Xmm11[16]; /* +0x0150 ee 1c 00 00 */ unsigned char Xmm12[16]; /* +0x0160 ee 1c 00 00 */ unsigned char Xmm13[16]; /* +0x0170 ee 1c 00 00 */ unsigned char Xmm14[16]; /* +0x0180 ee 1c 00 00 */ unsigned char Xmm15[112]; /* +0x0190 ee 1c 00 00 */ }; struct _CONTEXT:::: { unsigned char Header[32]; /* +0x0000 ef 1c 00 00 */ unsigned char Legacy[128]; /* +0x0020 f0 1c 00 00 */ unsigned char Xmm0[16]; /* +0x00a0 ee 1c 00 00 */ unsigned char Xmm1[16]; /* +0x00b0 ee 1c 00 00 */ unsigned char Xmm2[16]; /* +0x00c0 ee 1c 00 00 */ unsigned char Xmm3[16]; /* +0x00d0 ee 1c 00 00 */ unsigned char Xmm4[16]; /* +0x00e0 ee 1c 00 00 */ unsigned char Xmm5[16]; /* +0x00f0 ee 1c 00 00 */ unsigned char Xmm6[16]; /* +0x0100 ee 1c 00 00 */ unsigned char Xmm7[16]; /* +0x0110 ee 1c 00 00 */ unsigned char Xmm8[16]; /* +0x0120 ee 1c 00 00 */ unsigned char Xmm9[16]; /* +0x0130 ee 1c 00 00 */ unsigned char Xmm10[16]; /* +0x0140 ee 1c 00 00 */ unsigned char Xmm11[16]; /* +0x0150 ee 1c 00 00 */ unsigned char Xmm12[16]; /* +0x0160 ee 1c 00 00 */ unsigned char Xmm13[16]; /* +0x0170 ee 1c 00 00 */ unsigned char Xmm14[16]; /* +0x0180 ee 1c 00 00 */ unsigned char Xmm15[16]; /* +0x0190 ee 1c 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE_REPLY { unsigned char Header[4]; /* +0x0000 ea 13 00 00 */ unsigned char DeferBufferRetrieval; /* +0x0004 */ unsigned char DirectIoForReadWrite; /* +0x0005 */ unsigned char DirectIoForIoctl; /* +0x0006 */ }; struct tagCAFILETIME { unsigned long cElems; /* +0x0000 */ unsigned char pElems[8]; /* +0x0008 f5 12 00 00 */ }; struct _PEB:: { unsigned char BitField; /* +0x0000 */ /* unsigned char ImageUsesLargePages[0]; +0x0000 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 9a 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 9b 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 9c 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 9d 1b 00 00 */ unsigned char SpareBits[1]; /* +0x0000 9e 1b 00 00 */ }; struct _PEB:::: { /* unsigned char ImageUsesLargePages[0]; +0x0000 10 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 9a 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 9b 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 9c 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 9d 1b 00 00 */ unsigned char SpareBits[1]; /* +0x0000 9e 1b 00 00 */ }; struct _PEB:: { unsigned long CrossProcessFlags; /* +0x0000 */ /* unsigned char ProcessInJob[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 40 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 a3 1b 00 00 */ }; struct _PEB:::: { /* unsigned char ProcessInJob[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 40 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 a3 1b 00 00 */ }; struct _PEB:: { void *KernelCallbackTable; /* +0x0000 */ void *UserSharedInfoPtr; /* +0x0000 */ }; struct _PEB:: { unsigned long TracingFlags; /* +0x0000 */ /* unsigned char HeapTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3e 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 af 1b 00 00 */ }; struct _PEB:::: { /* unsigned char HeapTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3e 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 af 1b 00 00 */ }; struct _ALPC_DATA_VIEW_ATTR { unsigned long Flags; /* +0x0000 */ void *SectionHandle; /* +0x0008 */ void *ViewBase; /* +0x0010 */ unsigned long long ViewSize; /* +0x0018 */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; enum _WUDF_BREAK_POINT_TYPE { WudfUserBreakin = 1, WudfKernelBreakin = 2, WudfUserOrKernelBreakin = 3 }; struct _WUDFMESSAGE_WMI_POWER_DATA_REPLY { unsigned char Header[4]; /* +0x0000 ea 13 00 00 */ unsigned char QueryResult; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:: { unsigned short FieldTypeFlags; /* +0x0000 */ unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long Version; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { /* unsigned char Guid[0]; +0x0000 17 10 00 00 */ unsigned long long GuidPtr; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ unsigned long long ProcessorTime; /* +0x0000 */ unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0001 { void *DllBase; /* +0x0000 */ void *EntryPoint; /* +0x0008 */ unsigned long SizeOfImage; /* +0x0010 */ unsigned char ModuleHandle[8]; /* +0x0018 3b 12 00 00 */ unsigned char IsWudfComponent[8]; /* +0x0020 74 00 00 00 */ unsigned char FullModuleName[8]; /* +0x0028 71 06 00 00 */ unsigned char BaseModuleName[8]; /* +0x0030 71 06 00 00 */ }; struct $_TypeDescriptor$_extraBytes_20 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[20]; /* +0x0010 4e 1d 00 00 */ }; struct _M128A { unsigned long long Low; /* +0x0000 */ long long High; /* +0x0008 */ }; struct $_TypeDescriptor$_extraBytes_17 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[17]; /* +0x0010 56 1d 00 00 */ }; struct _WUDFMESSAGE_CREATE_DEVICE_STACK_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ }; struct tagVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 8d 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0008 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 96 13 00 00 */ /* unsigned char parray[0]; +0x0008 9e 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 06 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0008 ba 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 be 13 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 b6 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 06 00 00 */ void *pvRecord; /* +0x0008 */ unsigned char pRecInfo[8]; /* +0x0010 c2 13 00 00 */ }; struct tagVARIANT:::::: { long long llVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 8d 13 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 06 00 00 */ /* unsigned char punkVal[0]; +0x0000 94 13 00 00 */ /* unsigned char pdispVal[0]; +0x0000 96 13 00 00 */ /* unsigned char parray[0]; +0x0000 9e 13 00 00 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ long *plVal; /* +0x0000 */ long long *pllVal; /* +0x0000 */ /* unsigned char pfltVal[0]; +0x0000 40 06 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 06 00 00 */ short *pboolVal; /* +0x0000 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 b7 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 06 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e9 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 b8 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 b9 13 00 00 */ /* unsigned char pparray[0]; +0x0000 ba 13 00 00 */ /* unsigned char pvarVal[0]; +0x0000 be 13 00 00 */ void *byref; /* +0x0000 */ char cVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ unsigned long long ullVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0000 b6 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ unsigned long long *pullVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 06 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 06 00 00 */ void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[8]; /* +0x0008 c2 13 00 00 */ }; struct tagVARIANT:::::::: { void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[8]; /* +0x0008 c2 13 00 00 */ }; enum tagTYPEKIND { TKIND_ENUM = 0, TKIND_RECORD = 1, TKIND_MODULE = 2, TKIND_INTERFACE = 3, TKIND_DISPATCH = 4, TKIND_COCLASS = 5, TKIND_ALIAS = 6, TKIND_UNION = 7, TKIND_MAX = 8 }; struct tagTYPEATTR { unsigned char guid[16]; /* +0x0000 17 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned long dwReserved; /* +0x0014 */ long memidConstructor; /* +0x0018 */ long memidDestructor; /* +0x001c */ unsigned char lpstrSchema[8]; /* +0x0020 71 06 00 00 */ unsigned long cbSizeInstance; /* +0x0028 */ unsigned char typekind[4]; /* +0x002c 69 1d 00 00 */ unsigned short cFuncs; /* +0x0030 */ unsigned short cVars; /* +0x0032 */ unsigned short cImplTypes; /* +0x0034 */ unsigned short cbSizeVft; /* +0x0036 */ unsigned short cbAlignment; /* +0x0038 */ unsigned short wTypeFlags; /* +0x003a */ unsigned short wMajorVerNum; /* +0x003c */ unsigned short wMinorVerNum; /* +0x003e */ unsigned char tdescAlias[16]; /* +0x0040 6a 1d 00 00 */ unsigned char idldescType[16]; /* +0x0050 6b 1d 00 00 */ }; struct tagCLIPDATA { unsigned long cbSize; /* +0x0000 */ long ulClipFmt; /* +0x0004 */ unsigned char *pClipData; /* +0x0008 */ }; struct threadlocaleinfostruct:: { char *locale; /* +0x0000 */ unsigned char wlocale[8]; /* +0x0008 71 06 00 00 */ unsigned char refcount[8]; /* +0x0010 74 06 00 00 */ unsigned char wrefcount[8]; /* +0x0018 74 06 00 00 */ }; struct _WUDFMESSAGE_IRP_COMPLETION_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned long long Information; /* +0x0008 */ unsigned char Parameters[64]; /* +0x0010 ac 1c 00 00 */ }; struct tagDEC { unsigned short wReserved; /* +0x0000 */ unsigned char scale; /* +0x0002 */ unsigned char sign; /* +0x0003 */ unsigned short signscale; /* +0x0002 */ unsigned long Hi32; /* +0x0004 */ unsigned long Lo32; /* +0x0008 */ unsigned long Mid32; /* +0x000c */ unsigned long long Lo64; /* +0x0008 */ }; struct tagDEC:: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ unsigned short signscale; /* +0x0000 */ }; struct tagDEC:::: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ }; struct tagDEC:: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ unsigned long long Lo64; /* +0x0000 */ }; struct tagDEC:::: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ }; struct _IMAGE_OPTIONAL_HEADER64 { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long long ImageBase; /* +0x0018 */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long long SizeOfStackReserve; /* +0x0048 */ unsigned long long SizeOfStackCommit; /* +0x0050 */ unsigned long long SizeOfHeapReserve; /* +0x0058 */ unsigned long long SizeOfHeapCommit; /* +0x0060 */ unsigned long LoaderFlags; /* +0x0068 */ unsigned long NumberOfRvaAndSizes; /* +0x006c */ unsigned char DataDirectory[128]; /* +0x0070 a1 1d 00 00 */ }; struct _WUDFLPC_GET_MESSAGE { void *ReceiverViewBase; /* +0x0000 */ }; enum tagSYSKIND { SYS_WIN16 = 0, SYS_WIN32 = 1, SYS_MAC = 2, SYS_WIN64 = 3 }; struct tagTLIBATTR { unsigned char guid[16]; /* +0x0000 17 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char syskind[4]; /* +0x0014 ba 1d 00 00 */ unsigned short wMajorVerNum; /* +0x0018 */ unsigned short wMinorVerNum; /* +0x001a */ unsigned short wLibFlags; /* +0x001c */ }; struct tagBSTRBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pData; /* +0x0008 */ }; enum _PS_STD_HANDLE_STATE { PsNeverDuplicate = 0, PsRequestDuplicate = 1, PsAlwaysDuplicate = 2, PsMaxStdHandleStates = 3 }; struct $_TypeDescriptor$_extraBytes_38 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[38]; /* +0x0010 c2 1d 00 00 */ }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0018 */ void *StandardInput; /* +0x0020 */ void *StandardOutput; /* +0x0028 */ void *StandardError; /* +0x0030 */ unsigned char CurrentDirectory[24]; /* +0x0038 c5 1d 00 00 */ unsigned char DllPath[16]; /* +0x0050 a2 10 00 00 */ unsigned char ImagePathName[16]; /* +0x0060 a2 10 00 00 */ unsigned char CommandLine[16]; /* +0x0070 a2 10 00 00 */ void *Environment; /* +0x0080 */ unsigned long StartingX; /* +0x0088 */ unsigned long StartingY; /* +0x008c */ unsigned long CountX; /* +0x0090 */ unsigned long CountY; /* +0x0094 */ unsigned long CountCharsX; /* +0x0098 */ unsigned long CountCharsY; /* +0x009c */ unsigned long FillAttribute; /* +0x00a0 */ unsigned long WindowFlags; /* +0x00a4 */ unsigned long ShowWindowFlags; /* +0x00a8 */ unsigned char WindowTitle[16]; /* +0x00b0 a2 10 00 00 */ unsigned char DesktopInfo[16]; /* +0x00c0 a2 10 00 00 */ unsigned char ShellInfo[16]; /* +0x00d0 a2 10 00 00 */ unsigned char RuntimeData[16]; /* +0x00e0 a2 10 00 00 */ unsigned char CurrentDirectores[768]; /* +0x00f0 c7 1d 00 00 */ unsigned char EnvironmentSize[8]; /* +0x03f0 45 10 00 00 */ unsigned char EnvironmentVersion[8]; /* +0x03f8 45 10 00 00 */ unsigned char PackageMoniker[16]; /* +0x0400 a2 10 00 00 */ void *PackageDependencyData; /* +0x0410 */ unsigned long ProcessGroupId; /* +0x0418 */ }; enum _URLZONEREG { URLZONEREG_DEFAULT = 0, URLZONEREG_HKLM = 1, URLZONEREG_HKCU = 2 }; struct $_TypeDescriptor$_extraBytes_27 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[27]; /* +0x0010 cd 1d 00 00 */ }; struct _WUDFLPC_GET_MESSAGE:: { unsigned char MessageHeader[40]; /* +0x0000 1d 15 00 00 */ /* unsigned char WudfMessage[0]; +0x0028 d0 1d 00 00 */ unsigned char WudfReplyMessage[112]; /* +0x0028 51 16 00 00 */ }; struct _WUDFLPC_GET_MESSAGE:::: { /* unsigned char WudfMessage[0]; +0x0000 d0 1d 00 00 */ unsigned char WudfReplyMessage[112]; /* +0x0000 51 16 00 00 */ }; enum tagFUNCKIND { FUNC_VIRTUAL = 0, FUNC_PUREVIRTUAL = 1, FUNC_NONVIRTUAL = 2, FUNC_STATIC = 3, FUNC_DISPATCH = 4 }; struct tagCAUB { unsigned long cElems; /* +0x0000 */ unsigned char *pElems; /* +0x0008 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0008 */ }; enum VARENUM { VT_EMPTY = 0, VT_NULL = 1, VT_I2 = 2, VT_I4 = 3, VT_R4 = 4, VT_R8 = 5, VT_CY = 6, VT_DATE = 7, VT_BSTR = 8, VT_DISPATCH = 9, VT_ERROR = 10, VT_BOOL = 11, VT_VARIANT = 12, VT_UNKNOWN = 13, VT_DECIMAL = 14, VT_I1 = 16, VT_UI1 = 17, VT_UI2 = 18, VT_UI4 = 19, VT_I8 = 20, VT_UI8 = 21, VT_INT = 22, VT_UINT = 23, VT_VOID = 24, VT_HRESULT = 25, VT_PTR = 26, VT_SAFEARRAY = 27, VT_CARRAY = 28, VT_USERDEFINED = 29, VT_LPSTR = 30, VT_LPWSTR = 31, VT_RECORD = 36, VT_INT_PTR = 37, VT_UINT_PTR = 38, VT_FILETIME = 64, VT_BLOB = 65, VT_STREAM = 66, VT_STORAGE = 67, VT_STREAMED_OBJECT = 68, VT_STORED_OBJECT = 69, VT_BLOB_OBJECT = 70, VT_CF = 71, VT_CLSID = 72, VT_VERSIONED_STREAM = 73, VT_BSTR_BLOB = 4095, VT_VECTOR = 4096, VT_ARRAY = 8192, VT_BYREF = 16384, = 32770 }; struct _LDR_DATA_TABLE_ENTRY { unsigned char InLoadOrderLinks[16]; /* +0x0000 82 10 00 00 */ unsigned char InMemoryOrderLinks[16]; /* +0x0010 82 10 00 00 */ /* unsigned char InInitializationOrderLinks[0]; +0x0020 82 10 00 00 */ unsigned char InProgressLinks[16]; /* +0x0020 82 10 00 00 */ void *DllBase; /* +0x0030 */ void *EntryPoint; /* +0x0038 */ unsigned long SizeOfImage; /* +0x0040 */ unsigned char FullDllName[16]; /* +0x0048 a2 10 00 00 */ unsigned char BaseDllName[16]; /* +0x0058 a2 10 00 00 */ /* unsigned char FlagGroup[0]; +0x0068 df 1d 00 00 */ unsigned long Flags; /* +0x0068 */ /* unsigned char PackagedBinary[0]; +0x0068 3c 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0068 3d 10 00 00 */ /* unsigned char ImageDll[0]; +0x0068 3e 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0068 3f 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0068 40 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0068 41 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0068 42 10 00 00 */ /* unsigned char InIndexes[0]; +0x0068 e0 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0068 e1 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0068 e2 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0068 e3 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0068 e4 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0068 e5 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0068 e6 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0068 e7 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0068 e8 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0068 e9 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0068 ea 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0068 eb 1d 00 00 */ /* unsigned char CorImage[0]; +0x0068 ec 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0068 ed 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0068 ee 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0068 ef 1d 00 00 */ /* unsigned char Redirected[0]; +0x0068 f0 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0068 f1 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0068 f2 1d 00 00 */ unsigned short ObsoleteLoadCount; /* +0x006c */ unsigned short TlsIndex; /* +0x006e */ unsigned char HashLinks[16]; /* +0x0070 82 10 00 00 */ unsigned long TimeDateStamp; /* +0x0080 */ unsigned char EntryPointActivationContext[8]; /* +0x0088 61 10 00 00 */ void *PatchInformation; /* +0x0090 */ unsigned char DdagNode[8]; /* +0x0098 f4 1d 00 00 */ unsigned char NodeModuleLink[16]; /* +0x00a0 82 10 00 00 */ unsigned char SnapContext[8]; /* +0x00b0 f6 1d 00 00 */ void *SwitchBackContext; /* +0x00b8 */ unsigned char BaseAddressIndexNode[24]; /* +0x00c0 0d 11 00 00 */ unsigned char MappingInfoIndexNode[24]; /* +0x00d8 0d 11 00 00 */ unsigned long long OriginalBase; /* +0x00f0 */ unsigned char LoadTime[8]; /* +0x00f8 35 10 00 00 */ unsigned long BaseNameHashValue; /* +0x0100 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL_REPLY { unsigned char Header[8]; /* +0x0000 ea 13 00 00 */ unsigned long long InterfaceContext; /* +0x0008 */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[16]; /* +0x0010 82 10 00 00 */ unsigned char InMemoryOrderModuleList[16]; /* +0x0020 82 10 00 00 */ unsigned char InInitializationOrderModuleList[16]; /* +0x0030 82 10 00 00 */ void *EntryInProgress; /* +0x0040 */ unsigned char ShutdownInProgress; /* +0x0048 */ void *ShutdownThreadId; /* +0x0050 */ }; struct _ULARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; struct $_TypeDescriptor$_extraBytes_26 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[26]; /* +0x0010 03 1e 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Children[0]; +0x0000 0f 11 00 00 */ unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_BALANCED_NODE:::: { unsigned char Left[8]; /* +0x0000 0e 11 00 00 */ unsigned char Right[8]; /* +0x0008 0e 11 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Red[0]; +0x0000 10 11 00 00 */ /* unsigned char Balance[0]; +0x0000 36 10 00 00 */ unsigned long long ParentValue; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_30 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[30]; /* +0x0010 0e 1e 00 00 */ }; enum tagURLZONE { URLZONE_INVALID = -1, URLZONE_PREDEFINED_MIN = 0, URLZONE_LOCAL_MACHINE = 0, URLZONE_INTRANET = 1, URLZONE_TRUSTED = 2, URLZONE_INTERNET = 3, URLZONE_UNTRUSTED = 4, URLZONE_PREDEFINED_MAX = 999, URLZONE_USER_MIN = 1000, URLZONE_USER_MAX = 10000 }; struct WDF_DUMP_CONTEXT { void *ProcessHandle; /* +0x0000 */ void *DumpFileHandle; /* +0x0008 */ unsigned char ExceptionPointers[8]; /* +0x0010 99 18 00 00 */ unsigned long DriverStopThreadId; /* +0x0018 */ unsigned char Hr[4]; /* +0x001c 08 00 00 00 */ }; struct tagSAFEARRAYBOUND { unsigned long cElements; /* +0x0000 */ long lLbound; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_18 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[18]; /* +0x0010 19 1e 00 00 */ }; struct tagIDLDESC { unsigned long long dwReserved; /* +0x0000 */ unsigned short wIDLFlags; /* +0x0008 */ }; struct _tagSTACKFRAME64 { unsigned char AddrPC[16]; /* +0x0000 1e 1e 00 00 */ unsigned char AddrReturn[16]; /* +0x0010 1e 1e 00 00 */ unsigned char AddrFrame[16]; /* +0x0020 1e 1e 00 00 */ unsigned char AddrStack[16]; /* +0x0030 1e 1e 00 00 */ unsigned char AddrBStore[16]; /* +0x0040 1e 1e 00 00 */ void *FuncTableEntry; /* +0x0050 */ unsigned char Params[32]; /* +0x0058 1f 1e 00 00 */ unsigned char Far[4]; /* +0x0078 74 00 00 00 */ unsigned char Virtual[4]; /* +0x007c 74 00 00 00 */ unsigned char Reserved[24]; /* +0x0080 44 10 00 00 */ unsigned char KdHelp[112]; /* +0x0098 20 1e 00 00 */ }; struct $_TypeDescriptor$_extraBytes_28 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[28]; /* +0x0010 24 1e 00 00 */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[8]; /* +0x0000 28 1e 00 00 */ unsigned char FrameListCache[16]; /* +0x0008 82 10 00 00 */ unsigned long Flags; /* +0x0018 */ unsigned long NextCookieSequenceNumber; /* +0x001c */ unsigned long StackId; /* +0x0020 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[16]; /* +0x0008 ea 10 00 00 */ }; struct $_TypeDescriptor$_extraBytes_15 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[15]; /* +0x0010 2e 1e 00 00 */ }; struct tagTYPEDESC { /* unsigned char lptdesc[0]; +0x0000 31 1e 00 00 */ /* unsigned char lpadesc[0]; +0x0000 33 1e 00 00 */ unsigned long hreftype; /* +0x0000 */ unsigned short vt; /* +0x0008 */ }; struct tagTYPEDESC:: { /* unsigned char lptdesc[0]; +0x0000 31 1e 00 00 */ /* unsigned char lpadesc[0]; +0x0000 33 1e 00 00 */ unsigned long hreftype; /* +0x0000 */ }; struct _WNODE_HEADER { unsigned long BufferSize; /* +0x0000 */ unsigned long ProviderId; /* +0x0004 */ unsigned long long HistoricalContext; /* +0x0008 */ unsigned long Version; /* +0x0008 */ unsigned long Linkage; /* +0x000c */ unsigned long CountLost; /* +0x0010 */ void *KernelHandle; /* +0x0010 */ unsigned char TimeStamp[8]; /* +0x0010 35 10 00 00 */ unsigned char Guid[16]; /* +0x0018 17 10 00 00 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _WNODE_HEADER:: { unsigned long long HistoricalContext; /* +0x0000 */ unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:::: { unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:: { unsigned long CountLost; /* +0x0000 */ void *KernelHandle; /* +0x0000 */ unsigned char TimeStamp[8]; /* +0x0000 35 10 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0003 { unsigned char bTrackObjects[4]; /* +0x0000 74 00 00 00 */ unsigned char bTrackRefCounts[4]; /* +0x0004 74 00 00 00 */ unsigned long nMaxRefCountChangesToTrack; /* +0x0008 */ unsigned long nMaxStackDepthToTrack; /* +0x000c */ }; enum tagTYSPEC { TYSPEC_CLSID = 0, TYSPEC_FILEEXT = 1, TYSPEC_MIMETYPE = 2, TYSPEC_FILENAME = 3, TYSPEC_PROGID = 4, TYSPEC_PACKAGENAME = 5, TYSPEC_OBJECTID = 6 }; struct $_s__RTTIBaseClassArray$_extraBytes_48 { unsigned char arrayOfBaseClassDescriptors[52]; /* +0x0000 46 1e 00 00 */ }; struct { /* unsigned char typeInfo_WdfLpc[0]; +0x0000 ae 15 00 00 */ /* unsigned char typeInfo_WdfLpcCommPort[0]; +0x0000 61 15 00 00 */ /* unsigned char typeInfo_CPlatformEvent[0]; +0x0000 2e 19 00 00 */ unsigned char typeInfo_STACKFRAME64[8]; /* +0x0000 ee 19 00 00 */ }; struct $_TypeDescriptor$_extraBytes_16 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[16]; /* +0x0010 4d 1e 00 00 */ }; enum tagCOINITBASE { COINITBASE_MULTITHREADED = 0 }; enum tagDESCKIND { DESCKIND_NONE = 0, DESCKIND_FUNCDESC = 1, DESCKIND_VARDESC = 2, DESCKIND_TYPECOMP = 3, DESCKIND_IMPLICITAPPOBJ = 4, DESCKIND_MAX = 5 }; struct tagCY { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ long long int64; /* +0x0000 */ }; struct tagCY:: { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ }; enum _LDR_DDAG_STATE { LdrModulesMerged = -1, LdrModulesInitError = -1, LdrModulesSnapError = -1, LdrModulesUnloaded = -1, LdrModulesUnloading = -1, LdrModulesPlaceHolder = 0, LdrModulesMapping = 1, LdrModulesMapped = 2, LdrModulesWaitingForDependencies = 3, LdrModulesSnapping = 4, LdrModulesSnapped = 5, LdrModulesCondensed = 6, LdrModulesReadyToInit = 7, LdrModulesInitializing = 8, LdrModulesReadyToRun = 9 }; struct _LDR_DDAG_NODE { unsigned char Modules[16]; /* +0x0000 82 10 00 00 */ unsigned char ServiceTagList[8]; /* +0x0010 77 1e 00 00 */ unsigned long LoadCount; /* +0x0018 */ unsigned long ReferenceCount; /* +0x001c */ unsigned long DependencyCount; /* +0x0020 */ /* unsigned char Dependencies[0]; +0x0028 78 1e 00 00 */ unsigned char RemovalLink[8]; /* +0x0028 cb 10 00 00 */ unsigned char IncomingDependencies[8]; /* +0x0030 78 1e 00 00 */ unsigned char State[8]; /* +0x0038 7a 1e 00 00 */ unsigned char CondenseLink[8]; /* +0x0040 cb 10 00 00 */ unsigned long PreorderNumber; /* +0x0048 */ unsigned long LowestLink; /* +0x004c */ }; struct _LDR_DDAG_NODE:: { /* unsigned char Dependencies[0]; +0x0000 78 1e 00 00 */ unsigned char RemovalLink[8]; /* +0x0000 cb 10 00 00 */ }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _tagQUERYOPTION { QUERY_EXPIRATION_DATE = 1, QUERY_TIME_OF_LAST_CHANGE = 2, QUERY_CONTENT_ENCODING = 3, QUERY_CONTENT_TYPE = 4, QUERY_REFRESH = 5, QUERY_RECOMBINE = 6, QUERY_CAN_NAVIGATE = 7, QUERY_USES_NETWORK = 8, QUERY_IS_CACHED = 9, QUERY_IS_INSTALLEDENTRY = 10, QUERY_IS_CACHED_OR_MAPPED = 11, QUERY_USES_CACHE = 12, QUERY_IS_SECURE = 13, QUERY_IS_SAFE = 14, QUERY_USES_HISTORYFOLDER = 15, QUERY_IS_CACHED_AND_USABLE_OFFLINE = 16 }; struct _LDR_DATA_TABLE_ENTRY:: { /* unsigned char InInitializationOrderLinks[0]; +0x0000 82 10 00 00 */ unsigned char InProgressLinks[16]; /* +0x0000 82 10 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY:: { /* unsigned char FlagGroup[0]; +0x0000 df 1d 00 00 */ unsigned long Flags; /* +0x0000 */ /* unsigned char PackagedBinary[0]; +0x0000 3c 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0000 3d 10 00 00 */ /* unsigned char ImageDll[0]; +0x0000 3e 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0000 3f 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0000 40 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0000 41 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0000 42 10 00 00 */ /* unsigned char InIndexes[0]; +0x0000 e0 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0000 e1 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0000 e2 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0000 e3 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0000 e4 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0000 e5 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0000 e6 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0000 e7 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0000 e8 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0000 e9 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0000 ea 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0000 eb 1d 00 00 */ /* unsigned char CorImage[0]; +0x0000 ec 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0000 ed 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0000 ee 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0000 ef 1d 00 00 */ /* unsigned char Redirected[0]; +0x0000 f0 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0000 f1 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0000 f2 1d 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY:::: { /* unsigned char PackagedBinary[0]; +0x0000 3c 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0000 3d 10 00 00 */ /* unsigned char ImageDll[0]; +0x0000 3e 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0000 3f 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0000 40 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0000 41 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0000 42 10 00 00 */ /* unsigned char InIndexes[0]; +0x0000 e0 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0000 e1 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0000 e2 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0000 e3 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0000 e4 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0000 e5 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0000 e6 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0000 e7 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0000 e8 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0000 e9 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0000 ea 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0000 eb 1d 00 00 */ /* unsigned char CorImage[0]; +0x0000 ec 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0000 ed 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0000 ee 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0000 ef 1d 00 00 */ /* unsigned char Redirected[0]; +0x0000 f0 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0000 f1 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0000 f2 1d 00 00 */ }; enum __MIDL_IUri_0001 { Uri_PROPERTY_ABSOLUTE_URI = 0, Uri_PROPERTY_STRING_START = 0, Uri_PROPERTY_AUTHORITY = 1, Uri_PROPERTY_DISPLAY_URI = 2, Uri_PROPERTY_DOMAIN = 3, Uri_PROPERTY_EXTENSION = 4, Uri_PROPERTY_FRAGMENT = 5, Uri_PROPERTY_HOST = 6, Uri_PROPERTY_PASSWORD = 7, Uri_PROPERTY_PATH = 8, Uri_PROPERTY_PATH_AND_QUERY = 9, Uri_PROPERTY_QUERY = 10, Uri_PROPERTY_RAW_URI = 11, Uri_PROPERTY_SCHEME_NAME = 12, Uri_PROPERTY_USER_INFO = 13, Uri_PROPERTY_USER_NAME = 14, Uri_PROPERTY_STRING_LAST = 14, Uri_PROPERTY_HOST_TYPE = 15, Uri_PROPERTY_DWORD_START = 15, Uri_PROPERTY_PORT = 16, Uri_PROPERTY_SCHEME = 17, Uri_PROPERTY_ZONE = 18, Uri_PROPERTY_DWORD_LAST = 18 }; enum tagBINDSTRING { BINDSTRING_HEADERS = 1, BINDSTRING_ACCEPT_MIMES = 2, BINDSTRING_EXTRA_URL = 3, BINDSTRING_LANGUAGE = 4, BINDSTRING_USERNAME = 5, BINDSTRING_PASSWORD = 6, BINDSTRING_UA_PIXELS = 7, BINDSTRING_UA_COLOR = 8, BINDSTRING_OS = 9, BINDSTRING_USER_AGENT = 10, BINDSTRING_ACCEPT_ENCODINGS = 11, BINDSTRING_POST_COOKIE = 12, BINDSTRING_POST_DATA_MIME = 13, BINDSTRING_URL = 14, BINDSTRING_IID = 15, BINDSTRING_FLAG_BIND_TO_OBJECT = 16, BINDSTRING_PTR_BIND_CONTEXT = 17, BINDSTRING_XDR_ORIGIN = 18, BINDSTRING_DOWNLOADPATH = 19, BINDSTRING_ROOTDOC_URL = 20, BINDSTRING_INITIAL_FILENAME = 21 }; struct _WUDFMESSAGE_ATTRIBUTES { /* unsigned char MessageAttributeBuffer[0]; +0x0000 8d 1e 00 00 */ unsigned char MessageAttributes[96]; /* +0x0000 2a 14 00 00 */ }; enum tagVARKIND { VAR_PERINSTANCE = 0, VAR_STATIC = 1, VAR_CONST = 2, VAR_DISPATCH = 3 }; struct tagVARDESC { long memid; /* +0x0000 */ unsigned char lpstrSchema[8]; /* +0x0008 71 06 00 00 */ unsigned long oInst; /* +0x0010 */ unsigned char lpvarValue[8]; /* +0x0010 be 13 00 00 */ unsigned char elemdescVar[32]; /* +0x0018 90 1e 00 00 */ unsigned short wVarFlags; /* +0x0038 */ unsigned char varkind[4]; /* +0x003c 92 1e 00 00 */ }; struct tagVARDESC:: { unsigned long oInst; /* +0x0000 */ unsigned char lpvarValue[8]; /* +0x0000 be 13 00 00 */ }; struct tagARRAYDESC { unsigned char tdescElem[16]; /* +0x0000 6a 1d 00 00 */ unsigned short cDims; /* +0x0010 */ unsigned char rgbounds[12]; /* +0x0014 a8 1c 00 00 */ }; struct tagEXCEPINFO { unsigned short wCode; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned char bstrSource[8]; /* +0x0008 71 06 00 00 */ unsigned char bstrDescription[8]; /* +0x0010 71 06 00 00 */ unsigned char bstrHelpFile[8]; /* +0x0018 71 06 00 00 */ unsigned long dwHelpContext; /* +0x0020 */ void *pvReserved; /* +0x0028 */ unsigned char pfnDeferredFillIn[8]; /* +0x0030 a9 1e 00 00 */ long scode; /* +0x0038 */ }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; enum tagXMLEMEM_TYPE { XMLELEMTYPE_ELEMENT = 0, XMLELEMTYPE_TEXT = 1, XMLELEMTYPE_COMMENT = 2, XMLELEMTYPE_DOCUMENT = 3, XMLELEMTYPE_DTD = 4, XMLELEMTYPE_PI = 5, XMLELEMTYPE_OTHER = 6 }; struct _WUDFMESSAGE_ALL { /* unsigned char WudfMsg_CREATE_DEVICE_STACK_Message[0]; +0x0000 b0 1e 00 00 */ /* unsigned char WudfMsg_ADD_DEVICE_Message[0]; +0x0000 d8 13 00 00 */ /* unsigned char WudfMsg_IRP_Message[0]; +0x0000 b1 1e 00 00 */ /* unsigned char WudfMsg_IRP_Completion_Message[0]; +0x0000 b2 1e 00 00 */ /* unsigned char WudfMsg_CREATE_Message[0]; +0x0000 e2 13 00 00 */ /* unsigned char WudfMsg_CLOSE_Message[0]; +0x0000 b3 1e 00 00 */ /* unsigned char WudfMsg_CLEANUP_Message[0]; +0x0000 b4 1e 00 00 */ /* unsigned char WudfMsg_IO_Message[0]; +0x0000 b5 1e 00 00 */ /* unsigned char WudfMsg_Cancel_Message[0]; +0x0000 b6 1e 00 00 */ /* unsigned char WudfMsg_POWER_IRP_COMPLETE_Message[0]; +0x0000 b7 1e 00 00 */ /* unsigned char WudfMsg_CLOSE_DEVICE_STACK_Message[0]; +0x0000 b8 1e 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_ARRIVAL_Message[0]; +0x0000 fe 13 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_REMOVAL_Message[0]; +0x0000 b9 1e 00 00 */ /* unsigned char WudfMsg_TARGET_DEVICE_NOTIFICATION_Message[0]; +0x0000 05 14 00 00 */ /* unsigned char WudfMsg_TRANSPORT_QUERY_ID_Message[0]; +0x0000 0b 14 00 00 */ /* unsigned char WudfMsg_USB_SS_EVENT_Message[0]; +0x0000 ba 1e 00 00 */ /* unsigned char WudfMsg_ExitProcess_Message[0]; +0x0000 bb 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_ControlObjectName_Message[0]; +0x0000 bc 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_QueryProcess_Message[0]; +0x0000 bd 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_OpenProcess_Message[0]; +0x0000 be 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_CloseProcess_Message[0]; +0x0000 bf 1e 00 00 */ /* unsigned char WudfMsg_Connect_Message[0]; +0x0000 c0 1e 00 00 */ unsigned char WudfMsg_WMI_POWER_DATA_Message[112]; /* +0x0000 c1 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { void *Argument1; /* +0x0000 */ void *Argument2; /* +0x0008 */ void *Argument3; /* +0x0010 */ void *Argument4; /* +0x0018 */ }; enum POWER_ACTION { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7 }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long SystemContext; /* +0x0000 */ unsigned char Type[4]; /* +0x0004 29 12 00 00 */ unsigned char State[4]; /* +0x0008 27 12 00 00 */ unsigned char ShutdownType[4]; /* +0x000c c8 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerState[4]; /* +0x0000 ea 1c 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerSequence[12]; /* +0x0000 cd 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char Capabilities[64]; /* +0x0000 d0 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long long RawSizeInBytes; /* +0x0000 */ unsigned char AllocatedResources[8]; /* +0x0008 d4 1e 00 00 */ unsigned long long TranslatedSizeInBytes; /* +0x0010 */ unsigned char AllocatedResourcesTranslated[8]; /* +0x0018 d4 1e 00 00 */ }; struct _WUDFMESSAGE_CREATE_DEVICE_STACK { unsigned char Header[1]; /* +0x0000 da 13 00 00 */ }; struct _XSAVE_FORMAT { unsigned short ControlWord; /* +0x0000 */ unsigned short StatusWord; /* +0x0002 */ unsigned char TagWord; /* +0x0004 */ unsigned char Reserved1; /* +0x0005 */ unsigned short ErrorOpcode; /* +0x0006 */ unsigned long ErrorOffset; /* +0x0008 */ unsigned short ErrorSelector; /* +0x000c */ unsigned short Reserved2; /* +0x000e */ unsigned long DataOffset; /* +0x0010 */ unsigned short DataSelector; /* +0x0014 */ unsigned short Reserved3; /* +0x0016 */ unsigned long MxCsr; /* +0x0018 */ unsigned long MxCsr_Mask; /* +0x001c */ unsigned char FloatRegisters[128]; /* +0x0020 f0 1c 00 00 */ unsigned char XmmRegisters[256]; /* +0x00a0 d9 1e 00 00 */ unsigned char Reserved4[96]; /* +0x01a0 8d 1e 00 00 */ }; struct _WUDFMESSAGE_IRP { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ void *Irp; /* +0x0008 */ /* unsigned char DevnodeContext[0]; +0x0010 dd 13 00 00 */ unsigned char CreateContext[8]; /* +0x0010 e6 13 00 00 */ unsigned char IoStatus[16]; /* +0x0018 dc 1e 00 00 */ unsigned char MajorCode; /* +0x0028 */ unsigned char MinorCode; /* +0x0029 */ unsigned char Parameters[64]; /* +0x0030 ac 1c 00 00 */ }; struct _WUDFMESSAGE_CREATE:: { /* unsigned char Header[0]; +0x0000 da 13 00 00 */ unsigned char IoHeader[32]; /* +0x0000 e4 13 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned long PdoNameOffset; /* +0x0004 */ }; struct tagFUNCDESC { long memid; /* +0x0000 */ long *lprgscode; /* +0x0008 */ unsigned char lprgelemdescParam[8]; /* +0x0010 e4 1e 00 00 */ unsigned char funckind[4]; /* +0x0018 d6 1d 00 00 */ unsigned char invkind[4]; /* +0x001c 2b 1c 00 00 */ unsigned char callconv[4]; /* +0x0020 e3 1a 00 00 */ short cParams; /* +0x0024 */ short cParamsOpt; /* +0x0026 */ short oVft; /* +0x0028 */ short cScodes; /* +0x002a */ unsigned char elemdescFunc[32]; /* +0x0030 90 1e 00 00 */ unsigned short wFuncFlags; /* +0x0050 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_88 { unsigned char arrayOfBaseClassDescriptors[92]; /* +0x0000 e8 1e 00 00 */ }; struct $_TypeDescriptor$_extraBytes_25 { unsigned char pVFTable[8]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0008 */ unsigned char name[25]; /* +0x0010 ec 1e 00 00 */ }; enum PIDMSI_STATUS_VALUE { PIDMSI_STATUS_NORMAL = 0, PIDMSI_STATUS_NEW = 1, PIDMSI_STATUS_PRELIM = 2, PIDMSI_STATUS_DRAFT = 3, PIDMSI_STATUS_INPROGRESS = 4, PIDMSI_STATUS_EDIT = 5, PIDMSI_STATUS_REVIEW = 6, PIDMSI_STATUS_PROOF = 7, PIDMSI_STATUS_FINAL = 8, PIDMSI_STATUS_OTHER = 32767 }; enum tagApplicationType { ServerApplication = 0, LibraryApplication = 1 }; struct _WUDFMESSAGE_WMI_POWER_DATA { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ unsigned char WmiPowerAction[8]; /* +0x0010 f4 1e 00 00 */ }; enum WUDF_USB_SS_EVENT { UsbSSCallbackInvoked = 0, UsbSSComplete = 1 }; struct _WUDFMESSAGE_USB_SS_EVENT { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned char UsbSSEvent[4]; /* +0x0004 f8 1e 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ }; struct _LDR_SERVICE_TAG_RECORD { unsigned char Next[8]; /* +0x0000 77 1e 00 00 */ unsigned long ServiceTag; /* +0x0008 */ }; struct _WUDFMESSAGE_POWER_IRP_COMPLETE { unsigned char Header[1]; /* +0x0000 da 13 00 00 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char PowerState[4]; /* +0x0004 27 12 00 00 */ unsigned char IoStatus[16]; /* +0x0008 dc 1e 00 00 */ unsigned char DevnodeContext[8]; /* +0x0018 dd 13 00 00 */ }; struct _KDHELP64 { unsigned long long Thread; /* +0x0000 */ unsigned long ThCallbackStack; /* +0x0008 */ unsigned long ThCallbackBStore; /* +0x000c */ unsigned long NextCallback; /* +0x0010 */ unsigned long FramePointer; /* +0x0014 */ unsigned long long KiCallUserMode; /* +0x0018 */ unsigned long long KeUserCallbackDispatcher; /* +0x0020 */ unsigned long long SystemRangeStart; /* +0x0028 */ unsigned long long KiUserExceptionDispatcher; /* +0x0030 */ unsigned long long StackBase; /* +0x0038 */ unsigned long long StackLimit; /* +0x0040 */ unsigned char Reserved[40]; /* +0x0048 ff 1e 00 00 */ }; struct _WUDFMESSAGE_CLOSE { /* unsigned char Header[0]; +0x0000 da 13 00 00 */ unsigned char IoHeader[32]; /* +0x0000 e4 13 00 00 */ unsigned char CreateContext[8]; /* +0x0020 e6 13 00 00 */ }; struct _WUDFMESSAGE_CLOSE_DEVICE_STACK { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ }; struct tagELEMDESC { unsigned char tdesc[16]; /* +0x0000 6a 1d 00 00 */ /* unsigned char idldesc[0]; +0x0010 6b 1d 00 00 */ unsigned char paramdesc[16]; /* +0x0010 07 1f 00 00 */ }; struct tagELEMDESC:: { /* unsigned char idldesc[0]; +0x0000 6b 1d 00 00 */ unsigned char paramdesc[16]; /* +0x0000 07 1f 00 00 */ }; enum ADDRESS_MODE { AddrMode1616 = 0, AddrMode1632 = 1, AddrModeReal = 2, AddrModeFlat = 3 }; struct _tagADDRESS64 { unsigned long long Offset; /* +0x0000 */ unsigned short Segment; /* +0x0008 */ unsigned char Mode[4]; /* +0x000c 0d 1f 00 00 */ }; struct _CM_RESOURCE_LIST { unsigned long Count; /* +0x0000 */ unsigned char List[36]; /* +0x0004 11 1f 00 00 */ }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = -1, Internal = 0, Isa = 1, Eisa = 2, MicroChannel = 3, TurboChannel = 4, PCIBus = 5, VMEBus = 6, NuBus = 7, PCMCIABus = 8, CBus = 9, MPIBus = 10, MPSABus = 11, ProcessorInternal = 12, InternalPowerBus = 13, PNPISABus = 14, PNPBus = 15, Vmcs = 16, ACPIBus = 17, MaximumInterfaceType = 18 }; struct _CM_FULL_RESOURCE_DESCRIPTOR { unsigned char InterfaceType[4]; /* +0x0000 15 1f 00 00 */ unsigned long BusNumber; /* +0x0004 */ unsigned char PartialResourceList[28]; /* +0x0008 16 1f 00 00 */ }; struct _POWER_SEQUENCE { unsigned long SequenceD1; /* +0x0000 */ unsigned long SequenceD2; /* +0x0004 */ unsigned long SequenceD3; /* +0x0008 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[16]; /* +0x0000 a2 10 00 00 */ void *Handle; /* +0x0010 */ }; enum _WUDF_IO_MESSAGE_CONTEXT_TYPE { WudfIoMessageContextFile = 0, WudfIoMessageContextDeviceStack = 1 }; struct _WUDFMESSAGE_IO { /* unsigned char Header[0]; +0x0000 da 13 00 00 */ unsigned char IoHeader[72]; /* +0x0000 e4 13 00 00 */ }; struct _IO_STATUS_BLOCK { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ unsigned long long Information; /* +0x0008 */ }; struct _WUDFMESSAGE_IRP_COMPLETION { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ unsigned char CompletionContext[8]; /* +0x0008 b0 1c 00 00 */ unsigned char IoStatus[16]; /* +0x0010 dc 1e 00 00 */ unsigned char Parameters[64]; /* +0x0020 ac 1c 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_CONTROL_OBJECT_NAME { unsigned char Header[4]; /* +0x0000 da 13 00 00 */ unsigned long ControlObjectNameOffset; /* +0x0004 */ }; struct _IO_STATUS_BLOCK:: { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ }; struct _LDRP_CSLIST { unsigned char Tail[8]; /* +0x0000 cc 10 00 00 */ }; struct _DEVICE_CAPABILITIES { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ /* unsigned char DeviceD1[0]; +0x0004 3c 10 00 00 */ /* unsigned char DeviceD2[0]; +0x0004 3d 10 00 00 */ /* unsigned char LockSupported[0]; +0x0004 3e 10 00 00 */ /* unsigned char EjectSupported[0]; +0x0004 3f 10 00 00 */ /* unsigned char Removable[0]; +0x0004 40 10 00 00 */ /* unsigned char DockDevice[0]; +0x0004 41 10 00 00 */ /* unsigned char UniqueID[0]; +0x0004 42 10 00 00 */ /* unsigned char SilentInstall[0]; +0x0004 e0 1d 00 00 */ /* unsigned char RawDeviceOK[0]; +0x0004 e1 1d 00 00 */ /* unsigned char SurpriseRemovalOK[0]; +0x0004 e2 1d 00 00 */ /* unsigned char WakeFromD0[0]; +0x0004 31 1f 00 00 */ /* unsigned char WakeFromD1[0]; +0x0004 32 1f 00 00 */ /* unsigned char WakeFromD2[0]; +0x0004 e4 1d 00 00 */ /* unsigned char WakeFromD3[0]; +0x0004 e5 1d 00 00 */ /* unsigned char HardwareDisabled[0]; +0x0004 e6 1d 00 00 */ /* unsigned char NonDynamic[0]; +0x0004 33 1f 00 00 */ /* unsigned char WarmEjectSupported[0]; +0x0004 34 1f 00 00 */ /* unsigned char NoDisplayInUI[0]; +0x0004 35 1f 00 00 */ /* unsigned char Reserved1[0]; +0x0004 e8 1d 00 00 */ unsigned char Reserved[4]; /* +0x0004 36 1f 00 00 */ unsigned long Address; /* +0x0008 */ unsigned long UINumber; /* +0x000c */ unsigned char DeviceState[28]; /* +0x0010 37 1f 00 00 */ unsigned char SystemWake[4]; /* +0x002c ea 1c 00 00 */ unsigned char DeviceWake[4]; /* +0x0030 0c 12 00 00 */ unsigned long D1Latency; /* +0x0034 */ unsigned long D2Latency; /* +0x0038 */ unsigned long D3Latency; /* +0x003c */ }; struct _CM_PARTIAL_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char PartialDescriptors[20]; /* +0x0008 3b 1f 00 00 */ }; struct tagPARAMDESC { unsigned char pparamdescex[8]; /* +0x0000 41 1f 00 00 */ unsigned short wParamFlags; /* +0x0008 */ }; struct tagBINDPTR { /* unsigned char lpfuncdesc[0]; +0x0000 15 1c 00 00 */ /* unsigned char lpvardesc[0]; +0x0000 1a 1c 00 00 */ unsigned char lptcomp[8]; /* +0x0000 10 1c 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Level; /* +0x0000 */ unsigned long Vector; /* +0x0004 */ unsigned long long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { /* unsigned char Raw[0]; +0x0000 5e 1f 00 00 */ unsigned char Translated[16]; /* +0x0000 5f 1f 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::::::: { unsigned short Reserved; /* +0x0000 */ unsigned short MessageCount; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long Port; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long RequestLine; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Data[12]; /* +0x0000 46 10 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Reserved; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long DataSize; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length40; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length48; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 35 10 00 00 */ unsigned long Length64; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Class; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char Reserved1; /* +0x0002 */ unsigned char Reserved2; /* +0x0003 */ unsigned long IdLowPart; /* +0x0004 */ unsigned long IdHighPart; /* +0x0008 */ }; struct _WUDFMESSAGE_CANCEL { /* unsigned char Header[0]; +0x0000 da 13 00 00 */ unsigned char IoHeader[32]; /* +0x0000 e4 13 00 00 */ unsigned long long RequestIdToCancel; /* +0x0020 */ }; struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { unsigned char Previous[8]; /* +0x0000 28 1e 00 00 */ unsigned char ActivationContext[8]; /* +0x0008 61 10 00 00 */ unsigned long Flags; /* +0x0010 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_REMOVAL { unsigned char Header[8]; /* +0x0000 da 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0008 dd 13 00 00 */ unsigned char DeviceContext[8]; /* +0x0010 01 14 00 00 */ unsigned long long InterfaceContext; /* +0x0018 */ }; struct tagPARAMDESCEX { unsigned long cBytes; /* +0x0000 */ unsigned char varDefaultValue[24]; /* +0x0008 bd 13 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_CLOSE_PROCESS { unsigned char Header[1]; /* +0x0000 da 13 00 00 */ unsigned char HasProblem[3]; /* +0x0001 30 00 00 00 */ unsigned char HostProblem[28]; /* +0x0004 69 13 00 00 */ void *ProcessHandle; /* +0x0020 */ }; struct _WUDFMESSAGE_IO:: { /* unsigned char CreateContext[0]; +0x0000 e6 13 00 00 */ unsigned char DevnodeContext[8]; /* +0x0000 dd 13 00 00 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long IoControlCode; /* +0x0000 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long Key; /* +0x0000 */ unsigned char ByteOffset[8]; /* +0x0008 35 10 00 00 */ }; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation = 2, FileBothDirectoryInformation = 3, FileBasicInformation = 4, FileStandardInformation = 5, FileInternalInformation = 6, FileEaInformation = 7, FileAccessInformation = 8, FileNameInformation = 9, FileRenameInformation = 10, FileLinkInformation = 11, FileNamesInformation = 12, FileDispositionInformation = 13, FilePositionInformation = 14, FileFullEaInformation = 15, FileModeInformation = 16, FileAlignmentInformation = 17, FileAllInformation = 18, FileAllocationInformation = 19, FileEndOfFileInformation = 20, FileAlternateNameInformation = 21, FileStreamInformation = 22, FilePipeInformation = 23, FilePipeLocalInformation = 24, FilePipeRemoteInformation = 25, FileMailslotQueryInformation = 26, FileMailslotSetInformation = 27, FileCompressionInformation = 28, FileObjectIdInformation = 29, FileCompletionInformation = 30, FileMoveClusterInformation = 31, FileQuotaInformation = 32, FileReparsePointInformation = 33, FileNetworkOpenInformation = 34, FileAttributeTagInformation = 35, FileTrackingInformation = 36, FileIdBothDirectoryInformation = 37, FileIdFullDirectoryInformation = 38, FileValidDataLengthInformation = 39, FileShortNameInformation = 40, FileIoCompletionNotificationInformation = 41, FileIoStatusBlockRangeInformation = 42, FileIoPriorityHintInformation = 43, FileSfioReserveInformation = 44, FileSfioVolumeInformation = 45, FileHardLinkInformation = 46, FileProcessIdsUsingFileInformation = 47, FileNormalizedNameInformation = 48, FileNetworkPhysicalNameInformation = 49, FileIdGlobalTxDirectoryInformation = 50, FileIsRemoteDeviceInformation = 51, FileAttributeCacheInformation = 52, FileNumaNodeInformation = 53, FileStandardLinkInformation = 54, FileRemoteProtocolInformation = 55, FileRenameInformationBypassAccessCheck = 56, FileLinkInformationBypassAccessCheck = 57, FileIntegrityStreamInformation = 58, FileVolumeNameInformation = 59, FileMaximumInformation = 60 }; struct _WUDFMESSAGE_IO:::: { unsigned char FileInformationClass[4]; /* +0x0000 91 1f 00 00 */ }; struct _WUDFMESSAGE_IRP:: { /* unsigned char DevnodeContext[0]; +0x0000 dd 13 00 00 */ unsigned char CreateContext[8]; /* +0x0000 e6 13 00 00 */ };